A filename appearing beside a composer is an easy place to declare success. Yet the wrong asset may have been selected, or the chosen content may have changed. I extracted the evidence boundary from my browser work into a small independent example whose output states exactly which comparison passed.
Receive invented bytes rather than filesystem paths
The example never opens a visitor file. It accepts explicitly supplied bytes and retains them in memory. Names must be short basenames without path separators or reserved device names, and are never used as destinations. A 64 KiB asset limit and twenty selections per explicit scope keep the experiment small.
The original TaskFiles registers real paths, sizes and modification times, then checks a profile and the IDs allowed to the running task. This example expresses a deliberately explicit profile/project Scope instead. It does not reproduce the original size limit or permission implementation. That difference matters before anyone connects this teaching code to an operational host.
A handle refers to content and a selection lifetime
An unchanged name and byte sequence in the same scope reuse a handle; different content becomes another selection. Describe reads only handles allowed for the current request and returns name, size and SHA256. Knowing an ID does not grant access to another project or profile.
The change_synthetic_bytes method simulates an asset changing after selection. Equal length does not hide different bytes. Revoke ends that selection lifetime, so an old ID and an old grant list no longer permit a description. However, a caller-created Scope is not authenticated user identity. A production integration still needs trusted ownership and task-bound permissions outside this example.
Matching selection metadata still leaves server storage unknown
Compare_selection checks the ordered list of names and sizes declared by the caller. Reversed assets or a wrong size fail selection_verified. Extra fields that attempt to promote the comparison into a server-storage claim are rejected instead of being silently trusted.
Matching names and sizes can still describe different equal-length content. Both server_saved_verified and observation_authenticated therefore remain False even on a match. This function observes no browser and sends no attachment. Operational code must connect a current page selection check to a separate server result, with evidence for each stage and without turning one stage into proof of the other.
Explore the implementation
Complete independent synthetic implementation
"""Independent synthetic byte/selection receipts; no filesystem or network access."""
from dataclasses import dataclass
from hashlib import sha256
from uuid import uuid4
import re
MAX_BYTES = 65536
def payload(value):
if type(value) is not bytes or len(value) > MAX_BYTES:
raise ValueError('BYTES_REQUIRED_WITHIN_64_KIB')
return value
def filename(value):
if (type(value) is not str or not value or len(value) > 140
or value != value.strip() or value.endswith('.')
or value in ('.', '..') or re.search(r'[<>:"/\\|?*\x00-\x1f]', value)
or re.match(r'^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)', value, re.I)):
raise ValueError('BASENAME_REQUIRED')
return value
@dataclass(frozen=True)
class Scope:
profile: str
project: str
def __post_init__(self):
if any(type(x) is not str or not x.strip() or len(x) > 80
for x in (self.profile, self.project)):
raise ValueError('SCOPE_REQUIRED')
class Selection:
"""Immutable selected snapshots plus mutable synthetic current bytes."""
def __init__(self):
self._rows = {}
def add(self, scope, name, data):
if type(scope) is not Scope:
raise ValueError('SCOPE_REQUIRED')
name, data = filename(name), payload(data)
for key, row in self._rows.items():
if row['scope'] == scope and row['name'] == name and row['original'] == data and row['current'] == data:
return key
if sum(r['scope'] == scope for r in self._rows.values()) >= 20:
raise ValueError('SELECTION_LIMIT')
key = str(uuid4())
self._rows[key] = {'scope': scope, 'name': name, 'original': data, 'current': data}
return key
def _row(self, scope, handle):
row = self._rows.get(handle)
if type(scope) is not Scope or row is None or row['scope'] != scope:
raise ValueError('HANDLE_DENIED')
return row
def change_synthetic_bytes(self, scope, handle, data):
row = self._row(scope, handle)
row['current'] = payload(data)
def revoke(self, scope, handle):
self._row(scope, handle)
del self._rows[handle]
def describe(self, scope, allowed, handles):
if type(allowed) is not list or type(handles) is not list or not handles:
raise ValueError('NONEMPTY_HANDLE_LIST_REQUIRED')
if any(type(x) is not str for x in allowed + handles) or len(set(handles)) != len(handles):
raise ValueError('DISTINCT_STRING_HANDLES_REQUIRED')
result = []
for key in handles:
if key not in allowed:
raise ValueError('HANDLE_DENIED')
row = self._row(scope, key)
if row['current'] != row['original']:
raise ValueError('SELECTED_BYTES_CHANGED')
data = row['current']
result.append({'id': key, 'name': row['name'], 'size': len(data), 'sha256': sha256(data).hexdigest()})
return result
def compare_selection(self, scope, allowed, handles, observed):
expected = self.describe(scope, allowed, handles)
if type(observed) is not list or any(type(x) is not dict or set(x) != {'name', 'size'}
or type(x['name']) is not str or type(x['size']) is not int or x['size'] < 0 for x in observed):
raise ValueError('OBSERVED_NAME_SIZE_LIST_REQUIRED')
matched = observed == [{'name': x['name'], 'size': x['size']} for x in expected]
return {'selection_verified': matched, 'server_saved_verified': False,
'observation_authenticated': False, 'files': expected,
'reason': 'names_and_sizes_match' if matched else 'selection_mismatch'}
def compare_download_bytes(data, received, completed, expected_sha256=None):
"""Hash supplied bytes, not a remote URL, path, or invented saved file."""
data = payload(data)
if type(received) is not int or received < 0 or type(completed) is not bool:
raise ValueError('DECLARED_TRANSFER_FIELDS_REQUIRED')
if expected_sha256 is not None and (type(expected_sha256) is not str or not re.fullmatch('[0-9a-f]{64}', expected_sha256)):
raise ValueError('LOWERCASE_SHA256_REQUIRED')
digest = sha256(data).hexdigest()
reason = ('not_completed' if not completed else 'size_mismatch' if received != len(data)
else 'digest_mismatch' if expected_sha256 is not None and expected_sha256 != digest
else 'supplied_bytes_match')
return {'verified': reason == 'supplied_bytes_match', 'reason': reason, 'size': len(data),
'sha256': digest, 'expected_digest_checked': expected_sha256 is not None,
'network_origin_verified': False, 'power_loss_durability_verified': False}
A download comparison speaks only about supplied bytes
Compare_download_bytes calculates the actual length and SHA256 of bytes supplied to this function. It compares declared completion, received count and an optional expected digest, distinguishing incomplete, size-mismatch and digest-mismatch outcomes. Equal-size different strings remain a digest mismatch.
Verified means that the stated input comparison passed. It establishes no remote origin, video playability or survival after power loss. Without an expected digest, a computed fingerprint is not a comparison against an original; expected_digest_checked exposes that distinction. The network-origin and power-loss durability fields always remain False rather than inheriting success from a byte-count match.
Test the rejected inputs before celebrating a match
The tests cover another profile or project, missing grants, revoked IDs, changed content, wrong names and ordering, and a boolean masquerading as a size. Exceeding the selection limit must preserve existing assets, and mutating a returned descriptor must not alter the registry. A completed zero-byte comparison has its own case.
Thirty-six tests run against the independent source and the same thirty-six run after ZIP extraction. Five saved records come from actual local function calls; the viewer below reads those records only. They are not evidence of newly executing the original native upload or download. Current module checks and accumulated historical test counts are recorded separately.
Publish the responsibilities still needed for operational use
The code implements no native picker, filesystem reading, asynchronous pre-dispatch recheck, file writing or synchronization, network retry, login or persistent journal. Those responsibilities exist elsewhere in the original product. Presenting omitted integration as if it were already connected would give a reuser a misleading operational contract.
Code, tests, record generation and documentation permit modification and reuse. I share them as a starting point for treating names, selection lifetime, actual bytes, remote storage and disk durability as claims with separate evidence. The design goal is a readable account of which stage was confirmed, rather than concentrating operational success into a single green badge.