# OPS007-LAB1 — Bounded object upload evidence

Everything is local and synthetic. No AWS/Cloudflare account, real credential, external bucket, public endpoint, network egress, or real presigned link is used.

For each case produce eight states:
`storage_target_state`, `signer_authority_state`, `presign_binding_state`, `expiry_state`, `transport_boundary_state`, `transfer_method_state`, `multipart_lifecycle_state`, and `application_acceptance_state`.

Rules:
1. Evaluate signer scope, method/key binding, and expiry independently.
2. CORS is a browser-transport fact, not storage authorization.
3. Choose transfer method from the fixture workload; do not use one universal numeric threshold.
4. For multipart, retain successful parts, retry only failed parts, and close with complete or abort/cleanup evidence.
5. Storage completion is not application acceptance.
6. The transfer case must be solved from its own prefix, expiry, size, and part ledger.

Run `python -B run_checks.py` for learner-visible structural checks. Hidden acceptance lives outside learner paths.