symaira-eraseme

Symaira EraseMe

Accepted product direction — implementation pending: EraseMe remains an independent privacy product. Browse/Operate becoming optional Brain modules and credential UI moving to Brain must not introduce a mandatory Brain dependency into privacy workflows. See PB-2026-09-09.

Symaira EraseMe helps you exercise your GDPR/CCPA right to erasure against data brokers. It is a local-first Rust CLI with a native SwiftUI macOS app and an authenticated MCP JSON-RPC interface.

Current source tree: Rust-only CLI and native SwiftUI macOS app, version 0.17.0. The 0.15 line is the first without Go sources and supports macOS on Apple Silicon and Linux (amd64/arm64) only; 0.15.1 patched the bundled SQLite (RUSTSEC-2026-0459), 0.16.0 added plan delete and a compact get_dashboard_data default, and 0.17.0 improves read-only CLI output, command help and secret-provider timeout cleanup. The Rust-only package layout was introduced in the v0.14.0 canary prerelease. The historical v0.13.0 prerelease remains dual-backend, and v0.12.1 is the last Go-only stable release. Check GitHub releases for published versions and channels. The maintainer waived the seven-day post-stable observation period and authorized Go-source retirement on 2026-10-12. The Go implementation and module files are removed from this source tree; frozen Go observations and their immutable source history remain for conformance. CUT-004/CUT-005 technical acceptance and release gates are not waived.

Status: Beta. Core planning, event tracking, deadline handling, registry validation, inbox triage, reports, and the MCP/CLI contracts are implemented. Some broker-specific web flows still require manual review.

Features

• Curated registry of more than 1,200 data brokers with jurisdiction and law metadata.
• Event-sourced SQLite storage with projections and an audit trail.
• CLI commands for profile setup, planning, execution, inbox polling, triage, rebuttals, scheduling, reports, and manual fallback tasks.
• Explicit web-form previews and durable manual fallback tasks; browser execution is an injected boundary and is not a compile-time dependency.
• Shared Rust LLM provider layer for reply classification and rebuttal generation.
• Local MCP HTTP JSON-RPC server with 26 catalogued tools and Bearer-token auth.
• AES-256-GCM encrypted identity profile, standard Fernet encrypted database at rest, and explicit destructive-operation consent.
• Native SwiftUI dashboard for macOS. Rust-only release DMGs bundle the Rust CLI/MCP server.

Platform support

Product scope is Apple (macOS on Apple Silicon, iOS) plus Web. The current implementation ships the macOS app and CLI; this scope does not claim an existing iOS app or Web client. Linux remains supported for CLI/server use and CI.

Historical release assets and frozen platform observations stay immutable. Windows-only source, native test harnesses and PowerShell helpers have been removed (#1276); frozen Windows captures under tests/fixtures/go-frozen/ stay as read-only historical evidence. See #1274.

Install

macOS Apple Silicon and Linux

brew tap danieljustus/tap
brew install symeraseme
symeraseme version

Release archives

Download the macOS arm64 or Linux amd64/arm64 archive for your chosen version from GitHub releases. Rust-only archives contain only the Rust CLI; no Go rollback binary or legacy backend selector is distributed. The historical v0.13.0 prerelease is dual-backend and its assets must remain unchanged; v0.12.1 is the last Go-only stable release. Canary builds reach Homebrew only after stable promotion and the release gates pass.

macOS GUI

For a published Rust-only version, download its versioned macOS DMG from GitHub releases. It bundles only the Rust CLI/MCP server. The release workflow requires Developer ID signing, notarization, stapling and attestation before publication. Local builds may be ad-hoc signed and are not equivalent to that published artifact. Historical v0.13.0 assets remain unchanged. No GUI Homebrew cask is configured.

Migration from the pre-cutover installation

The last pre-cutover implementation is preserved at the annotated Git tag python-final. Existing installations should migrate their local data before removing the old runtime:

symeraseme migrate \
  --source /path/to/old-state \
  --destination /path/to/rust-state \
  --dry-run

The migration is explicit, creates a backup before writing, never deletes the source, and can resume from .migration-state.json. See TROUBLESHOOTING.md for the full rollback procedure.

Quick start

# Create an encrypted local identity profile
symeraseme init-profile

# Inspect the embedded broker registry
symeraseme registry validate
symeraseme brokers list --law GDPR

# Plan, review, and dry-run a campaign
symeraseme plan create --campaign initial --max 5
symeraseme plan show --campaign initial
symeraseme plan execute --campaign initial --dry-run

# Created a campaign by mistake? Delete it while nothing was sent
symeraseme plan delete --campaign initial --dry-run

# Track deadlines and view reports
symeraseme tick --dry-run
symeraseme generate-report

Destructive execution requires explicit consent. Review the plan first and use symeraseme grant execute --ttl 3600 for a short-lived automation token.

MCP server

Start the local authenticated HTTP server:

symeraseme mcp
# Default: http://127.0.0.1:8000

Use --host and --port to change the loopback endpoint. Non-loopback binds require --allow-remote. Use --stdio when an MCP client needs newline-delimited JSON-RPC over standard streams.

The token is generated on startup and written with restrictive permissions to the configured data directory (mcp_token). Send it on every HTTP request as:

Authorization: Bearer <token>

Never put the token in source control, issue reports, shell history, or logs. The complete transport and tool contract lives in docs/mcp-contract.md.

Configuration and secrets

The event store defaults to ~/.local/share/symeraseme/symeraseme.db; it never falls back to a temporary directory in production. Configuration precedence is built-in defaults, ~/.config/symeraseme/config.toml (or $XDG_CONFIG_HOME/symeraseme/config.toml), the project .symeraseme.toml, then environment variables. SYMERASEME_DATA_DIR selects the base data directory, SYMERASEME_DB_DIR overrides only the database directory, and SYMERASEME_ENCRYPT_DB accepts 1|true|yes|on or 0|false|no|off. Invalid values fail closed. When encryption is enabled, the SQLite file is written as a standard Fernet envelope and decrypted only into a private temporary directory during use; switching modes is atomic.

Credentials should be referenced through the canonical symvault:// form or a platform secure store; resolved values are never logged. Provider-specific configuration is consumed by the shared Rust LLM provider layer.

Development

Requirements: Rust 1.98.0 (pinned in rust-toolchain.toml). The Rust build, test suite and frozen-observation checks do not require Go. A full Xcode installation is required for the macOS GUI.

# Prepare immutable producer history once, before the first test run
python3 scripts/prepare-frozen-history.py --fetch

# Rust CLI and frozen-observation conformance suite
make build-rust
make rust-gate
make parity

# Additional Rust acceptance gates (require cargo-llvm-cov and pinned Miri)
make coverage
make miri

# macOS app
make app-test
./app/SymairaEraseMe/build.sh

# Local development packaging example only; not a release-version claim
VERSION=0.17.0 ./scripts/package-dmg.sh

Use a full-history clone. Even then, squash merges and deleted feature branches can leave pinned producer commits outside ordinary branch/tag history. The explicit preparation above fetches only missing immutable producer objects; it does not change the checkout, fixtures or recorded source identities. Subsequent replay is offline with respect to that history. Without --fetch, the preparation command only checks availability and fails if an object is missing.

make parity replays recorded Go observations through Rust without a Go executable. Keep the frozen observations and their source-provenance checks intact. make build, make test, make lint, make vet and make fmt-check now run Rust tooling. make coverage enforces 80% project line coverage and 90% aggregate critical-code line coverage. make miri runs the pinned Rust interpreter contract; it is not a substitute for native concurrency tests. The old live-oracle Make targets are retired. Native platform, security and release-artifact gates remain separate from the local make rust-gate.

Registry contributions

Add a verified YAML broker entry under registry/brokers/, then run:

make build-rust
./build/rust/debug/symeraseme-rust registry validate

Do not fabricate endpoints or include personal data. The registry is embedded in the Rust CLI and is not rewritten by normal CLI operation.

Project layout

crates/                 Rust CLI, core, and engine
rust-tests/parity/      Conformance suite and frozen Go observations
registry/               Broker/law/schema source data
skills/                 Agent skill bundle and workflow documentation
app/SymairaEraseMe/      SwiftUI macOS client
scripts/                 Build, packaging, and verification tools

Releases

Tags matching v* trigger .github/workflows/release.yml:

1. The Rust prerelease workflow builds natively on macOS arm64 and Linux amd64/arm64, packages three static Rust CLI archives, and verifies the archives, checksums.txt and the per-archive CycloneDX SBOMs.
2. The staging job attests build provenance for the three archives and creates a draft prerelease, then reads every asset back without publishing it.
3. The macOS job builds the SwiftUI app with the Rust CLI/MCP server and uploads the versioned DMG to that draft. It is signed, notarized, stapled and attested.
4. After all assets and attestations are complete, the final job verifies both checksum manifests, publishes the canary and requires GitHub to report it as immutable. Enable the repository's Immutable releases setting before