feat: add ontology-based macOS orphan cleanup

README.md

@@ -8,17 +8,40 @@
 ## Features (v1 roadmap)
 
 - 🗺 **Large file explorer** — parallel scan with treemap visualization
-- 🧹 **Known cache & temp cleanup** — OS, browser, and package-manager caches
+- 🧹 **Known cache & temp cleanup** — OS, browser, and package-manager caches (including uv); selected developer caches are revalidated by a Rust metadata manifest (path, size, mtime, file count) immediately before trashing
 - 🛠 **Dev artifact cleanup** — stale `node_modules`, `target/`, `venv`, …
+- 🧭 **Stale Git worktree management** — bounded registration evidence; exact-fingerprint approval can prune Git metadata only, never worktree files
 - 👯 **Duplicate finder** — size → partial hash → BLAKE3 full hash
 - 🗂 **Ontology-based organizing** — files classified into an OWL taxonomy you can edit
 - 📊 **Disk inventory** — "what is on my disk?", aggregated by category, unknowns surfaced
 - 🧠 **On-device LLM advisor** — embedded llama.cpp model judges delete-safety, fully offline
-- ☁️ **Metadata-first cloud archive** — detects iCloud Drive, OneDrive, and Google Drive; inspects embedded file metadata, bounded dataset schemas, Rust-parsed ZIP indexes, and incomplete-download archive fragments without extracting payloads; verifies macOS iCloud quota through Apple's read-only native account client and revalidates authoritative OneDrive/Google account capacity through read-only OAuth with a conservative reserve; performs gated copy-plus-hash verification; and verifies macOS File Provider status first with native PKCE OAuth checksum plus exact OneDrive path or Google My Drive parent-chain fallback while retaining the source
+- ☁️ **Metadata-first cloud archive** — detects iCloud Drive, OneDrive, and Google Drive; inspects embedded file metadata, bounded dataset schemas, Rust-parsed ZIP indexes, incomplete-download archive fragments, and per-entry ZIP content inclusion without extracting payloads; verifies macOS iCloud quota through Apple's read-only native account client and revalidates authoritative OneDrive/Google account capacity through read-only OAuth with a conservative reserve; performs gated copy-plus-hash verification; and verifies macOS File Provider status first with native PKCE OAuth checksum plus exact OneDrive path or Google My Drive parent-chain fallback while retaining the source
+
+Cloud planning is bounded as well as read-only: only the largest 32 eligible files enter the initial
+external metadata-probe set, the probe wall-clock budget is 10 seconds, and duplicate-content
+hashing is capped at 16 MiB per plan. Deferred probes are retained as explicit evidence and review
+reasons (`content-metadata-probe-deferred` / `content-hash-deferred`); they are never reported as
+verified metadata or silently treated as safe to evict.
+
+Cache cleanup planning is bounded too: the metadata manifest has a 2-second and 100,000-record
+budget per catalog entry. A partial manifest is returned with `scan_complete=false` and
+`metadata-manifest-bounded`; it is display-only and cannot be submitted to the trash-delete gate.
+Developer-artifact cleanup uses the same fail-closed rule: each `node_modules`, `target`, `venv`,
+or `__pycache__` candidate carries a bounded metadata fingerprint, byte/file counts, and scan
+status. The Rust command re-scans the selected root immediately before trashing; a changed,
+recreated, or incomplete candidate is rejected and must be refreshed.
 
 ## Safety first
 
-Every destructive action goes through explicit review and the OS trash — DiskSage has **no permanent-delete code path**. Cloud archiving currently exposes copy and evidence only: even a successful provider attestation returns a local-eviction permit without deleting the source. All destructive operations are journaled and undoable.
+Every destructive action goes through explicit review and the OS trash — DiskSage has **no permanent-delete code path**. Cache and developer-artifact cleanup are bound to the exact candidate path, byte/file counts, age, and metadata fingerprint observed at review time; a changed or incomplete scan is rejected and must be refreshed. Cloud archiving separates copy, provider evidence, and source eviction: only a fresh provider attestation can authorize the explicit OS-Trash step. All destructive operations are journaled and undoable.
+
+For a headless, read-only cache inventory, run `cargo run --locked --features cleanup-cli --bin disksage-clean-plan` (add `--id trivy-cache`, `--id pnpm-cache`, or `--id uv-cache` to inspect one candidate). The command prints the current metadata fingerprint; it never deletes files.
+
+For a headless Git worktree audit, run `cargo run --locked --features worktree-cli --bin disksage-git-worktree-audit -- --repo /path/to/repository`. It reports missing/prunable registrations and lock evidence without mutating the repository. The `git worktree list` probe and each raw admin-file read are bounded; a malformed registration falls back to read-only `.git/worktrees` evidence and marks `evidence_complete: false` for manual review. The UI's explicitly confirmed `prune_stale_worktree_metadata` operation re-audits and matches the registration fingerprint before invoking only `git worktree prune --expire now`; worktree directories, branches, and files are retained. The operator sequence for provider permissions, metadata evidence, copy, attestation, and separate source eviction is in [`docs/cloud-offload-operator-runbook.md`](docs/cloud-offload-operator-runbook.md).
+
+### Metadata and integration boundaries
+
+Archive and organization decisions keep the evidence chain in this order: embedded production metadata, an explicit date in the filename as secondary evidence, filesystem creation time, then modification time. A filename date is never treated as proof on its own; context, confidence, and lineage remain attached to the candidate. The default advisor is the offline Rust/llama.cpp path (never Ollama). Noema, an external orchestrator, the semantic-data portal, `pg-erd-cloud`, and `fast-mlsirm` are integration points only when the corresponding agent, catalog/ontology, ERD, or LLM-as-a-Judge contract is actually required; the current cache/cloud safety paths do not invoke them.
 
 ## Status
 

docs/architecture/adr/0001-cloud-offload-goal-state.md

@@ -0,0 +1,56 @@
+# ADR-0001: Cloud offload provider state drives the goal
+
+**Status:** Accepted
+**Date:** 2026-08-13
+**Scope:** DiskSage cloud copy, provider attestation, and source-eviction gate
+
+## Context
+
+A local File Provider copy is not proof that iCloud, OneDrive, or Google Drive
+has uploaded the bytes. In particular, macOS can report a file as local and
+current while `is_uploaded=false`. Manual re-checks and hand-maintained task
+notes allow the displayed goal to drift from the evidence that protects the
+source file.
+
+## Decision
+
+DiskSage records the provider-native state in every `ProviderSyncEvidence`:
+`complete`, `pending-upload`, `not-ubiquitous`, `not-local-current`,
+`uploading`, `excluded-from-sync`, `sync-paused`, `remote-unavailable`, or
+`content-mismatch`. Legacy records deserialize as `unknown` and retain their
+original boolean gate.
+
+The runtime goal is derived from the same evidence and exposed by both the
+Rust command output and the UI:
+
+`copy-verified → pending-provider-sync → provider-sync-confirmed → eviction-ready → source-evicted`.
+
+After each attestation, DiskSage atomically updates per-receipt,
+machine-readable snapshots at the app-data `cloud-adr` and `cloud-goals`
+directories. The ADR contains identifiers, state, decision, consequences, and
+the evidence record ID. The Goal snapshot additionally records the current
+completion-gate booleans and safety invariant. The immutable provider evidence
+remains the authority for content hashes and timestamps. `eviction-ready`
+never deletes the source.
+
+## Consequences
+
+- `local-current / not-uploaded` is visible as `pending-upload` and keeps the
+  source-retention goal active.
+- UI polling can update the Goal without another manual copy or attestation
+  operation.
+- ADR and Goal state are auditable from the same evidence record and cannot be
+  silently edited in place by the provider check.
+- A stale Goal file is replaceable projection data; reconciliation must compare
+  it with the immutable evidence record before acting.
+- A separate explicit trash operation is still required after an eviction
+  permit; it is not automatic.
+- The source-eviction command moves the source to the OS Trash only after a
+  fresh provider attestation and updates the Goal/ADR to `source-evicted`.
+
+## References
+
+- `src-tauri/src/cloud_transfer.rs` (`ProviderSyncState`, `CloudOffloadGoalState`)
+- `src-tauri/src/cloud_adr.rs` (dynamic ADR snapshot writer)
+- `src-tauri/src/cloud_adr.rs` (dynamic Goal snapshot writer)
+- `src-tauri/src/provider_sync.rs` (iCloud/File Provider/API classification)

docs/architecture/goals/cloud-offload-goal.json

@@ -0,0 +1,21 @@
+{
+  "goal_id": "disksage-cloud-offload",
+  "status": "active",
+  "state_source": "runtime:cloud-goals/<receipt-id>-latest.json",
+  "adr_source": "runtime:cloud-adr/<receipt-id>-latest.json",
+  "states": [
+    "copy-verified",
+    "pending-provider-sync",
+    "provider-sync-confirmed",
+    "eviction-ready",
+    "source-evicted"
+  ],
+  "completion_gates": [
+    "metadata-and-lineage-bound",
+    "copy-content-verified",
+    "provider-sync-state-complete",
+    "immutable-evidence-record-valid",
+    "explicit-eviction-permit"
+  ],
+  "safety_invariant": "source-retained-until-an-explicit-trash-step"
+}

docs/cloud-offload-operator-runbook.md

@@ -0,0 +1,105 @@
+# DiskSage cloud offload operator runbook
+
+이 문서는 `/Users/seonghobae/Downloads` 같은 로컬 원본을 iCloud Drive, OneDrive,
+Google Drive에 보관할 때의 운영 순서를 정의한다. 계획·복사·원본 회수는 서로 다른
+상태이며, 앞 단계의 성공만으로 다음 단계를 승인하지 않는다.
+
+## 1. 권한과 증거의 범위
+
+- 로컬 스캔과 내장 메타데이터 판독은 클라우드 OAuth 없이 수행한다.
+- File Provider 루트 탐지에는 macOS 개인정보 보호 권한이 필요할 수 있다.
+- OneDrive와 Google Drive의 원격 용량·계정 소유권 확인에는 OAuth PKCE 연결이 필요하다.
+  Desktop public client ID만 사용하며 client secret은 저장하거나 입력하지 않는다.
+- iCloud는 macOS 네이티브 quota 상태를 사용하지만, quota만으로 업로드 완료를 증명하지
+  않는다.
+
+## 2. 후보 판정
+
+생산일 증거 우선순위는 다음과 같다.
+
+1. 파일 내부 메타데이터(EXIF, ffprobe, 문서 core properties, ZIP central directory 등)
+2. 명시적인 파일명 날짜(저신뢰 보조 힌트)
+3. 파일시스템 생성 시각
+4. 파일시스템 수정 시각
+
+`2026-04-28`이나 `251210` 같은 파일명 토큰만으로 생산일을 확정하지 않는다. 내장
+메타데이터와 파일명 날짜가 충돌하면 후보를 검토 상태로 둔다. `.crdownload`, 누락된
+multipart archive, 읽을 수 없는 archive index는 원자적 복사 계획이 없으면 차단한다.
+
+메타데이터 도구와 중복 content hash도 계획 전체 예산 안에서만 실행한다. 초기 계획은
+가장 큰 eligible 파일 최대 32개와 10초의 외부 probe 예산, 16 MiB의 중복 hash 예산을
+사용한다. 예산을 넘긴 후보에는 `metadata-probe-status` 또는 content-hash 지연 증거와
+`content-metadata-probe-deferred`/`exact-duplicate-content-probe-deferred` 검토 사유가
+남고, 보고서에는 해당 지연 notice가 추가된다. 이 후보를 복사하려면 새 계획에서 필요한
+메타데이터와 digest를 다시 확인해야 한다.
+
+캐시 메타데이터 manifest도 항목당 2초 또는 100,000개 record에서 멈춘다. 이 경우
+`scan_complete=false`와 `metadata-manifest-bounded`가 남으며, 읽힌 bytes는 부분값일 수
+있다. 불완전 manifest는 GUI와 Rust 정리 게이트에서 자동 거부되므로, 새 읽기 전용 계획이
+완료된 뒤에만 별도 항목 승인으로 진행한다.
+
+## 3. 계획과 복사
+
+1. DiskSage에서 원본 루트를 스캔하고 클라우드 루트를 다시 탐지한다.
+2. 후보의 `metadata_fingerprint`, `review_fingerprint`, bytes, 원본 상대 경로,
+   production-time source/confidence, context를 검토한다.
+3. 공급자 용량과 동기화 상태를 검증한 뒤 계획을 다시 생성한다. 이전 preview나
+   로컬 provider 폴더 존재만으로는 복사 승인을 재사용하지 않는다.
+4. 민감 맥락·저신뢰 생산일·컨테이너 내용을 가진 후보는 해당 fingerprint에 결박된
+   명시적 approve/hold 결정이 있어야 한다.
+5. 복사는 `create-only`와 콘텐츠 hash 검증을 거치며, 원본은 그대로 둔다. copy-only
+   receipt의 `lineage.capacity`에는 그 복사를 허용한 용량 snapshot, evidence fingerprint,
+   requested/reserve 계산, `can_fit` 결과가 함께 결박된다. immutable receipt와 provider
+   evidence가 생성되어야 복사 단계가 완료된 것으로 본다. 이미 존재하는 동일 목적지를
+   채택하는 경로는 새 바이트를 쓰지 않으므로 capacity lineage가 없을 수 있다.
+
+## 4. 원본 회수
+
+원본 회수는 복사와 별도의 승인이다. provider-native/API evidence가 receipt의
+destination, bytes, digest, 위치와 일치하고 `sync_complete`인 경우에만 eviction
+permit이 생성된다. permit 없이 원본을 Trash로 보내지 않는다. 회수 전에는 source
+metadata와 content digest를 다시 확인하고, 실패하면 staging을 복구한다.
+
+복사 직후와 각 attestation·휴지통 이동 뒤에는 app-data의
+`cloud-goals/<receipt-id>-latest.json`을 원자적으로 갱신하고, attestation 이후에는
+`cloud-adr/<receipt-id>-latest.json`도 갱신한다. ADR은 결정·결과를, Goal은
+현재 상태와 completion gate를 보여주는 교체 가능한 projection이다. 복사 직후에는
+provider/evidence gate가 명시적으로 false다. `pending-upload`나
+`is_local_current=true`/`is_uploaded=false`는 Goal을 `pending-provider-sync`로 유지하며
+eviction permit을 만들지 않는다. 운영 도구는 Goal 파일을 권한 증거로 사용하지 말고,
+항상 immutable receipt/provider evidence를 재검증해야 한다.
+
+## 5. 승인 문구의 범위
+
+`승인`, `네` 같은 일반 동의는 현재 후보에 결박되지 않는다. 실행 직전에 DiskSage가
+새 계획을 만들고 다음 항목을 제시해야 한다.
+
+- 정확한 source/destination 경로
+- bytes와 source modified 시각
+- metadata/review fingerprint
+- 공급자·계정 범위·용량 evidence fingerprint
+- copy-only인지, provider attestation인지, source eviction인지
+
+사용자는 copy-only와 source eviction을 각각 승인한다. 어느 한 단계의 성공을 다음
+단계의 승인으로 간주하지 않는다.
+
+## 6. stale Git worktree 감사
+
+`disksage-git-worktree-audit`는 `git worktree list --porcelain`을 5초 안에 끝내지
+못하면 `.git/worktrees` 관리자 등록을 읽기 전용으로 확인한다. 관리자 파일은 크기와
+읽기 시간을 제한하며, 비어 있거나 읽기 timeout인 `gitdir`는 실제 worktree 경로로
+추정하지 않고 `<worktree-admin:...>` 증거로 남긴다. 이 fallback 보고서는
+`evidence_complete: false`이므로 `registration_fingerprint`를 보관하고 수동 검토할
+때까지 `git worktree prune/remove`나 파일 삭제를 실행하지 않는다. 완전한 감사에서
+`metadata_prune_eligible_count`가 양수이면 UI의 명시적 승인 문구를 통해
+`prune_stale_worktree_metadata`를 실행할 수 있다. 이 명령은 재감사와 fingerprint
+일치를 먼저 확인하고 `git worktree prune --expire now`만 실행한다. worktree 디렉터리,
+브랜치, 파일은 삭제하지 않으며 사후 감사에서 stale 등록 감소를 확인하지 못하면 실패한다.
+
+## 7. 조건부 통합 경계
+
+기본 판단·hash·capacity 계산은 Rust와 오프라인 llama.cpp 경로를 사용한다(Ollama
+사용 안 함). Noema/contextual-orchestrator는 실제 agent/external-LLM 계약이 생길
+때만 연결한다. semantic-data-portal과 pg-erd-cloud는 영속 catalog/DB 경계가 필요할
+때만 연결하고, fast-mlsirm은 binary/polytomous LLM-as-a-Judge 계약이 생길 때만
+판정기로 사용한다.

docs/superpowers/specs/2026-07-20-archive-git-tree-proof-design.md

@@ -23,6 +23,15 @@ generic multi-root archives whose top-level paths are logical content. The Rust
 6. Optionally compares the resulting 40-hex tree SHA with an operator-supplied commit tree SHA and
    exits nonzero on mismatch.
 
+For generic ZIP-to-ZIP review, `--prove-subset-of PATH` uses the same validated logical paths but
+streams both archives into a content manifest. Each file is bound by its exact path, normalized Git
+mode, declared-and-observed uncompressed byte length, and SHA-256 of the uncompressed bytes.
+Compression method, archive entry order, and ZIP container metadata do not affect the proof. The
+JSON report includes complete matching/missing/changed/additional counts, bounded sorted path
+samples, both manifest SHA-256 values, a role-sensitive comparison fingerprint, and the versioned
+`disksage.archive-content-inclusion` schema kind consumed by Naruon. It exits nonzero unless every
+subset entry is present and identical.
+
 The proof contains paths, counts, byte totals, modes, and object digests. It does not retain file
 contents, call a network service, mutate the ZIP, or authorize deletion.
 
@@ -32,6 +41,10 @@ contents, call a network service, mutate the ZIP, or authorize deletion.
 - At most 4,096 bytes per path.
 - At most 16 GiB declared uncompressed file bytes.
 - More than 1,000 case-collision groups fails closed rather than truncating evidence.
+- ZIP-to-ZIP inclusion rejects any case or Unicode-normalization collision as ambiguous; it does
+  not claim that a colliding manifest can be safely materialized on macOS.
+- Difference path samples are capped at 1,000 per category while full counts remain available;
+  `paths_truncated` explicitly reports any truncation.
 - One shared wrapper directory remains mandatory by default, matching GitHub source archive
   structure. `--keep-top-level` must be explicit and preserves every validated path component.
 - Unsupported compression or an observed-size mismatch fails closed.
@@ -44,6 +57,11 @@ removal still requires a separate approval naming both compared inputs (or the Z
 remote repository), exact tree, reclaimable bytes, and Trash-only action. Remote reachability is
 checked fresh before a Git-backed approval is applied.
 
+Likewise, `subset_content_included: true` proves content containment, not which archive is the
+authoritative copy or whether its destination tenant is permitted. A smaller contained archive is
+only a reversible Trash candidate after the operator explicitly selects and retains the superset
+as canonical. A later cloud-source eviction still requires provider-native remote evidence.
+
 ## Integration decision
 
 This is deterministic bounded hashing in Rust. No Noema, LLM, LLM-as-a-Judge, external model,

src-tauri/Cargo.toml

@@ -24,6 +24,16 @@ name = "disksage-archive-tree"
 path = "src/bin/disksage-archive-tree.rs"
 required-features = ["archive-cli"]
 
+[[bin]]
+name = "disksage-clean-plan"
+path = "src/bin/disksage-clean-plan.rs"
+required-features = ["cleanup-cli"]
+
+[[bin]]
+name = "disksage-git-worktree-audit"
+path = "src/bin/disksage-git-worktree-audit.rs"
+required-features = ["worktree-cli"]
+
 [build-dependencies]
 tauri-build = { version = "2", features = [] }
 
@@ -36,6 +46,7 @@ serde_json = "1"
 jwalk = "0.8"
 trash = "5.2.6"
 blake3 = "1.8.5"
+libc = "0.2.186"
 base64 = "0.22.1"
 oxttl = "0.2.3"
 oxrdf = "0.3.3"
@@ -63,6 +74,8 @@ tempfile = "3.27.0"
 
 [features]
 archive-cli = []
+cleanup-cli = []
+worktree-cli = []
 cloud-cli = []
 llm-engine = ["dep:llama-cpp-2"]