全局架构/MEDIA/资源、包与媒体交付

ARCHITECTURE DOSSIER · 02

资源、包与媒体交付

上传隔离、校验、晋级、下载票据与端侧验证

MIXEDMEDIACODE + RUNTIME + QA

MEDIA · COMPONENT TOPOLOGYowner / runtime / truth state

01Client

Portal / iOS uploadertarget

声明用途、大小、MIME、checksum

Product clientsWeb / Swift

02Edge

Signed upload edgetarget

短期 ticket 与大小/MIME 限制

Media Platformtarget CDN/object edge

03Service

reits-media controlmixed

upload capability、object claim、bounded package validation、promote、asset 与 download ticket

Media Platformmain@db8c55a · code only

Policy scanner lanetarget

malware/policy verdict、definition revision 与 retry

Media Securitynot implemented

Open Platform publishermixed

版本、manifest、能力与 package/asset 引用

Developer Platformsystemd · local storage current

iOS send kitrunning

媒体准备、hash、分片、失败恢复

Client PlatformSwift Package

04State

Quarantine / immutable bucketstarget

隔离上传与不可变资产

Media Platformnot deployed

CRITICAL SEQUENCE

真实主链与事务边界

每一步都必须能回到调用方、契约、状态 owner 与失败证据；UI 只显示服务端已经确认的真值。

01
客户端计算 SHA-256 并提交 owner/tenant/class/name/size/MIME/idempotency intent
02
资源服务校验当前支持的 miniapp_package、大小、MIME 与 hash 并签发 exact-header S3 PUT
03
浏览器直传 private versioned quarantine bucket；业务 API 不经手资源字节
04
complete 单 claimant 核对对象版本、长度、S3 checksum 与下载重算 SHA-256
05
bounded validator 拒绝 path traversal、重复路径、特殊文件、单项/总量/压缩比越界与无效 manifest
06
独立 policy scanner TARGET 通过后复制到 asset/class/hash 不可变 key 并删除 quarantine
07
业务只保存 asset_id/hash/S3 version reference，消费者用短时 ticket 下载并复核 hash

INTERFACE REGISTER

跨项目接口与安全条件

producer、consumer、契约和 guard 同时登记；其中任何一列缺失都不能进入多团队并行开发。

ProducerVersioned contractConsumerSecurity / consistency guard

UploaderUploadIntent {tenant,owner,class,name,size,mime,sha256,idempotency_key}reits-media

subject + scope + resource grant TARGET; bounded class/MIME/size CURRENT

reits-mediaUploadCapability {asset_id,upload_id,put_url,headers,size,expires_at}Web / service adapter

short TTL + exact object key/MIME/length/checksum; URL never persisted

Package validatorValidationEvidence {entries,uncompressed_bytes,entrypoint,manifest}Promotion

bounded ZIP only; not malware verdict

PublisherPackageManifest {version,asset_id,hash,capabilities}Miniapp Gateway

review + immutable release + consumer hash

reits-mediaDownloadTicket {asset_id,url,expires_at}iOS / Web

asset READY + short TTL; signed URL never stored/logged

STATE OWNERSHIP

数据真值与恢复

Asset / upload metadatareits-media

STOREMySQL schema in code · production absent

RETENTIONasset policy target

RECOVERYDB manifest + object inventory + drill

Quarantine uploadsreits-media

STOREprivate versioned S3 target

RETENTIONbounded pending/rejected policy target

RECOVERYexpired intent 重新上传

Immutable packagesreits-media bytes / miniapp-open-platform reference

STOREprivate S3 + CloudFront target

RETENTIONrelease/reference lifecycle

RECOVERYcross-domain object inventory + manifest

Collected mediadata-sources

STORELocal files now

RETENTION来源政策

RECOVERY迁移至 resource service

FAILURE MODEL

故障必须怎样收敛

TRIGGERchecksum 不一致

SYMPTOM包或媒体不可验证

CONTAIN留在 quarantine，禁止发布

expected/actual hash

TRIGGERbounded validation 或未来 scanner 失败

SYMPTOM上传完成但资源不可发布

CONTAIN保留拒绝 reason/evidence；不生成 public/ticketable asset

validation evidence + policy verdict

TRIGGERcomplete 并发或瞬时存储错误

SYMPTOM重复 promote 或 processing 卡住

CONTAIN单 claimant；瞬时失败 release claim，幂等返回原结果

upload state + idempotency receipt

TRIGGERlocal package disk 满

SYMPTOM发布与下载失败

CONTAIN冻结新发布，已缓存版本继续

disk alert + package smoke

QA RELEASE GATES

不是画完架构图就算完成

这些门禁连接 UI 状态、接口负向路径、运行证据与可恢复性；发布证据必须绑定 exact commit。

MEDIA-01

类型、大小、MIME、checksum、idempotency 和对象版本

服务端负向 + 并发测试

MEDIA-02

checksum 与签名在宿主端复核

iOS/Web E2E

MEDIA-03

quarantine 不可公开读取

安全回归

MEDIA-04

ZIP bomb/path traversal/duplicate/special entry 与 policy scanner

恶意样本矩阵

MEDIA-05

8 张 K15 资源/运营 UI 九态与证据分轨

visual + a11y + contract

MEDIA-06

对象/DB inventory 与隔离恢复

部署前 restore drill

← 身份与访问控制可信内容与公共知识 →