# Object Storage Batch D Checkpoint

- Date: 2026-07-28
- Branch: `codex/objectstorage-production-capability`
- Worktree:
  `/home/donghyeon/workspace/clean-architecture-backend-template-objectstorage`
- Scope: direct-transfer provider/application primitives only
- Public endpoint: none
- Readiness advanced: no; all direct cards remain R0

## Implemented scope

- Added direct single-upload session policy, durable prepared/issued transitions, bearer
  redaction, exact completion verification, published-version download resolution, and an
  S3-presigner lifecycle owned by the selected provider.
- Added direct multipart durable session and part-grant families, opaque acknowledgement tokens,
  sharded part records, admission-close/expiry fencing, exact ledger validation, completion/abort
  states, response-loss resolution, and persisted terminal exact-version replay.
- Added direct S3 initiate/discovery, exact-part presign, `ListParts` acknowledgement, conditional
  complete followed by exact HEAD verification, and abort resolution.
- Registered direct single and multipart delegates only when their exact compiled capability is
  selected. One presigner is constructed and closed exactly once.
- Added golden canonical envelopes for the direct session, direct multipart session, and direct
  multipart grant families.
- Fixed `MultipartCompleteRequest` null validation so valid immutable `List.of(...)` input no longer
  throws from `contains(null)`.

## Qualification truth

The exact MinIO release cannot prove create-only PUT or create-only multipart completion, so both
direct profiles are explicitly `UNSUPPORTED`. The direct MinIO contract/fault lanes are negative
admission tests: they prove no bearer or multipart mutation enters an unsupported profile. No test
skip is used as positive evidence.

The AWS managed/direct source sets compile, but no AWS call was made and no AWS evidence row was
published. No inbound controller, authorization surface, CORS runtime configuration, or public
direct API exists.

## Verification

Commands completed with `BUILD SUCCESSFUL`:

```bash
cd src
./gradlew :adapter:outbound:objectstorage:test \
  --tests '*DirectTransferCoordinatorTest' \
  --tests '*PresignedGrantRedactionTest' \
  --tests '*S3DirectTransferProviderTest' \
  --tests '*ObjectControlRecordCodecTest' \
  --tests '*S3ProviderCompositionTest' --console=plain
./gradlew :adapter:outbound:objectstorage:test \
  --tests '*DirectMultipartCoordinatorTest' \
  --tests '*DirectMultipartRaceTest' \
  --tests '*S3DirectMultipartProviderTest' \
  --tests '*ObjectControlRecordCodecTest' \
  --tests '*S3ProviderCompositionTest' --console=plain
./gradlew \
  :adapter:outbound:objectstorage:objectStorageMinioContractTest \
  :adapter:outbound:objectstorage:objectStorageMinioFaultTest \
  --tests '*DirectTransfer*' --console=plain
./gradlew :adapter:outbound:objectstorage:test \
  --tests '*DirectTransferCorsContractTest' --console=plain
./gradlew :adapter:outbound:objectstorage:objectStorageAwsQualificationTestClasses --console=plain
./gradlew :adapter:outbound:objectstorage:check --console=plain
./gradlew :adapter:outbound:objectstorage:verifyDependencyLocks \
  verifyCleanArchitectureDependencies --console=plain
./gradlew \
  :adapter:outbound:objectstorage:objectStorageMinioContractTest \
  :adapter:outbound:objectstorage:objectStorageMinioFaultTest --console=plain
bash ../.github/scripts/verify-gate-matrix.sh
./gradlew test --console=plain
./gradlew check --console=plain
```

The module `check` includes unit tests, Checkstyle, Spotless, SpotBugs, architecture, configuration
processor, environment-key, and repository-wide policy checks. Existing test-only compiler
warnings remain non-failing. The final repository-wide test run completed 79 tasks and the final
repository-wide check completed 214 tasks.

## Deliberate limitations

- Issued bearer material is process-local. A restart fails closed instead of reconstructing or
  reissuing an already-issued bearer.
- The signing clock/window is stored and bounded, but AWS SDK presigner query timing is not driven
  by the injected application clock.
- The direct multipart recovery/race matrix covers its principal fences and completion response
  loss but is not exhaustive enough for an R2 claim.
- Retention/Object Lock grant headers and a provider-enforced direct-single hard size ceiling are
  not qualified.
- No public endpoint exists, so CORS evidence is a pure contract and no direct card may exceed R0
  in the current registry.

## Approval Gate A

Tasks 20–24 remain blocked until the user explicitly approves scanner ownership, the sample's
first publication profile, the additive asynchronous API/status contract, and digest transport.
No scan/publication/sample endpoint implementation was started.

## LLM Wiki capture

The canonical vault `/home/donghyeon/workspace/ai-tool/llm-wiki-private/` and its parent
`/home/donghyeon/workspace/ai-tool/` do not exist in this environment. The required
`raw/branch-notes/codex-objectstorage-production-capability.md` and derived raw documents could not
be created or updated. No similarly named non-canonical clone was used.