Damage Scenarios and Quarantine

Damage Scenario → Invariant Map

One vector per row; each defense has one owner doc.

#	Scenario	Defense	Owner
1	Old client strips unknown sidecar fields	Signature covers _unknown; newer schema never written	Metadata
2	Bytes mismatch declared content type	content_type allow-list + sandboxed decoder	Validation
3	Chunk retried at a conflicting range	Wholly committed → duplicate, nothing written; partial overlap → reject; changed bytes stopped by the client’s chunk-tag guard	Upload
4	Old manifest replayed to revive a delete	prior_provenance_hash advance check, both sides	Provenance
5	Re-sign under a weaker suite	Signature covers suite and protocol version	Keys
6	Concurrent captions	LWW + superseded_captions surfaces the loser	Metadata
7	OR-set remove of an unobserved add	Removes target a known add_id	Metadata
8	Corrupt thumbnail overwrites a good one	Signed DerivativeManifest chain	Provenance
9	Fake timestamp distorts audit	Audit-only; server received_at authoritative	Keys
10	Dedup TOCTOU duplicates a blob	Check + pending insert in one transaction	Filesystem
11	Upload exceeds declared size	Range end checked against the declared size before writing	Upload
12	Unknown crypto_suite_id	400 at handshake, before any session	Validation
13	Peer floods the rejected-hash table	Per-peer quota, bounded LRU	Federation
14	Model swap invalidates AI tags	Model id+version per entry; no cross-model compare	Metadata
15	Leaked session revokes the rest	revoke_all_sessions needs master-key proof	Authentication
16	Holder of all current keys rewrites history	Hash chain signed by past (retired) devices	Provenance
17	Random amk_version skips MLS	Monotonic, server-known amk_version	Validation
18	v_old client writes to an upgraded album	Stale intent_id → 409	Versioning
19	Malformed sidecar after crash	Quarantined, never skipped	Repair
20	Manifest names an unlisted device	created_by_device must be in the directory	Validation
21	Hand-crafted metadata blob envelope	Byte-exact wire format, checked at decode	Encryption
22	Retried delete double-decrements	Manifest idempotency on prior_provenance_hash	Validation
23	Old backup overwrites current state	Chain reconciliation; newer local wins; divergence quarantined	Backup
24	Device predates its enrollment	IK-signed added_at must precede the manifest	Keys
25	Peer floods hints	Advisory; pulls fully validated	Federation
26	Peer TLS key silently changes	TOFU pin; rotation needs multi-vantage corroboration	Federation
27	Partial stack edit	Bundle-atomic .tmp staging and rename	Filesystem
28	Revoked capability still served	TTL ≤ 24h; revocations polled ≤ 15 min	Federation
29	Embeddings from an unknown model	Vector index refuses unknown model_id	AI
30	Client forges server-derived fields	Server recomputes; ignores client values	Upload
31	Stale directory undoes a revocation	Master-signed monotonic directory_version; reader high-water mark	Keys
32	Server fabricates or rewinds an epoch	Ceiling from signed MLS commits; in-flight key → pending	Keys
33	Share link enumerated	≥128-bit id, rate limits, indistinguishable 404	Shares
34	Peer mass-reports a user	Signed, rate-limited; never server-wide	Moderation
35	Federated pulls exhaust storage	Charged to receiver, capped per source peer	Quota
36	Leaked upload link floods owner	Link caps, quota at creation, rate limits, revocation	Drops
37	Hostile file via upload link	Inbox only; sandboxed review before adoption	Drops
38	Server swaps the drop encapsulation key	Drop public key travels only in the URL fragment	Drops
39	Guest drop passed off as user-authored	No manifest; adoption mints an adopter-signed create	Drops
40	Upload-link passphrase brute force	Argon2id verifier, rate limits, caps	Drops
41	Doctored capability min_protocol_version	Signed claim; handshake and album pin still apply	Federation
42	Offline share passphrase brute force	Argon2id per guess; rate-limited fetch; fragment secret	Shares
43	Server loses bytes, denies accepting them	Signed CustodyReceipt; loss is provable	Custody
44	Client claims custody it never had	No receipt, no claim	Custody
45	Receipt replayed elsewhere / stale attestation	Server id signed in; attestations echo a client nonce	Custody
46	Wake flood drains battery	Contentless, coalesced; degrades to polling	Notifications
47	Wake timing leaks activity	Contentless, coalesced, jittered; self-hostable transports	Notifications

Quarantine Surfaces

Every “don’t apply, surface it” path. A quarantined item is never silently dropped or applied; a human inspects, repairs, or discards it.

• verify_asset reject → quarantine area, audit log.
• Federation soft-fail → bounded rejected-hash table.
• Orphaned original, malformed sidecar → .library/quarantine/, bytes preserved (Repair).
• Stale revival or restore conflict → audit log + UI.
• Write stranded by an album upgrade → local pending_until_upgrade queue.
• Drop awaiting adoption → owner’s server inbox.

Provenance Immutability Rules

Policy over the provenance chain:

• No path (API, filesystem, federation) overwrites or deletes an entry; append-only by construction.
• Hard-delete removes ciphertext and metadata; the chain stays as a tombstone.
• Backups carry the full chain; restore reconciles.
• Current-key compromise can only append: past signers stay in the device directory forever (revoked_at, never pruned).