Skip to content

Candidate Capture Vault — Sealing Discipline

Store: rtopacks-candidate-capture-prod / rtopacks-candidate-capture-dev (R2). Class: sealed custody (no D1 schema). Created: SHARED-SPINE-STORES-01 (2026-07-08), outside Terraform (wrangler); IaC debt owed to TERRAFORM-V5-RECONCILIATION-01.

Holds: ID images, session recordings, attestation documents, consent-sealed artefacts — the capture bytes the intake pipeline seals. The D1 side (rtopacks-intake.capture_ref) carries the metadata (object_key, digest, capture_type, anchor_grade); the bytes live here.

The sealing contract

  • Digest-sealed at landing. Every object's sha256 is recorded in rtopacks-intake.capture_ref.digest. Proposed object-key convention: {engagement_id}/{capture_type}/{digest}.
  • Immutable — amendments are new objects, never overwrites. R2 has no native write-once; immutability is enforced by the consuming surface's write path (put-if-absent by key; an overwrite is a defect). Documented here, enforced with the surface (out of scope for the store-creation brief).
  • Recordings carry their own retention posture, distinct from the document floor (llnd-00, held). The retention values are configured defaults set with the consuming tile — not constants minted at store creation.
  • Biometric-adjacent sensitivity (session recordings, ID images): the classification is recorded here; the access posture (which operator roles may view captures) binds with the surface, not at store creation.

Scope note

SHARED-SPINE-STORES-01 created the bucket pair only — it lands no objects and mounts no surface. Capture logic (consent-gated capture, digest-sealing at write, immutability enforcement, retention values, access posture) rides the first consuming tile (LLND), which exercises it against a live consumer. Distinct from rtopacks-rpl-evidence-* (the RPL tile evidence vault, a later create) and from rtopacks-documents / rtopacks-media (existing, unrelated).