> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/phases/phase_08/unified_erasure_inventory.md). # Unified Erasure Inventory **Phase**: 08 - Release Hardening and Legacy Decommission **Session**: 02 - Unified Erasure Contract and Inventory **Status**: Inventory-only contract **Last Updated**: 2026-05-31 This artifact defines the release-scoped storage boundaries that future trusted erasure work must cover. It is not deletion evidence. It does not ship destructive behavior, a purge endpoint, a browser erasure control, a Worker room deletion endpoint, hosted account deletion, public replay takedown, or a trusted unified erasure claim. The protocol source of truth is `packages/protocol/src/erasure.ts`. Server and Worker helpers consume that inventory through read-only adapters. ## Claim Boundary Trusted unified erasure remains unavailable until later sessions provide all of the following evidence: * Session 03: local and browser dry-run, explicit confirmation, deletion, audit, idempotency, partial-failure, and verification behavior. * Session 04: Worker Durable Object erasure or explicit Worker no-claim gate plus hosted identity release-gate evidence. * Session 08: release-candidate validation that no one-boundary cleanup is described as full trusted erasure. Cleanup, reset, recovery, leave, uninstall, manual file removal, archive deletion, export deletion, backup pruning, or hosted placeholder documentation must remain non-erasure wording until that full workflow passes. ## Shared Vocabulary | Vocabulary | Current contract | | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Boundary families | local file, local runtime memory, browser storage, Worker Durable Object, user export, local backup, local log, diagnostics, workspace file, future hosted | | Authorities | local user, browser user, room leader, room participant, workspace owner, hosted account owner, operator review, not available | | Dry-run labels | required later, planned summary, manual review, unsupported, not applicable | | Confirmation labels | explicit confirmation required, room authority required, hosted authorization required, manual review required, not available | | Audit labels | inventory preview, dry-run summary, confirmation summary, boundary skipped, boundary verified, partial failure, unsupported claim blocked, manual review | | Verification labels | inventory presence, filesystem absence, browser state absence, Worker snapshot absence, archive scan, log scan, backup manifest check, workspace review, hosted no-claim | | Unsupported claims | trusted unified erasure, one-boundary cleanup, browser reset, Worker leave, diagnostics recovery, CLI uninstall, manual file removal, archive/export/backup delete, Worker room deletion, hosted account deletion, public replay takedown | ## Inventory Rows | Boundary | Owner | Status | Authority | Dry-run | Verification | Handoff | | --------------------------------------- | --------------------- | --------------- | -------------------- | --------------- | ---------------------------------------------- | ------------ | | FactionOS home directory | `apps/cli` | planned runtime | local user | required later | inventory presence, filesystem absence | Session 03 | | Local session archives | `apps/server` | planned runtime | local user | required later | archive scan, filesystem absence | Session 03 | | Transcript-mined memory store | `apps/server` | planned runtime | local user | required later | filesystem absence, inventory presence | Session 03 | | Local settings file | `apps/cli` | planned runtime | local user | required later | filesystem absence | Session 03 | | Local lifecycle file | `apps/cli` | planned runtime | local user | required later | filesystem absence | Session 03 | | Project root state file | `apps/cli` | planned runtime | workspace owner | required later | filesystem absence | Session 03 | | Local logs | `apps/server` | planned runtime | local user | required later | log scan, filesystem absence | Session 03 | | Local backup archives | `operator` | planned runtime | local user | manual review | backup manifest check, filesystem absence | Session 03 | | Valid hook spool entries | `apps/hooks` | planned runtime | local user | required later | inventory presence, filesystem absence | Session 03 | | Malformed hook spool entries | `apps/hooks` | manual review | local user | manual review | inventory presence, filesystem absence | Session 03 | | Local exported artifacts | `apps/server` | planned runtime | local user | required later | filesystem absence | Session 03 | | Local diagnostics and recovery metadata | `apps/cli` | planned runtime | local user | required later | inventory presence, log scan | Session 03 | | Code scan runtime memory | `apps/server` | planned runtime | local user | planned summary | inventory presence | Session 03 | | LLM request runtime memory | `apps/server` | planned runtime | local user | planned summary | inventory presence | Session 03 | | Browser settings localStorage | `apps/web` | planned runtime | browser user | required later | browser state absence | Session 03 | | Browser replay fragments and buffers | `apps/web` | planned runtime | browser user | required later | browser state absence | Session 03 | | Browser War Room hints | `apps/web` | planned runtime | browser user | required later | browser state absence | Session 03 | | Browser local auth hints | `apps/web` | planned runtime | browser user | required later | browser state absence | Session 03 | | Browser in-memory runtime state | `apps/web` | planned runtime | browser user | planned summary | browser state absence | Session 03 | | Worker room participants | `apps/warroom` | planned runtime | room leader | required later | Worker snapshot absence | Session 04 | | Worker recent event buffer | `apps/warroom` | planned runtime | room leader | required later | Worker snapshot absence | Session 04 | | Worker authority hashes | `apps/warroom` | planned runtime | room leader | required later | Worker snapshot absence | Session 04 | | Worker idempotency records | `apps/warroom` | planned runtime | room leader | required later | Worker snapshot absence | Session 04 | | Worker room revisions | `apps/warroom` | planned runtime | room leader | required later | Worker snapshot absence | Session 04 | | Worker and browser hint adjacency | `apps/warroom` | inventory only | room participant | planned summary | Worker snapshot absence, browser state absence | Session 04 | | Workspace files | `operator` | manual review | workspace owner | manual review | workspace review | Session 08 | | Future hosted identity records | future hosted service | deferred | hosted account owner | unsupported | hosted no-claim | Future scope | | Future hosted storage records | future hosted service | deferred | hosted account owner | unsupported | hosted no-claim | Future scope | | Future public replay records | future hosted service | deferred | hosted account owner | unsupported | hosted no-claim | Future scope | | Future hosted analytics records | future hosted service | deferred | hosted account owner | unsupported | hosted no-claim | Future scope | | Future Web Push subscriptions | future hosted service | deferred | hosted account owner | unsupported | hosted no-claim | Future scope | | Future remote access state | future hosted service | unavailable | not available | unsupported | hosted no-claim | Future scope | ## Blocked Payload Categories Inventory previews, dry-run summaries, audit entries, validation notes, logs, docs, diagnostics, and future UI must not expose raw payloads from these categories: * Prompts, transcripts, file contents, code contents, command bodies, terminal output, scan payloads, memory finding text, and workspace file contents. * Secret values, credential values, authority tokens, authority hashes, local paths, raw env dumps, participant secrets, and cloud or hosted account ids. * Replay buffers, export bodies, archive bodies, backup payloads, diagnostic payloads, log payloads, spool payloads, room payloads, idempotency response bodies, browser storage values, analytics payloads, push subscriptions, media drafts, and quarantined historical content. Safe output is limited to labels, counts, booleans, docs paths, timestamps, statuses, synthetic identifiers, and explicit unsupported-claim wording. ## Non-Erasure Examples | Flow | Required wording | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------ | | Browser settings reset | Clears one browser boundary only; not trusted unified erasure. | | Browser War Room leave/reset | Clears browser room context only; Durable Object state remains in scope. | | Worker socket disconnect | Ends one socket lifecycle only; not room deletion or erasure. | | Diagnostics recovery | Removes stale listener PID files and malformed spool entries only. | | CLI uninstall | Restores or edits hook settings only; does not erase FactionOS state. | | Manual file removal | User-owned file deletion outside the workflow is not auditable trusted erasure. | | Archive/export/backup cleanup | One artifact family does not prove memory, browser, Worker, workspace, hosted, log, diagnostic, or spool coverage. | ## Session 03 Handoff Session 03 must use the protocol inventory before implementing local or browser runtime behavior. It must add dry-run previews, explicit confirmation, idempotency, partial-failure reporting, redacted audit output, verification, and visible failure states for every local and browser boundary above. ## Session 04 Handoff Session 04 must decide whether Worker Durable Object room state can be erased with room-local authority or whether release wording must stay no-claim. It must not treat room authority as hosted account identity, and it must not treat browser leave/reset as Worker erasure. ## Session 08 Handoff Session 08 must validate docs, tests, and release notes against this artifact. It must keep `P06-S07-ERASURE` open until runtime deletion, Worker handling, audit, and verification evidence exists. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/phases/phase_08/unified_erasure_inventory.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.