---
title: "Production contract (historical)"
description: "Historical implemented-subset contract, retained for scope and rollback context; it is not a current go-live approval."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.myswift.rs/llms.txt
> Use this file to discover all available pages before exploring further.

# Production contract (historical)

> **Historical scope; current production verdict is NO-GO**
>
> This page preserves the 2026-08-18 implemented-subset contract and rollback
> context. It is not a current production approval. On 2026-08-31, W068
> replication and W069 EC merge in strict scorer W070 for **G6 GREEN** on source
> `17adf0bfa78b30b2a7eed9f39836e0d63c715d2c`. G7 is **NOT ACCEPTED**, G8 is
> blocked, and the current production verdict remains NO-GO. See
> [Current status](/status-2026-08-31).

This page is the historical one-page contract for the implemented S3 / Swift subset
on this fleet. The isolation unit is a **Keystone project** (historical
“tenant”), not a single invented customer name. Stance:
**IMPLEMENTED_SUBSET_ONLY**. It is not a drop-in for every S3 client, and
it is not a Swift twin.

> **Lab contract, not a production go-live**
>
> In the historical 2026-08-18 record, proxies and the VIP ran Guard
> (`3d0138d5…`, [releases](/releases)). The dated stance was
> **IMPLEMENTED_SUBSET_ONLY**. The 49/8 score was that contract's acceptance
> result, not a current GREEN gate. Gate `671bcbaf…` was the recorded rollback
> copy on each node, and object servers used the dated BUG-1 build
> (`471e8b73…`).

Scoreboard evidence: post-GUARD
`strict-s3-dual-20260818-postguard.json` (2026-08-18, SHA-256
`52588c82…`), failing set identical to post-GATE (`50f0c860…`). Method:
[Dual-oracle](/dual-oracle). Client behavior: [S3 API](/s3-api).
Claim boundary: [parity](/parity).

## 为什么以前要填「真正租户」

之前合同页上的「真正租户 / TBD tenant」**不是**技术上只能开一个账号。
那是法律和 SLO 标签：防止有人把实验室残留（`AUTH_dev`、`AUTH_test`、
`AUTH_lab`）当成客户。

Keystone 里隔离单位是 **project**（历史上也叫 tenant）。一个用户可以对
多个 project 有角色；一个 project 也可以有多个用户或组。Swift 账号通常
是 `AUTH_<project_id>`。S3（EC2）凭证按用户发放，经 `s3token` 落到某个
project。

系统本身已经允许多 project、多用户。本合同写的是：**本舰队书面子集覆盖
哪些 Keystone project**（可以是一列），以及在这些 project 上有角色的已
认证用户，可以使用已实现的 S3 / Swift 子集。不编造一个强制的唯一客户名。
也不把 `AUTH_dev` 写成生产用户——它仍是自动化残留。

## Binding

| Item | Value |
|------|--------|
| Stance | `IMPLEMENTED_SUBSET_ONLY` |
| Frozen 57-case scoreboard | **49/8 is the acceptance pass** (`rc=1` is expected) |
| 57/57 zero-fail runner | not a go-live condition |
| Recorded live state (2026-08-18) | Guard `3d0138d5…` ×4 + VIP; object `471e8b73…` ×4 |
| Binds the VIP | yes, on the Guard generation |
| Isolation unit | Keystone **project** (Swift account `AUTH_<project_id>`) |
| In-scope projects | operator-listed project IDs (may be several). No mandatory customer name. Lab leftovers `AUTH_dev` / `AUTH_test` / `AUTH_lab` are out of scope. |
| Who may use the subset | any authenticated user or group with a role on an in-scope project |
| S3 credentials | per-user EC2 keys, scoped through `s3token` to a project |

## Parties

| Role | Value |
|------|--------|
| Provider | Peregrine lab fleet (Contabo VIP `10.0.0.10:8085`) |
| In-scope Keystone projects | operator lists project IDs; this page does not invent one |
| Principals | users / groups with a role on those projects |
| Allowed clients | `TBD — operator fills` |

## In scope (after Guard)

| Surface | Contract |
|---------|----------|
| SigV4 header + presign (skew / expiry enforced) | yes |
| SigV2 header + presign | yes |
| `aws-chunked` / `STREAMING-AWS4-HMAC-SHA256-PAYLOAD` | yes |
| Bucket CRUD, `GET /` ListBuckets, GetBucketLocation | yes |
| Object PUT / GET / HEAD / DELETE, copy, Range | yes |
| ListObjects v1 / v2 | yes |
| MPU (initiate, part, list, complete, abort) + composite ETag | yes |
| Versioning, ListVersions, versioned GET/DELETE | yes (cross-proxy CAS binds with Guard) |
| Multi-delete | yes |
| Bucket ACL read/write; object ACL **read** | yes |
| Account-root `PUT/DELETE/POST/HEAD /` | 405 `MethodNotAllowed` (supplement B 3/3; `AUTH_dev` stayed active as leftover evidence, not as a customer) |
| EC | liberasurecode **1.8.0** |
| Consistency daemons | **12/13**; `swift-account-reaper` excluded |

## Rust extras (kept)

These stay implemented. They are **not** turned into `501`. They are
**not** a Python-parity PASS on the frozen 57 (seven of the eight
residuals). Second scoreboard: `tools/strict-s3-supplement.py`.

| Extra | Rust behavior |
|-------|----------------|
| Object ACL write `?acl` | 200 |
| Bucket tagging write `?tagging` | 200 |
| Object tagging delete `?tagging` | 204 |
| Bucket CORS GET / PUT / DELETE | 200 / 200 / 204 |
| RestoreObject `?restore` | honest `400 InvalidObjectState` while cold routing is off |

## Out of scope

| Surface | Notes |
|---------|-------|
| Physical cold-tier / storage-policy routing | proxy does not load the map; LocalDir is lab-only, default off |
| Runtime multi-tenant IAM | library only; proxy does not load policies |
| `?policy` `?website` `?inventory` and other unlisted subresources | `501 NotImplemented` |
| Certified object-lock product | lab canary only; not an attested retention product |
| Multi-cluster container-sync | same-cluster unit only |
| KMIP | residual |
| eventlet / greenlet serving | not wired |
| Multi-primary auto-shrink | disabled by default |
| `swift-account-reaper` | stays frozen |
| Lab leftover accounts | `AUTH_dev` / `AUTH_test` / `AUTH_lab` are not customers; leftover cleanup is evidence, do not silently delete |

## Platform

| Item | Contract |
|------|----------|
| Intended public name | `causalhelix.com` (sibling TLS agent). Not a live HTTPS claim. |
| Live client path | lab self-signed VIP `https://10.0.0.10:8085` |
| Alerts | mailbox named `74511.lab@gmail.com`; channel being connected. Proven sink remains lab JSONL on swift1. |
| Object servers | BUG-1 build `471e8b73…` (rolled 2026-08-18). Wave-2 is the rollback copy. |
| DR config-plane backup | lab weekly cron; passphrase stays with the operator |
| HAProxy / Keepalived / VIP | do not restart or move in this contract |

## SLO

| Metric | Value |
|--------|--------|
| Availability | `TBD — operator fills` |
| PUT / GET / LIST latency | `TBD — operator fills` |
| Durability target | `TBD — operator fills` |
| Support hours / on-call | `TBD — operator fills` |
| Public hostname | intended `causalhelix.com`; HTTPS not live |
| Alert receiver | `74511.lab@gmail.com` — mailbox named, channel being connected |

## Rollback

Rollback target is Gate (`671bcbaf…`) on each node's
`swift-proxy-server.rollback.swiftN.*` copy. Recipe:
[Runbooks](/runbooks).

## Operator fills

| Field | Value |
|-------|--------|
| In-scope Keystone project IDs | list (may be several); no invented customer name |
| Principals | any authenticated user / group with a role on those projects |
| Allowed clients | `TBD — operator fills` |
| Availability SLO | `TBD — operator fills` |
| Latency SLO | `TBD — operator fills` |
| Durability target | `TBD — operator fills` |
| Support hours / on-call | `TBD — operator fills` |
| Public hostname + certificate | intended `causalhelix.com`; certificate and HTTPS not live |
| Alert receiver | `74511.lab@gmail.com` — mailbox named, channel being connected |
| Post-Guard rollback SHA | Gate `671bcbaf2a1d195ad532a00d6132e12b6665486d7117451aa130c5dd603346c9` |

Source: https://docs.myswift.rs/production-contract/index.mdx