Verify archived files before accepting a matching manifest on retry #64

New Issue

2026-11-05T12:09:29Z

spencerm commented

2026-11-05 12:09:29 +00:00

Priority: medium.

server/packetstation/domain/archive.py:718 returns success when _same_manifest() matches metadata. It bypasses _write_once(), which would hash existing files.

Reproduce: let a catch-up copy finish writing files and manifest, interrupt before archive.mark_done commits, then delete or alter one archived file. Retry that pending/failed seal. The matching manifest causes success without validating the files, and the job marks the copy done.

This concerns a same-seal pending/failed retry. Completed archive rows are not normally revisited by the worker. A refile uses a new seal/folder.

Acceptance criteria:

Check existence, size and SHA-256 of every expected file before returning success for a matching manifest.
Restore missing files from verified source assets where appropriate.
Refuse and alert on differing existing bytes; preserve the documented no-overwrite guarantee.
Add crash-before-mark_done retry tests for missing and corrupted files, plus an intact idempotent retry.

Related: #57. Validation: static inspection. Source: Grok and Qwen; parent confirmed the early return and narrowed Qwen's trigger.

Reviewed revision: 18333600b55b70971877c1a0c72d1d61b6ce9c69. Raised from the November 2026 independent project reviews and parent verification. No production system was tested.

Priority: medium. [server/packetstation/domain/archive.py:718](https://gt.pescoinc.biz/spencerm/PacketStation/src/commit/18333600b55b70971877c1a0c72d1d61b6ce9c69/server/packetstation/domain/archive.py#L718) returns success when _same_manifest() matches metadata. It bypasses _write_once(), which would hash existing files. Reproduce: let a catch-up copy finish writing files and manifest, interrupt before archive.mark_done commits, then delete or alter one archived file. Retry that pending/failed seal. The matching manifest causes success without validating the files, and the job marks the copy done. This concerns a same-seal pending/failed retry. Completed archive rows are not normally revisited by the worker. A refile uses a new seal/folder. Acceptance criteria: - Check existence, size and SHA-256 of every expected file before returning success for a matching manifest. - Restore missing files from verified source assets where appropriate. - Refuse and alert on differing existing bytes; preserve the documented no-overwrite guarantee. - Add crash-before-mark_done retry tests for missing and corrupted files, plus an intact idempotent retry. Related: #57. Validation: static inspection. Source: Grok and Qwen; parent confirmed the early return and narrowed Qwen's trigger. Reviewed revision: `18333600b55b70971877c1a0c72d1d61b6ce9c69`. Raised from the November 2026 independent project reviews and parent verification. No production system was tested.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: spencerm/PacketStation#64