antoinetoussaint-byte · Oct 27, 2026 · Oct 21, 2026 · Oct 21, 2026 · Oct 23, 2026 · Oct 23, 2026
diff --git a/RELEASE_GATES.md b/RELEASE_GATES.md
@@ -229,8 +229,10 @@ A successful image build and matching materials alone do not establish that a
 generated-file change belongs in the PR. Reproduce recipes using the CI-pinned
 CLI and the released agents selected by the service manifests.
 Every topology service must declare image coverage, even if its recipe is absent
-from the checkout. Redis and Vault explicitly use the existing Codefly vendor
-image audit; an unknown agent is an error.
+from the checkout. Redis, Vault and object storage explicitly use the existing
+Codefly vendor image audit — the object-storage agent runs its gateway and MinIO
+images, both pinned by the agent, and builds nothing here; an unknown agent is
+an error.
 
 Changes to the image contract force the full service graph through CI. Before
 each canonical build attempt, CI snapshots Buildx history. After the build,

diff --git a/libraries/source-read-sdk/library.codefly.yaml b/libraries/source-read-sdk/library.codefly.yaml
@@ -12,7 +12,7 @@ sources:
       module: saas-starter
       service: accounts
       endpoint: authority
-      contract-digest: sha256:10a231ea430313364937808160138bca599ac012230ad70b7047eac27764836a
+      contract-digest: sha256:743b63bad9a546f105e994c754d845865e189465e6c72816e5785efe38ab7831
       services:
         - ModuleCapabilitiesService
 generated-by:

diff --git a/module/DATABASE_AUTHORITY.md b/module/DATABASE_AUTHORITY.md
@@ -526,7 +526,7 @@ executable inventory and this table in the same change.
 | Scope | Relations | Required database boundary |
 |---|---|---|
 | `global` | `audit_event_types`, `authority_core_delegations`, `authority_core_grant_epochs`, `authority_core_installations`, `authority_core_module_revisions`, `authority_core_modules`, `authority_core_owner_aware`, `authority_core_person_epochs`, `authority_core_replay`, `authority_core_role_grants`, `authority_core_tombstones`, `bootstrap_state`, `data_retention_policies`, `datasource_credential_budgets`, `email_templates`, `feature_flags`, `hop_admission_keys`, `hop_admission_proofs`, `identity_providers`, `module_envelopes`, `plan_entitlements`, `plans`, `platform_admins`, `solution_delivery_documents`, `solution_generation_history`, `solution_host_bindings`, `solution_registrations`, `solution_targets` | No RLS; exact grants |
-| `tenant` | `actor_chain_journal`, `actor_chain_revocations`, `api_keys`, `approval_decisions`, `approval_requests`, `audit_event_idempotency`, `audit_events`, `connector_credentials`, `dashboards`, `datasource_account_links`, `datasource_domains`, `datasource_group_bindings`, `codefly_effect_receipts`, `datasource_operation_attempts`, `datasource_oauth_consumed_states`, `datasource_source_operations`, `datasource_sources`, `delegation_grants`, `domain_events`, `entitlement_overrides`, `executable_artifact_approvals`, `github_app_installations`, `github_app_setups`, `installations`, `invitations`, `membership_integrity_findings`, `org_generic_settings`, `org_identity_providers`, `org_key_bindings`, `org_settings`, `organization_activations`, `organization_authorization_revisions`, `organization_members`, `organizations`, `principal_authorization_revisions`, `principals`, `record_shares`, `role_assignments`, `role_permissions`, `roles`, `scope_grants`, `scope_nodes`, `source_delegations`, `source_read_revisions`, `subscriptions`, `team_members`, `team_membership_quarantine`, `teams`, `usage_events`, `usage_totals`, `webhook_deliveries`, `webhook_subscriptions`, `work_context_replay` | Enabled and forced RLS with at least one policy |
+| `tenant` | `actor_chain_journal`, `actor_chain_revocations`, `api_keys`, `approval_decisions`, `approval_requests`, `audit_event_idempotency`, `audit_events`, `connector_credentials`, `dashboards`, `datasource_account_links`, `datasource_domains`, `datasource_group_bindings`, `datasource_object_manifests`, `codefly_effect_receipts`, `datasource_operation_attempts`, `datasource_oauth_consumed_states`, `datasource_source_operations`, `datasource_sources`, `delegation_grants`, `domain_events`, `entitlement_overrides`, `executable_artifact_approvals`, `github_app_installations`, `github_app_setups`, `installations`, `invitations`, `membership_integrity_findings`, `org_generic_settings`, `org_identity_providers`, `org_key_bindings`, `org_settings`, `organization_activations`, `organization_authorization_revisions`, `organization_members`, `organizations`, `principal_authorization_revisions`, `principals`, `record_shares`, `role_assignments`, `role_permissions`, `roles`, `scope_grants`, `scope_nodes`, `source_delegations`, `source_read_revisions`, `subscriptions`, `team_members`, `team_membership_quarantine`, `teams`, `usage_events`, `usage_totals`, `webhook_deliveries`, `webhook_subscriptions`, `work_context_replay` | Enabled and forced RLS with at least one policy |
 | `user` | `client_authorization_codes`, `gdpr_requests`, `mfa_backup_codes`, `mfa_devices`, `mfa_login_transactions`, `notifications`, `onboarding_progress`, `resource_follows`, `sessions`, `user_consent_events`, `user_consent_preferences`, `user_identities`, `users`, `webauthn_ceremonies`, `webauthn_credentials` | Enabled and forced RLS with at least one policy |
 | `pre_auth` | `magic_links`, `waitlist_entries` | Enabled and forced RLS; fail-closed request policy, accessed only by the control-plane role |
 | `job` | `job_messages` | Enabled and forced RLS with at least one policy; no request relation grant — function-only scoped enqueue plus exact job-worker grants |

diff --git a/module/DEPLOYMENT_TOPOLOGY.md b/module/DEPLOYMENT_TOPOLOGY.md
@@ -36,6 +36,7 @@ REST without a corresponding accounts endpoint, generation fails.
 | Caller | Target endpoints | Kubernetes ports |
 | --- | --- | --- |
 | `accounts` | `cache/read`, `cache/write` | TCP 6379 |
+| `accounts` | `object-storage/grpc` | Codefly-assigned gRPC port |
 | `accounts` | `store/tcp` | TCP 5432 |
 | `accounts` | `vault/http` | TCP 8200 |
 | `auth-gateway` | `accounts/connect`, `accounts/rest`, `accounts/grpc` | TCP 8080, 9090 |

diff --git a/module/contracts/api/accounts/authority/contract.binpb b/module/contracts/api/accounts/authority/contract.binpb
diff --git a/module/contracts/api/accounts/authority/proto/saas/accounts/v1/datasource.proto b/module/contracts/api/accounts/authority/proto/saas/accounts/v1/datasource.proto
@@ -189,7 +189,48 @@ message UploadDatasourceConfig {
   // AWS-style access key id. The matching secret access key is the credential.
   string access_key_id = 5;
   // Upper bound on objects fetched per sync. Zero applies the connector default.
+  // Only objects that pass the filters below count against it.
   uint32 max_objects = 6;
+  // Which keys under the prefix are ingested. Each pattern is an RE2 regular
+  // expression matched against the object key with the prefix removed,
+  // unanchored and case-sensitive (anchor with ^ and $, fold case with (?i)).
+  // An empty include admits every key; an exclude match always wins. Applied
+  // when the prefix is listed, before anything is fetched, so an excluded
+  // object is never read and never counts against max_objects. An invalid
+  // expression is refused when the source is added or updated, never at sync:
+  // the call fails INVALID_ARGUMENT with a google.rpc.BadRequest violation, and
+  // a message that starts with the field's path, e.g.
+  // "upload.include_patterns[1]: …".
+  repeated string include_patterns = 7 [(buf.validate.field).repeated = {
+    max_items: 16
+    items: {
+      string: {
+        min_len: 1
+        max_len: 256
+      }
+    }
+  }];
+  repeated string exclude_patterns = 8 [(buf.validate.field).repeated = {
+    max_items: 16
+    items: {
+      string: {
+        min_len: 1
+        max_len: 256
+      }
+    }
+  }];
+  // Case-insensitive key suffixes, e.g. [".md", ".pdf"], intersected with the
+  // patterns. Empty admits every type. GitHub's file_extensions semantics.
+  repeated string file_extensions = 9 [(buf.validate.field).repeated = {
+    max_items: 32
+    items: {
+      string: {
+        min_len: 2
+        max_len: 33
+        pattern: "^\\.[A-Za-z0-9][A-Za-z0-9._-]*$"
+      }
+    }
+  }];
 }
 
 // Datasource is one connected external datasource. It is org-scoped and carries
@@ -437,6 +478,27 @@ message UpdateSourceRequest {
   // sole reason that the source had reconciled since the form was opened. What
   // an editor needs guarded is what they were looking at.
   SourceFetchScope expected = 6 [(buf.validate.field).required = true];
+  // An object-storage source's key patterns (see UploadDatasourceConfig),
+  // replaced whole like every field here. Its file_extensions is field 5; its
+  // branch and paths must be empty. Refused for a github source.
+  repeated string include_patterns = 7 [(buf.validate.field).repeated = {
+    max_items: 16
+    items: {
+      string: {
+        min_len: 1
+        max_len: 256
+      }
+    }
+  }];
+  repeated string exclude_patterns = 8 [(buf.validate.field).repeated = {
+    max_items: 16
+    items: {
+      string: {
+        min_len: 1
+        max_len: 256
+      }
+    }
+  }];
 }
 
 // SourceFetchScope is what a source fetches — the three values UpdateSource
@@ -467,6 +529,17 @@ message SourceFetchScope {
         max_len: 33
       }
     }
+  }];  repeated string include_patterns = 4 [(buf.validate.field).repeated = {
+    max_items: 16
+    items: {
+      string: {max_len: 256}
+    }
+  }];
+  repeated string exclude_patterns = 5 [(buf.validate.field).repeated = {
+    max_items: 16
+    items: {
+      string: {max_len: 256}
+    }
   }];
 }
 

diff --git a/module/contracts/api/accounts/connect/contract.binpb b/module/contracts/api/accounts/connect/contract.binpb
diff --git a/module/contracts/api/accounts/connect/proto/saas/accounts/v1/datasource.proto b/module/contracts/api/accounts/connect/proto/saas/accounts/v1/datasource.proto
@@ -189,7 +189,48 @@ message UploadDatasourceConfig {
   // AWS-style access key id. The matching secret access key is the credential.
   string access_key_id = 5;
   // Upper bound on objects fetched per sync. Zero applies the connector default.
+  // Only objects that pass the filters below count against it.
   uint32 max_objects = 6;
+  // Which keys under the prefix are ingested. Each pattern is an RE2 regular
+  // expression matched against the object key with the prefix removed,
+  // unanchored and case-sensitive (anchor with ^ and $, fold case with (?i)).
+  // An empty include admits every key; an exclude match always wins. Applied
+  // when the prefix is listed, before anything is fetched, so an excluded
+  // object is never read and never counts against max_objects. An invalid
+  // expression is refused when the source is added or updated, never at sync:
+  // the call fails INVALID_ARGUMENT with a google.rpc.BadRequest violation, and
+  // a message that starts with the field's path, e.g.
+  // "upload.include_patterns[1]: …".
+  repeated string include_patterns = 7 [(buf.validate.field).repeated = {
+    max_items: 16
+    items: {
+      string: {
+        min_len: 1
+        max_len: 256
+      }
+    }
+  }];
+  repeated string exclude_patterns = 8 [(buf.validate.field).repeated = {
+    max_items: 16
+    items: {
+      string: {
+        min_len: 1
+        max_len: 256
+      }
+    }
+  }];
+  // Case-insensitive key suffixes, e.g. [".md", ".pdf"], intersected with the
+  // patterns. Empty admits every type. GitHub's file_extensions semantics.
+  repeated string file_extensions = 9 [(buf.validate.field).repeated = {
+    max_items: 32
+    items: {
+      string: {
+        min_len: 2
+        max_len: 33
+        pattern: "^\\.[A-Za-z0-9][A-Za-z0-9._-]*$"
+      }
+    }
+  }];
 }
 
 // Datasource is one connected external datasource. It is org-scoped and carries
@@ -437,6 +478,27 @@ message UpdateSourceRequest {
   // sole reason that the source had reconciled since the form was opened. What
   // an editor needs guarded is what they were looking at.
   SourceFetchScope expected = 6 [(buf.validate.field).required = true];
+  // An object-storage source's key patterns (see UploadDatasourceConfig),
+  // replaced whole like every field here. Its file_extensions is field 5; its
+  // branch and paths must be empty. Refused for a github source.
+  repeated string include_patterns = 7 [(buf.validate.field).repeated = {
+    max_items: 16
+    items: {
+      string: {
+        min_len: 1
+        max_len: 256
+      }
+    }
+  }];
+  repeated string exclude_patterns = 8 [(buf.validate.field).repeated = {
+    max_items: 16
+    items: {
+      string: {
+        min_len: 1
+        max_len: 256
+      }
+    }
+  }];
 }
 
 // SourceFetchScope is what a source fetches — the three values UpdateSource
@@ -467,6 +529,17 @@ message SourceFetchScope {
         max_len: 33
       }
     }
+  }];  repeated string include_patterns = 4 [(buf.validate.field).repeated = {
+    max_items: 16
+    items: {
+      string: {max_len: 256}
+    }
+  }];
+  repeated string exclude_patterns = 5 [(buf.validate.field).repeated = {
+    max_items: 16
+    items: {
+      string: {max_len: 256}
+    }
   }];
 }
 

diff --git a/module/contracts/api/catalog.codefly.json b/module/contracts/api/catalog.codefly.json
@@ -10,7 +10,7 @@
       "kind": "protobuf",
       "package": "saas.accounts.v1",
       "path": "contracts/api/accounts/authority/contract.binpb",
-      "digest": "sha256:10a231ea430313364937808160138bca599ac012230ad70b7047eac27764836a",
+      "digest": "sha256:743b63bad9a546f105e994c754d845865e189465e6c72816e5785efe38ab7831",
       "services": [
         {
           "name": "ModuleCapabilitiesService",
@@ -66,7 +66,7 @@
       "kind": "protobuf",
       "package": "",
       "path": "contracts/api/accounts/connect/contract.binpb",
-      "digest": "sha256:10a231ea430313364937808160138bca599ac012230ad70b7047eac27764836a",
+      "digest": "sha256:743b63bad9a546f105e994c754d845865e189465e6c72816e5785efe38ab7831",
       "services": [
         {
           "name": "ArtifactService",

diff --git a/module/deployment/README.md b/module/deployment/README.md
@@ -385,6 +385,7 @@ services:
     - name: cache
     - name: frontend
     - name: marketing
+    - name: object-storage
     - name: store
     - name: telemetry
     # no `vault`: KEY_SERVICE_BACKEND=kms with

diff --git a/module/deployment/generated/service-topology.json b/module/deployment/generated/service-topology.json
diff --git a/module/module.codefly.yaml b/module/module.codefly.yaml
@@ -49,5 +49,6 @@ services:
     - name: cache
     - name: frontend
     - name: marketing
+    - name: object-storage
     - name: store
     - name: vault
diff --git a/module/module.package.codefly.yaml b/module/module.package.codefly.yaml
@@ -18,12 +18,12 @@ services:
         kind: protobuf
         package: saas.accounts.v1
         path: contracts/api/accounts/authority/contract.binpb
-        digest: sha256:10a231ea430313364937808160138bca599ac012230ad70b7047eac27764836a
+        digest: sha256:743b63bad9a546f105e994c754d845865e189465e6c72816e5785efe38ab7831
       - endpoint: connect
         kind: protobuf
         package: ""
         path: contracts/api/accounts/connect/contract.binpb
-        digest: sha256:10a231ea430313364937808160138bca599ac012230ad70b7047eac27764836a
+        digest: sha256:743b63bad9a546f105e994c754d845865e189465e6c72816e5785efe38ab7831
   - name: auth-gateway
     endpoints: [grpc, rest]
     api-contracts:
@@ -38,6 +38,8 @@ services:
     endpoints: [http]
   - name: marketing
     endpoints: [http]
+  - name: object-storage
+    endpoints: [grpc]
   - name: store
     endpoints: [tcp]
   - name: vault

diff --git a/module/services/README.md b/module/services/README.md
@@ -9,6 +9,12 @@ wrong, and nothing enforces it.
 `marketing` and `frontend` are separate Next.js applications: marketing owns
 public apex/`www` content, while frontend remains the authenticated product
 behind `auth-gateway`.
+`object-storage` is the composed object-storage gateway
+(codefly-dev/service-object-storage). The host keeps no store client of its
+own: accounts reads every object-storage datasource through it, under a
+per-call binding of the source's bucket and credential, and the gateway owns
+the store protocol and the public-destination guard — see
+`accounts/AGENTS.md`.
 
 Run the complete local dependency graph from `module/`: