Private audio archives need creation-time permissions and chunk validation

A label-free audio archive needs two checks beyond final file modes and filename hygiene. Create every private output with exclusive mode 0600 from its first byte; writing with ambient permissions and tightening afterward leaves a transient disclosure window. Also validate the complete RIFF structure, allowing only the expected fmt and data chunks with an exact declared length. A playable WAV can carry metadata chunks or trailing bytes, so codec validation alone does not justify a label-free claim. Keep archive and receipt destinations distinct, require regular tar members, and verify a clean extraction byte-for-byte against the committed audio hashes.

Applies when: Packaging private WAVs into a deterministic archive whose receipt claims that labels or metadata are absent. Keywords: private WAV archive permissions RIFF metadata label-free deterministic tar