> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Fetcher direct-mode integrity contract

> Direct-mode SHA-256 output detects accidental corruption but does not authenticate against tampering.

<Badge stroke icon="calendar-days" iconType="regular">August 17, 2026</Badge> <Badge stroke icon="file-code" iconType="regular">Documentation correction</Badge> <Badge color="yellow" size="lg" stroke icon="triangle-exclamation" iconType="regular">Review recommended</Badge>

## Affects

***

Teams that use the embedded Fetcher engine in direct mode without a `ResultSink`.

## What changed

***

Direct mode returns plaintext JSON with an unkeyed SHA-256 digest. The digest can detect accidental corruption, but it does not authenticate the payload against malicious alteration. Store-mode persistence and protection remain the responsibility of the host or sink; the standalone Worker manages encryption, storage, and HMAC.

This is a documentation correction. Runtime behavior did not change.

## Impact

***

**Classification: Review recommended.** Do not use the direct-mode digest as a tamper-evidence or authenticity control.

## What you need to do

***

Review any threat model or control that treats the direct-mode SHA-256 digest as authentication. Use an authenticated transport or a keyed integrity mechanism where tampering is in scope.

## Resources

***

* [What is Fetcher?](/en/products/about-products)