docs(buck2): record CAS origin prototype

[schickling-assistant]

Problem

Decision 0034 uses immutable GitHub Release assets as the durable origin and the shared CAS only as an accelerator. The existing bazel-remote also exposes a digest-addressed HTTP CAS, but the consumer, authentication, offline, action-cache, and retention behavior had not been exercised together.

Goal

Retain a reproducible experiment record that lets the durable-origin options be re-derived without making a new architecture decision.

Decisions

No architecture decision. The experiment uses the current public @overeng/utils package tarball because no buck2-product-v3-utils-* release exists, and records that fixture difference explicitly.

Verification

axe vrs check --profile strict context/buck2:

axe vrs check: ok

Observed on bazel-remote 2.6.2:

• authenticated correct-digest PUT: 200; wrong-digest PUT: rejected with checksum mismatch;
• read-public mode: Nix pkgs.fetchurl, pnpm URL dependency, and Buck2 http_file all returned byte-identical artifacts;
• strict Basic auth: pnpm passed, pkgs.fetchurl and Buck2 http_file failed at their current credential boundaries;
• Buck2 incremented CAS GET hits by one and left action-cache counters at zero; its warm repeat used 0 network bytes;
• pnpm recorded the independently computed SHA-512 but frozen offline reinstall still required the direct tarball.

The scratch service and Buck daemons were stopped; ports 50045/50046 were verified closed.

Complexity

No production machinery. One evidence record only.

Concerns

The successful transport probes do not establish durable retention: the measured service is a bounded LRU cache. A publicly readable CAS also cannot contain private artifacts, and the current Nix/Buck HTTP consumers cannot use the strict Basic-auth shape without a different fetch boundary or client support.

Friction & bottlenecks

• The requested buck2-product-v3-utils-* fixture does not exist; the current buck2-package-v1-overeng-utils-* release is the available public tarball.
• The released package has direct-URL runtime dependencies, so pnpm 11 requires blockExoticSubdeps: false; this is transport-independent and already anticipated by the composition bakeoff.
• The fleet heavy-command admission wait dominated two Buck wall times; inner build times and gate-wrapped wall times are reported separately.

Follow-ups

None created: this PR deliberately supplies evidence without selecting among release assets, a durable CAS backend, or another retained origin.

References

• Decision 0034: artifact-default composition without a registry
• Decision 0033: public/private cache trust tiers
• Decision 0013: shared cache foundation
• Public fixture release: https://github.com/overengineeringstudio/effect-utils/releases/tag/buck2-package-v1-overeng-utils-5ec4fb7b529fb020ab4159491fe46ad8a36c9a8859370236f426eba925953f2b

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.t3mkm4sd
session	unknown
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.1.14
agent_runtime	OMP 18.1.14
tooling_profile	dotfiles@5d1e05f

[schickling-assistant]

Superseded: this record landed on main via #1319 (experiments) / #1301 (key-stability evidence, DELTA-001 removal). Closing per the 2026-09-22 stack handoff.