WORM Storage

Write-Once-Read-Many storage backs every artifact the platform considers evidentiary: raw event envelope bytes, uploaded documents, rule source artifacts, and sealed Court Ready Bundle ZIPs. Once written, blobs cannot be modified or deleted (BR-001).

Content addressing

Blobs are identified by their SHA-256 digest. The metadata layer stores the digest, the size, the MIME type, and a manifest entry linking back to the canonical event(s) that produced or referenced the blob. Reads return Content-Type + ETag = "sha256:..." so HTTP clients can verify integrity end-to-end.

Hash chain anchoring

Periodically the platform anchors the head hash of each tenant’s chain into an external git repo (github.com/jammer-x/UM-worm-anchors, per docs/worm-design.md). The git push creates an independent timestamp that any auditor can verify without trusting InsuredAudit’s servers.

Quarantine semantics

Documents that fail malware scan are kept in WORM (the bytes are evidence) but the metadata is flagged scan_status: INFECTED. GETs return 451 LEGAL_REASONS until an admin reviews and releases them via POST /v1/quarantine/{id}/release. Inline scanning rejects the upload with 400 DOCUMENT_INFECTED while still preserving the bytes.

Retention

Default retention is governed by the tenant’s retention policy; legal-hold-tagged objects are tombstoned against sweeps. Releases require an explicit release_authority on DELETE /v1/legal-holds/{id} and are logged to the chain-of-custody table.