{"version":"2.1.251","anchor":"publish-re-verifies-a-file-s-identity-after-opening-it","canonical_anchor":"publish-re-verifies-a-file-s-identity-after-opening-it","heading":"Publish re-verifies a file's identity after opening it","tier":"internal","area":"Artifacts","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251\/e\/publish-re-verifies-a-file-s-identity-after-opening-it","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251","markdown":"### Publish re-verifies a file's identity after opening it\n\nIn confined evaluation runs, publishing re-checks a file's identity before reading it.\n\n**What**\n\nIn confined evaluation runs, publishing an artifact from a local file now re-opens the file by descriptor and confirms it is not a symlink, has exactly one hard link, and still has the inode and device seen earlier, before reading any bytes. A mismatch throws `source_unverified`.\n\n**Details**\n\n- Closes the window between checking a file and reading it, where the path could be swapped.\n- Only runs when `CLAUDE_CODE_EVAL_CONFINED` is set; otherwise the file is read directly as before.\n\n**Evidence**\n\n`a.CLAUDE_CODE_EVAL_CONFINED`\n\n- Area: Artifacts\n- Names: `CLAUDE_CODE_EVAL_CONFINED`\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 3\/5"}