21 lines
1.2 KiB
Markdown
21 lines
1.2 KiB
Markdown
# ARR guarded object storage
|
|
|
|
`ManagedObjectStore` owns an immutable staged-to-committed workflow for source and generated artifacts. Canonical keys
|
|
contain only opaque job/attempt identity and role-controlled filenames; user filenames never enter object keys.
|
|
|
|
Every object carries job, attempt, state, role, SHA-256, exact byte size and MIME metadata. Upload snapshots and hashes
|
|
the local file, conditionally creates a staged object, conditionally copies to the committed key, verifies committed
|
|
bytes, and deletes only the exact staged object.
|
|
|
|
ARR2 OSS requirements:
|
|
|
|
- configured region matches the bucket and server-side encryption is enabled;
|
|
- versioning is neither Enabled nor Suspended;
|
|
- bucket ACL is `private` or `public-read`, never `public-read-write`;
|
|
- every ARR-managed object is explicitly written with object ACL `private`;
|
|
- credentials come from the SDK environment/RAM/STS chain and ambient desktop proxies are disabled.
|
|
|
|
The active flow materializes the committed source into a private temporary directory before processing. No public URL,
|
|
Provider, fetch grant or external downloader is used. Legacy grant/output-exchange modules remain inactive compatibility
|
|
code.
|