The structural boundary for an authorization graph. default is the
conventional application realm. _anvil/system is deliberately
representable here because Anvil uses the same data model internally;
public calls targeting that reserved scope are rejected by the server. For
every public call, storage_tenant must equal the authenticated caller’s
immutable storage tenant; spelling another tenant never changes identity.
Prefixes are bucket-relative. Anything below an immutable prefix is
write-once; anything below a program-only prefix is writable only through a
pinned atomic program. Overlap validation belongs to the server.
Bulk puts carry their bounded payload inline because there is one enclosing
unary request. They use the same canonical operation identity and semantics
as the corresponding StartPut plus Put plus PutEnd sequence.
Application IDs and client IDs are cluster-wide authentication identities;
each is globally unique. An application has exactly one client credential
in Anvil 0.5. Supplying the same canonical application, client ID and secret is
an idempotent replay.
Freshness is evidence, not an admission rule. A query returns the available
generation and this structure; it never fails solely because indexing lags.
This is the only public operation in this service with atomic multi-path
visibility. A program definition is an ordinary immutable object at the
bucket-relative path _anvil/programs/{name}@{version}. It is
written through StartPut with PutImmutableOperation, followed by Put and
PutEnd, and is governed by the same path authorization as every other
object. The invocation pins that ordinary object’s full address and content
hash.
The non-empty batch is one all-or-nothing set mutation in one realm. Add
and remove are idempotent. The 0.5 hard limit is 1000 mutations and the
operation ID is limited to 128 UTF-8 bytes. Reusing an operation ID with a
different canonical input is rejected.
Identifiers, namespaces, relations, schema IDs, and realm IDs are limited
to 256 UTF-8 bytes. Opaque object IDs and exact paths are limited to 4096
UTF-8 bytes. A realm is carried only by AuthzScope, never in a namespace.
Creates one storage tenant, its first owner application and that
application’s credential in one durable metadata write. Only a caller with
system#manage_system may perform this operation.
Complete metadata and operation for one addressed upload. A header never
contains payload bytes, a caller-supplied content hash, or a storage
reference. Exactly one operation must be selected.
Publish on a MUTABLE path only when its current live or tombstone head has
exactly expected_version. The condition is checked when the completed upload
is published; StartPut does not reserve or lock the path while bytes arrive.
Create on an IMMUTABLE path. Identical existing content is an idempotent
replay; different existing content fails. This operation never changes path
policy.
Protobuf cannot make a field unskippable on a hostile wire, so the server
rejects a missing/empty token. Unlike the old frame union, however, this
message has no header variant a normal client can send out of order. Every
request in one stream must carry the same token.
A 0.5 schema contains at most 256 namespaces, 256 members per namespace,
and 256 selectors or rules per member. Publication canonicalizes the body:
replaying identical content returns the same SchemaRef, while changed
content creates the next immutable revision for the schema ID.
Opaque upload capability returned by StartPut. Clients must not parse
value. A token is bound to its authenticated caller and one protocol phase.
StartPut returns an UPLOAD token; Put returns a fresh READY token for PutEnd.
An absent consistency value means latest. page_size zero selects the server
default of 100; the 0.5 hard maximum is 1000. page_token is opaque and
limited to 128 KiB. A returned token pins its continuation to the same
filters and revision; a no-longer-current revision fails rather than moving.
A tuple subject is either one typed object or one userset in the request’s
realm. The reserved public principal is the object app:_anvil/public;
schemas must still opt into it with PublicSubjectSelector.
WatchPrefix is an unordered, at-least-once invalidation feed. Duplicates are
legal and rapid changes to one path may be coalesced; intermediate versions
are not promised. It carries no payload bytes and is not change-data-capture
or an audit log. A consumer must reread each path until it observes at least
minimum_path_version.
LOCAL is the default for speed: the ingress acknowledges after its durable
local write while normal placement continues. REPLICATED waits for the fixed
2+1 payload layout (or the corresponding mutable-record quorum) before
acknowledging. A cluster that cannot satisfy the requested class returns
DURABILITY_UNAVAILABLE without publishing. Unknown values are invalid.
UNVERSIONED is the meaningful zero/default: replacing or deleting a head
does not retain the predecessor for later reads. ENABLED retains versions
and is a one-way bucket capability.