A sources.lock.json beside the rater root records each Source’s name,
artifact, required sha256 (64 lowercase hex digits), and media, plus
optional pages, title, and edition. The pin is artifact plus hash; omit
version UUIDs. Vault keeps its version history independently.
Use rslr sources add document.pdf, then declare the returned local artifact ID
in Sources, and run rslr sources lock rater.rsl. lock preserves existing
pins; update moves them to the local store’s newest bytes. check verifies
stored content against its hash. The local .rsl cache supports offline work.
A locally minted ID identifies local files; Vault registration supplies its own file ID.
Export validates a present lock and carries it into the catalog, which is part
of the bundle identity. Locking remains optional; existing unlocked raters keep their behavior.
Locks with the earlier unpublished version field must remove it; the parser
rejects unknown fields and still requires sha256 offline.
For registered Vault files, integrations can fetch exact bytes with
GET /api/v2/files/{artifact}/download?sha256={sha256} using their normal
credentials. A missing registration fails; keep the hash on every retry.
The download response identifies the selected version and its size/media type.
Automatic remote fetching, citation viewer wiring, and retention are separate
from the local compiler workflow described here.
