Review Package Writer Sink

The review_package sink writes deterministic filesystem packages containing message evidence for local review, audit preparation, and handoff workflows. It is disabled by default and must be explicitly enabled in configuration.

The sink is not a cross-domain guard, release authority, sanitizer, approval workflow, data diode, or classification tool. It creates evidence packages only. Authorization, redaction, release decisions, and guard behavior remain outside nats-sinks.

Configuration

{
  "sink": {
    "type": "review_package",
    "enabled": true,
    "directory": ".local/review-packages",
    "duplicate_policy": "skip_existing",
    "include_payload": true,
    "max_payload_bytes": 16777216,
    "fsync": true
  }
}

Field	Required	Default	Description
type	yes	none	Must be review_package.
enabled	yes	false	Must be true; this keeps the sink fail-closed unless explicitly selected.
directory	yes	none	Root directory where package directories are placed.
duplicate_policy	no	skip_existing	skip_existing treats redelivery after a prior package commit as success. fail rejects duplicates.
include_payload	no	true	Writes payload bytes as payload.bin when enabled.
max_payload_bytes	no	16777216	Maximum payload size accepted into one package.
fsync	no	true	Flush files and directory entries before reporting success.
pretty	no	true	Pretty-print JSON evidence files.

Package Layout

Each message maps to a deterministic package directory derived from the message idempotency key. Package names do not use the subject or payload.

pkg-<deterministic-id>/
  manifest.json
  metadata.json
  payload.bin
  mission_metadata.json
  security_labels.json
  data_quality.json
  artifact_references.json
  custody.json
  hashes.json

Files are present only when the corresponding envelope field exists. The sink writes into a temporary directory, flushes evidence files, then atomically renames the directory into place. write_batch(...) returns only after all package directories for the batch have been durably placed.

Operational Notes

• Keep package roots protected with filesystem permissions and disk encryption appropriate to the data being handled.
• Prefer duplicate_policy: "skip_existing" for at-least-once redelivery.
• Keep fsync: true for production custody paths.
• Use payload encryption and security-label profiles where required before events reach this sink.
• Treat generated packages as evidence awaiting external review, not as proof of release approval.

Testing

The unit test suite validates package creation, deterministic package IDs, duplicate handling, path safety, payload-size failure cleanup, and package hash evidence. The review package writer does not require live NATS or live database services for local tests.