flightops sources imports explicitly selected UTF-8 .txt, .md and .json files. It never recursively discovers company content or connects a provider. Imported prose is an inert source claim. It cannot verify a repair, change a fixed evaluator, promote a procedure or grant permission to execute commands.
Example (paths relative to the chosen root):
flightops sources import --root /work/owned-notes \
--rights-review 'Ownership and retention reviewed by the project owner' notes.md
flightops sources list
flightops sources show ITEM_ID
flightops sources read ITEM_ID --revision SHA256 --start 1 --end 8
flightops sources refresh ITEM_ID
flightops sources revoke ITEM_ID --reason 'Owner withdrew retention'
flightops sources delete ITEM_IDThe import action explicitly grants local capture and retention for the selected files. Inference, sharing and training are separately denied by default. An accountable owner may use --allow-use inference|share|train for a separately reviewed permission; this records a use decision, not evidence of legal clearance or authorization to run training. Reimporting the same revision preserves its original policy. Use permissions are checked again on every selection, including upstream policies and current caller authorization. The command-line interface is an explicit local owner action, not a remote authentication boundary.
Each source identity binds its root and relative path. Each revision identity binds that source identity and its SHA-256, so equal bytes with different rights remain distinct. Immutable source-use policies and evidence receipts live in the shared catalog. Current revision pointers and acquisition/withdrawal events use additive owned-source tables. A source edit appends a revision; reverting bytes can move the current pointer back without rewriting history. Deleted originals become unavailable on explicit refresh. There is no background synchronization.
Imports accept at most 32 selected files, 1 MiB each and 16 MiB per request; the store admits at most 1,000 revisions. Symlinks and paths outside the selected root are refused. Selected line ranges and JSON fields are at most 32 KiB. A secret pattern check is a precaution, not clearance. No provider credentials are stored. Each item commits independently; a later import failure does not erase an earlier successful selected item. Retry is idempotent for unchanged source revisions.
Withdrawal blocks current derived use through native upstream policy, removes adapter-owned copies and clears source path/title metadata from the current item. Historical fingerprints and permitted audit tombstones remain. The original source file is never deleted. Interrupted purges remain purge_pending, with reads blocked; the CLI retries authorized cleanup on the next operation. Service callers use reconcile_withdrawals(authorize=...) explicitly.
Retained copies belong to the selected database's sibling .sources directory. Metadata backups do not silently copy these payloads. Restored source metadata must be treated as unavailable until a selected authorized import supplies the bytes; original paths are not an implicit restore source. Explicit owned-source backup exclusion integration is tracked alongside the recording backup work. No live-only provider route, account connector or actual company-data acceptance is claimed for owned-file sources.