Cylinder: Draft 0.3 of the proposal 82739cfbafe2

Status: Draft 0.3 (proposal revision 3), 2026-10-12. Draft 0.2 added the

multi-party consensus, agent scopes and revset queries; 0.3 corrects the

MicroVM mount path, the reach of the file index, revocation, encryption,

leases and upstream quarantine, and keeps §7 open. C0 is built; the rest

is not. "Cylinder" is a working name (the artifact-repository idea parked

on 2026-10-02); nothing here is decided until Andy says so.

- **MicroVMs:** Flow's MicroVM tier runs on Firecracker, which has no

  virtio-fs, so a microVM gets the artifact as a block device: an ext4

  image served on the fly from the chunk tree (a userspace block device,

  ublk, or an NBD server), fetching blocks as the guest reads them and

  duplicating no bytes. That removes copying whole images onto each

  runner's disk without changing hypervisor. The syscall tier and

  containers mount the tree directly over `flow-casfs`; mounting it with

  virtio-fs would need Cloud Hypervisor or QEMU instead of Firecracker.

- **An SBOM with every artifact:** the job that publishes an artifact also

  records what it contains by package and version (an SBOM, itself an

  artifact named in the receipt's outputs), so "which artifacts hold a

  vulnerable version of this package" is a lookup, not a scan (§4.6).

  customer's own account and region, encrypted at rest by the store with

  customer-managed keys (for example S3 with a KMS key). Chunks stay named

  by the hash of their plain bytes: encrypting them on the client with

  separate keys would stop them deduplicating and stop peers checking them

  by hash.

**The inverted file index:** Because artifacts are trees of

content-addressed files rather than opaque tarballs, Cylinder keeps an

index from each file's hash to the artifacts that contain it:

- **Exact files, at once.** Given a known-bad file (a compromised binary,

  a leaked key, the exact `libcrypto.so.3` an advisory names), one lookup

  lists every container image, runner image and package across the fleet

  holding it, with no layers to unpack.

- **Not versions.** A patched or rebuilt library is a different file with

  a different hash, so this index does not answer "which images have a

  vulnerable version of OpenSSL". That comes from package identity: the

  SBOM each artifact carries (§4.3), indexed by package and version. The

  two together answer both questions; the file index alone answers the

  first.

- **Revocation without an outage.** When an artifact, base image or file

  is revoked in policy, admission hooks refuse new pods that use it at

  once. Pods already running are not touched by admission; a controller

  marks them, then replaces or evicts them within a grace period the

  policy sets, so one policy change cannot take production down.

safe automated retention without operational risk. A lease is signed by

a key scoped to leases and to its `scope`, and has a maximum length (a

day, renewed while the workload runs), so a compromised node cannot hold

storage forever or pin artifacts outside its own scope.

  packages from crates.io or npm, Cylinder proxies them into the

  organization's Strata store, locking the hashes into internal mirror

  channels. Upstream outages or deletions cannot break builds. Packages

  arrive compressed (`.crate` and `.tgz` are gzip), which chunks poorly,

  so the original archive is kept for clients that check its hash and its

  unpacked files are chunked as an artifact tree, where they deduplicate

  with everything else.

| Vulnerability search | Unpack and scan every layer | Exact files by one index lookup; versions by SBOM package index |

- **C0. Images in the hub (built 2026-10-12, oxygenhub #146).** Admin ›

  Runners › Images: every runner image, its size and architecture, where

  it is (the hub, each runner, swarm fetches in progress), the

  repositories whose jobs used it, and an image held nowhere marked.

- **C4. Leases and the indexes.** Kubernetes deployment lease operator

  for safe GC; the inverted file index and the SBOM package index; the

  controller that replaces revoked running workloads within their grace

  period.

These are Andy's decisions. Each carries the position proposed in review,

not an answer.

- **The name.** Proposed: keep **Cylinder**. It fits the elemental

  progression: *Oxygen* (VCS) is carried in *Cylinders* (artifacts) by

  *Jetstream* (the fleet), driven by *Flow* (pipelines).

- **Where it lives.** Proposed: first in `oxygenflow` as

  `crates/oxygen-cylinder`, beside `jet` and `flow`, to share `flow-casfs`

  and the chunking code; its own repository from C3.

- **Local builds.** Proposed: allowed, at the lowest assurance level

  (`local`); production channels require more (`tier-microvm` and

  `reproduced(2)`).

- **A public catalogue and federation.** Proposed: public hubs federate

  by publishing signed Strata bundles of channels and artifacts, checked

  offline with no central intermediary.

- **Its place in the queue.** Proposed: C1 alongside Jetstream's service

  boundary, so Jetstream's image store is built on Cylinder from the

  start rather than on a temporary mechanism. Against: the core work of

  2026-10-03 (Strata's remaining stores, agents, hub polish) waits

  longer.