File Upload & Scanning Pipeline  ·  View 04 of 21  ·  People and journeys

Journey — Attach a File to a Conversation

The ordinary case: four megabytes, five phases, and two seconds that must not feel like doubt.

Editable source SVG draw.io All views
Workspace member mobile and web Goal — Share a document in a conversation without thinking about it Trigger — Someone asks for the deck, in the thread, now Done when — The other person opens it, and nobody saw the word scanning 1 · Pick in the client 2 · Send bytes leave 3 · Wait ◆ moment of truth 4 · Shared ◆ moment of truth 5 · Opened by someone else What they do Drags a 4 MB PDF Watches a progress bar Sees "checking file" Message posts Colleague taps it What the platform does Initiate, mint SAS Direct-to-blob chunks Finalise, hash, enqueue Signature scan Promote to serving Emit available event Read SAS, state re-checked How it feels Unaware Fine Suspicious Where it hurts 2 s reads as broken "Checking" sounds like doubt Posted before available Revoked mid-read What we do about it No size prompt under 10 MB Parallel chunks, 16 ways p50 verdict 2 s, interactive lane Optimistic post is a scope opt-in Post waits on the event, not a poll Short SAS bounds a revocation to minutes Journey — Attach a File to a Conversation v 1.0 · lane interactive · target p95 verdict 8 s under 10 MB

What the journey proves

  • The only phase with a sentiment trough is Wait, and it lasts p50 two seconds — which is why the interactive lane exists and why bulk work can never share it
  • The message posts on the available event, not on a poll: a client polling for a verdict turns one upload into dozens of control calls at 60 million objects a day
  • "Checking file" is deliberately not "scanning for viruses": the first is a process, the second is an accusation about the person who sent it

Where it hurts

  • Posting the message before the object is available is the tempting shortcut, and it is the optimistic-availability decision — permitted only as a per-scope opt-in, never a platform default
  • A revocation mid-read cannot be prevented, only bounded: the 5-minute read credential is that bound
  • A generic failure on a blocked file produces a support ticket and no learning; state and reason are surfaced to the uploader instead

Stated assumptions

  • A 4 MB PDF is the median interactive object
  • Members tolerate ~2 s of in-product wait without reporting a fault
  • The chat tenant has not opted into optimistic availability
◀  Actors and Their Core Journeys All views Journey — A 40 GB Master from a Bad Network  ▶
Solution Architecture v1.0 · Microsoft Azure · Integration Platform Architecture · 2026-1004-journey-attach