Modules
ExStorageService - An S3-compatible object storage server.
Behaviour for durable, content-addressed blob storage.
Durable local content-addressed blob storage.
Bounded tee-to-local repair for full remote blob streams.
A durable local blob ready to be referenced by object metadata.
A servable blob source.
Bytes written to a temporary file but not yet published in the local CAS.
Validates S3 bucket names and filesystem path segments.
HTTP client for S3-compatible cloud storage (AWS S3, Cloudflare R2, MinIO, S3-compatible).
Per-bucket cloud cache configuration backed by Concord KV.
Local read-cache for cloud-backed buckets.
Immutable identity and desired durability for a content-addressed blob.
Verifies that a cluster data node can satisfy its configured write quorum.
Node-drain control and bounded, derived progress reporting.
Role-aware liveness and readiness checks.
Persistent cluster-node registration and exact configured membership reads.
Persistent control-plane identity for one configured cluster member.
Registers one persistent node generation after Concord becomes available.
Polls durable outbox pages and executes fenced jobs with bounded concurrency.
Supervises one instance's durable outbox dispatcher and bounded tasks.
Pure deterministic rendezvous placement for immutable blob hashes.
Selects a checksum-valid local or remote source for one committed blob.
Quorum-backed Concord readiness checks.
Idempotent execution for repair and excess-replica cleanup jobs.
Pure placement reconciliation plus bounded, deterministically owned scans.
Evidence that one node durably stored and verified a blob.
Generates and validates opaque request IDs for authenticated cluster traffic.
Streams one local blob representation through SHA-256 verification.
Maintains distributed Erlang connections to an explicit static seed list.
Sanitized cluster status boundary.
Aggregates topology-fenced repair-owner snapshots and durable maintenance jobs.
Builds the discovery children for the configured cluster topology.
Content-addressed transport contract for blob operations between cluster nodes.
Establishes durable blob quorum before object metadata becomes visible.
Immutable runtime context for one locally supervised storage instance.
Configuration for eventual external S3 disaster-recovery targets.
One eventual external replication target.
Idempotent handlers for eventual external-replication jobs.
Builds deterministic eventual-DR events for object metadata transactions.
Anti-entropy sync GenServer that periodically compares local objects with remote replicas and reconciles differences.
Streams immutable object versions to external S3-compatible replicas.
IAM Access Key management backed by Concord key-value store.
IAM Audit logging backed by Concord key-value store.
IAM Policy engine backed by Concord key-value store.
IAM User management backed by Concord key-value store.
Validated configuration for one storage instance.
Supervises the local data-plane services for one storage instance.
Metadata operations backed by Concord key-value store.
Storage boundary used by atomic object metadata operations.
Concord implementation of the object metadata backend.
Bounded, typed access to v2 blob descriptors.
Strongly reads blob-location evidence and records read-path failures.
Fences local physical deletion against concurrent object publication.
Durable job persistence with atomic lease and fencing transitions.
Unambiguous version 2 metadata keys.
Non-destructive, resumable migration from legacy object metadata to v2.
Metadata descriptor for content-addressed object bytes.
Durable evidence that one node has a checksum-verified blob.
Persistent cluster control-plane record.
Typed boundary for one durable, fenced background job.
Mutable pointer to the latest immutable object version.
Immutable metadata for one logical object version.
Durable operation outcome used to resolve an ambiguous transaction timeout.
Durable protection for bytes that may be referenced by an unresolved write.
Atomic multipart-part publication for the cluster data plane.
Atomic v2 object metadata commits.
Atomic pre-commit intent and per-hash GC protection.
Materializes committed outbox events into durable, independently leased jobs.
Read-only inventory of legacy and v2 metadata records.
Prometheus-style metrics collection using ETS counters.
Stable local process names for storage instances.
Webhook-based bucket event notifications.
Coordinates object metadata with durable blob storage.
Read-only blob location and bounded durability audit operations.
Operator-facing cluster bootstrap and status operations.
Operator-facing node drain controls and bounded progress reads.
Bounded repair planning and durable repair-run operations.
Compatibility facade for external S3 disaster-recovery configuration.
Compatibility replica struct.
Compatibility facade for eventual cross-cluster replication hooks.
Compatibility facade over the fenced v2 durable outbox.
Compatibility view of a v2 durable job.
Compatibility facade for ExStorageService.CrossClusterReplication.Sync.
Compatibility facade for external S3 replication.
Global content-addressable blob store under the reserved cas/ root.
Garbage collector for the global content-addressable store.
Background process that periodically scans for unreferenced content files and removes them to reclaim disk space.
Storage engine facade over the global content-addressable store
(ExStorageService.Storage.CAS).
GenServer that periodically evaluates lifecycle rules for buckets.
Immutable, content-addressed manifests describing multipart objects.
One-shot migration of legacy bucket-local content files
({data_root}/{bucket}/objects/...) into the global CAS
({data_root}/cas/objects/sha256/...).
Multipart upload storage operations.
Garbage collector for stale multipart uploads.
Immutable, content-addressed pack files for cold blobs.
Cold-storage policy for the global CAS (PRD §20 Phase 6).
Compatibility facade for bucket versioning.
Telemetry event definitions and helpers for S3 and cluster operations.
Mix Tasks
Audits one bounded page of cluster blob durability metadata without writing
Shows the immutable descriptor and recorded locations for a SHA-256 hash
Waits for Concord readiness and persistently registers the configured node
Shows sanitized Concord, configured membership, and durability status
Migrates legacy object metadata without deleting or modifying v1 records
Prints a read-only, paginated inventory of legacy and v2 metadata
Moves all content files referenced by object metadata from the legacy bucket-local layout into the global CAS. Run with the service stopped or in maintenance mode
Persistently marks a data node as draining
Shows one bounded page of node-drain progress
Previews one locally owned repair-shard page without enqueueing work
Enqueues one locally owned repair-shard page through the durable outbox