A media catalogue that can recover interrupted imports.

THE WORK

The project.

Media Intake Service brings original files into a local catalogue with content hashes, manifests and a recoverable import history. Repeated imports can reuse an asset's identity, while rights records and reviews are checked separately against the material they cover. Python CLI and MCP entry points share the same intake service.

ATTEMPTS & CORRECTIONS

What changed along the way.

1. 01Keeping usage conditions without treating them as a ban26 July 2026

   At first

   The toolkit kept all rights restrictions in one list. Its current-rights check rejected a record whenever that list contained any text.

   What needed to change

   A condition attached to an allowed use was treated the same as a restriction that prohibited it. The model needed an explicit distinction; guessing permission from a free-text sentence would only hide the ambiguity.

   The change

   The rights evaluator now classifies usage conditions separately from blockers, then checks the intended purpose, asset and supplied scope. Conditions and attribution requirements remain on the asset record. Explicit blockers, expired rights and older restrictions that haven't been classified still prevent use.

   The result

   The committed change can carry the conditions of an allowed use forward while leaving unresolved restrictions blocked. Test definitions follow both cases through intake status. They weren't rerun for this account, and the review made no decision about real usage rights.

IMPLEMENTATION

Design choices.

1. Recovery needs two routes. A receipt can replay an import that finished; surviving manifests can recover assets from an import that stopped before its receipt was written. Treating both as a fresh import would lose that distinction.
2. Content, not the filename, identifies a reusable asset. Two files with the same name can contain different material, and different content at an immutable destination raises a conflict instead of being overwritten.
3. Paths resolve inside the configured media root. Traversal and escaping symlinks are rejected, and a rights reference must belong to the target product. Those checks happen before the service copies accepted files.
4. File replacement is atomic, but the whole import spans several writes. Manifests give the derived indexes a recovery source; they don't make the operation a transaction that can roll every file back.
5. Usage conditions stay with the asset, while explicit blockers and unresolved restrictions can still prevent use. The review policy also checks current manifest hashes, so an older decision doesn't automatically cover changed material.

HOW IT FITS TOGETHER

Architecture.

• An import starts with a scan, so the caller can see accepted files, duplicates and filename collisions before applying changes. Typer and FastMCP both call the same Python service; neither has a separate copying implementation.
• The service hashes the product, source classification, rights reference, paths and file contents into one request identity. A completed request returns its saved receipt. The lookup runs again after taking the product lock, covering an import that finished while another caller was waiting.
• If no receipt exists, saved manifests let the service reconstruct its asset indexes before copying anything new. Matching content keeps its asset ID. New files go through a temporary copy, flush, sync and hash comparison before an atomic replacement puts them in place.
• The import then records manifests, indexes, status and events before writing its final receipt. Review is a separate step: the approval policy compares required reviews and a human final decision with current manifest hashes. Copying the right bytes doesn't decide whether they're approved for use.

CHECKS & RESULTS

What was checked.

A source review shows what the code does. It is not a fresh test of the running app.

1. Code and development records reviewedReviewed11 September 2026

   The code, tests and available development records were checked. Reported test results keep their original scope. No fresh app or live deployment check was run for this write-up.

   Scope of this check

   Code review, not a fresh run of the app