Module objects 

Exact storage access for signed protocol objects and stored blob bodies.

Every remote object is addressed by an ExactObjectRef. The logical key supplies domain separation and the physical locator selects the one provider object whose stored size and hash the signed reference authenticates. Prefix enumeration and provider names never select protocol authority.

Structs

BlobWriteAuthority

CircleProtocolObjectDomain

A domain protected by a Circle epoch key.

ExactObjectRef

Exact stored representation of one immutable object.

ExactObjectVersion

Opaque provider revision for an exact mutable object.

ExactProtocolObject

One loaded protocol object: its typed value, its canonical plaintext, and the bytes that go to storage.

ObjectSlot

Exact logical and physical location persisted before an immutable write.

PreparedExactObject

Immutable stored bytes and the exact reference derived from them.

PreparedProtocolObject

ProtocolObjectContext

Authenticated storage context for one immutable semantic object.

ProtocolObjectDomain

Typed protocol-object domain names. Each name’s value carries the only protection class its object kind permits.

ProviderDeviceBinding

RecipientSealedProtocolObjectDomain

A domain whose canonical bytes already carry recipient-specific encryption.

ResolvedProviderBinding

RotationPending

Store-key work is in flight or committed but not fully adopted. Every cloud seal refuses while this holds, including while a local removal candidate may still publish and after a committed rotation whose key is not locally adopted or whose exact operation journal remains open.

SignedStoreProtocolObjectDomain

A signed Store control-plane domain whose bytes must remain readable before the reader has adopted the Store data key named by those bytes.

StoreEncryptedProtocolObjectDomain

A domain protected by the Store key.

VerifiedObject

Enums

AwsPrincipal

BlobSpoolProtection

Protection selected by the audience authority that prepares a blob spool.

BlobSpoolWrite

CloudKitEnvironment

GoogleDriveCorpus

LocalRotation

This device’s own rotation: a candidate it may still publish or lose, or its committed rotation awaiting local adoption. The commit consumes the candidate, so the two are the same fact at different points of its life — a device holds one or the other, never both.

PhysicalObjectLocator

Provider-specific physical address for a caller-reserved immutable slot.

ProtectedObjectDomain

Signed object kind bound into protection AAD and checked against the semantic path before storage I/O.

ProtocolObjectProtection

ProviderPrincipalId

RotationGate

RotationGateError

RotationPendingState

S3EndpointBinding

StorageBackendFailure

Error type for storage operations.

StorageError

StoreObjectError

StoreProviderBinding

Provider namespace/corpus facts signed once by the Store root.

Constants

ROTATION_GATE_STATE_KEY

The exact store-key work that blocks sealing: a local candidate, an activated local removal awaiting adoption, a peer’s committed generation awaiting adoption, or a local fact together with a peer fact. Durable database transitions and this in-memory copy move together at operation boundaries.

Functions

decode_protocol_object

Decode the JSON body of one protocol object. Bytes that do not parse as T are malformed for the slot they were read from.

verify_membership_head_reference

verify_store_root

Reject an object that names a different Store root than the one it was read under.