Bound remote asset content verification

docs/integrations/gitea.md

@@ -89,6 +89,8 @@ Attachment downloads and redirects carry the Gitea authorization token only
 when their scheme, host, and port match the configured service. Cross-origin
 content is downloaded without that token and verified by its digest. Downloads
 follow at most ten redirects; an additional redirect is unverifiable.
+Comparison reads no more than the declared local size plus one byte; shorter
+or longer content conflicts, regardless of the server's reported size.
 
 Shared delivery uploads only after inspection finds no conflicts or
 unverifiable assets. It uploads missing binaries in filename order and then the

docs/roadmap/implementation.md

@@ -48,7 +48,7 @@ the agent policy; an intermediate compilation dependency is recorded accurately.
 | 10 | A07: allocation and temporary metadata | Complete — allocation resolution, joined cleanup causes, tag evidence, and receipt installation checks passed. |
 | 11 | A07: build and delivery outcomes | Complete — managed and native cleanup tests cover success, failure, cancellation, hosted completion, and CLI reporting. |
 | 12 | A08 | Complete — redirect boundary, origin authorization, cycle, and delivery outcome tests passed. |
-| 13 | A09 | Pending |
+| 13 | A09 | Complete — bounded reads, size and digest mismatches, stream failures, cancellation, reconciliation, and public prebuilt delivery checks passed. |
 | 14 | A10 | Pending |
 | 15 | A13 | Pending |
 | 16 | A15 | Pending |