Skip to content

Design Records

Design records capture the reasoning behind SILO maintenance decisions: the problem being solved, the compatibility boundary, rejected alternatives, implementation requirements, and the evidence required before release.

  • SILO Server 20260903 Pre-release Review

    In Design

    DesignReviewsecurityCompatibilityRelease

    Featured Image for SILO Server 20260903 Pre-release Review

    This is the durable pre-release engineering record behind SILO 20260903. It explains why an earlier “all issues are solved” assessment was not accepted at face value, what the independent review found, how the fixes were narrowed, and which gates …

    This is the durable pre-release engineering record behind SILO 20260903. It explains why an earlier “all issues are solved” assessment was not accepted at face value, what the independent review found, how the fixes were narrowed, and which gates …

  • No I/O Before Auth, No Privilege From Headers

    In Design

    DesignsecurityCORSReplicationSSE-CCompatibility

    Featured Image for No I/O Before Auth, No Privilege From Headers

    This record describes the CORS hot-path and replication-request trust repair merged into SILO as PR #101 (938603458 through 04b097fd9). Status on 2026-09-03: PR #101 merged into main on 2026-09-01 with four follow-up commits: per-entry Snowball trust …

    This record describes the CORS hot-path and replication-request trust repair merged into SILO as PR #101 (938603458 through 04b097fd9). Status on 2026-09-03: PR #101 merged into main on 2026-09-01 with four follow-up commits: per-entry Snowball trust …

  • Should SILO Fix ListMultipartUploads? Design Review of Issue #79

    In Design

    DesignS3CompatibilityMultipart

    Featured Image for Should SILO Fix ListMultipartUploads? Design Review of Issue #79

    This is the problem, design, and decision record for SILO issue #79. Status on 2026-08-30: confirmed compatibility defect; design proposal only. No server implementation, release artifact, deployment, or production verification is claimed by this …

    This is the problem, design, and decision record for SILO issue #79. Status on 2026-08-30: confirmed compatibility defect; design proposal only. No server implementation, release artifact, deployment, or production verification is claimed by this …

  • Read-Only Checksum Audit and Reliable CLI Output

    In Design

    DesignS3CompatibilityChecksummcli

    Featured Image for Read-Only Checksum Audit and Reliable CLI Output

    This is the design and implementation record for MCLI’s read-only checksum verification workflow and pgsty/mc#5, the non-TTY output defect found during release review. Status: shipped in the final mcli 20260903 release. The command merged to main …

    This is the design and implementation record for MCLI’s read-only checksum verification workflow and pgsty/mc#5, the non-TTY output defect found during release review. Status: shipped in the final mcli 20260903 release. The command merged to main …

  • Two SSE-C Keys, One CopyObject Response

    In Design

    DesignS3SSE-CChecksumCompatibility

    Featured Image for Two SSE-C Keys, One CopyObject Response

    This record explains the CopyObject SSE-C checksum response repair committed in SILO as e73436c99. Status on 2026-08-28: implementation, encryption and key-rotation tests, complete server suites, race tests, static checks, build, and independent …

    This record explains the CopyObject SSE-C checksum response repair committed in SILO as e73436c99. Status on 2026-08-28: implementation, encryption and key-rotation tests, complete server suites, race tests, static checks, build, and independent …

  • Config Environment Files Are Not Shell Scripts

    In Design

    DesignConfigurationCompatibilityOperations

    Featured Image for Config Environment Files Are Not Shell Scripts

    This record defines the startup contract for MINIO_CONFIG_ENV_FILE and explains the compatibility repair committed in SILO as 2aea7fe9c. Status on 2026-08-28: implementation, focused tests, the complete cmd and internal suites, tagged tests, race …

    This record defines the startup contract for MINIO_CONFIG_ENV_FILE and explains the compatibility repair committed in SILO as 2aea7fe9c. Status on 2026-08-28: implementation, focused tests, the complete cmd and internal suites, tagged tests, race …

  • BadDigest, InvalidRequest, and the CompleteMultipartUpload Checksum Contract

    In Design

    DesignS3CompatibilityChecksum

    Featured Image for BadDigest, InvalidRequest, and the CompleteMultipartUpload Checksum Contract

    This is the design, investigation, and verification record for SILO #48, with the decision boundary for the related SILO #50. Status: pgsty/silo#74 merged as 590aeaa7d, and pgsty/silo.pgsty.com#6 merged as 9805dd7; full local verification, remote CI, …

    This is the design, investigation, and verification record for SILO #48, with the decision boundary for the related SILO #50. Status: pgsty/silo#74 merged as 590aeaa7d, and pgsty/silo.pgsty.com#6 merged as 9805dd7; full local verification, remote CI, …

  • A ListObjects Shortcut Must Not Turn a Missing Bucket into an Empty One

    In Design

    DesignS3CompatibilityListObjects

    Featured Image for A ListObjects Shortcut Must Not Turn a Missing Bucket into an Empty One

    This document records the problem analysis, design discussion, and repair decision for SILO #32 and PR #37. Status on 2026-08-26: PR #37 was updated to the DCO-signed head e9c5340be, formally approved, and merged as 49c8aeac4; #32 closed …

    This document records the problem analysis, design discussion, and repair decision for SILO #32 and PR #37. Status on 2026-08-26: PR #37 was updated to the DCO-signed head e9c5340be, formally approved, and merged as 49c8aeac4; #32 closed …

  • One Endpoint, Two Privileges: Separating User and Group Status

    In Design

    DesignIAMsecurityCompatibility

    Featured Image for One Endpoint, Two Privileges: Separating User and Group Status

    This document records the discussion, repair, and final authorization design for upstream issue minio/minio#21478 and SILO PR #73. Status on 2026-08-26: SILO PR #73 was merged as 2e2377d1c, preserving the signed-off repair commit 58735ee38. All eight …

    This document records the discussion, repair, and final authorization design for upstream issue minio/minio#21478 and SILO PR #73. Status on 2026-08-26: SILO PR #73 was merged as 2e2377d1c, preserving the signed-off repair commit 58735ee38. All eight …

  • Conditional DELETE: Why the Condition Must Be Evaluated Once

    In Design

    DesignS3CompatibilityDELETE

    Featured Image for Conditional DELETE: Why the Condition Must Be Evaluated Once

    This document records the analysis, design discussion, and repair decision for SILO PR #12. Status on 2026-08-26: PR #12 remains open at head 5b71a75e, 118 commits behind the latest main. Its commit has no DCO sign-off and GitHub reports no check …

    This document records the analysis, design discussion, and repair decision for SILO PR #12. Status on 2026-08-26: PR #12 remains open at head 5b71a75e, 118 commits behind the latest main. Its commit has no DCO sign-off and GitHub reports no check …

  • Why CompleteMultipartUpload Must Return ChecksumType: Review of PR #57

    In Design

    DesignS3CompatibilityChecksum

    Featured Image for Why CompleteMultipartUpload Must Return ChecksumType: Review of PR #57

    This is the design, review, and decision record for SILO #47 and PR #57. Status on 2026-08-26: PR #57 was approved and merged as a96116b1; #47 closed automatically. All nine checks on the tested PR head passed, followed by green Go CI and VulnCheck …

    This is the design, review, and decision record for SILO #47 and PR #57. Status on 2026-08-26: PR #57 was approved and merged as a96116b1; #47 closed automatically. All nine checks on the tested PR head passed, followed by green Go CI and VulnCheck …

  • Optional Checksums, Mandatory Failure: Repairing UploadPart and UploadPartCopy Compatibility

    In Design

    DesignS3CompatibilityChecksum

    Featured Image for Optional Checksums, Mandatory Failure: Repairing UploadPart and UploadPartCopy Compatibility

    This is the complete design and implementation record for SILO #46. The repair was not merely a changed if statement. One apparently optional S3 header reached into multipart completion semantics, copy responses, compression and encryption pipelines, …

    This is the complete design and implementation record for SILO #46. The repair was not merely a changed if statement. One apparently optional S3 header reached into multipart completion semantics, copy responses, compression and encryption pipelines, …

  • When the Total Is Unknown: Folder Download Progress

    In Design

    DesignConsoleDownload

    Featured Image for When the Total Is Unknown: Folder Download Progress

    Status: Shipped in SILO Console 2.2.0 (16960f7ab); the server embeds it since its Console pin was updated (4d6e1ea8e) · Priority: P1 · Owner: pgsty/silo-console · Related issue: pgsty/silo#62 · PRD review: Claude Fable 5 (xhigh) — APPROVE · …

    Status: Shipped in SILO Console 2.2.0 (16960f7ab); the server embeds it since its Console pin was updated (4d6e1ea8e) · Priority: P1 · Owner: pgsty/silo-console · Related issue: pgsty/silo#62 · PRD review: Claude Fable 5 (xhigh) — APPROVE · …

  • Preview Text, Never Execute It: SILO Console Text Preview PRD

    In Design

    DesignConsolepreviewsecurity

    Featured Image for Preview Text, Never Execute It: SILO Console Text Preview PRD

    Status: shipped in SILO Console 2.2.0 · Owner: pgsty/silo-console · Tracking: pgsty/silo#17 · Review: consensus of product, security, and frontend architecture reviews SILO Console can preview images, PDFs, audio, and video, but not the small logs, …

    Status: shipped in SILO Console 2.2.0 · Owner: pgsty/silo-console · Tracking: pgsty/silo#17 · Review: consensus of product, security, and frontend architecture reviews SILO Console can preview images, PDFs, audio, and video, but not the small logs, …

  • DSN-Only Database Notifications: A Compatibility Boundary for #53

    In Design

    DesignNotificationCompatibility

    Featured Image for DSN-Only Database Notifications: A Compatibility Boundary for #53

    This document is the product requirements and final design record for SILO issue #53. It records the accepted compatibility boundary, implementation, and verification for PostgreSQL and MySQL bucket-notification targets. Decision SILO will retain …

    This document is the product requirements and final design record for SILO issue #53. It records the accepted compatibility boundary, implementation, and verification for PostgreSQL and MySQL bucket-notification targets. Decision SILO will retain …