Context
Rights checked only at upload go stale by the time a job actually publishes. The dangerous moment in media automation is not the model that captions the file. It is publish.
The Rights-Aware Media Publishing Pipeline treats promotion as immutable and rights as something you evaluate at execution time.
Decision
Upload sessions expire, checksum, and verify before an asset version exists. Review renditions are keyed by source checksum. Publication intents carry idempotency keys. Territory, time, rendition, and destination grants are checked when the job runs.
ingest → immutable promotion → publish-time rights check → delivery or unknown → reconcile or revoke
Unknown delivery outcomes are first-class. Operators reconcile. Compensating revocation stops a five-minute signed delivery scope immediately. PostgreSQL owns lifecycle state. Object storage owns bytes.
What I rejected
A rights flag set at upload that publication trusts forever, and treating an ambiguous CDN response as success. Both leave a published object after the grant has lapsed.
Failure scenario
The destination returns an unknown outcome. The intent stays unresolved. An operator reconciles or revokes. Revocation invalidates the signed scope; a later fetch does not succeed on a stale yes.
Evidence
Object-storage pipeline, promotion lineage, and documented compensation when delivery is uncertain. This is not DRM and not a CDN.
Inspect: Repository · Run locally