Adom Wiki

Addendum for the same page (pg_0awtv7q479): these files were removed from HEAD today but remain reachable at old refs and need the same history purge. They are screenshots that showed the developer's container name, and one (screenshots/ad-settings.png) showed the private host in a settings JSON: docs/main-view-v2.png, docs/main-view-v3.png, docs/screenshot-gui.png, docs/settings-v2.png, gui.png, hb.png, hero-billboard.png, hero-billboard-v2.png, hero-v2.png, screenshots/ad-build-info.png, screenshots/ad-embedded.png, screenshots/ad-settings.png, screenshots/ad-shell-approval.png, screenshots/ad-standalone.png, screenshots/gui.png, screenshots/hero-rebrand.png. Five images still in use were replaced by redacted versions (docs/hero.png, docs/main-view.png, docs/settings.png, hero.png, screenshots/hero.png); their pre-redaction refs need purging too.

Asks 1 and 2 are on prod (git-wiki f80ac1b, 2026-09-21). Ask 3 is staged and runs the moment Colby says so, since it is irreversible and touches an adom org page with the admin identity.

1. Withdraw a version's bytes. POST /api/packages/<owner>/<slug>/withdraw, manage rights or admin, body { "versions": ["1.2.3", ...] } or { "range": { "from": "1.9.100", "to": "2.1.130" } } (inclusive, over the package's published versions), reason, and confirm: "<owner>/<slug>" (400 CONFIRM_REQUIRED without it). Every platform's tarball for each version is deleted and the release rows are stamped withdrawn_at / withdrawn_reason. The rows and manifest snapshot stay, so the number stays burned (a republish under it is still 409, never a silent replacement), and /api/v1/packages/.../<ver>/tarball answers 410 VERSION_WITHDRAWN with the reason and date. Listing, latest and range resolution skip withdrawn versions; a dist-tag pointing at one moves to the newest remaining. Tarballs are served DYNAMIC at the edge (checked: cf-cache-status: DYNAMIC), so nothing lingers in the CDN. pkg deprecate is unchanged and still the right tool for "do not use", this is for "must not exist".

2. Purge a file from history. POST /api/pages/<owner>/<slug>/files/purge, manage rights or admin, body { "paths": [...], "reason", "confirm": "<owner>/<slug>" }. Every ref is rewritten without the paths (git fast-export | filter | fast-import, nothing external), unreachable objects are pruned, the blob cache is evicted, the page's commit-activity rows are dropped and the page re-indexed. Commits, messages and branch structure survive (some become empty); every commit sha on the page changes, so an old ?ref= read is a 404, not a lookup that still works for the owner. A path that is still wanted at HEAD is purged like any other, so the caller re-pushes its current bytes afterwards (I hold byte-faithful copies of your five redacted images for exactly that). Page images embedded under ?v=<commit> URLs can sit in the CDN image cache for up to 24 h after the purge.

3. adom-bridge. Prepared, not executed: withdraw 1.9.100 through 2.1.130 (285 versions; latest 2.1.143 is untouched), then purge the 24 paths (your three, your sixteen screenshots, and the five replaced images) from pg_0awtv7q479 and re-push the five current redacted files as one commit. Colby's word is the gate; I will post the evidence here (410 on a withdrawn version, 404 at an old ref, HEAD unchanged for the five) when it has run, and close.

Verified on staging on a throwaway: withdraw -> 410 VERSION_WITHDRAWN, purge -> the old sha stops serving while README and HEAD stay. Tests: test/ops/history-purge.test.mjs (the fast-export filter incl. C-quoted paths, and a real repo purge) and test/ops/purge-routes.test.mjs (auth, confirmation, range, latest move, 410, old-ref 404). Docs: api reference under both routes, hint-codes rows. CLI side: nothing required beyond printing the 410's message; a pkg withdraw and repo purge verb pair would be a natural fit if you want them.

@john, you can run ask 3 yourself, today, under your own identity: adom/adom-bridge is an org page and both routes take manage rights, which an adom member has. That is the better path (your page, your call, no admin key involved). Both need the typed confirm and neither can be undone.

Withdraw the leaked range (285 versions; latest 2.1.143 is outside it and stays):

adom-wiki api POST /api/packages/adom/adom-bridge/withdraw \
  --json '{"range":{"from":"1.9.100","to":"2.1.130"},"reason":"private container hostname in the compiled Linux CLI (adom/wiki#212)","confirm":"adom/adom-bridge"}'

Purge the 24 paths from every commit, then re-push the five images you still use (the purge removes a path from HEAD too, so take a byte-faithful copy of those five first with adom-wiki repo download adom/adom-bridge --extract <dir>):

adom-wiki api POST /api/pages/adom/adom-bridge/files/purge \
  --json '{"paths":["main-SKILL.md","dist/linux/adom-desktop","dist/linux/adom-bridge-cli","docs/main-view-v2.png","docs/main-view-v3.png","docs/screenshot-gui.png","docs/settings-v2.png","gui.png","hb.png","hero-billboard.png","hero-billboard-v2.png","hero-v2.png","screenshots/ad-build-info.png","screenshots/ad-embedded.png","screenshots/ad-settings.png","screenshots/ad-shell-approval.png","screenshots/ad-standalone.png","screenshots/gui.png","screenshots/hero-rebrand.png","docs/hero.png","docs/main-view.png","docs/settings.png","hero.png","screenshots/hero.png"],"reason":"private container hostname in screenshots and shipped binaries (adom/wiki#212)","confirm":"adom/adom-bridge"}'
cd <dir> && adom-wiki repo push adom/adom-bridge --files docs/hero.png docs/main-view.png docs/settings.png hero.png screenshots/hero.png -m "Re-add redacted images after history purge"

Then check: a withdrawn version's tarball answers 410 VERSION_WITHDRAWN, an old sha from your repo log answers 404 on any of those paths, and HEAD still shows the five images. Every commit sha on the page changes, so refresh anything that pinned one. If you would rather I run it, say so here and Colby signs off; otherwise I close this when you report it done.