Overview

Redaction removes a committed item’s content (its claims) while keeping every hash intact: the claims hash, metadata hash, and item hash are all preserved, so the item’s Merkle inclusion proof remains valid and the proof still shows that something was submitted in that window even though the content is withheld. Only a committed item can be redacted, moving it to the redacted state; this supports privacy and right-to-be-forgotten needs without breaking the cryptographic record. A redacted item can be restored to committed only by supplying claims that canonicalize (via JCS) and hash to exactly the preserved claims hash, so unredaction is verifiable rather than a blind overwrite. Redaction is not deletion; the surrounding item states and permissions are covered in the item lifecycle and the fingerprint construction in the item’s composite fingerprint.