# Secure feature contract and release checklist

Completed example — all product names, people, evidence IDs and results below are synthetic teaching data. They are not test results from this website or an assessment of a real product.

## Feature contract

Feature: LedgerDesk receipt attachment, r12. Owner: invoices team. A current invoice owner may upload a PDF up to 5 MiB and later download it. Store private receipts for the invoice retention period; quarantine objects expire after 24 hours if processing cannot finish. Tenant membership and invoice ownership come from server records.

## State transitions

| From→to | Who / prerequisites | Durable effect | Failure / retry | Evidence |
| --- | --- | --- | --- | --- |
| New→quarantined | Current owner, bounded body | Generated object ID and pending metadata | Abort removes incomplete object | F-01,F-02 |
| Quarantined→approved | Inspection worker validates expected format and scan outcome | Record approval version | Duplicate task returns current state | F-03,F-04 |
| Approved→downloaded | Current authorized requester | Bounded audit event; bytes remain private | Authorization failure returns no object | F-05,F-06 |

## Boundary tests

F-01 accepts the ordinary owner/PDF. F-02 denies Ben on Ana's invoice before storage and rejects a six-MiB body. F-03 denies a renamed executable and a scanner timeout; no public URL appears. F-04 retries the same task and creates one approved metadata record. F-05 allows Ana's authorized download. F-06 denies cross-tenant and revoked-owner downloads, including direct object identifiers. Filename is display metadata only; generated IDs choose storage locations. Response content type and disposition are server-selected.

## Operations and release

Log operation ID, pseudonymous actor ID, tenant ID, object ID, decision and reason; never receipt bodies or signed credentials. Worker pool is bounded to four inspections with a queue depth alert at 100. A scanner outage keeps bytes quarantined. Rollback disables new uploads but retains authorized reads for already-approved receipts. Synthetic run F-12 on r12/artifact D passes F-01–F-06; deployment must still confirm D and the intended private-storage policy before activation. No claim is made that content inspection detects every malicious file.