Prove protected media and exports only inside owner-approved scope.

Required inputs

• Gallery aliases only, with raw bucket object keys excluded from durable notes.
• Owner, non-owner, and optional super-admin account aliases for each visibility mode.
• Approval window, allowed device/browser targets, and exact read-only or mutation scope.

Evidence to record

• Alias-to-route mapping for public list, gallery detail, manifest, ZIP, and denial checks.
• Owner approval timestamp or handoff reference without credentials or private identifiers.
• Explicit list of checks that are excluded until a later proof session.

Required inputs

• Protected gallery alias and expected grant claim or header name without secret values.
• Authorized owner or granted-account alias and denied non-owner alias.
• Signed read URL expiry window and expected fail-closed response after expiry.

Evidence to record

• Header presence or absence with secret values redacted.
• Authorized read, denied read, and expired read results recorded separately.
• Provider or app logs checked for unexpected 4xx/5xx during the approved window.

Required inputs

• Public or owner-accessible gallery alias approved for repeated manifest/ZIP requests.
• Maximum burst size, expected success count, expected throttled count, and client-key strategy.
• Owner-approved log window and rollback or revoke action if the run behaves unexpectedly.

Evidence to record

• Concurrent request summary with total, allowed, rate-limited, revoked, forbidden, and failed counts.
• Retry-After values and CORS-exposed export headers captured from live responses.
• Database row count or owner-approved readback proving one gallery/client hash row when provider access is approved.

Required inputs

• Approved media count, expected visibility set, and safe filenames or aliases.
• Desktop and mobile device/browser targets for share, copy, save, or download behavior.
• Evidence storage location that excludes raw media when thumbnails or filenames are private.

Evidence to record

• Manifest photo count and expiry compared with the expected approved media set.
• ZIP filename, content count, SHA-256 header, and client-side hash verification result.
• Native share, copy, save, or download result recorded per device/browser.

Required inputs

• Source commit, deployed revisions, route timestamps, account aliases, and approved media aliases.
• Failed or contradicted checks with exact response code, route, and next action.
• Still-gated checks that require broader owner approval or provider access.

Evidence to record

• Launch closeout packet updated with media proof results and follow-up gates.
• Status page and repo ledger updated only for evidence that actually passed.
• Rollback or revocation action recorded if the proof session changed access state.