Archive intake opens uploads safely, one document per file
A zip or tar.gz archive uploaded to the vault is opened entirely in
memory and every file inside travels the full intake pipeline on its
own: both scan gates, the uploader's own compartment bounds, and its own
audit record. Anything hostile — a file named to climb out of the
archive, a decompression bomb, an archive hiding inside an archive — is
held for review instead, and never stops the honest files beside it.
Every file in an archive becomes its own document
- Given a zip archive holding two ordinary notes
- When the vault ingests the archive
- Then each note is stored as its own document
A file named to climb out of the archive is held for review
- Given a zip archive holding an ordinary note and a file named to escape upward
- When the vault ingests the archive
- Then the escaping file is held for review while the note is stored
An archive holding more files than the vault allows is refused
- Given a zip archive holding more files than the vault's limit
- Then the vault refuses the archive and stores nothing from it
A decompression bomb is refused
- Given a small archive that expands to an enormous size
- Then the vault refuses the archive and stores nothing from it
An archive hiding inside an archive is held unopened
- Given a zip archive holding an ordinary note and another archive
- When the vault ingests the archive
- Then the inner archive is held for review unopened while the note is stored
An upload whose name and contents disagree is refused
- Given an upload named as a zip whose bytes are not a zip
- Then the vault refuses the archive and stores nothing from it
A member uploads a zip through the portal and finds every notestack
- Given a signed-in vault member with a compartment of their own
- When they upload a zip of two notes through the portal
- Then each note can be found by searching for its subject