# ARR guarded object storage

`ManagedObjectStore` owns an immutable staged-to-committed workflow for source and generated artifacts. Canonical keys
contain only opaque job/attempt identity and role-controlled filenames; user filenames never enter object keys.

Every object carries job, attempt, state, role, SHA-256, exact byte size and MIME metadata. Upload snapshots and hashes
the local file, conditionally creates a staged object, conditionally copies to the committed key, verifies committed
bytes, and deletes only the exact staged object.

ARR2 OSS requirements:

- configured region matches the bucket and server-side encryption is enabled;
- versioning is neither Enabled nor Suspended;
- bucket ACL is `private` or `public-read`, never `public-read-write`;
- every ARR-managed object is explicitly written with object ACL `private`;
- credentials come from the SDK environment/RAM/STS chain and ambient desktop proxies are disabled.

The active flow materializes the committed source into a private temporary directory before processing. No public URL,
Provider, fetch grant or external downloader is used. Legacy grant/output-exchange modules remain inactive compatibility
code.