Implement native archive and model workflows (#74)

docs/assets.md

@@ -31,6 +31,29 @@ task material uploads use their two-stage capability contracts and require a
 complete response containing the new asset UUID. Upload size, cancellation, and
 timeout failures remove their pending correlation state.
 
+OAR and model workflows are native as well. The tar reader validates checksums,
+ustar paths, entry kinds, offsets, counts, nesting depth, per-entry size, and
+expanded size before exposing data. OAR output is sorted and uses fixed gzip and
+tar metadata, so identical asset, object, terrain, parcel, and settings trees
+produce identical bytes. Loading recognizes canonical `UUID_type.ext` asset
+names, bounded RAW32 terrain, and typed region-settings XML. Archive paths never
+escape their selected root, and symbolic or hard links are rejected.
+
+`GltfDocument` accepts bounded JSON glTF 2.0 and GLB 2.0 documents, resolves data
+URIs or caller-provided external buffers, validates buffer-view/accessor ranges,
+and decodes normalized scalar, vector, matrix, skin, and animation data. JSON and
+GLB output retain scenes, nodes, surfaces, materials, textures, skins, and
+animations in stable order; multi-buffer GLB output aligns and rebases views.
+Collada conversion applies declared units and up-axis orientation, resolves
+profile-COMMON effects and material bindings, triangulates triangles/quads, and
+confines referenced textures to the document directory. Mesh assets use stable
+quantization and LLSD section ordering.
+
+Model upload is deliberately opt-in. Offline resource/pricing payload generation
+does no network I/O; live preparation discovers the completed capability and
+inventory layers, includes real destination folders, permission masks, and the
+configured cost, then honors cancellation through both pricing and upload calls.
+
 The disk cache uses UUID-only filenames by default and confines custom filename
 callbacks to the configured cache directory. Reads reject empty, oversized, or
 non-regular files. Writes use uniquely named same-directory files, flush them,