ManagedObjectStore owns an immutable staged-to-committed workflow for source and generated artifacts. Canonical keys contain only opaque job/attempt identity and role-controlled filenames; user filenames never enter object keys.

Every object carries job, attempt, state, role, SHA-256, exact byte size and MIME metadata. Upload snapshots and hashes the local file, conditionally creates a staged object, conditionally copies to the committed key, verifies committed bytes, and deletes only the exact staged object.

ARR2 OSS requirements:

configured region matches the bucket and server-side encryption is enabled;
versioning is neither Enabled nor Suspended;
bucket ACL is private or public-read, never public-read-write;
every ARR-managed object is explicitly written with object ACL private;
credentials come from the SDK environment/RAM/STS chain and ambient desktop proxies are disabled.

The active flow materializes the committed source into a private temporary directory before processing. No public URL, Provider, fetch grant or external downloader is used. Legacy grant/output-exchange modules remain inactive compatibility code.