Retrieval after original storage loss

Scope

This experiment copies the original signed artifact response to a separate read-only Sprite. It transfers only public artifact bytes: no source snapshot, sessions, private signing key or rewritten signature. The mirror has a separate filesystem and survives deletion of the original storage Sprite. Both run in the same Fly account/provider, so this is machine-loss isolation, not independent administration, provider resilience or automatic protocol replication.

The mirror is a finite Python experiment fixture, not a new production Skein runtime or write-admission endpoint. It serves exactly one artifact path, refuses writes and other paths, limits the response to 16 KiB and concurrent handlers to eight, uses five-second socket timeouts, and shuts down after fifteen minutes. Socket timeouts are not an absolute total-request deadline. Its cohort-secret URL prefix is private test access control, not protocol identity.

Procedure

A publisher creates synthetic observations and signs an artifact on the original Rust node. Its short-lived Beacon advertises the artifact locator and key fingerprint. The operator saves that reference, copies the public response to the mirror and checks equality before deleting the publisher and original storage. The mirror process then cold-restarts from its own file, and the original URL is checked for failure. The reader starts after the original discovery lease elapses.

The fresh reader receives only the original pinned fingerprint, artifact ID, mirror URL, campaign identifier and decision criteria. It must verify the original signature and text binding before using the observations. The signed payload still names the original receiving node: historical read verification is not a new publication or replay against the mirror. There is no re-signing or conversion of the original admission into a new storage permission.

Controls and limits

python3 scripts/test_artifact_mirror.py checks exact response retrieval, wrong paths, write refusal and rejection of mirror-modified text by the pinned-key shell verifier. The model trial uses OpenCode 1.18.27 and ~z-ai/glm-flash-latest, forty steps and a five-minute limit per agent. The operator independently checks the selected profile and unpredictable observation ID against the withheld fixture.

This tests an operator-arranged copy and saved-reference retrieval. It does not test discovering a replica, independent retention policy, automatic repair, revocation, cross-provider loss, or the empirical truth of signed observations. Without the retained bytes and a way to locate them, a valid signature alone cannot provide availability. Raw evidence stays in outputs/research-mirror-v1/.

Result

The mirror retained the signed record and served it after both the publisher and original storage Sprites were deleted. Its process cold-restarted from its own file first. The fresh reader then fetched from the mirror, verified the signature against its saved fingerprint and locator, recovered the withheld observation ID and correctly selected P2 at 216 mJ. The operator independently verified the same record and choice. The reader's tool trace includes a successful shell-verifier exit status; this is not based only on its self-report.

The original artifact URL returned a non-JSON response after deletion. The initial harness expected a network/HTTP exception and stopped before starting the reader. The check was corrected to treat failure to retrieve the expected artifact as unavailability. The still-fresh reader then ran without changed inputs. This orchestration failure is retained in raw evidence; it was not an artifact loss.

Publisher duration: 90.68 seconds. Reader duration: 28.75 seconds. Provider usage delta: $0.011237246. All four Sprites were destroyed. Public artifact and bookmark verification data, aggregate results and evidence hashes are under docs/results/research-mirror-v1/. The public bookmark omits the private test URL.

One report error is retained: the reader said P4 failed both selection thresholds; it failed only latency. This did not change the qualifying set or correct choice. No reuse acknowledgment was published because the mirror was read-only. The observatory preserves the source publication; reader actions are in the report and tool evidence, not fabricated conversation messages.

This establishes retrieval from an explicitly located retained copy after original machine loss. It does not establish independent operators, automatic repair or replica discovery. Next test a fresh reader against substituted or corrupted mirror responses, then consider separately administered storage and replica location.