Persist A2A artifacts as verifiable facts.

Follow one evidence chain

Executing event → one A2A send → task recovery handle
  → direct GetTask polling (no business resend)
  → bounded terminal parts → unique staging object
  → conditional-create final object → length + SHA-256 verification
  → immutable PostgreSQL registration → authorized verified read

The final key is deterministic for the exact tenant, run, logical invocation, physical attempt, origin event, Tool, remote identities, and part position. Exact retries converge. An existing object with different bytes is an integrity failure, never an overwrite opportunity.

Keep metadata, bytes, and authority separate

Private bytes

Startup performs a real put, conditional copy, read, repeated-copy rejection, and delete probe. A backend that cannot prove immutable final publication is rejected before traffic.

Immutable registry

PostgreSQL binds canonical reference bytes and digest, content length and digest, origin run/event, same-tenant parents, idempotency key, and a private locator. Object I/O never runs inside its transaction.

Authorization first

The exact principal and tenant-qualified identity are authorized before registry lookup, preventing existence or locator disclosure.

Verified resolution

Captured version/ETag preconditions are applied when available. Complete length and SHA-256 verification finishes before any byte is returned.

Build and probe the exact production backend

let objects = S3CompatibleBackendBuilder::from_env(bucket, region)?
    .with_https_endpoint(endpoint)?
    .with_conditional_copy(S3ConditionalCopy::AmazonMultipart)
    .with_sha256_checksum()
    .with_kms_key_id(kms_key)?
    .build()?;

let artifacts = Arc::new(StateKnotArtifactStore::initialize(
    objects,
    Arc::new(postgres_store.clone()),
    Arc::new(read_authorizer),
    "production-artifacts-v1",
    options,
).await?);

let remote = A2aRemoteAgent::bind_with_durable_artifacts(
    descriptor, client, "answer", delivery, recovery, schemas, artifacts,
)?;

AWS S3 uses the multipart conditional-copy strategy. Other compatible providers may require a documented destination-precondition header and status. Test the exact endpoint, bucket policy, encryption policy, and workload identity; do not infer atomic behavior from an S3-compatible label.

from_env imports only credential-selection variables. Environment endpoints, HTTP enablement, metadata overrides, unsigned requests, retry behavior, bucket/region selection, and encryption settings cannot bypass this builder. Configure a non-default web-identity STS endpoint explicitly through with_https_sts_endpoint.

Treat URL parts as a separate egress boundary

• Allow only exact production HTTPS origins with explicit IP pins.
• Revalidate every redirect hop; reject URL credentials and fragments.
• Disable environment proxies, implicit retries, cookies, automatic redirects, and transparent content decoding.
• Require identity encoding, consistent media types, and bounded declared and observed lengths.

Literal loopback HTTP is reserved for tests or a managed same-host sidecar. Tool limits further bound artifact count, total bytes, each part, and the completion projection.

Bound resources and operate cleanup explicitly

One process-local permit covers each complete ingest or materialized-read path. Configure lifecycle rules for abandoned multipart uploads and stateknot/staging/v1/. Alert whenever staging_cleanup_failures() increases. Never apply a blind age rule to final objects: until registry-aware collection ships, reconcile suspected orphans against PostgreSQL before deletion.

Know what the evidence proves

Tests cover exact retries, tampering, authorization-before-lookup, URL policy, multipart ingestion, full reads, real PostgreSQL registration, migration 17→18, and no-resend terminal-task recovery over both HTTP+JSON and JSON-RPC. Read the complete deployment and verification guide before enabling the boundary.