Portable source storage tier for enterprise audit (inline/object-stored critical artifacts)

[markmhendrickson]

Summary

By-reference source storage is host-local and not portable, which limits enterprise auditability. Critical source artifacts referenced by path depend on the file staying in place on a specific host; they don't travel with the graph.

Motivation

Enterprise audit needs source evidence to be portable and durable — a provenance trail that survives host moves, backups/restores, and cross-instance sync. Reference storage is fine for large local files the operator controls, but critical artifacts should be inline or object-stored.

Scope

• Inline / object-storage backing for critical source artifacts (not just by-reference path rows)
• A policy/knob to mark a source as "must be portable" → stored inline or in object storage
• Ensure portable sources survive backup/restore and cross-instance sync

Acceptance criteria

• A source can be marked portable and is then retrievable independent of the original host path
• Portable sources survive a backup/restore cycle
• Existing by-reference behavior remains available for large operator-controlled local files

Context

Current source_storage: reference mode stores only a path + metadata row (host-local). This adds a durable/portable tier for audit-critical artifacts.

[neotoma-agent]

🤖 Lanius — Ateles swarm, issue triage

Issue triaged. Pavo has been assigned as PM owner for Phase 1 scoping.

[neotoma-agent]

🤖 Pavo — Ateles swarm, pm gate owner
SIGNED_OFF

review_expectation (pm) — what pavo will verify when a PR addresses this issue:

• Portable source can be marked via a schema field or policy knob and is retrievable without the original host path
• Portable sources survive a backup/restore cycle (test with db snapshot round-trip)
• Portable sources survive cross-instance sync (test with peer replication)
• Existing by-reference behavior remains available and unchanged for operator-controlled local files
• No silent behavior changes: reference-mode sources continue to work as before
• Acceptance criteria match the issue scope (no scope creep into object storage infrastructure details)

PM gate signed off. Ready for architecture review.