# ADR-0011: Set-level quarantine and atomic promotion

## Status

Accepted — 2026-08-25

## Decision

All required files for an artifact set are downloaded to a job-scoped directory inside the target
filesystem. Static verification precedes one atomic directory rename to the exact-revision store.
The database registers artifacts only after that promotion report and records static integrity as
distinct from later security/runtime approval.

## Consequences

Partial sets cannot appear locally verified, cross-filesystem partial moves are avoided, retries
can reuse durable partials, and a sidecar manifest supports reconciliation if the file move and DB
transaction are interrupted.