- Shipped
- November 8, 2026 at 1:09 AM UTC
- Author
- Kamo
- Commit
- 2b2438c
- Resource upload writes the raw kb bucket, so it goes through AntivirusUploadGuard (KB) before anything touches storage: 422 ANTIVIRUS_BLOCKED (nothing stored) / 503 ANTIVIRUS_UNAVAILABLE, answered in that shape by the controller. - The content hashes ride on the object as user metadata (kamo-blake3 / kamo-sha3), so every presign site (single URL, batch, library tiles, platform help) looks up the content's global verdict first: a locked or still-checking resource is never signed (423 on the single URL, no URL for a tile). Resources stored before this carry no hashes and are not judged here. - ConfigMap kamo.antivirus.* (enabled: false until KamoAntivirus is Ready); ANTIVIRUS_INTERNAL_AUTH_SECRET from mlos-internal-auth.