Validate downloads before installing workspace files

2026-09-02 00:37:00 +00:00
parent ba858cc997
commit 39b2665d8b
13 changed files with 204 additions and 665 deletions
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -498,6 +498,8 @@ Cache layout (durable S3 audio cache):
 Each cached audio file has an adjacent managed identity record. It binds the
 file to its remote object version and verified digest; deleting or altering the
 record simply causes Narratio to download and verify the object again.
+Remote audio and restored files are fully transferred into sibling temporary
+files and validated before they replace their canonical workspace paths.

 ### Workspace Permissions