Skip to content

Tags: Design

  • Go 1.27 TLS Defaults and OIDC Discovery Failure Modes

    In Design

    DesignTLSOIDCOperations

    Go 1.27 TLS Defaults and OIDC Discovery Failure Modes

    After SILO’s toolchain moved to Go 1.27, the Server TLS repair 48e184652 (“fix(tls): honor Go key exchange defaults across transports”) removed its explicit curve overrides. This page records the TLS changes and the diagnostic method for OIDC …

    After SILO’s toolchain moved to Go 1.27, the Server TLS repair 48e184652 (“fix(tls): honor Go key exchange defaults across transports”) removed its explicit curve overrides. This page records the TLS changes and the diagnostic method for OIDC …

  • Request-Header Deadlines: Absolute Header Limits and Rolling Body Idle Timeouts

    In Design

    DesignHTTPS3Review

    Request-Header Deadlines: Absolute Header Limits and Rolling Body Idle Timeouts

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • Replica Metadata Normalization: What a Trusted Copy May Not Re-Inject

    In Design

    DesignReplicationS3Review

    Replica Metadata Normalization: What a Trusted Copy May Not Re-Inject

    This page records the repair of how a trusted replication receiver restores metadata for a replica, merged into Server main as PR #194 (fix 4fcdf37ce, merged as 9f3037e941). As of 2026-09-16: the fix is on verified main 40220bd836cb. It is not in the …

    This page records the repair of how a trusted replication receiver restores metadata for a replica, merged into Server main as PR #194 (fix 4fcdf37ce, merged as 9f3037e941). As of 2026-09-16: the fix is on verified main 40220bd836cb. It is not in the …

  • Replicated Tag Ordering: Revision Timestamps, Tombstones, and Resurrection

    In Design

    DesignReplicationS3Review

    Replicated Tag Ordering: Revision Timestamps, Tombstones, and Resurrection

    This page records the analysis and repair of two defects in how object tags keep their ordering across replication, merged into Server main as PR #193 (fix 03027727d) and PR #196 (fix 680eac66e). As of 2026-09-16: both fixes are on verified main …

    This page records the analysis and repair of two defects in how object tags keep their ordering across replication, merged into Server main as PR #193 (fix 03027727d) and PR #196 (fix 680eac66e). As of 2026-09-16: both fixes are on verified main …

  • SSE-C Replica Integrity

    In Design

    DesignS3Operations

    SSE-C Replica Integrity

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • Object Lock Replication Ordering

    In Design

    DesignS3Operations

    Object Lock Replication Ordering

    Release boundary, 2026-09-16: f4c1286c9 shipped in Server 20260903. The later timestamp-only removal, SSE-C retransmission and cross-pool repairs in #129, #134 and #178 are on main and not in that release. The advisory ledger records the original …

    Release boundary, 2026-09-16: f4c1286c9 shipped in Server 20260903. The later timestamp-only removal, SSE-C retransmission and cross-pool repairs in #129, #134 and #178 are on main and not in that release. The advisory ledger records the original …

  • Multi-Pool Object Consistency

    In Design

    DesignS3Operations

    Multi-Pool Object Consistency

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • Federated CopyObject: Preserve the Destination Contract

    In Design

    DesignS3Operations

    Federated CopyObject: Preserve the Destination Contract

    Source status, 2026-09-16: this records the main-branch CopyObject fixes in #157, #159, #163, #177 and #179. They are absent from Server 20260903. The subject is the legacy etcd bucket-federation path that forwards a copy to another deployment as …

    Source status, 2026-09-16: this records the main-branch CopyObject fixes in #157, #159, #163, #177 and #179. They are absent from Server 20260903. The subject is the legacy etcd bucket-federation path that forwards a copy to another deployment as …

  • Durable IAM Revocations

    In Design

    DesignS3Operations

    Durable IAM Revocations

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • Bucket Configuration Replication: Source Times, Deletions, and Deterministic Convergence

    In Design

    DesignReplicationS3Review

    Bucket Configuration Replication: Source Times, Deletions, and Deterministic Convergence

    #77 is a reproduced site-replication correctness defect. A receiver replaces source time with arrival time and may then reject a genuinely newer deletion. Some configuration types stop exporting their timestamp after deletion, preventing heal from …

    #77 is a reproduced site-replication correctness defect. A receiver replaces source time with arrival time and may then reject a genuinely newer deletion. Some configuration types stop exporting their timestamp after deletion, preventing heal from …

  • Replication Reliability: Delete Completion, MRF Visibility, and Resync Cancellation

    In Design

    DesignReplicationS3Review

    Replication Reliability: Delete Completion, MRF Visibility, and Resync Cancellation

    This page records the analysis, design choices, review, and implementation of #153, #152, and #137. They belong to the same replication reliability series, but affect operation classification, recovery visibility, and task lifecycle respectively. One …

    This page records the analysis, design choices, review, and implementation of #153, #152, and #137. They belong to the same replication reliability series, but affect operation classification, recovery visibility, and task lifecycle respectively. One …

  • An Unsigned Header Is Not Part of the Request

    In Design

    DesignSecuritySigV4CopyObjectPresignedCompatibility

    An Unsigned Header Is Not Part of the Request

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • SILO Server 20260903 Pre-release Review

    In Design

    DesignReviewSecurityCompatibilityRelease

    SILO Server 20260903 Pre-release Review

    This is the durable pre-release engineering record behind SILO 20260903. It explains why an earlier “all issues are solved” assessment was not accepted at face value, what the independent review found, how the fixes were narrowed, and which gates …

    This is the durable pre-release engineering record behind SILO 20260903. It explains why an earlier “all issues are solved” assessment was not accepted at face value, what the independent review found, how the fixes were narrowed, and which gates …

  • No I/O Before Auth, No Privilege From Headers

    In Design

    DesignSecurityCORSReplicationSSE-CCompatibility

    No I/O Before Auth, No Privilege From Headers

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

  • ListMultipartUploads: Implementation, Upgrade Contract and Design History

    In Design

    DesignS3CompatibilityMultipart

    ListMultipartUploads: Implementation, Upgrade Contract and Design History

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • Read-Only Checksum Audit and Reliable CLI Output

    In Design

    DesignS3CompatibilityChecksummcli

    Read-Only Checksum Audit and Reliable CLI Output

    This is the design and implementation record for MCLI’s read-only checksum verification workflow and pgsty/mc#5, the non-TTY output defect found during release review. Status: shipped in the final mcli 20260903 release. The command merged to main …

    This is the design and implementation record for MCLI’s read-only checksum verification workflow and pgsty/mc#5, the non-TTY output defect found during release review. Status: shipped in the final mcli 20260903 release. The command merged to main …

  • Two SSE-C Keys, One CopyObject Response

    In Design

    DesignS3SSE-CChecksumCompatibility

    Two SSE-C Keys, One CopyObject Response

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

  • Config Environment Files Are Not Shell Scripts

    In Design

    DesignConfigurationCompatibilityOperations

    Config Environment Files Are Not Shell Scripts

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

  • BadDigest, InvalidRequest, and the CompleteMultipartUpload Checksum Contract

    In Design

    DesignS3CompatibilityChecksum

    BadDigest, InvalidRequest, and the CompleteMultipartUpload Checksum Contract

    The repairs for #48 and #50 are included in Server 20260903. This record supersedes the August proposal to leave CRC64NVME canonicalization unchanged. Why validation belongs at completion Initiation selects the checksum algorithm and object type; …

    The repairs for #48 and #50 are included in Server 20260903. This record supersedes the August proposal to leave CRC64NVME canonicalization unchanged. Why validation belongs at completion Initiation selects the checksum algorithm and object type; …

  • A ListObjects Shortcut Must Not Turn a Missing Bucket into an Empty One

    In Design

    DesignS3CompatibilityListObjects

    A ListObjects Shortcut Must Not Turn a Missing Bucket into an Empty One

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

  • One Endpoint, Two Privileges: Separating User and Group Status

    In Design

    DesignIAMSecurityCompatibility

    One Endpoint, Two Privileges: Separating User and Group Status

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

  • Conditional DELETE: One Condition, One Logical Object

    In Design

    DesignS3CompatibilityDELETE

    Conditional DELETE: One Condition, One Logical Object

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

    Publication update, 2026-09-17: The September source repairs discussed here shipped in Server 20260916. Coordinated upgrades, opt-in prerequisites and remaining limitations still apply. Dated source-status and validation records below retain their …

  • Why CompleteMultipartUpload Must Return ChecksumType: Review of PR #57

    In Design

    DesignS3CompatibilityChecksum

    Why CompleteMultipartUpload Must Return ChecksumType: Review of PR #57

    PR #57, contributed by Shooks (@Dansyuqri), fixed #47. The repair is included in Server 20260903. This records the response contract; production deployment remains specific to the artifact and installation an operator actually runs. The defect and …

    PR #57, contributed by Shooks (@Dansyuqri), fixed #47. The repair is included in Server 20260903. This records the response contract; production deployment remains specific to the artifact and installation an operator actually runs. The defect and …

  • Optional Checksums, Mandatory Failure: Repairing UploadPart and UploadPartCopy Compatibility

    In Design

    DesignS3CompatibilityChecksum

    Optional Checksums, Mandatory Failure: Repairing UploadPart and UploadPartCopy Compatibility

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

  • When the Total Is Unknown: Folder Download Progress

    In Design

    DesignconsoleDownload

    When the Total Is Unknown: Folder Download Progress

    Historical scope: this is the Console 2.2.0 progress repair, included in Server 20260903’s embedded Console. Console 2.4.1 subsequently added file streaming and native browser handoff, eliminating the complete JavaScript ZIP Blob. Transport …

    Historical scope: this is the Console 2.2.0 progress repair, included in Server 20260903’s embedded Console. Console 2.4.1 subsequently added file streaming and native browser handoff, eliminating the complete JavaScript ZIP Blob. Transport …

  • Preview Text, Never Execute It: SILO Console Text Preview PRD

    In Design

    DesignconsolepreviewSecurity

    Preview Text, Never Execute It: SILO Console Text Preview PRD

    Status: shipped in SILO Console 2.2.0 · Owner: pgsty/silo-console · Tracking: pgsty/silo#17 · Review: consensus of product, security, and frontend architecture reviews SILO Console can preview images, PDFs, audio, and video, but not the small logs, …

    Status: shipped in SILO Console 2.2.0 · Owner: pgsty/silo-console · Tracking: pgsty/silo#17 · Review: consensus of product, security, and frontend architecture reviews SILO Console can preview images, PDFs, audio, and video, but not the small logs, …

  • DSN-Only Database Notifications: A Compatibility Boundary for #53

    In Design

    DesignNotificationCompatibility

    DSN-Only Database Notifications: A Compatibility Boundary for #53

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …

    Release check (2026-09-16): the original repair described here is included in Server 20260903. Dated review and test accounts below record their original evidence, not a still-pending release or acceptance of a particular production installation. …