Data Vault

Navigate minimized owner-scoped protected-object metadata today and design future client-encrypted upload, purpose-bound retrieval, controlled sharing, retention, and erasure workflows without making the gateway a storage owner, key custodian, or cleartext proxy.

BUSINESS CASES

Where this module fits

protected document inventory and bounded directory navigation
client-encrypted multipart storage
purpose- and recipient-bound retrieval
controlled sharing and grant revocation
retention, recycle, restore, and cryptographic-erasure governance
private-to-public evidence reconciliation

PRIMARY CONSUMERS

Who integrates it

workspace data owners
records and compliance systems
document-processing agents
evidence and disclosure integrations

PREREQUISITES

What must exist first

vault:read for implemented private reads and a separately promoted vault:write contract for mutations
an authenticated active workspace derived from the bearer
classification, retention, legal-hold, encryption, quota, recipient, and disclosure policy
a client-side encryption and key-management boundary outside the gateway
caller-owned rules for evidence freshness, storage readiness, ticket handling, and public-anchor finality

RECOMMENDED WORKFLOW

Compose the module safely.

01
ingest live OpenAPI and use the bearer-derived workspace root; never submit a vault selector
02
list top-level objects, select by stable object identifier, and refresh current minimized detail
03
navigate directories one bounded level at a time instead of requesting or inferring a recursive tree
04
when promoted, create a bounded client-encrypted upload session and complete it only after every ordered part, digest, content root, and manifest commitment verifies
05
when promoted, request a short-lived subject-, purpose-, object-, version-, and audience-bound download ticket after current owner or grant authorization
06
when promoted, create, inspect, and revoke typed grants separately from invitations and delivery
07
reconcile retention, legal holds, grants, replicas, and key-destruction evidence before recycle, restore, or erasure
08
verify private owner state separately from public Explorer anchor and proof projections

AGENT INTEGRATION

Machine-use boundaries

Keep cleartext content, base64 payloads, encryption or decryption material, object names, recipient identities, tickets, opaque content roots, private storage endpoints, and raw storage metadata out of shared prompts, logs, analytics, caches, URLs, and agent memory.
Use stable object identifiers for navigation and reconciliation; names and paths are mutable presentation values and never authorization keys.
Treat storage_readiness=READY, encrypted_content_root, shard counts, event commitments, and anchor state as limited posture. None grants download, decryption, sharing, disclosure, retention change, restore, or erasure authority.
A sharing invitation is not a grant, a grant is not delivery, a ticket is not decryption authority, revocation cannot claw back previously obtained cleartext, and a database deleted flag or IPFS unpin is not cryptographic-erasure proof.
Traverse deliberately with bounded depth and re-read current owner or grant state before every dependent action; another workspace's object must remain indistinguishable from a missing object.
The ten legacy /api/v2/quantum/storage/* POST routes are bodyless 501 migration markers. Do not translate their legacy bodies or infer canonical request schemas from caller-selected vault IDs, base64 content, raw metadata, or direct-download behavior.
Never call a planned modern lifecycle contract until its exact operation appears in the live production OpenAPI document.

Register only production-listed routes as executable tools, and re-fetch the deployed OpenAPI before generating or sending a request. Source-ready routes awaiting deployment are preparation references; planned contracts are non-executable.

MODULE CONTRACTS

Every mapped endpoint

Each operation states whether its request shape is authoritative in OpenAPI, reviewed as a planning profile, or intentionally left as an outline pending an owner schema.