docs backend evidence community safety RVA01_INGRESS_CONTRACT

RVA01 — enforced photo ingress

Status: LOCAL_DONE / INTEGRATION_PENDING. B-BR-005 / B-BR-M04, evidence reservation/upload.

Production reservation issues a short-lived HMAC capability for the owned API PUT route, never a storage PUT URL. Domain separation binds session and expiry; persisted facts bind exact MIME/size/hash. Only ISSUED, unexpired sessions accept bytes. Four transfers per API process; five durable attempts per session with a bounded lease. Accepted transfers replay without rewriting storage. Failed or ambiguous attempts can retry under the same hash; attempts never refund.

Content-Length and declared+1 bounded read reject oversize before storage. Read deadline 15s, overall budget 20s. Storage credentials/PUT signatures stay private. Lease fencing protects receipts. Owner completion/verification/retention remain required. Expired capabilities cannot extend reservation deadlines.

RED: size/chunking/truncation/hash/type/token/expiry/admission/storage failures. Real SQL: attempt exhaustion, lease fencing and receipt replay. Real private S3: accepted bytes and rejected object absence. Provider-neutral API enforcement does not imply an unrun real-R2 or release acceptance.

Validation

Tested tree: synchronized 9e0a831 plus this RVA01 runtime/test/migration set.

• RED: gateway contract tests failed before the gateway existed.
• GREEN: evidence unit/HTTP/media/storage/application/domain, API unit, HTTP server and OpenAPI contract suites passed under -race (bounded -p 2).
• Three real-SQL ingress cases passed: 12 racers yield one lease, failed attempts exhaust at five, stale nonce cannot finish, receipt replay retains actual bytes, migration 000061 alone preserves an existing session and replays empty.
• Actual API/worker/private-S3 process tests passed for standard and development photo flows, now including oversized transfer refusal then exact retry.
• Gateway four-transfer concurrency and no-rewrite receipt replay passed.
• Route-specific body cap test passed; other endpoints keep their original cap.
• sqlc generation/vet, affected Go vet, gofmt and diff/secret checks passed. OpenAPI vacuum lint passed with existing nonblocking warnings; no claim of zero warnings or a fresh advisory scan.

Services: exclusive local Compose project abastevo-rva-20261011-9e0a831, loopback PostgreSQL 32788 and private S3 32789. No VPS or existing soak changed. The validation Compose storage fixture used a retired MinIO repository; replaced it with the identical immutable Bitnami fixture already reviewed in PR129. Existing migration-000060 upgrade proof now freezes its target at 000060, so future append-only migrations cannot invalidate that historical upgrade test.

Envelope: at most 4 × (3 MiB + 1) buffered ingress bytes per API process; 5 charged attempts × 10 reservations caps successful-body transfer attempts at 150 MiB/day per contributor, independent of URL reissuance. Receipt bytes cannot exceed the reservation. HTTP/edge admission and provider staging qualification remain separate later gates. Startup/restart invalidates capabilities if the configured secret changes; clients reserve again under the same operation.