Verify artifacts

Outcome

An artifact becomes canonical only after trusted verification computes its digest and commits one tenant-scoped immutable manifest.

Prerequisites

Separate staging upload authority from finalization authority. Define maximum size, accepted media and magic types, archive/symlink policy, malware policy, retention class, and tenant/project ownership.

Steps

1. Mint a random, one-use, short-lived staging upload target.
2. Stream the uploaded object through size, digest, media, magic, ownership, and content-policy checks.
3. Compute the canonical digest in the trusted finalizer.
4. Conditionally promote to the workspace/project content-addressed namespace without overwrite.
5. Commit manifest, lineage, retention, and event only after promotion succeeds.
6. Quarantine invalid bytes and reconcile ambiguous finalization by the deterministic operation ID.

Slice 0 uses a create-only filesystem implementation and verifies digest plus mode. Remote staging and promotion activate with object storage.

Verify

Test overwrite, mismatch, partial upload, duplicate finalization, collision, symlink/archive abuse, cross-tenant deduplication, and a lost finalize response. Every valid retry yields one manifest.

Recover

If bytes and database diverge, mark affected evidence unavailable, stop promotion, run the consistency scanner, and restore or re-upload only from a verified source. Do not edit a digest to match bad bytes.

Next task

Review the local gateway boundary.