FastSim publishes a primary recording through the scoped run.output service. The service is transactional: a plugin writes a private staging file, validates an opaque readback lease, and asks Core to publish the validated inode. The integrity profile controls content hashing only; it does not relax the transaction or FSR structure gates.

Choosing a profile

RunOutputPolicy defaults to structural integrity:

python
policy = RunOutputPolicy(output_root)
assert policy.integrity == "structural"

Use SHA-256 only when the deployment requires content authentication across the validation-to-commit interval:

python
policy = RunOutputPolicy(output_root, integrity="sha256")

Only structural and sha256 are accepted. The selected profile is exposed as transaction.integrity, so the validator can avoid work that Core did not request.

Work structural (default) sha256
Writer payload SHA-256 0 1 streaming digest
Validator full-file SHA-256 0 1
Commit full-file SHA-256 0 1
Closed writer and readback leases Required Required
Validated byte count Required Required
FSR structure and inventory validation Required Required
File-descriptor, inode, link, and size identity Required Required
fdatasync, directory fsync, atomic publish, cleanup Required Required

The current FSR binary 1.2 integration uses its structural-validation reader profile. A structural validation receipt uses validation_profile="structural-container", integrity="structural", and content_sha256=None. A strict receipt uses validation_profile="full-file-and-inventory", integrity="sha256", and the actual lowercase digest.

Transaction order

  1. begin_primary(...) reserves one logical output transaction.
  2. open_stream() returns a worker-affine staging lease.
  3. The worker writes and closes that exact lease.
  4. seal(lease) verifies the staging file descriptor, inode, link count, and size.
  5. open_readback() returns one opaque, read-only, size-bounded lease.
  6. The validator parses the FSR container, checks its manifest, footer, index, and record inventory, then closes the readback lease.
  7. confirm_validation(lease, receipt) verifies the exact lease, byte count, and integrity profile. SHA-256 mode also verifies the validator digest against the writer digest.
  8. commit() rechecks identity, performs the selected digest check, synchronizes the file and parent directory, publishes without overwriting an existing final name, verifies the published inode, and removes staging.

Every failure before publication removes staging unless the trusted policy asks to preserve bounded incomplete evidence. Revocation and application shutdown use the same cleanup boundary.

Receipts

RunOutputValidationReceipt and RunOutputCommitReceipt use schema version 2. Both carry an explicit integrity value. Their digest fields are optional by profile:

  • structural: content_sha256 / sha256 must be None.
  • sha256: the digest must be a 64-character lowercase hexadecimal value.

An empty string is invalid in both profiles. Receipt integrity must match the transaction exactly.

Security boundary

Structural mode detects changed inode identity, link count, or size and refuses a container that fails FSR validation. It intentionally does not promise to detect a same-size byte modification made after successful readback validation. Select integrity="sha256" when that threat is in scope; its commit-time re-read detects the modification before publication.