App object storage

Availability

Managed object storage is not available yet. The current bucket service is a control-plane preview. It creates a bucket-shaped record, generates one-time S3-shaped credentials, and can publish OF_S3_* environment variables, but its endpoint is stub-minio-platform.local:9000. No MinIO bucket is created and no object can be stored there.

Do not use a record with status stub for uploads, backups, or any data that must survive. A successful call proves only that the control-plane contract ran.

What you can test today

The preview exercises these boundaries:

unique bucket-name generation;
app ownership checks in the MCP wrapper;
one-time secret handling;
metadata-only list responses;
publication of OF_S3_ENDPOINT, OF_S3_BUCKET, OF_S3_ACCESS_KEY, OF_S3_SECRET_KEY, and OF_S3_REGION; and
association of the bucket reference with the app.

If environment publication succeeds, the values are still placeholders. Remove them before deploying a workload that expects real storage.

MCP tools

Tool	Current behavior
`add_app_bucket(app_id)`	Creates a `stub` record and may publish placeholder `OF_S3_*` values.
`list_app_buckets(app_id)`	Lists metadata. It never returns the secret key.


add_app_bucket(app_id='550e8400-e29b-41d4-a716-446655440000')

Check the response before using it:


{
  "bucket_id": "buk-a7f3b2c1d9e4f",
  "endpoint_url": "http://stub-minio-platform.local:9000",
  "status": "stub",
  "env_published": false
}

When automatic environment publication is unavailable, the response can include the secret and an env_payload once. That does not turn the stub endpoint into storage. Handle the response as sensitive and do not log it.

REST contract

Method	Path	Result
`POST`	`/api/app-infra/buckets`	Creates a preview record and returns one-time credential-shaped data.
`GET`	`/api/app-infra/buckets/{bucket_id}`	Returns metadata without the secret key.
`GET`	`/api/app-infra/buckets?app_id={app_id}`	Lists bucket metadata for an app.

Prefer the owner-scoped MCP tools for normal use. The platform routes are the internal integration surface.

Planned application contract

When a real provider is enabled, applications will construct an S3-compatible client explicitly from the five OF_S3_* variables. Do not rely on ambient AWS credentials. The same variable names can be used with a temporary operator-managed S3 service today, provided you supply real values through App environment variables.

Before managed storage can be called ready

A production-capable release needs evidence for:

a deployed and reachable object-store host;
per-app access isolation;
upload, download, and redeploy-persistence tests;
rotation and safe deprovisioning;
capacity, availability, and error monitoring; and
backup or replication behavior appropriate to the stated durability target.

Until those checks pass, use an operator-managed S3-compatible service and test its recovery path directly.