Verify restored audio before installation

internal/app/restore_execute.go

@@ -117,7 +117,7 @@ func executeRestoreDownloadAction(
 	}
 
 	if restoreActionIsAudio(action) {
-		return executeRestoreAudioAction(ctx, cfg, safeLocalPath, action, store)
+		return executeRestoreAudioAction(ctx, cfg, safeLocalPath, parent, leaf, action, store)
 	}
 
 	temporaryPath, err := downloadRestoreTemp(safeLocalPath, func(destination io.Writer) error {
@@ -324,6 +324,8 @@ func executeRestoreAudioAction(
 	ctx context.Context,
 	cfg *config.Config,
 	safeLocalPath string,
+	parent *os.Root,
+	leaf string,
 	action RestoreAction,
 	store storage.ObjectStore,
 ) error {
@@ -332,8 +334,19 @@ func executeRestoreAudioAction(
 	}
 	spoolDir := artifacts.SessionSpoolRestoreAudioDir(cfg.Pipeline.Spool.Root, cfg.Session.Campaign, cfg.Session.SessionID)
 	spoolPath := filepath.Join(spoolDir, filepath.Base(safeLocalPath))
+	temporary, err := os.CreateTemp(filepath.Dir(safeLocalPath), "."+filepath.Base(safeLocalPath)+".restore-*")
+	if err != nil {
+		return fmt.Errorf("create sibling audio staging file: %w", err)
+	}
+	temporaryPath := temporary.Name()
+	if err := temporary.Close(); err != nil {
+		_ = os.Remove(temporaryPath)
+		return fmt.Errorf("close sibling audio staging file: %w", err)
+	}
+	defer func() { _ = os.Remove(temporaryPath) }()
+
 	cacheEnabled := cfg.Pipeline.Cache.S3Audio == nil || *cfg.Pipeline.Cache.S3Audio
-	_, err := audio.MaterializeS3Audio(ctx, audio.S3MaterializeRequest{
+	_, err = audio.MaterializeS3Audio(ctx, audio.S3MaterializeRequest{
 		Store: store,
 		Object: storage.ObjectInfo{
 			Key:  action.RemoteKey,
@@ -344,10 +357,19 @@ func executeRestoreAudioAction(
 		CacheRoot:    strings.TrimSpace(cfg.Pipeline.Cache.Root),
 		CacheEnabled: cacheEnabled,
 		SpoolPath:    spoolPath,
-		DestPath:     safeLocalPath,
+		DestPath:     temporaryPath,
 	})
 	if err != nil {
 		return fmt.Errorf("materialize audio: %w", err)
 	}
+	if err := verifyRestoredObject(ctx, store, action, temporaryPath); err != nil {
+		return err
+	}
+	if err := validateRestoreDestinationLeaf(parent, leaf); err != nil {
+		return err
+	}
+	if err := fileops.InstallSiblingTempFile(temporaryPath, safeLocalPath, fileops.WorkspaceFileMode); err != nil {
+		return fmt.Errorf("install verified audio atomically: %w", err)
+	}
 	return nil
 }