S3 Object Lock

The archive bucket attested-relay-archive-370686332139-us-west-2 now has a 30-day COMPLIANCE default for future uploads. All 32 existing object versions under artifacts/ were backfilled and individually verified; their retention expires at 2026-10-11T01:45:27.252992+00:00. Other historical diagnostic prefixes were not backfilled. The bucket default covers future uploads to all prefixes.

A fresh upload through the deployed Hetzner mirror's scoped service identity received COMPLIANCE retention automatically. Anonymous full-byte SHA256 readback, idempotent repeat upload and rejection of conditional overwrite passed. The mirror's live scan verified six origin artifacts on S3 and Hetzner without errors. No deletion attempts were made.

Enabling retention exposed a missing upload checksum: S3 rejected the previous mirror PutObject calls. The mirror now sends Content-MD5, while content-address verification continues to use SHA256. The updated mirror and diagnostic verifier were deployed on Hetzner, preserving previous source files. Only the mirror service was restarted. All 12 local mirror tests passed, including checksum validation in the fake S3 endpoint.

Evidence:

• applied-configuration.json: verified bucket default.
• backfill-verification.json: exact protected version IDs and retention dates.
• fresh-upload-verification.json: service upload and retention/readback proof.
• get-object-lock-configuration.json and list-object-versions.json: earlier baseline immediately after enabling the feature, before setting retention.
• proposed-30-day-configuration.json: the configuration subsequently applied.

Retention protects stored versions until their expiry. It does not prevent changes to future defaults, public access, or delete markers hiding a retained version. The enclave still acknowledges parent storage before asynchronous S3 mirroring; it does not attest S3 durability or retention.

Hash-count change in the same work session

config/relay-v2.toml now specifies 4,881,600 iterations per group: 84 × 4,881,600 = 410,054,400 = 678 × 7 × 86,400 hashes. TOML parsing and the arithmetic were checked. This is a next-build setting; the running 19a53a5 enclave and its published puzzles remain unchanged. Deployment requires a rebuilt EIF, new measured PCR/evidence and a new warm-up, estimated at roughly 16 hours from the previous generation rate. No enclave restart or solver interruption was performed. This remains calibrated computational work, not a hardware-independent seven-day confidentiality guarantee.