File Upload & Scanning Pipeline  ·  View 14 of 21  ·  Runtime

Scan Pipeline — Three Object Classes

Five rows, six stages, and the blank cells that are the argument.

Editable source SVG draw.io All views
Admit Fetch Unpack Inspect Compose Record Small — ≤ 10 MB Interactive lane Stream from blob None needed Signature engine Single-engine rule Verdict, p50 2 s Large — up to 50 GB Background lane Large exec profile Assemble to scratch Container walk Signature engine Deep engine on trigger N-of-M, safest wins Verdict, p95 20 min Archive / container Lane by size Assemble to scratch Expand: depth 12, 200× Bound breach Per-member scan Any member infected = infected Indeterminate names the bound Dedup short-circuit Hash hit, 35% Reuse within isolation level Reuse recorded against origin Poison path Engine crash or OOM Retry ≤ 2, fresh sandbox Dead-letter Indeterminate + human within 24 h Scan Pipeline — Three Object Classes, One Contract The blank cells are the statement: a deduplicated object is never fetched or unpacked, and the poison path never reaches a composition rule. Every class ends in the same place — a recorded verdict — which is what lets one state machine serve all of them. v 1.0 · classes 3 + 2 paths

What the blanks say

  • A deduplicated object is never fetched and never unpacked: the 35% hash-hit rate is the single largest cost lever in the design, and it spends nothing but an index lookup
  • The poison path never reaches a composition rule — it reaches a dead letter and a human, because a crashed engine has produced no opinion to compose
  • Small objects need no unpack stage at all, which is why the median cost of the platform is set by the fast engine and not the slow one

Decisions

  • Three execution profiles by size, not one sized for the worst case: a 50 KB screenshot and a 50 GB archive share an API, not a worker shape
  • Archive expansion is bounded at depth 12 and a 200× expanded-size ratio; a breach is indeterminate naming the bound, and the object goes to a human within 24 hours
  • Any infected member of an archive makes the archive infected — the composition rule resolves to the safest available outcome, never the most convenient

Open

  • Whether large objects are scanned streamed or assembled is Question 5, and it is not settled here: this view shows assembly, which is the conservative choice
  • How many engines, and the trigger that escalates to the deep engine, is Question 4 — the view assumes fast-always, deep-conditional
◀  Critical Flow — Initiate to First Read All views Back-Pressure — Which Promise Breaks First  ▶
Solution Architecture v1.0 · Microsoft Azure · Integration Platform Architecture · 2026-1014-scan-pipeline-by-class