Cloudflare R2 for Product Journey Evidence

Cloudflare R2 for Product Journey Evidence is Reshot’s reachable S3-compatible storage path for private evidence objects, outward artifacts, content-addressed Publications, and signed Release Book exports. The implementation verifies stored bytes rather than treating an accepted upload as proof.

Two storage boundaries

Public outward assets and private evidence must not share accidental access. The configuration supports a public asset bucket/domain and a separate private record bucket. Private storage fails closed when the record bucket is missing or aliases an exposed public configuration.

Public assets can use a custom CDN domain. Private objects require authorized server access and never rely on a public URL.

Configuration

The server uses:

• Cloudflare account ID;
• R2 access key ID and secret;
• public asset bucket;
• optional dedicated private-record bucket;
• public custom domain for intentional outward assets;
• endpoint, region, and path-style settings for compatible environments.

Credentials remain server-side. Production startup rejects local fallback when durable object storage is required; build-time checks may avoid network access without weakening runtime validation.

Content-addressed writes

Evidence and outward artifacts use stable object paths and content hashes. Upload metadata records relevant identity such as Release Book ID or SHA-256. After upload, the implementation can HEAD the object, download bounded bytes, and recompute the hash.

A mismatched size or hash fails publication/export. This prevents an API success response from standing in for verified storage.

Release Book export

The Release Book exporter writes a signed JSON bundle to private record storage and an intentional public path. It verifies both copies by object length and downloaded SHA-256 before returning the artifact and public path.

The artifact records Journey and Journey Version lineage, content address, media type, size, Release Book identity, signed payload hash, and public-key fingerprint.

Renditions and Publications

Rendition workers can store output bytes in R2. Publication delivery storage uploads, checks, and downloads exact objects. Stable application URLs can resolve to content-addressed R2 paths while immutable asset identity remains preserved.

Do not expose a private Observation merely because it already exists in object storage. Public delivery requires a sanitized approved Rendition and Channel policy.

Direct uploads

CLI and application flows can use presigned URLs for direct object upload. The client sends bytes to R2 without application authorization headers. The application then commits metadata through its transactional API and verifies the expected object.

Presigned URLs are bounded credentials. Limit expiry, method, path, content type, and size. Do not log them or treat them as stable public URLs.

Retention and deletion

Private evidence retention resolves legal holds and policy before deletion. The implementation deletes R2 bytes first, then marks the database row purged. A failed object deletion does not mark the record complete; the job retries.

This ordering prevents metadata from claiming deletion while bytes remain. Public Publication retention and historical release obligations may use different policies.

Range and bounded reads

Evidence services apply maximum byte sizes and can use range reads. Avoid unbounded downloads from untrusted metadata. Verify media type, expected size, and checksum before parsing or displaying artifacts.

Privacy and access

Separate public and private buckets, use least-privilege tokens, rotate credentials, and configure explicit CORS for direct upload. Keep sensitive evidence encrypted in transit and at rest, enforce workspace authorization before download, and avoid predictable public paths for private records.

R2 storage does not decide whether an artifact is safe to publish. Review, redaction, and Publication policy do.

Failure handling

Classify missing configuration, upload error, object absence, size mismatch, checksum mismatch, download limit, and deletion failure separately. Record retries and do not return a Publication receipt until exact bytes verify.

For a compromised credential, rotate keys, audit object access, inspect published/private boundary, and invalidate presigned flows. Preserve incident and correction records.

Setup procedure

1. create separate public and private buckets;
2. create least-privilege API credentials;
3. configure custom public domain for intentional assets;
4. set server environment variables;
5. verify production storage preflight;
6. upload a non-sensitive fixture through the supported path;
7. HEAD, download, and hash-check it;
8. verify private object cannot be fetched publicly;
9. test retention deletion and retry behavior;
10. seal and verify a synthetic Release Book export.

What this page does not claim

Reshot does not claim that Cloudflare R2 itself provides Journey semantics, Review, Publication policy, or release truth. It is the storage layer. It also does not claim Vercel or another provider integration merely because a deployment can reach S3-compatible storage.

Continue with the Release Book Verifier, Product Journey API, and Product Journey Import, Export, and Portability.