# EraseProof (CLI prototype)

EraseProof is the Pro tier of the same product line as the sibling tool
PrivacySweep. PrivacySweep does one-shot secure deletion of files you name
explicitly on the command line, producing a single report for that run.
EraseProof is built for a different job: policy-driven, recurring,
auditable erasure. You define NAMED policies in a JSON config file, each
one pairing a target directory + glob pattern + age filter with an
overwrite-pass count, and you re-run a named policy over and over as
part of a routine (a cron job, a scheduled task, a compliance cadence).
Every --apply run APPENDS its erasure records to a persistent, append-only
ledger file rather than overwriting it, so months later a compliance-
minded professional can point at that one ledger and prove exactly what
was erased, when, and under which policy, across every run that ever
touched it — not just the most recent one. The underlying secure-overwrite
mechanism (multi-pass random-data overwrite, fsync'd after each pass, then
removed) is identical to PrivacySweep's; that part is deliberately not
reinvented here. Browser/app trace-location auto-discovery (automatically
finding cache/temp locations across installed apps, rather than a
hand-configured target_dir) and the encrypted vault from the full concept
are still on the roadmap — see ../plan.md for the full product plan.

## Build from source

Requires Go 1.24+, no external dependencies.

    go build -o eraseproof .

Cross-compile for another platform:

    GOOS=windows GOARCH=amd64 go build -o eraseproof.exe .
    GOOS=darwin  GOARCH=arm64 go build -o eraseproof .

## Usage

    eraseproof scan   --policy FILE <policy-name> [--json]
    eraseproof run    --policy FILE <policy-name> --ledger FILE [--apply] [--passes N]
    eraseproof ledger --ledger FILE [--policy NAME] [--json]

### scan (read-only)

Previews which files currently match a named policy's target directory,
glob pattern, and age filter, with sizes. Touches nothing — pure
discovery/trace-scanning, safe to run at any time.

### run

Without --apply: a dry run identical in spirit to scan, framed as "this
run would erase" — nothing is touched and no ledger entries are written.

With --apply: every matching file is overwritten with cryptographically
random data for the policy's pass count (falls back to --passes, default
3, if the policy doesn't specify one), fsync'd after each pass, then
removed. This is the exact same shred mechanism PrivacySweep uses — genuinely
destructive, no quarantine, no undo.

After a successful erase, one JSON-lines record is APPENDED to the
--ledger file per erased file: path, size in bytes, the SHA-256 of the
file's content immediately before it was destroyed, the policy name, the
pass count used, and a UTC timestamp. This append is a strict O_APPEND
write — an existing ledger file is never truncated or rewritten, so
records from previous run invocations (against this policy or any other,
at any earlier time) remain intact and are simply added to. That
guarantee is what makes the ledger a cumulative proof-of-erasure history
rather than a per-run report.

### ledger (read-only)

Prints a summary of the cumulative ledger: total files erased, total
bytes destroyed, and a breakdown per policy name across every run that
ever appended to the file. Pass --policy NAME to restrict the summary to
one policy's contribution. This is the actual "why pay more for Pro"
report — proof, at any point in the future, of everything ever erased.

### Policy file format

    {
      "policies": [
        {
          "name": "temp-cleanup",
          "target_dir": "/tmp/eraseproof-demo/scratch",
          "pattern": "*.tmp",
          "older_than": "0d",
          "passes": 3
        }
      ]
    }

- name: the identifier passed as <policy-name> on the command line.
- target_dir: directory scanned recursively for matches.
- pattern: glob matched against each file's base name only (not the full
  path). Empty or "*" matches every file.
- older_than: digits followed by a d/h/m suffix (e.g. "30d", "12h",
  "45m"); "0d" or "" disables the age filter and matches files of any age.
- passes: overwrite-pass count for files erased under this policy; falls
  back to --passes (default 3) if omitted or zero.

## Prebuilt binaries

See ../downloads/ for prebuilt binaries (Windows/macOS/Linux) and
CHECKSUMS.txt for their SHA-256 hashes. Unsigned indie builds — Windows
SmartScreen and macOS Gatekeeper will warn on first run, expected until a
code-signing certificate is in place.