File Upload & Scanning Pipeline  ·  View 19 of 21  ·  Operations

Object Lifecycle

Seven states, and the closing arrow most implementations never draw.

Editable source SVG draw.io All views
Initiated credential issued Transferring chunks landing Finalised hash verified, unreachable Scanning leased, bounded Available serving plane Quarantined evidence, 180 d Re-judged new signature set Lifecycle state sole gatekeeper first chunk accepted finalise asserts the set enqueued once, durably clean verdict promotes infected or indeterminate release, or re-scan sweep revocation returns it Object Lifecycle — The Loop Most Designs Leave Open Application we own Decision point Opportunity Risk / gap The closing arrow from Re-judged back to Initiated-side states is the one most implementations never draw: it is what makes a clean verdict revocable, and without it the liability window for new intelligence is unbounded. v 1.0 · states 7 + deleted

The closing arrow

  • Re-judged returning an object to quarantine is what makes a clean verdict revocable. Without it, the liability window for new intelligence is unbounded.
  • A state machine that only moves forwards cannot express "we were wrong yesterday", which is the single most common defect in upload pipelines
  • Revocation must propagate inside the read-credential lifetime, which is why that credential is 5 minutes

Decisions

  • Finalised is a real state in which bytes exist and nothing can read them — the state that the whole two-plane split exists to make structural
  • Indeterminate is a terminal verdict with its own handling path, not a retry loop: it reaches a human or a policy decision within 24 hours
  • Every transition is recorded with actor, cause and timestamp in an append-only log; an object in a non-terminal state past its dwell time is reconciled, re-driven or reported — never left silent

Stated assumptions

  • Rolling 180-day re-scan sweep for older objects, 24 h for the recent window
  • Quarantine evidence 180 days before irreversible destruction
  • Indeterminate rate ≤ 0.2% of objects
◀  Observability All views Security Zones  ▶
Solution Architecture v1.0 · Microsoft Azure · Integration Platform Architecture · 2026-1019-object-lifecycle