docs backend evidence cd ZD 03

ZD-03 — Independent private storage

Status: LOCAL_DONE / INTEGRATION_PENDING Validation: PASS (source); live migration and zero-diff OWED

B-BR-CD-ZD-05: Only one storage process may write the private media directory. API/worker rollouts must not carry or restart storage. Singleton Recreate Deployment and ClusterIP Service stay outside the release agent patch scope. The public signed host/path/bucket and S3 Host header remain unchanged; only internal proxy forwarding changes, opt-in on development/owned staging only.

BUC-CD-ZD-03: After reviewing the signed source images, the operator stops only the API Deployment in a scheduled staging window, waits for its storage process to exit, starts singleton storage against the existing directory, then restores the API with service forwarding. No overlap, volume deletion, secret rotation or other namespace. Verify signed upload/private read and R2 zero-diff; rollback stops singleton storage before restoring the old pod. Live application requires an explicit owner yes and remains OWED.

Manifest tests use JSON (a Kubernetes YAML subset) for the affected deployment and new objects so their complete structure can be tested with Python stdlib; no new YAML parser/runtime dependency is introduced.

Validation on parent 30160e51 plus task: RED sidecar still present and service forwarding ignored; GREEN structural singleton/no-media-mount/ClusterIP and render/shell-variable tests, config negative scope matrix and HTTP race tests. Entire HTTP integration suite includes the preserved existing signed peer roundtrip and a new real MinIO fixture: signed PUT/GET, unsigned read 403, forged signature 403, synthetic object cleanup. Both infra gates (7 refusal checks), affected vet/gofmt, startup shellcheck and diff-check pass.

No deploy-agent RBAC expansion: it still cannot modify Services/ConfigMaps and its rollout patches remain limited to API/worker. The source ConfigMap retains the installed MinIO startup/private policy and credential references; only its S3 listener becomes pod-network reachable, console stays loopback. Worker S3 calls retain the same signed public endpoint through the API proxy, which forwards to Service DNS. No existing URL is rewritten.

The migration must use the signed API build containing the opt-in switch; applying these manifests against an older API image is unsupported. Automatic release publishing does not apply these topology manifests. Bootstrap is a scheduled explicit operator step, not a zero-downtime claim.