> For the complete documentation index, see [llms.txt](https://docs.cortex.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortex.aic.io/workflow-guides/collection/ingest.md).

# Ingest

Acquire authorised material with its source and requirement context, then inspect real extraction and deliberate suggestion review.

**Who uses this:** Collector, Analyst.\
**Open in CORTEX:** `/ingest/new`.\
**In-app guide:** `/help?topic=ingest`.

**Expected result:** The acquisition retains original bytes and provenance, with a visible processing outcome and any reviewed suggestions.

## Before you start

* Have Ingest enabled, upload and Memory access, and access to the selected requirement and source.
* Use the current reviewed active source revision, authorised for ingestion against the exact current requirement and acquisition time.
* Prepare one nonempty supported TXT, CSV, JSON, PDF or DOCX file no larger than 10 MiB; know its actual acquisition context.

## What to do

{% stepper %}
{% step %}

## Select the acquisition context

Open Acquire material. Before entry, check the visible requirement, active source and exact ingest authority prerequisites.

Select the requirement and source; CORTEX checks the current source-use case for their versions, handling and acquisition time.

The authority case link leads to the approval workflow if the check fails. A narrowed search can hide a valid record.
{% endstep %}

{% step %}

## Preserve the material

Continue to Original material after the prerequisite step is ready.

* Enter a 3–200 character title.
* Select one supported original file.
* Record its actual UTC acquisition time.
* Add 10–2,000 character provenance notes.
* If a separate visible duplicate exists, provide a 10–500 character reason.

Required fields and step status update as you enter data.

Select **Preserve original and acquire material** once. If you go back to change the source, choose the file again.
{% endstep %}

{% step %}

## Inspect the stored outcome

Open material detail and use **Refresh stored state**.

Check:

* Filename
* Byte length
* Original SHA-256
* Source and requirement pins
* Scan policy
* Processing state

Queued or Processing does not mean extracted; quarantine does not mean clean.
{% endstep %}

{% step %}

## Review the extraction

When Ready, select the derivative version and inspect its segment locators, plain text and warnings against the source.

Suggestions from that access-checked extraction are shown 25 at a time. **Previous** and **Next** select the first suggestion on the new page.

Choose accept, reject or correction with a rationale and select **Save suggestion review**. The service rechecks:

* Processing review authority
* Current access
* Scan state
* Material version
* Candidate identity

Original parser values remain retained.

If the form is read only, follow Read access guidance and ask an authorised access administrator to inspect your material and suggestion review permission (`process.review`).
{% endstep %}

{% step %}

## Use recovery controls deliberately

If authorised and policy permits, supply a reason to **Cancel current processing** or **Queue scan and processing**.

Reprocessing preserves old derivatives and citations.

Inspect a failure or interrupted acquisition before creating another upload.
{% endstep %}
{% endstepper %}

## Check the result

* Is the source authority valid for this requirement and actual acquisition time?
* Does handling cover both source and requirement?
* Do the stored original details match the intended file?
* Have I read warnings and compared important extracted passages?
* Am I distinguishing suggestion review from an analytical conclusion?

## If you get stuck

<details>

<summary>Why did authority stop an upload?</summary>

The source needs an attached current authority case and approved processing purpose for the exact source, requirement and acquisition time.

Cancellation, suspension, expiry or a changed scope prevents new acquisition.

Checks run before bytes are read and before duplicate results are returned.

If authority changes after storage, the interrupted upload retains its original and is not queued; inspect its state before retrying.

</details>

<details>

<summary>What changes after a scanner update?</summary>

The operator installs a reviewed signed scanner bundle.

A changed policy or signature identity can make an earlier clean receipt unsuitable for new use.

Refresh the stored state and, when permitted, queue scanning again with a reason.

Earlier attempts and citations remain retained; changing the scan policy is not a way to release held material.

</details>

<details>

<summary>Why is the file quarantined and unavailable for processing?</summary>

Read its scan state. RequiredUnavailable means no current clean verdict authorises use.

Inspect Malware scan history and the stored failure.

Outages and timeouts retry up to three times durably; after the operator resolves the issue, an authorised analyst can **Queue scan and processing** with a reason.

Detected threats cannot be released in the UI.

Downloads, new citations and generation require current approval.

</details>

<details>

<summary>Why did parsing fail or produce limited text?</summary>

Inspect the controlled failure and extraction warnings.

Check the real file format and supported text content; automatic OCR, translation and transcription are not enabled.

Human interpretations and translations can be retained and independently reviewed alongside exact original passages.

Ask the operator about persistent parser failures before deliberate reprocessing.

</details>

<details>

<summary>Why did upload conflict after I selected the source?</summary>

The source review or requirement may have changed.

Reload and deliberately reselect the approved current versions.

If an interrupted acquisition already exists, inspect it before retrying so original material is not obscured by duplicates.

</details>

## Responsibility and limits

* The operator supplies truthful acquisition context and checks source-use rights; a file extension or hash cannot establish safety or legality.
* Required scanning checks the exact retained bytes against the configured local ClamAV engine and signature identity. Expired policy, unknown outcomes, outages and detected threats remain held. Read the scan receipts; only the service can record a verdict.

**Reference and scope:** Implementation guidance supporting processing and provenance in JDP 2-00 (4th ed.), 3.35–3.38 and 5.26. Extraction is not analyst interpretation or automatic acceptance.

## Related workflows

* [Record and review external collection authority](/workflow-guides/collection/authority-cases.md)
* [Record processing purposes and privacy applicability](/workflow-guides/assurance/processing-activities.md)
* [Record authority before new source use](/sources-and-evidence/source-authority.md)
* [Find evidence and select exact retained passages](/sources-and-evidence/memory.md)
* [Interpret, translate and cite exact evidence passages](/sources-and-evidence/interpretation.md)
* [Work through connection and deployment limits](/workflow-guides/assurance/offline.md)