A file button makes three promisesComposer admission, durable Session replay, and Agent-readable evidence need separate contracts. rc.2 remains image-specific across all three.

One attachment. Three possible projections.

Durable sourceLocal immutable object

Verified bytes, opaque identity, Session authorization, quarantine, and retention.

Route-owned derivativeProvider file binding

Endpoint, account, model route, API version, digest, state, expiry, and deletion.

Plan at the exact route.

Admitlocal
→
AuthorizeSession
→
Negotiateroute
→
Projectnative | parse
→
Evidencetruth

Do not reduce capability to a Boolean.

  1. PDFInline or upload? Embedded text, rendered pages, OCR, citations, encryption, and page limits.
  2. VideoContainer, codecs, frames, audio, subtitles, duration, timestamps, and sampling.
  3. LifecycleProcessing, reuse, expiry, deletion, residency, and route changes.
attachment  sha256:raw…
provider    exact endpoint
route       model + API
state       ready
expires     2026-08-29…

Route deliberately.

Passthrough

Only when the exact route declares the media, transfer form, semantics, and limits.

Extract or hybrid

Use bounded parsing for stable citations; combine it with native visual/audio understanding when required.

Fail closed

Keep a human-only card or return an actionable refusal when no safe consumer exists.

Tell the truth about media.

PDFText is not the rendered page

Record native text, OCR, page images, coordinates, omissions, and truncation separately.

VideoSuccess is not full observation

Record frame sampling, audio, subtitles, timestamps, and any events the route can miss.

Six high-value release gates.

Primary evidence.

Keep the complete architecture record.

The canonical guide covers local admission, capability records, binding identity, upload recovery, PDF and video truth boundaries, egress policy, failure routing, and twenty-seven acceptance gates.

Read the complete guide