If there is "an operator's input during the download of the component[," then how will they know what the input was? How will they know what the last download actually looked like?
If the operator gets hit by a truck, who will know how to recreate the latest and greatest? What happens if the operator becomes disgruntled and decides to cause some damage by inputting malevolent code? (Had an argument with the boss, or was laid off/fired, or bad-hair day, or wife left him, or any other such thing)
Back to file names:
You don't mention what app (tool) you are using as a repository. However, most, if not all, have a provision for labelling files. That is the location I would use to identify the attributes. That is also where the folks would identify the change authorization - the one that said he/she could add an attribute. It's called change tracking.
Of course that results in more work, but that's part of the job, your's and their's.
So, you would have Config_foo_iter(ation)1.xml (labelled with) "attr1, authorized by Change Authorization (CA) 1 (or maybe JSmith email 20120425_1215pm)
Config_foo_iter2.xml: based on iter1 plus attr2 and attr3. Authorized by CA 2
Config_foo_ Etc.
That way, for each file, you know the attributes covered and who authorized incorporation of the new attributes.
The folks won't like it because it is a bit of extra work, but to do it the way they want will create chaos and you will lose application integrity before a lot of time passes.
