Files uploaded together stay together.
A browser selection or drop batch gets one immutable submission ID, so the admin can see package context later.
Evidence-grade intake
Preserve arrival facts without making a portal.
Sprag records what arrived, which files arrived together, how the admin handled them, and whether the page was sealed after intake closed. Submitters get status proof, not file access.
Boundary
Integrity records are not legal certification.
Sprag helps an operator explain handling. It does not make admissibility claims or prevent a server owner from tampering with their own database.
What is recorded
The record follows the intake shape.
Proof without access.
The receipt URL shows aggregate arrival facts and limited status: received, reviewed, rejected, or downloaded.
Hashes and handling events.
The admin can export page metadata, submission IDs, stored-object SHA-512 hashes, upload/download timestamps, and handling logs.
Sealed mode
Close intake and make later handling visible.
Sealing a page closes public uploads, prevents reopening, and prevents page deletion. Later admin downloads, metadata edits, file deletes, ZIP exports, manifest exports, and receipt-status changes remain possible but appear as post-seal handling events.
Exports
Plaintext ZIPs and E2E ciphertext are different.
Plaintext pages can be exported as streamed ZIP files. E2E pages are intentionally not exposed through server-side plaintext ZIP export because the server cannot decrypt them.
For E2E pages, the server-side hash is a ciphertext-object hash. The admin decrypts downloaded ciphertext in the browser with the page private key.