PXE-FABRIC 0B: R2 boot-origin bucket purpose, digest-keyed publish + custom-domain readback folds

dag/extdeps/cloudflare/r2.dag

@@ -66,6 +66,13 @@ data r2_get_bucket_authority: ExternalAuthority = ExternalAuthority {
   }
 }
 
+data r2_custom_domains_authority: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "developers.cloudflare.com/r2/buckets/public-buckets/"
+  }
+}
+
 data r2_tokens_doc_as_of: Timestamp = "2026-08-18"
 
 // THE READ ID IS THE ONE PERMISSION GROUP ID THIS MODULE PINS, AND THE WRITE ID IS DELIBERATELY NOT
@@ -480,6 +487,17 @@ fn r2_published_location_citations() -> List<FactCitation> {
   ]
 }
 
+data r2_custom_domain_reading: NonEmptyStr = "Public access through r2.dev subdomains is rate-limited and should only be used for development purposes. Domain access through a custom domain allows you to use Cloudflare Cache to accelerate access to your R2 bucket. Last updated Jun 16, 2026. Read 2026-09-18."
+
+data r2_custom_domain_citation: FactCitation = FactCitation {
+  fact: DeclarationRef {
+    module_path: "extdeps.cloudflare.r2",
+    decl_name: "r2_custom_domain_reading",
+    field: WholeDeclaration
+  },
+  authority: r2_custom_domains_authority,
+}
+
 
 // THE r2_s3_endpoint_url ROW IS RETIRED: gunbc.cloudflare.r2_origin_object reaches it through
 // r2_object_url on the executing put_origin_object and fetch_origin_object entries, which is the

dag/gunbc/census_closure_frontier.dag

@@ -48,6 +48,7 @@ import extdeps.tools.sha256sum { sha256_verify_native_transport_frontier_rows }
 import gunbc.cloudflare.r2_token_mint { cloudflare_r2_token_mint_frontier_rows }
 import extdeps.cloudflare.account_api_tokens { cloudflare_account_api_tokens_frontier_rows }
 import extdeps.cloudflare.r2 { cloudflare_r2_frontier_rows }
+import gunbc.cloudflare.boot_origin { cloudflare_boot_origin_frontier_rows }
 import gunbc.network_boot_delivery { network_boot_delivery_frontier_rows }
 import product.supplier.cloudflare_r2 { cloudflare_r2_supplier_frontier_rows }
 import extdeps.backblaze.b2 { backblaze_b2_frontier_rows }
@@ -111,6 +112,7 @@ fn census_closure_frontier_row_groups() -> List<List<FrontierRow>> {
     cloudflare_r2_token_mint_frontier_rows,
     cloudflare_account_api_tokens_frontier_rows,
     cloudflare_r2_frontier_rows,
+    cloudflare_boot_origin_frontier_rows,
     network_boot_delivery_frontier_rows,
     cloudflare_r2_supplier_frontier_rows,
     backblaze_b2_frontier_rows,

dag/gunbc/cloudflare/r2_origin.dag

@@ -82,8 +82,9 @@ fn fleet_cloudflare_account_standing() -> FleetCloudflareAccountStanding {
 // manifest read back from a disposable cache establishes nothing, so the origin has to be a named
 // place with a stated admission. Widening it later is a change to this row, which is exactly the
 // visibility a bucket that quietly became a general dumping ground would not have.
-type DurableOriginAdmission
+type OriginAdmission
   = FabricCommitManifestsAndContentAddressedOutputs {}
+  | DigestKeyedBootArtifacts {}
 
 // A CREDENTIAL FOR THE ORIGIN IS TWO FACTS AND A STANDING. The S3 access key id IS the Cloudflare
 // token id (extdeps.cloudflare.r2 R2S3AccessPair, cited) and is not a secret: it is what the
@@ -99,6 +100,10 @@ type DurableOriginAdmission
 // and would have grown a differently shaped write field beside it; two shapes for one concept is the
 // fork DESIGN section 3 forbids, so both directions inhabit OriginCredentialStanding and the field
 // names carry the direction.
+//
+// OriginCredentialMintEntryUnbuilt: no mint entry exists for this credential yet; secret_id is where
+// its token will be stored once one does. Distinct from OriginCredentialUnminted so mint_entry keeps
+// one meaning: an entry to run.
 type OriginCredentialStanding
   = OriginCredentialPinned {
       access_key_id: NonEmptyStr
@@ -107,11 +112,14 @@ type OriginCredentialStanding
   | OriginCredentialUnminted {
       mint_entry: DeclarationRef
     }
+  | OriginCredentialMintEntryUnbuilt {
+      secret_id: NonEmptyStr
+    }
 
-type DurableOriginBucket {
+type R2OriginBucket {
   bucket_name: NonEmptyStr
   jurisdiction: R2Jurisdiction
-  admits: DurableOriginAdmission
+  purpose: BucketPurpose
   read_credential: OriginCredentialStanding
   write_credential: OriginCredentialStanding
 }
@@ -137,8 +145,12 @@ type DurableOriginBucket {
 // constructor that admits a repeated key on either axis. The authored list below remains a fallible
 // ingress that refuses loudly; that residual, and its own next-rung trigger, are stated once in
 // std.allocation_roster rather than restated here.
+// THE BOOT ORIGIN IS A SECOND PURPOSE, NOT A WIDENING OF THE FIRST. The durable origin is private and byte-owning for commit readback; the
+// boot origin is read by machines over a public custom domain. Admitting boot bytes into the durable
+// bucket would make it public, and the durable origin's read token would become a boot reader's.
 type BucketPurpose
   = FabricDurableOrigin {}
+  | FabricBootOrigin {}
 
 type R2BucketAllocation {
   purpose: BucketPurpose
@@ -148,6 +160,35 @@ type R2BucketAllocation {
 fn bucket_purpose_key(purpose: BucketPurpose) -> String {
   match purpose {
     FabricDurableOrigin {} => "fabric-durable-origin"
+    FabricBootOrigin {} => "fabric-boot-origin"
+  }
+}
+
+// WHAT A BUCKET ADMITS IS DERIVED FROM ITS PURPOSE, never carried beside it, so a durable bucket
+// with boot admission (or the reverse) has no constructor.
+fn bucket_purpose_admission(purpose: BucketPurpose) -> OriginAdmission {
+  match purpose {
+    FabricDurableOrigin {} => FabricCommitManifestsAndContentAddressedOutputs {}
+    FabricBootOrigin {} => DigestKeyedBootArtifacts {}
+  }
+}
+
+// EVERY ADMITTED POPULATION IS WRITE-ONCE, so the PUT is create-only for each: a content-addressed
+// object or a manifest slot is never legitimately overwritten, and a digest-keyed boot artifact is
+// its digest. A future population that may be replaced must say so here, not at the call site.
+fn origin_admission_is_create_only(admission: OriginAdmission) -> Bool {
+  match admission {
+    FabricCommitManifestsAndContentAddressedOutputs {} => true
+    DigestKeyedBootArtifacts {} => true
+  }
+}
+
+// PUBLIC READ IS A PROPERTY OF THE PURPOSE, decided by an exhaustive match so a new purpose must
+// state it. Only the boot origin is ever attached to a custom domain.
+fn bucket_purpose_admits_public_read(purpose: BucketPurpose) -> Bool {
+  match purpose {
+    FabricDurableOrigin {} => false
+    FabricBootOrigin {} => true
   }
 }
 
@@ -168,6 +209,10 @@ data gunbc_fleet_r2_bucket_allocations: List<R2BucketAllocation> = [
     purpose: FabricDurableOrigin {},
     bucket_name: "gunbai-fabric-origin",
   },
+  R2BucketAllocation {
+    purpose: FabricBootOrigin {},
+    bucket_name: "gunbai-fabric-boot",
+  },
 ]
 
 fn allocated_bucket_name(purpose: BucketPurpose) -> NonEmptyStr? {
@@ -200,22 +245,22 @@ data fabric_durable_origin_write_secret_id: NonEmptyStr = "cloudflare-r2-origin-
 // AN UNALLOCATED PURPOSE HAS NO BUCKET, AND THAT IS AN ARM RATHER THAN A DEFAULT. Reconstructing a
 // name at this seam is the derivation the roster exists to forbid, and returning an empty one would
 // address the account's root instead of a bucket.
-type DurableOriginStanding
-  = DurableOriginAllocated { bucket: DurableOriginBucket }
-  | DurableOriginUnallocated { purpose: BucketPurpose }
+type R2OriginStanding
+  = R2OriginAllocated { bucket: R2OriginBucket }
+  | R2OriginUnallocated { purpose: BucketPurpose }
 
 // DEFAULT JURISDICTION, STATED RATHER THAN DEFAULTED. Eu, Us, Fedramp, and FedrampHigh are
 // data-residency commitments this fleet has not made and cannot honour, and picking one would assert
 // a compliance boundary nothing enforces.
-fn fabric_durable_origin_standing() -> DurableOriginStanding {
+fn fabric_durable_origin_standing() -> R2OriginStanding {
   match allocated_bucket_name(purpose: FabricDurableOrigin {}) {
-    Absent => DurableOriginUnallocated { purpose: FabricDurableOrigin {} }
+    Absent => R2OriginUnallocated { purpose: FabricDurableOrigin {} }
     Present { value: name } =>
-      DurableOriginAllocated {
-        bucket: DurableOriginBucket {
+      R2OriginAllocated {
+        bucket: R2OriginBucket {
           bucket_name: name,
           jurisdiction: R2JurisdictionDefault,
-          admits: FabricCommitManifestsAndContentAddressedOutputs {},
+          purpose: FabricDurableOrigin {},
           read_credential: OriginCredentialPinned {
             access_key_id: fabric_durable_origin_read_access_key_id,
             token_value: secret_ref_pin_version(
@@ -303,3 +348,30 @@ fn fleet_cloudflare_bootstrap_custody() -> BootstrapCustodyStanding {
     }
   }
 }
+
+// THE BOOT ORIGIN'S TWO CUSTODY LOCI, disjoint from the durable origin's and from each other. The
+// read token is held by whatever verifies publication; the write token only by the publisher. Neither
+// is minted yet: gunbc.cloudflare.r2_token_mint_run mints per R2OriginTokenProfile against the durable
+// bucket only, so until it is parameterized by BucketPurpose both arms are Unminted and every boot
+// PUT refuses at the standing, before any network call. Accessor rows in
+// gunbc.auth.fleet_secret_accessor_roster land with the minted versions, never before: a row whose
+// secret does not exist would stop that roster's fold for every other lane.
+data fabric_boot_origin_read_secret_id: NonEmptyStr = "cloudflare-r2-boot-origin-read-token"
+
+data fabric_boot_origin_write_secret_id: NonEmptyStr = "cloudflare-r2-boot-origin-write-token"
+
+fn fabric_boot_origin_standing() -> R2OriginStanding {
+  match allocated_bucket_name(purpose: FabricBootOrigin {}) {
+    Absent => R2OriginUnallocated { purpose: FabricBootOrigin {} }
+    Present { value: name } =>
+      R2OriginAllocated {
+        bucket: R2OriginBucket {
+          bucket_name: name,
+          jurisdiction: R2JurisdictionDefault,
+          purpose: FabricBootOrigin {},
+          read_credential: OriginCredentialMintEntryUnbuilt { secret_id: fabric_boot_origin_read_secret_id },
+          write_credential: OriginCredentialMintEntryUnbuilt { secret_id: fabric_boot_origin_write_secret_id },
+        }
+      }
+  }
+}

dag/gunbc/cloudflare/r2_origin_object.dag

@@ -31,14 +31,17 @@ import gunbc.cloudflare.r2_origin {
   CloudflareAccountAllocated,
   CloudflareAccountUnallocated,
   fleet_cloudflare_account_standing,
-  DurableOriginBucket,
-  DurableOriginAllocated,
-  DurableOriginUnallocated,
+  R2OriginBucket,
+  R2OriginAllocated,
+  R2OriginUnallocated,
   fabric_durable_origin_standing,
   bucket_purpose_key,
   OriginCredentialStanding,
   OriginCredentialPinned,
   OriginCredentialUnminted,
+  OriginCredentialMintEntryUnbuilt,
+  bucket_purpose_admission,
+  origin_admission_is_create_only,
 }
 import gunbc.cloudflare.r2_s3_netrc {
   R2S3NetrcPlaced,
@@ -86,7 +89,7 @@ import gunbc.fabric_m0_origin_readback {
 //
 // THE PUT IS CREATE-IF-ABSENT, DERIVED FROM THE ADMISSION RATHER THAN CHOSEN. The origin admits
 // commit manifests and content-addressed outputs (gunbc.cloudflare.r2_origin
-// DurableOriginAdmission): a content-addressed object at its own digest is byte-identical to any
+// OriginAdmission): a content-addressed object at its own digest is byte-identical to any
 // earlier write, and a manifest slot is written once per attempt, so no admitted object is ever
 // legitimately OVERWRITTEN. If-None-Match: * makes that a store-side refusal (412) instead of a
 // convention. A 412 is reported as its own arm -- the object is already there, which for both
@@ -187,10 +190,11 @@ type OriginTarget
       locator: R2ObjectLocator
       access_key_id: NonEmptyStr
       token_value: SecretRef
+      create_only: Bool
     }
   | OriginTargetRefused { cause: NonEmptyStr }
 
-fn origin_credential_for(direction: OriginDirection, bucket: DurableOriginBucket) -> OriginCredentialStanding {
+fn origin_credential_for(direction: OriginDirection, bucket: R2OriginBucket) -> OriginCredentialStanding {
   match direction {
     OriginRead => bucket.read_credential
     OriginWrite => bucket.write_credential
@@ -233,9 +237,9 @@ fn resolve_origin_target(direction: OriginDirection, key: NonEmptyStr) -> Origin
       OriginTargetRefused { cause: concat("NO CLOUDFLARE ACCOUNT ID: ", intervention.instruction as String) as NonEmptyStr }
     CloudflareAccountAllocated { company: _, account_id: account_id } =>
       match fabric_durable_origin_standing() {
-        DurableOriginUnallocated { purpose: purpose } =>
+        R2OriginUnallocated { purpose: purpose } =>
           OriginTargetRefused { cause: concat("NO BUCKET ALLOCATED FOR ", bucket_purpose_key(purpose: purpose)) as NonEmptyStr }
-        DurableOriginAllocated { bucket: bucket } =>
+        R2OriginAllocated { bucket: bucket } =>
           match origin_credential_for(direction: direction, bucket: bucket) {
             OriginCredentialUnminted { mint_entry: entry } =>
               OriginTargetRefused {
@@ -245,6 +249,14 @@ fn resolve_origin_target(direction: OriginDirection, key: NonEmptyStr) -> Origin
                   " and pin the stored version in gunbc.cloudflare.r2_origin before this operation can sign a request",
                 ], "") as NonEmptyStr,
               }
+            OriginCredentialMintEntryUnbuilt { secret_id: secret_id } =>
+              OriginTargetRefused {
+                cause: join([
+                  "THE ORIGIN'S ", origin_direction_word(direction: direction),
+                  " CREDENTIAL HAS NO MINT ENTRY: nothing mints ", secret_id as String,
+                  " yet, so this operation cannot sign a request",
+                ], "") as NonEmptyStr,
+              }
             OriginCredentialPinned { access_key_id: access_key_id, token_value: token_value } =>
               OriginTargetReady {
                 locator: R2ObjectLocator {
@@ -254,6 +266,7 @@ fn resolve_origin_target(direction: OriginDirection, key: NonEmptyStr) -> Origin
                 },
                 access_key_id: access_key_id,
                 token_value: token_value,
+                create_only: origin_admission_is_create_only(admission: bucket_purpose_admission(purpose: bucket.purpose)),
               }
           }
       }
@@ -296,7 +309,7 @@ fn put_origin_object(
     OriginTransportPresent =>
   match resolve_origin_target(direction: OriginWrite, key: key) {
     OriginTargetRefused { cause: cause } => put_without_credential_exposure(verdict: OriginPutRefused { key: key, cause: cause })
-    OriginTargetReady { locator: locator, access_key_id: access_key_id, token_value: token_value } =>
+    OriginTargetReady { locator: locator, access_key_id: access_key_id, token_value: token_value, create_only: create_only } =>
       match place_r2_s3_netrc(
         host: r2_s3_endpoint_host(endpoint: locator.endpoint) as NonEmptyStr,
         access_key_id: access_key_id,
@@ -313,7 +326,7 @@ fn put_origin_object(
               local_path: local_path as String,
               netrc_path: netrc_binding_path(binding: binding),
               sigv4_region: r2_s3_sigv4_region,
-              create_only: true,
+              create_only: create_only,
             ),
             transport: LocalExec,
           )
@@ -375,7 +388,7 @@ fn fetch_origin_object(
     OriginTransportPresent =>
   match resolve_origin_target(direction: OriginRead, key: key) {
     OriginTargetRefused { cause: cause } => OriginFetchUnavailable { key: key, cause: cause }
-    OriginTargetReady { locator: locator, access_key_id: access_key_id, token_value: token_value } => {
+    OriginTargetReady { locator: locator, access_key_id: access_key_id, token_value: token_value, create_only: _ } => {
       let staging = shell.Mktemp.Dir()
       if staging.success == false {
         OriginFetchUnavailable { key: key, cause: "no private directory could be minted to stage the origin's bytes, so nothing was fetched" }