[E29-S02] Image processing job #113

New Issue

2026-08-27T00:03:24Z

kpcto commented

2026-08-27 00:03:24 +00:00

Parent epic: [E29] Media pipeline (#55)

Intent

Re-encode every accepted image into safe, sized derivatives before any byte is served, so public objects carry no metadata and originals never reach a browser.

Acceptance criteria

Re-encode every accepted image through a maintained imaging library before serving
Strip all metadata so EXIF, GPS and camera serial data never reach the public volume
Bake orientation in and then drop it so orientation is applied without metadata
Produce derivatives at widths 480, 800, 1200, 1600 and 2400 without upscaling
Emit AVIF and WebP per width plus one universal JPEG fallback
Never serve the original upload bytes to a browser
Emit width and height on rendered images so cumulative layout shift stays at zero

Explicitly out of scope

Upload validation and checksum de-duplication are covered by E29-S01
Video poster frames and transcoding decisions are covered by E29-S04

Test plan

Assert no EXIF, GPS or camera serial data survives in any public derivative
Assert derivatives exist at every applicable width without upscaling
Assert original upload bytes are never served to a browser

Rollback note

Delete public derivatives and reprocess from stored originals; no schema migration

Owning stream

platform

Risk quadrant

agent-full

> Parent epic: [E29] Media pipeline (#55) ## Intent Re-encode every accepted image into safe, sized derivatives before any byte is served, so public objects carry no metadata and originals never reach a browser. ## Acceptance criteria - Re-encode every accepted image through a maintained imaging library before serving - Strip all metadata so EXIF, GPS and camera serial data never reach the public volume - Bake orientation in and then drop it so orientation is applied without metadata - Produce derivatives at widths 480, 800, 1200, 1600 and 2400 without upscaling - Emit AVIF and WebP per width plus one universal JPEG fallback - Never serve the original upload bytes to a browser - Emit width and height on rendered images so cumulative layout shift stays at zero ## Explicitly out of scope - Upload validation and checksum de-duplication are covered by E29-S01 - Video poster frames and transcoding decisions are covered by E29-S04 ## Test plan - Assert no EXIF, GPS or camera serial data survives in any public derivative - Assert derivatives exist at every applicable width without upscaling - Assert original upload bytes are never served to a browser ## Rollback note - Delete public derivatives and reprocess from stored originals; no schema migration ### Owning stream platform ### Risk quadrant agent-full

kpcto added this to the Sprint M milestone 2026-08-27 00:03:24 +00:00

kpcto added the

labels 2026-08-27 00:03:24 +00:00

kpcto referenced this issue

2026-08-27 08:05:13 +00:00

[E29-S02-T01] Strip EXIF/GPS from public objects #305

kpcto referenced this issue

2026-08-27 08:05:14 +00:00