Submission Validation Pipeline

Submission Validation Pipeline A workflow diagram generated by Archify. 01 / Submission request 02 / Validation stages (security.py + validator binary) EX / Rejected submissions Transport Content Enforce Before any action Receive · POST @@save-poll · Submission request › Transport · pollResult Receive POST @@save-poll pollResult Hand-off · normalized copy → notify() · Submission request › Enforce Hand-off normalized copy → notify() Transport limits · header + body size · Validation stages (security.py + validator binary) › Before any action › Transport Transport limits header + body size Shape & fields · JSON shape · fields · text · Validation stages (security.py + validator binary) › Before any action › Content Shape & fields JSON shape · fields · text Files & limits · data URLs · filenames · MIME · Validation stages (security.py + validator binary) › Before any action › Content Files & limits data URLs · filenames · MIME Validator binary · survey-core · 30 s · Validation stages (security.py + validator binary) › Enforce · fail-closed Validator binary survey-core · 30 s fail-closed Reject 413 · request_too_large · Rejected submissions › Transport Reject 413 request_too_large Reject 400 · invalid_json · unknown_field · Rejected submissions › Content Reject 400 invalid_json · unknown_field Reject 400 · unsafe_filename · mime_mismatch · Rejected submissions › Content Reject 400 unsafe_filename · mime_mismatch Reject 400 / 500 · validation failed · no binary · Rejected submissions › Enforce Reject 400 / 500 validation failed · no binary valid invalid schema + payload within limit Legend Agent logic Policy External system

Order is the contract

  • • Transport limits are enforced before any JSON is parsed
  • • Checks run on a recursive copy, never on the caller payload
  • • Only the normalized copy reaches validation, storage and actions

Fail closed, decide early

  • • A rejected submission never reaches a subscriber or action
  • • A missing or tampered validator binary refuses the submission
  • • Single-use tokens are consumed only after validation succeeded

Deterministic evidence

  • • Every failure returns a stable code plus an optional field
  • • Failures are logged at warning level without submission content
  • • Audit entries carry only reason, field, origin and remote address