Every promise, with the test that would break it

Run the pinned one-liner on verify-it-yourself during the largest signed-out scan you can construct. Little Snitch or a full Wireshark capture works too. One outbound connection during the scan phases that is not on the expected-traffic list disproves the claim. So does outbound volume that scales with the disk being scanned.

Structurally. The scanning engine contains no network client at all. The app’s only networked modules are the version check, the sign-in flow, the license and scan-summary calls, and the anonymous crash reporter (path- and email-scrubbed before sending — it appears on the expected-traffic list). None of them are reachable from inside a scan. AI analysis talks to Ollama over loopback (127.0.0.1:11434), which never crosses your network interface. This is the claim the Wireshark Invitation stands on: catch it, and we fix it, disclose it here, and credit you.

Fill a folder with expendable files and clean it with Vaulith — any category, any size. Then account for every removed file. Each one must exist, byte-identical, in Vaulith’s Quarantine or your OS Trash. One removed file in neither place disproves the claim. So does any button in the app that bypasses both.

Every removal flows through one pipeline: original location → Quarantine → OS Trash. The quarantine module is the only code allowed to move files out of place. The engine has no code path that permanently deletes your files — the capability is not compiled in. Automated invariant tests pin this. A change that added a permanent-delete path would fail the build before it could ship.

On a Mac, clone a large file with cp -c big.mov big-copy.mov or Finder’s Duplicate. The “copy” now shares its bytes with the original. Scan the folder. If Vaulith promises the clone’s full apparent size, the claim is broken. Then check any cleanup: note the promised figure, and compare df -h before and after. Freed space below the promise disproves the claim. At or above it is the designed behavior.

Before reporting reclaimable space for a duplicate, the engine runs a metadata-only APFS clone probe. It never opens the file, so it is safe even on cloud placeholders. The probe can only reduce the claimed bytes, never raise them. A clone of the copy you keep is reported as freeing approximately nothing. The governing rule, pinned in the test suite: promised never exceeds actual. And files that live only in the cloud — dataless iCloud or OneDrive placeholders — are excluded from the recoverable number entirely: a placeholder occupies almost no local disk, so counting its logical size would promise space that deleting cannot free. Cleaners that count cloud stubs inflate exactly this number.

Plant a decoy that triggers the classifier among a pile of junk — a text file laid out like a tax form, or a file named like a passport scan. Scan, then try every bulk path in the app: select-all, clean-everything, category-level cleanup. If the decoy lands in any bulk-delete batch, the claim is broken. The classifier itself is best-effort and will not catch every sensitive file. That is why this claim is about what happens after classification — the part that can be absolute.

Classification places these files in a flag-only tier at the data-model level. The selection logic that builds bulk operations is incapable of including them — not merely told not to. It is not a checkbox that could ship unticked. Automated invariant tests pin the rule “a sensitive-classified file can never enter a bulk-delete batch.” A change violating it fails the build. What the classifier looks for is in the glossary below.

Fresh machine, fresh install. Download, scan, review results, clean within the free tier. Any wall that demands an email address, account, or card before you’ve chosen to buy disproves this claim.

The app is anonymous-first by architecture. The free tier’s monthly allowance is tracked locally on your machine, not against a server account. So there is nothing for a sign-up wall to gate. The sign-in flow is wired into exactly one place: the purchase path. This is also why the signed-out network test on verify-it-yourself is so easy to run.

Plant a pile of decoys that trigger the sensitive classifier inside an organized ~/Documents subfolder. Run a whole-Mac scan with them and without them: the grade must be identical. Then move one decoy into Downloads and re-scan: now, and only now, the Privacy sub-score may drop. A grade that moves on ownership alone disproves the claim — and so would any “problems found” counter that scores files you merely possess.

In the score model itself: the exposure term counts only findings whose path crosses a high-traffic folder, and the total sensitive count is not an input to any formula. The formula is public at /score, and property tests pin “owning N well-placed sensitive files never lowers the grade.” The same suite pins that an A+ is reachable entirely free — there is no grade only money can fix.

Run the pinned network check on verify-it-yourself through a scan that produces a grade — signed out, there is no traffic to inspect at all. Signed in, capture the scan-summary sync and read the payload: any field carrying the grade, a sub-score, or a sensitive category disproves the claim. So does a grade ever appearing in the web dashboard — a place it could only reach by being transmitted.

The Report Card lives in a local-only store the upload path never references, and the sync payload has no field a score could ride in — the invariant is pinned as a unit test on the upload path itself. Shared card images are built by a strict allowlist that structurally cannot contain a file name, path, category, exact sensitive count, or location, and they are saved locally by you — the app posts nothing.

Scan a single folder, or deny Full Disk Access and scan. Any letter grade on the result disproves the claim — the honest output is component numbers labeled “in the areas scanned,” with a route to fixing access. Then try to share it: a partial card must refuse to produce a shareable letter at all.

A coverage gate sits between the scan and the letter: truncation, permission-heavy skips, a narrowed scope, or too few files each withhold the grade, and the share path refuses partial cards outright rather than trusting the screen to hide a button. Every branch of the gate is pinned as a unit test — the full rules are published at /score.

Archive a set of old documents, then diff: every file must exist under ~/Documents/Vaulith Archive/ at its original relative path, byte-identical, with nothing missing and nothing renamed. A name collision must refuse the move rather than overwrite. Any file that disappears, changes, or lands under a different name disproves the claim.

Archiving runs through the same hardened move pipeline as Protect — one code path, every guard identical: canonical-path verification on both ends, collision refusal with no overwrite branch, per-file manifest records, and an undo that moves files back individually and names the reason for anything that can’t return. The move policy, refusals, and undo round-trip are pinned by engine tests that run before any release is signed.

Plant a ten-year-old file that triggers the sensitive classifier (a decoy tax return works) and scan. If it appears in the Deep Archive panel, the claim is disproved. The same goes for an old document inside a Git repository.

The archive shelf draws only from the document-hygiene categories; sensitive files carry sensitive categories and are never in the pool — the exclusion is category-structural, not a filter that could be forgotten. In-project files are demoted by the engine to flag-only, which the shelf refuses. The candidacy predicate is a single shared function, and both exclusions are pinned as unit tests that run before any release is signed.

Note your grade, archive every eligible document, and settle. Any change in the letter, either sub-score, or the “clean N GB” promise that counts archived bytes as cleanable disproves the claim.

The ‘archived’ status stays inside every scoring summary by construction — there is no branch that removes archived files from the grade’s inputs — and the panel says so before you click. The no-grade promise and the exact confirm-screen sentence are pinned as unit tests that run before any release is signed.

Detection runs on your machine, in a filename shield and a model-free content check. The filename shield recognizes names that look sensitive, like a tax return or a passport scan. The content check marks a file only on two independent signals: two distinct strong terms from one category, or one structural pattern plus a supporting term. Either match flags the file and blocks bulk deletion (claim 4). Nothing about a match ever leaves your device.