/tags/sentinel/Recent content in Sentinel on Momo Engineering Journal/images/og-image.png/images/og-image.pngHugoen-usWed, 28 Oct 2026 17:47:15 -0600/posts/058-s3-lifecycle-on-cas/Wed, 21 Oct 2026 03:35:13 +0000/posts/058-s3-lifecycle-on-cas/Lifecycle rules are the first feature that makes momo delete data on a schedule rather than on request — which turns age, storage class, and delete markers into correctness problems. This post walks through the expiration and transition engine, why a background worker is the only safe place to run it, and how expiration composes with versioning’s delete markers./posts/020-r2-degraded-read-self-heal/Thu, 27 Aug 2026 10:14:18 +0000/posts/020-r2-degraded-read-self-heal/When a local replica is corrupted or missing, degraded read fetches from healthy survivors transparently, while a background rebuild loop restores cluster redundancy./posts/019-r1-failure-domain-placement/Wed, 26 Aug 2026 23:52:57 +0000/posts/019-r1-failure-domain-placement/Replicas must not ride in the same rack: CRUSH weights become rack/zone/DC-aware so a single domain failure can’t lose the data./posts/043-reduce-read-verify-hashing/Wed, 26 Aug 2026 19:00:59 +0000/posts/043-reduce-read-verify-hashing/Verify-on-read re-hashes the full object on every local read (~8x slower than write). A ReadVerifier seam skips re-verification for blobs verified this process, while scrub still catches bitrot./posts/042-perf-profiling-baseline/Wed, 26 Aug 2026 17:46:56 +0000/posts/042-perf-profiling-baseline/Phase-0 profiling harness via go test -cpuprofile/-memprofile; Rule 75 forbids networked pprof on unauthenticated listeners. The baseline proved stdlib SHA-256 already uses AVX2./posts/044-plugin-seam-architecture/Wed, 26 Aug 2026 16:45:18 +0000/posts/044-plugin-seam-architecture/Adaptive behaviors use compile-time Go interface seams injected at decision points — not dynamic plugins. The fast path stays concrete; the trust core stays auditable; policy is declarative./posts/032-r5-metrics-phases-2-4/Tue, 25 Aug 2026 03:25:22 +0000/posts/032-r5-metrics-phases-2-4/R5 Phases 2-4 shipped: storage metrics (disk, CAS, GC), P2P metrics (SWIM, leases, scatter-gather), and opt-in latency histograms — all with <1% overhead via sync/atomic counters./posts/035-s3-501-discipline-remaining-ops/Mon, 24 Aug 2026 21:44:12 +0000/posts/035-s3-501-discipline-remaining-ops/Final 501 sweep: SelectObjectContent, UploadPartCopy, analytics, inventory, metrics, intelligent-tiering now return honest 501 NotImplemented./posts/034-s3-501-discipline-object-subresources/Mon, 24 Aug 2026 21:13:07 +0000/posts/034-s3-501-discipline-object-subresources/5 object-level query parameters now return honest 501 NotImplemented instead of silently falling into GetObject/PutObject/DeleteObject./posts/033-s3-501-discipline-bucket-config/Mon, 24 Aug 2026 20:00:50 +0000/posts/033-s3-501-discipline-bucket-config/16 bucket config subresources (versioning, ACL, policy, CORS, lifecycle, etc.) now return honest 501 NotImplemented instead of silently misrouting to ListObjects/GetObject./posts/007-at-rest-integrity-and-gc/Mon, 24 Aug 2026 19:36:43 +0000/posts/007-at-rest-integrity-and-gc/CAS keys make verify-on-read free: central verification, x-amz-checksum echo, tombstone GC, and corruption surfacing./posts/031-core-integrity-verification/Mon, 24 Aug 2026 18:03:31 +0000/posts/031-core-integrity-verification/S3 integrity checksums moved from a surface-level adapter into the storage/ingest core via a protocol-agnostic ChecksumProvider seam — every write path verified, replicas re-verify on receive./posts/012-s3-integrity-checksums/Mon, 24 Aug 2026 16:36:34 +0000/posts/012-s3-integrity-checksums/x-amz-checksum-CRC32/SHA256 echo on PUT; integrity surfaced to clients so dirty bytes never masquerade as clean. Teaches: client-verifiable integrity, Bolt zero-allocation on read path, Sentinel honesty guarantee./posts/014-confidential-dedup-oprf/Fri, 14 Aug 2026 00:26:56 +0000/posts/014-confidential-dedup-oprf/Threshold-OPRF lets E2EE cas blobs dedup without revealing content hashes — plus adaptive failed-auth backoff and lockout./posts/009-s3-multipart-and-breadth/Thu, 13 Aug 2026 06:02:26 +0000/posts/009-s3-multipart-and-breadth/Multipart upload support plus a rigorous 501 strategy for unsupported S3 subresources — honest breadths over silent misbehavior./posts/011-s3-https-tls-enforcement/Wed, 12 Aug 2026 07:23:29 +0000/posts/011-s3-https-tls-enforcement/The S3 gateway turned HTTPS-or-explicit-insecure into the default: no silent plaintext for the gateway or inbound tcp/quic./posts/010-s3-auth-presigned-sigv4/Tue, 11 Aug 2026 23:11:16 +0000/posts/010-s3-auth-presigned-sigv4/Query-string SigV4 for presigned URLs, mandatory X-Amz-Date freshness, and decoupling gateway access/secret keys from the native auth token./posts/008-s3-gateway-core/Tue, 11 Aug 2026 18:25:16 +0000/posts/008-s3-gateway-core/The S3 gateway: SigV4, S3-compliant XML errors, Head/List/Copy, pagination, ranges, and metadata — a compatible API surface for real clients./posts/013-e2ee-envelope-encryption/Tue, 11 Aug 2026 16:36:53 +0000/posts/013-e2ee-envelope-encryption/Envelope encryption with a client-held key: the server stores ciphertext and can’t read it — across S3 and native transports./posts/039-signed-payload-sse-s3/Tue, 11 Aug 2026 05:14:24 +0000/posts/039-signed-payload-sse-s3/SigV4 signed payload verification for S3 PUT/POST and Server-Sent Events for async operation notifications./posts/040-aws-chunked-streaming/Tue, 11 Aug 2026 04:52:58 +0000/posts/040-aws-chunked-streaming/aws-chunked payload encoding streams large S3 uploads in signed chunks — no full-body buffering, per-chunk SigV4 integrity./posts/015-sentinel-security-audit/Tue, 04 Aug 2026 00:47:24 +0000/posts/015-sentinel-security-audit/A 76-deep audit (authed via Sentinel) surfaced CRLF injection, smuggling, traversal and path leaks — the pattern that forged momo’s security mindset./posts/030-external-s3-client-replication-downgrade/Wed, 01 Jul 2026 23:36:39 +0000/posts/030-external-s3-client-replication-downgrade/External S3 clients like aws-cli don’t send momo headers — the server detects this and downgrades client-side replication modes to server-side alternatives, ensuring replication never silently drops./posts/037-zero-crash-hardening-patterns/Wed, 03 Jun 2026 06:03:39 +0000/posts/037-zero-crash-hardening-patterns/Systematic defensive coding: nil-safety, numeric overflow guards, resource lifecycle discipline, panic recovery at every boundary, and concurrency safety under -race./posts/002-replication-strategies-polymorphic/Mon, 04 May 2026 18:54:37 +0000/posts/002-replication-strategies-polymorphic/Chain, Splay, and Primary-Splay replication — and the metrics-driven controller that switches between them at runtime.