Transfer Security Boundaries

Transfer Security Boundaries A data-flow diagram generated by Archify. 01 / Input 02 / Policy 03 / Credential 04 / Transfer 05 / Verify / publish Local File · 01 / Input Local File Upload Policy · 02 / Policy · no redirects Upload Policy no redirects Live Credential · 03 / Credential · epoch fenced Live Credential epoch fenced Scotty Session · 04 / Transfer Scotty Session Source Row · 05 / Verify / publish Source Row Web Asset URL · 01 / Input Web Asset URL Web Redirect Guard · 02 / Policy · every redirect Web Redirect Guard every redirect Cookie Policy · 03 / Credential · per URL Cookie Policy per URL Web Download Client · 04 / Transfer Web Download Client Asset Download · 05 / Verify / publish · staging · atomic replace Asset Download staging · atomic replace Android Asset URL · 01 / Input Android Asset URL Android URL Policy · 02 / Policy · every redirect Android URL Policy every redirect _StickyBearerPolicy · 03 / Credential · per URL · generation _StickyBearerPolicy per URL · generation Guarded Response · 04 / Transfer Guarded Response guarded_transfer · 05 / Verify / publish · same-dir staging guarded_transfer same-dir staging admit selected backend validated URL credential boundary authorized bytes dedicated client finalize server indexes validate hop _redirect_guard · hooks select cookies CredentialPolicy GET credential scoped receive + verify buffered or streamed enter fence guarded_transfer await policy sticky per URL GET credential scoped stream + cleanup bounded · exit precise Legend primary data policy / PII async batch data store data flow

Backend-selected download planes

  • • Web AssetDownloadService uses _make_download_client plus redirect guards and hooks
  • • AndroidAssetDownloadService wraps shared guarded_transfer with a sticky bearer policy

No credential drift

  • • Both paths validate each redirect before attaching credentials
  • • Android 401 or 403 raises AuthError and invalidates the observed bearer generation

Cleanup and publication

  • • Shared _await_advisory_cleanup shields response exit, per-URL close, and batch cleanup
  • • Exit precedence is process exit, pending cancellation, current cancellation, then cleanup cancellation
  • • Single-file downloads replace same-directory staging only after a complete transfer