Design journal
How Chum is built, decision by decision — each post resolves to the real artifacts it describes.
- The hole in my own claim I have been saying Chum lets you verify a bucket's history without trusting the operator. I read my own code again, and that is not true yet — the records are signed by my server's key, and nothing outside my server ever commits to the head. Here is exactly what Chum does prove, what it does not, why the fix is not a louder claim, and what a verifiable-storage guarantee can honestly be.
- Making chumd observable and abuse-resistant How chumd became operable without changing the domain: one structured log line and a request ID per request, a dedicated Prometheus registry served at /metrics, and a default-off per-IP token-bucket limiter wired inside the obs middleware — with the trusted-proxy X-Forwarded-For subtlety that keeps the limiter from being trivially spoofed.
- Multipart assembly: one object's identity as a Merkle root of its parts A multipart upload assembles many uploaded parts into one logical object — but what is that object's identity? SP7 makes it a Merkle root over the part CIDs, not a re-hash of the concatenated bytes: a signed pointer record names a manifest blob, the manifest commits to each part's CID, and every part is itself a real content-addressed blob. Partial verification falls straight out of the structure, and a dedup-safe reaper session-sweep is the only thing that ever deletes a byte.
- Deletion done right: tombstones, a write journal, and a guarded purge How deletion works in a content-addressed, de-duplicated, append-only store — a signed tombstone that removes the name not the proof, a two-phase substrate plus write-intent journal that lets the reaper reclaim only crash-orphaned bytes without ever scanning, and an operator-only signed purge that surfaces as ErrPurged.
- Reaching a durable substrate How Chum's content-addressed substrate became production-grade: a streaming integrity decorator that fails closed on any backend, an S3-compatible CAS, and a hardened filesystem default — all behind an unchanged seam.
- Building the AT Protocol pointer store How the mutable naming layer became a content-addressed, offline-verifiable record chain — replacing a bespoke signing scheme with canonical DAG-CBOR records, did:key P-256 signatures, and a blockstore that an MST layer can later reuse without re-encoding.
- Ratifying SP0 — choosing the auth and substrate ADRs How we closed the two foundational architecture decisions that unblock the entire Track C production-storage path: DID-signed service-auth JWTs for the data path, and a standalone CID-keyed blob store owned by Chum.