# Media on CARLOS: a staged roadmap **Date:** 2026-09-07, revision 6 **Status:** rulings taken. Paul ruled on all eleven decisions in §7 on 2026-09-07; each is marked **(ruling)**. Everything not so marked is a **(decision)** that a stage spec may overturn cheaply. Brainstormed with Claude from discussions #107, #112 and #113 and the requirements the Meet session sent on 2026-09-07. Reviewed four times by GPT-6 via Codex, independently of the author: revision 1's 27 findings are in `CODEX-FINDINGS-MEDIA.md`, revision 2's 14 in `CODEX-FINDINGS-MEDIA-R2.md`, revision 3's 9 in `CODEX-FINDINGS-MEDIA-R3.md`, revision 4's 8 in `CODEX-FINDINGS-MEDIA-R4.md`, and revision 5's 2 in `CODEX-FINDINGS-MEDIA-R5.md`, all unedited. **Round 5 returned accept: no P1 or P2 remained, and its two wording corrections are in this revision.** Each place a finding changed the text is marked **(codex N)**, **(codex R2-N)**, **(codex R3-N)** or **(codex R4-N)**. §10 names the two parts declined. This is a roadmap, not an implementation spec. Each stage below gets its own design and plan when it is picked up. The roadmap exists so the first stage is built with the later ones in view, so nobody builds a stage out of order, and so the security properties are named before any URL shape is. ## 0. The goal in one sentence Any app on CARLOS can serve, transform, stream and relay media at the performance people expect from a CDN or a media API, with nothing to install and no third-party service in the path, and every object can be public, secret or private. "No third party" is not taste. Suite ruling 6 forbids egress that is a property of the product, and a media CDN, an image API, a TURN service or a hosted SFU that every app dials by default is exactly that. The platform is the one recipient a team has already chosen, so media handled by the platform is not egress at all. That distinction is what makes this a platform feature rather than a per-app settings field, and the plan keeps that language throughout. ## 1. Where things stand, measured on `main` Discussion #107 recorded most of this on 2026-08-31. Re-checked today, and corrected where the reviews found the citations wrong. - **Apps already have object storage**, bucket-per-app, credentials delivered sealed through `config.json` (object-storage spec §5). Reads and writes go app-to-S3 directly. The spec says at line 27 that a byte-proxy in the data path is "permanently out of scope". Reads must cross that line for a CDN to exist. Writes never will. - **Sealed config is decryptable on every host.** The deployment's decryption key sits in `host.env` on every box (config-secrets spec §4) and `internal/appconfig/materialize.go:30` renders secrets to env at adopt time. A compromised host therefore already exposes every app's store keys and secrets, not only its own residents'. Nothing in this plan makes that better or worse, and no claim below may pretend a per-region secret changes it. **(codex R2-2)** - **The store already scans.** `internal/objstore` has a ClamAV scanner, a resumable sweep that tags every object with a verdict, a scan queue of one object per item under the app's own prefix, and, when a store's scan block has enforcement on, a `Deny` on `GetObject` for objects tagged infected, written into the store user's policy (`internal/objstore/aws.go:211`, `objstore.go:82`). There is no upload hook by design; the sweep counts what it has not seen. Any new reader of the bucket must carry the same deny whenever the store user does, or it is a bypass. **(codex 4, 26, R4-8)** - **The edge cannot read a store bucket.** The region host role is scoped to the deployment bucket and its own region's data bucket (`infra/modules/region-host/main.tf:106`, residency argument in the header at line 6). A new grant is most of the serving design. - **The shared response cache is unsafe for anything authorised.** The key is host, method, path and query; a hit returns before any handler runs (`internal/edge/edge.go:1300`). `kind:status` already opts out and caches for itself because an unbounded keyspace in a process-global LRU lets one tenant evict every other. Media has that problem and an authorisation one. - **Purge is local to one box.** The purge listener is a unix socket on the host it runs on, and the `Carlos-Purge` response header acts on the edge that saw the response. Nothing distributes an invalidation across regions today. **(codex 9)** - **An edge keeps serving from last-converged state through a control bucket outage** (multi-region ingress spec, line 123). Any authority media adds to the route record inherits that: a disconnected edge will honour a revoked key until told otherwise. **(codex R2-6)** - **The tick path is local.** `activatorDeliverer` reaches an instance through the activator and its unix socket on the same box, and refuses routes without one (`internal/host/schedule_wiring.go:220`). Once-timers are filed on an instance's control socket, bound to that host (`internal/schedule/control.go:28`). Neither crosses a box. **(codex R2-4, R2-8)** - **Range and conditional handling come from `http.ServeFile`** for `kind:static`, and only there. A streaming S3 handler has to build its own HTTP mapping, and S3 `GetObject` serves one range per request. **(codex 7)** - **The edge is identity-free by design** (`internal/edge/edge.go:1`). It never reads a cookie. Suite identity is a home-minted Ed25519 assertion, audience-bound, single-use, two minutes long, delivered by auto-POST; it cannot be replayed per image. Suite doctrine ruling 3 says authorisation is never cached at any scope, and leak item 11 names a cacheable personalised response at the platform edge as a cross-person leak. - **The doctrine's visibilities are rungs plus an orthogonal link.** Ruling 15: an item is `private`, `granted` or `team`, and may additionally carry a read-only link. `team` is not public. One item can be reachable by its roster and by a link at the same time, so the storage model must let both doors reach one object. **(codex 11, R2-3)** - **Doctrine §8 says the recipient of any egress is the app's choice, never the team's**, disclosed in the README's first paragraph and on every artefact produced. A team-pasted relay URL is not admissible. **(codex 12, R2-12)** - **Members already control placement.** `carlos apps place` and `carlos instances create --region` exist, and the instances API reports which boxes and regions serve a host (`internal/console/instancesplacement.go:21`). What does not exist is a runtime signal an app can read about its host's transport capabilities. **(codex R2-13)** - **Wildcard certificates cover exactly two labels** under the apps domain (`internal/edge/wildcard.go:186`), and app names are `^[a-z][a-z0-9-]{0,31}$` (`internal/release/release.go:239`), so a one-label media name for any app of up to 26 characters is also a valid app name, and an app name may end in a hyphen, which a DNS label may not (`internal/provision/provision.go:223`). Hostnames in the account namespace are also claimed by the instances door (`internal/console/apiinstances.go:571`), which lets an app take any unclaimed label, not only its own name. **(codex 24, R2-10, R4-4, R4-5)** - **The fleet is small ARM.** Four production regions on Graviton `t4g.small`, one `t4g.medium`, burstable at a 20% per-vCPU baseline with the same two vCPUs on both sizes; the medium adds memory, not CPU. No GPU, no ffmpeg, no package installs at bootstrap. Remote hosts are Raspberry Pis. **(codex 20)** - **The Go tree is pure and CI keeps it so** (`.amadan/ci.d/20-cross@5` sets `CGO_ENABLED=0` deliberately). That rule exists so the CLI cross-compiles for the Macs people run it on. It constrains the tree, not the box, and §3 sets the rule for native helpers. - **There is no generic media job queue.** The scan queue is the one bucket-backed queue in the tree and its header explains where jobs must live so app deletion finds them. Stage 3 reuses that shape rather than inventing a second one. **(codex 19)** - **UDP is a stated non-goal of the capabilities spec** (line 931). A relay is therefore a platform service next to the edge, not an app capability. - **A tunnel-backed host cannot carry `Connection: Upgrade`** (remote-host-pi design, line 63). - **Real demand exists.** Docs ships an "insert image" menu item disabled. Meet is being designed now and needs STUN for calls to connect across most home and mobile networks. Woodstar runs its own media service as a tenant app, the shape this plan makes unnecessary. - **Apps already hold immutable keys.** rastrillo's blob store is content-addressed and presigns locally. A content-addressed key can be cached forever, and a sealed (E2EE) blob is opaque bytes the platform can serve but never transform. ## 2. Public, secret, private Three words, three delivery doors, two storage namespaces. The doors are how bytes reach a browser, not a new authorisation model: the app still decides who may see what, from its own grants, and the doctrine's rungs map onto the doors as the last row of the table says. | Door | Who can fetch | What the edge checks | Bytes cached | Reads from | |---|---|---|---|---| | **public** `/p/` | anyone with the URL | nothing | by object key, long-lived, in every allowed region | `public/` only | | **secret** `/s//` | anyone holding a valid capability | the capability's signature, scope, namespace and expiry | by object key, once per object, in every allowed region | `protected/` | | **private** `/_carlos/media/` on the app's origin | a person the app admits, now | asks the app on every request | by object key, on the app's home edge, after the app says yes | `protected/` | | *doctrine* | `private`, `granted` and `team` rungs deliver through the **private** door; a read-only link on any of them is a **secret** capability naming the same object; nothing is **public** unless the app's own rule makes an item world-readable | | | | **Two namespaces, not three.** The media prefix has `public/` and `protected/`. The public door reads `public/` and nothing else, so rewriting a URL from one door to another cannot reach a protected object: `/p/x` reads `public/x`, which does not exist for a protected key. The secret and private doors both read `protected/`, which is what lets one object be reachable by its roster through the app's check and by a link through a capability at the same time, as the doctrine's orthogonal link requires. Derivatives and renditions live under the same namespace as their source. **(codex 1, R2-3)** **Changing visibility is a lifecycle, not a copy.** Between the two namespaces it is: copy to the new namespace, delete the old key and its derivatives, append a purge covering them, fence any transform or job in flight against the old key (§4, stage 1, "publication fence"), and report completion only when every box that could hold a copy, in any region the app has ever been allowed, has either acknowledged the purge or let its serving lease expire (§4, stage 1, "purge"). Bytes a browser already holds cannot be withdrawn, and the docs say so. **(codex R3-1)** Within `protected/`, secret and private are not a move at all: the app mints a capability or stops minting them, and an existing capability dies at its expiry or when its key id is revoked. Stage 1's gate tests public-to-protected and link-to-roster transitions on cold and warm caches. **(codex R2-1)** **Public** is a plain URL on the media host. Content-addressed keys get immutable caching. Mutable keys get whatever the app says with `Cache-Control` on the object, defaulting to a short lifetime, and the app can purge. **Secret** is the doctrine's read-only link and what S3 presign, Mux and Cloudinary do: a bearer capability, signed by the app, naming an object or a prefix in `protected/`, expiring. Anyone holding it can fetch; the bytes are the same for every holder, so a popular file is cached once and revocation lags by the expiry. **The capability is a path segment, not a query string**, so a playlist's relative references to its segments resolve under the same capability and every child request is authorised without rewriting. **(codex 6)** What the signature covers is defined in stage 1, not left to the implementer. **(codex 5)** **Private** is identity-bound, and the only way to honour ruling 3 is to not decide at the edge. On every request the edge asks the app: "may this request read this key?" The app answers from its own grants and session, in a millisecond, and the edge serves from its byte cache or fetches the object. This is the shape of nginx `auth_request`, with these properties the reviews forced into the open: - **Private media is served on the app's own origin**, under a reserved path the edge intercepts ahead of the shared-cache lookup and ahead of any proxy branch, because that is the only place the app's session cookie reaches. A separate media host never sees a host-only cookie, a custom domain cannot set one for the apps domain, and cross-site cookies cannot be relied on across supported browsers and privacy settings. The cost is user content on the app's origin, and the mitigations in stage 1 (nosniff, a CSP sandbox on every response, attachment disposition for anything not image, audio, video, font or PDF, and no inline SVG or HTML ever) are what make that acceptable. **(codex 2, R2-14)** - **The check travels over the route's own backend transport**, never through a cache: the activator and unix socket for an instance on the same box, the route's TCP dial for a service route, the tunnel for a remote host. A private request for an app whose instance lives on another box reaches the home edge by the existing backhaul, as every other request for that route does, and the home edge's media cache is the one that serves it. Private bytes are therefore cached on the app's home edge only; public and secret bytes are cached in every allowed region. The check fails closed on timeout, redirect, or anything but a 200, and runs before `HEAD`, before a 304, before a range is answered and before a cache hit is admitted. **(codex 3, R2-4)** - **Private responses carry `Cache-Control: private, no-store`.** Secret responses carry `Cache-Control: private, max-age=, must-revalidate`, generated per request from the capability presented and overriding any directive on the object, so no HTTP cache may serve a stale copy past the capability's expiry. The edge's own byte cache is internal and never a substitute for either. **(codex 3, R2-5)** The costs: the app's instance is in the hot path for private media, one small request per fetch, and a hibernating instance wakes for it; the app must expose the check endpoint, which rastrillo provides once for every app; the edge stays identity-free, forwarding a cookie it never reads. The edge never caches the app's answer, for any tenant, under any knob. Ruling 1 says never; a proposal to cache a positive answer comes back to §7 for a changed ruling, not to a stage spec as an option. **(ruling 1 in §7; codex R3-7)** Media publication is never evidence for anything else. A sibling app seeing an object under `public/` learns nothing about whether it may ingest the source item; custody keys on the app's grants, as the doctrine says. **(codex 11)** ## 3. Native helpers and media services: the rule Images and video are the two places where pure Go is not fast enough on a `t4g.small`. The answer is not a cgo dependency. Two classes, with different rules. **(codex 16, 22; ruling 10)** **Codec helpers** transform bytes and nothing else. - The Go tree stays `CGO_ENABLED=0`. A helper is a separate program in whatever language wins the benchmark: Rust, C, C++, Go with wazero, or an existing tool such as `vips` or `ffmpeg`. Every candidate, including a Go one, runs as its own process. Nothing decodes inside the edge. - A helper is built and shipped as its own artifact, linux/arm64 only, with an authenticated manifest naming its version, hash and the libraries and codecs it carries. A box with the role that needs it fetches it at bootstrap and at each promotion, and can roll back the way it rolls back the platform binary. It never enters the CLI build. - A platform unit spawns it under a hardened systemd scope with no network, a read-only filesystem apart from scratch, and memory, CPU, wall-time, scratch-space and process limits. It talks over stdin/stdout or a unix socket, and the Go side owns the protocol, so `vips` today and a Rust helper tomorrow answer the same calls. **Media services** are network-facing long-running units: the relay in stage 4a, LiveKit in 4b, a live packager. They are platform units like the edge, with their own units, ports and hardening, and the no-network rule above does not apply to them. This is the answer to "could we build some dependencies in Rust or C for throughput": yes, as codec helpers, and the spikes in stages 2 and 3 decide whether the first ones are ours or borrowed. ## 4. The stages and how they depend on each other Six pieces of work. The graph replaces a single sequence; anything with no arrow into it can start now. Stage 1 carries two things later stages share, the derivative-write grant and the publication fence, so that whichever of 2 or 3 ships first finds them ready. **(codex 27, R2-11; ruling 11)** stage 1 serving class ─┬─▶ stage 2 image transforms ├─▶ stage 3 audio/video on demand ─▶ recording (in 4b) └─▶ stage 5 app-facing helpers stage 4a STUN + TURN ────▶ stage 4b LiveKit SFU, live streaming | Stage | Delivers | Needs from the platform | Size | |---|---|---|---| | 1 | `kind:media`: serving class with the three doors | edge read grant with the scan deny, signed capabilities, streaming handler, isolated cache, distributed purge, hostname claim, derivative-write grant, publication fence, CLI | one spec, one plan | | 2 | image transforms behind preset URLs | a codec helper, limits, derivative identity | one spec, one spike first | | 3 | audio and video on demand: single rendition, then ladders, posters, waveforms | a media worker, a job queue under the app prefix, ffmpeg helper | one spec, one infra change | | 4a | STUN and TURN | UDP ingress, a relay unit, per-app per-region credentials as config, limits | one spec, one infra change; **starts now** | | 4b | LiveKit as a media service, recording, live streaming | a `c7g.large`, LiveKit's server unit, a live serving extension | one spec | | 5 | uploads, rastrillo helpers, accounting, residency disclosure | small pieces spread across 1 to 4 | folded into each stage's plan | ### Stage 1: `kind:media`, the serving class A new serving class, the fourth app-mintable route kind beside `instance`, `service` and `static` (the edge also dispatches the platform's own `status`), that serves an app's store bucket through the edge, cached, with the three doors of §2. This is piece A of #107 with its open questions answered. **(codex R4-8)** **What an app sees.** `carlos media enable` writes an additive `media` block into `store.json` (prefix, allowed regions, key ids, hostname) and mints `media-..`, one label so the account wildcard already covers it. **(codex 24)** Because `media-` can also be a valid app name, the hostname is a **media-host claim** of its own, owned by the source app and recorded in the account, not an app row. It is one entry in the account's hostname namespace, and every door that acquires a hostname there consults it: new app names, renames, and the instances door that lets an app take an unclaimed label. Enable is refused, with the error saying so, when `media-` is already an app's name or an existing route or instance host, and those doors refuse a label a media claim holds; the acquisitions are serialised on the claim so two racing requests cannot both win. An app whose name ends in a hyphen cannot form a DNS label with `media-` prefixed and is refused enable before any claim or grant is written, with the error saying to rename. The generated label can be up to 38 characters, inside a DNS label; the shared `release.ValidApp` grammar is not narrowed, because existing manifests and channel pointers parse through it. **(codex R2-10, R3-4, R4-4, R4-5)** The app writes objects under `/public/` or `/protected/` with the store credentials it already has, and forms URLs: https://media-docs.abc.oncarlos.com/p/ public https://media-docs.abc.oncarlos.com/s// secret https://docs.abc.oncarlos.com/_carlos/media/ private, on the app's origin The capability is one URL-safe base64 path segment encoding the signed claims and the signature. Everything after it is resolved against the scope the claims name, so `.../s//videos/abc/index.m3u8` and the `720p/seg001.m4s` it references are both authorised by the same capability. The cache key strips the capability and keys on the object. **What a capability signs.** Domain separator (`carlos-media-v1`), the app's store identity, the key id, the namespace (`protected/`), the scope as either an exact key or a prefix that is matched only at a `/` boundary after percent-decoding and normalising the path with no `..`, the expiry, and in stage 2 the transform presets allowed. Maximum life is seven days **(ruling 3)**. Rotation is a second key id with an overlap; emergency revocation removes a key id from the route record. The capability never appears in edge logs, and every media response carries `Referrer-Policy: no-referrer`. **(codex 5)** **How the edge is granted read.** The provisioner gains a bucket-policy operation. At enable it attaches statements on that one bucket letting each allowed region's host role `GetObject` on both namespaces and `PutObject` and `DeleteObject` under `derived/` within them, **with the same `s3:ExistingObjectTag` deny the store user carries**, so an object the scanner has tagged infected is unreadable through media exactly as it is through the app's credentials. Enable and disable are a reconciled walk like the store grant, with partial completion, store revocation and route replacement handled, and disable also retires cached bytes. Adopted and non-AWS stores are refused in version one. **(codex 4, 25, R2-11; ruling 2)** **Signing keys.** An Ed25519 pair per app, minted at enable. The public half goes in the route record, which every edge already syncs. The private half reaches the app as `CARLOS_MEDIA_SIGNING_KEY` through the sealed `config.json` path that already carries store keys. The edge holds no secret. **(ruling 3)** **The handler.** `mediaHandlerFor` streams: one S3 `GetObject` per request with a single normalised range, the body copied through, never buffered. It defines its own HTTP mapping rather than borrowing `http.ServeFile`'s: single-range only, multi-range answered with the whole object, `If-Range` against the ETag, `If-None-Match` before bytes, `HEAD` answered from metadata, 416 on unsatisfiable. Every cache entry is bound to the object's ETag and published only after a complete fill, so a range from one version is never stitched to metadata from another. **(codex 7)** Response headers set on every media response, whatever the object carries: `X-Content-Type-Options: nosniff`, `Content-Security-Policy: sandbox`, `Referrer-Policy: no-referrer`, a `Content-Type` from the object's metadata with a small allow-list fallback, `Content-Disposition: attachment` for anything that is not an image, audio, video, font or PDF, the door's `Cache-Control` from §2, and a real CORS policy for the app's own hostnames with `Vary: Origin`, because `Cross-Origin-Resource-Policy` is not CORS and an HLS player in JavaScript needs the latter. **(codex 23)** **Its own cache.** `kind:media` is exempt from the shared LRU in both directions and keeps a disk cache under `/data/media-cache/` that stores objects as fixed-size blocks (1 MiB), so overlapping ranges share storage. Isolation is per box: a total disk budget with filesystem headroom, a fair share per route within it, eviction that takes first from whichever route is furthest over its share, an account-level cap across routes, and a bound on concurrent fills. The fleet-wide figure is accounting, not a limit any one box can enforce. **(codex 8)** **Purge, distributed, with a serving gate.** A purge is a record appended to a log in the platform bucket, sequence-numbered per app. Every edge tails the log and applies it; entries carry the generation they were filled under, so an in-flight fill cannot repopulate an entry a purge already covers. A returning edge reconciles its purge cursor and its route authority **before** admitting any hit from the persistent cache, and if the log history it needs is gone it drops its media cache rather than guess. **Serving media is a lease.** An edge may serve any media door, public included, only while its media authority (the route record's media block and its purge cursor) is younger than fifteen minutes; past that every media door on that edge fails closed, because a public object that was moved to `protected/`, a disabled route, a removed region or an infected verdict must not outlive an outage on a box that clients can still reach. Retirement of a key, a route or a region is complete when every box that could hold a copy has acknowledged it or its lease has expired, and the API and CLI report completion per box on exactly that condition; the local `Carlos-Purge` header and socket stay as fast paths and never count as completion. A scan verdict turning infected files a purge for the key and its derivatives. **(codex 4, 9, R2-6, R3-1)** **The publication fence.** Anything that writes derived output, a stage 2 transform or a stage 3 job, writes to an attempt-specific key under `derived/_attempts/` and has no authority to publish it. **The console is the publisher.** A commit is a console door, `POST /a//apps//media/publish`, carrying the attempt, the lease and the source ETag; the console checks the lease is current in its registry, the source's purge generation and the app's incarnation match what it holds, and only then writes the per-source manifest itself. That is one serialiser with the state to refuse, which a conditional write against the manifest is not: an expired worker with no successor would find the manifest's ETag unchanged and its `If-Match` would succeed. The serving path reads derived output only through a committed manifest, **with no exception**: a synchronous transform's first requester waits for the publish door's answer and receives the bytes only if it was 200, because an attempt that stalled past its lease or across an infected verdict must not reach even the request that caused it. One console round trip on a first miss is the cost. Purge, an infected verdict, cancellation and app deletion each bump the generation in the registry, so a late commit is refused by the door. Attempt keys are swept. This lives in stage 1 because both later stages need it and neither may reinvent it. **(codex 17, R2-7, R3-2, R4-3)** **Residency, enforced.** The `media` block names the regions allowed to serve and cache the app's media. The bucket policy grants only those regions' host roles, the media host's DNS records exist only in those regions, and the handler on any other edge answers 421 with the right host as a backstop, so a client addressing a foreign edge directly cannot fill a cache there. Default at enable: the regions the app's routes are already placed in, shown back by `carlos media status` and on the media docs page. **(codex 10, R2-9; ruling 4)** **Store spec amendment.** Line 27 of the object-storage spec gains one sentence: reads may cross the data plane through `kind:media`; writes never do. Uploads stay app-to-S3 on the app's credentials. **What stage 1 must prove** (§9) is the attacks in §2 and this section failing, not only playback succeeding. **(codex 27)** **Not in stage 1:** transforms, transcoding, uploads through the edge, per-viewer analytics, signed cookies, bandwidth quotas, dashboards beyond a bytes-served counter, multipart upload helpers. ### Stage 2: image transforms `/p/?t=thumb`, `/s//?t=thumb` and the private form, where `thumb` is a preset the app declared. A transform is synchronous, pure CPU in a codec helper, and its result is written back to the app's bucket through the publication fence so the second region never redoes the first's work. **Abuse surface first.** A public transform URL is CPU amplification on the box that terminates TLS for every tenant. From the first commit, transform parameters are a **named preset** the app declared, or for secret objects the presets the capability names, or for private objects the presets the app's check endpoint approves. Free-form parameters are refused everywhere. **(codex 5)** On top of that: single-flight per derived identity, a per-box concurrency cap with per-tenant fair admission so one tenant cannot hold every slot, a queue that turns into 503 after a short wait, a source pixel-count cap, output dimension caps, and a per-route derivative byte budget. **(codex 17)** **Derivative identity.** A derivative is named by the source key, the source ETag, the normalised preset, the resolved output format and the helper version, and committed through the fence. `f_auto` picks AVIF, WebP or JPEG from `Accept`, and the response says `Vary: Accept`. **(codex 17)** **The engine, decided by a spike.** Three candidates, all run as separate processes under the §3 rule. First, a Go helper embedding wazero-hosted `libwebp`, `libavif` and `jpegli` (the `gen2brain/*` packages), which keeps the build pure Go end to end. Second, `vips` as a fetched helper. Third, our own Rust helper using the `image` and `ravif` crates or linking libvips, persistent over a unix socket. The spike measures a 4000×3000 JPEG to an 800-wide WebP and AVIF on a `t4g.small` that is also serving: thumbnail latency, peak memory, sustained throughput under eight concurrent requests, behaviour on malformed input, and the serving latency of the box while it runs. Under a second for WebP with serving latency flat is the bar, and the candidate that clears it with the least to operate wins. The bar is not a ceiling on the fleet: if nothing clears it on a `t4g.small`, the choices are a bigger edge box, a dedicated transform box the fleet shares, or telling apps what to expect, and the spike's numbers decide which. **(codex 16; ruling 5)** **What a transform does.** Resize, crop modes, format, quality, and always strips metadata. EXIF GPS in a public photo is a privacy leak the platform should not require every app to remember. Animated GIF and WebP are passed through untransformed in version one. Sealed blobs are refused with 415. **Derivatives** land in the tenant's bucket under `/derived//.`, written by the region host role under stage 1's `derived/` statement, and count against the tenant's storage. Purging a source key removes its derivatives. **(ruling 6)** **Not in stage 2:** face detection, smart crop, watermarks, uploads, SVG rasterisation, anything needing a model. ### Stage 3: audio and video on demand Stage 1 already plays a well-formed MP4 or MP3 progressively: `Range` passes through and the browser's `