[stephrobert]

Summary

One local S3 data plane, mounted on the port the emulator already serves, behind
a door per provider and region (/_feint/s3/<provider>/<region>/). Bytes are
written by internal/core/objectstore, which the core owns and no pack knows;
internal/s3 speaks the protocol; each pack declares only what its own API
publishes — the host its SDK builds, the region names it uses, and whether it
publishes an endpoint at all.

Three clients drive it end to end: the AWS CLI, octl against the OUTSCALE OOS
door, and Terraform. The bytes are compared by digest after a restart, which is
the only claim worth making about a store.

Alongside it, feint run (#849) lands a client whose cloud endpoint is compiled
in. It takes no hostname — that is the point, and the safety property: an
off-loopback target is unspellable. It reads the doors the running emulator
actually serves from /_feint/s3, mints a short-lived authority in a 0700
directory it verifies rather than creates, and hands the child four proxy
variables. feint doctor reports a leftover authority and decides by the owning
PID, so a run in flight is not reported as debris.

What the measurements decided, rather than taste

The hardcoded Scaleway Terraform path was called unreachable, and the premise
was wrong. Three documents said so. The reasoning was that redirection needs
DNS; it does not — an HTTP forward proxy receives the hostname in the client's
own CONNECT line. The old reasoning is kept in docs/limits.md under its own
heading, with the error named, because a limit that quietly disappears teaches
nothing. A witness now holds the claim:
TestScalewayTerraformStorageThroughFeintRunOnTheHostNetwork drives apply, a
second plan and destroy through feint run, and reads 139,264 identical bytes
back through the local door. It refuses to run inside a namespace rather than
pass vacuously.

An ETag is not served on simple PUT, and so there is no aws_s3_object in the
example stack. The object applies and its bytes land identical, but every
later plan wants to update it in place: the AWS provider compares the ETag a
read returns against filemd5. Serving one means persisting it, a v5 byte
format older binaries could not read. The choice was between that migration and
an example carrying a permanent diff, and a permanent diff in an example teaches
a reader that drift is normal here. Written down in
docs/object-storage-routing.md, not left implicit.

Two OUTSCALE discovery shapes are missing, and they are named.
GetBucketOwnershipControls and GetBucketTagging are unrecorded; the door
answers the two that are. No shape is invented here, so the gap is a written gap
rather than a guess.

What the repository's own gates caught, and what CI caught that they could not

• The byte store was armed in one conformance starter out of three. This is
  defect feat(account,images,conformance): a declared project catalogue, a resolve that only prints what boots, and every listen verdict waiting for the port it judges (#572, #476) #605 repeated exactly, so the fix is not three edits but
  TestEveryConformanceEmulatorArmsTheSameObjectStore, which now also joins the
  three --s3-doors lists and fails when they drift.
• The probe reported a fault where the emulator was refusing honestly. A
  disabled object store answered 503 and the probe read it as a defect. It now
  carries X-Feint-Not-Emulated (An Exoscale operation feint declines is refused with a bare 404 the official client reads as an ordinary empty answer: three refusals inside a fully green stack #477) and the probe skips a marked 5xx
  only — an unmarked 5xx is still a fault, and a marked 4xx is still a read
  refusal. Coverage was proved not to shrink: 100 operations probed armed
  against 98 unarmed.
• The SOS door was assumed rather than asked for, which broke the one job
  that runs the container as published, with no override. stacks.sh now
  queries /_feint/s3 and leaves the bucket out when no door answers — and the
  assertion keys off that answer, not off the variable being set.

The third one is the population trap this repository already documents: a
verdict about "this run" has to be proven on the poorest run that triggers
it. The poorest run here is the image job. The richest is the one on my own
desk, which is why the mistake was easy.

CI on this branch was red for four jobs and nobody could have known, because
conformance.yml runs on push only for main. I found it by dispatching the
workflow to check a job I had just added. The last run on b8dfc6d is green on
all ten jobs, image and fields included.

What is NOT done, and why

#850 asks for six things. Five are met; the sixth is bounded, not generated,
and this pull request does not pretend otherwise — it closes no issue.

Criterion 59 wants the capability declaration generated. capability.go admits
one axis, a client against a pack, with one mode and one proof kind; this is a
data-plane capability for a pair already marked supported. Generating the row
would mean a second axis and a new proof kind for a single row — the resolver
#644 deleted because nothing rested on it. So the row in docs/confidence.md is
written as opt-in and tied to its instrument by a test
(TestTheHardcodedEndpointRowIsOwnedByAnInstrument): if it ever stops saying
no, it must name the witness, CI must run it, and the witness must exist in
the file it names. That prevents the defect the criterion was aimed at. The
generation itself is a separate change.

What was run, and what was named rather than run

mise run testplan printed 125 changed paths and a long plan. Played on
b8dfc6d:

• mise run prepush green (check, docs:check, drift:check, shapes:check)
• mise run conformance on the assembled set, exit 0, 263.96s, score 386 of
  411 routes proven by a real client. The four machine-runtime suites printed
  SKIP: no machine runtime, which is Three quarters of the conformance workflow is a client's retry back-off on refusals the emulator answers in 30 ms #459's deliberate behaviour: a suite that
  cannot measure says so rather than passing silently
• mise run lint-shell, mise run falsify:lint (1554 mutations across 232
  specs, every declared fragment still applies)
• every leg of conformance.yml on this exact commit, all ten jobs green,
  image and fields included

Named rather than run, because a reviewer cannot tell a considered omission
from a forgotten one:

• FEINT_VM=incus-ovn mise run conformance:leg -- runtime and
  conformance:functional. The plan routes on an import of
  internal/core/machine, not on a change to it: this diff adds no driver path
  and touches no network, address or firewall. Starting containers is a side
  effect on the operator's station, so it is asked for rather than taken
• mise run falsify:all is the night pass and was launched separately; the
  specs that mutate files this diff touches are its subset, and falsify:lint
  already proves every declared fragment still matches its file
• mise run limits:check exits 2 on this branch and on main: ten sections
  of docs/limits.md cite an issue that closed after anyone last read them.
  That is Documentation : réexaminer les 10 sections limits signalées, sans rafraîchir les acknowledgements en masse #857, tracked with exactly these ten sections, and it is deliberately
  not refreshed here. limits-acks.py refresh would re-date all of them and
  turn a freshness signal into a lie; none of the ten is the S3 section this
  branch touched, and the gate runs in the nightly drift workflow, not on pull
  requests

Type of change

• A route added or changed
• Bug fix
• Refactor
• Documentation
• Chore / tooling
• Security / supply chain

Checklist

Always

• mise run check passes
• No new external Go dependency — go.mod is unchanged
• internal/core still knows no provider. objectstore stores bytes under
  opaque keys; the provider spelling lives in internal/s3/doors.go and in
  each pack's profile
• Nothing in the diff could be written identically for another provider.
  s3.Profile is the field list that proved it: a host, a region, an
  address key — and Boot.User's precedent for the case where a provider
  does not fit
• mise run testplan was run and what it printed was run

When a model wrote a substantive part of this

• An Assisted-by: trailer names the tool and the model version, on every
  commit. No Co-Authored-By for a tool, per CONTRIBUTING.md
• mise run conformance run on the assembled set, not per commit
• Every field name comes from the provider's SDK, their OpenAPI document or
  a run of the real client. The two shapes for which that is not true are
  not served, and are named above

When a route is added or changed

• Every route declares its upstream operation at the SDK's exact name
• mise run conformance passes
• Responses validated against the provider's own API description
  (--contracts contracts)
• /_feint/conformance | jq .unread_request_fields read
• coverage/ committed with the change

When behaviour a client can observe changes

• docs/limits.md updated — including the three statements it had wrong
• Generated README tables regenerated

When .github/workflows/ is touched

• Every action pinned to a full 40-character SHA with a # vX.Y.Z comment
• harden-runner is the first step of the new hardcoded-endpoint job
• permissions: least-privilege
• No job renamed. One job added, so the required checks may want it
• The exit-code contract holds; no gate piped through tee

When a machine runtime is involved

N/A — no machine runtime in this change. The object store writes bytes to a
directory and the doors are HTTP.

Related issues

Refs #850 — five of six criteria met, 59 bounded rather than generated.
Refs #849, #858.

Does not close anything: the remaining criterion and the two unrecorded OOS
shapes are real, and an issue closed on five sixths is an issue nobody reopens.

---

🤖 Generated with Claude Code