On upload-complete, verify the stored ciphertext sha256. Document that integrity is primarily the AEAD tag (preferred) with the server-side hash as a transport-corruption check. Reject mismatches.
Acceptance criteria:
- Ciphertext hash verified server-side at completion
- Corruption produces a clear error, file stays unusable
- Decryption-time AEAD verification documented for clients
On upload-complete, verify the stored ciphertext
sha256. Document that integrity is primarily the AEAD tag (preferred) with the server-side hash as a transport-corruption check. Reject mismatches.Acceptance criteria: