Module http_ro 

Unauthenticated, read-only object store over plain HTTPS (R599-T5).

The read leg of a content-addressed store needs no credential, and giving it one is a net loss. Integrity comes from the content address, not from the transport: yah_mesofact_bundle::materialize_bundle verifies the manifest hashes to the requested digest and that every blob hashes to its recorded blake3 before writing anything to disk. A hostile origin, a compromised CDN, or a corrupted cache cannot inject bytes — the hash check fails. Authentication would add only confidentiality, which published bundles do not need.

What that buys, and why it is the posture rather than a shortcut:

• Nodes hold no secrets. A node bootstraps with nothing to provision, rotate, or leak. Compare the alternative: a write-capable R2 key on every box in the fleet, which would let any compromised node overwrite the release store it reads from.
• Anything can serve it — an R2 custom domain, a CDN edge, an nginx on the LAN, a peer node’s cache (W272 §2’s peer-to-peer mirroring), a USB stick in an air-gapped room. The bytes are self-verifying, so the transport is interchangeable.
• It caches. Immutable, content-addressed keys are the ideal CDN object: infinite TTL, no invalidation protocol, free cold-start acceleration.

This is the same split OCI registries (anonymous pull / authenticated push), Nix binary caches, and the Go module proxy all landed on: public immutable bytes, credentialed publish, trust anchored in the digest. The write half stays in crate::R2ObjectStore and lives only on the publisher.

Accordingly the mutating half of ObjectStore is not emulated here — it returns Error::Backend rather than pretending. A caller that needs to write wants the credentialed store and should say so.

Structs

HttpReadOnlyObjectStore

Read-only ObjectStore backed by a public HTTPS origin.