distributor/docs/roadmap/http.md

Roadmap: HTTP Upload Extensions

Purpose

The HTTP upload API is implemented. Current behavior is documented in:

• CLI
• Configuration
• Operations
• Troubleshooting
• HTTP upload contract
• Application internals
• Ingestion internals

This roadmap records HTTP upload extensions that are intentionally not part of the current implementation.

Deferred Extensions

Authentication

• URL-token authentication for constrained clients.
• Additional token lifecycle tooling.
• Mutual TLS or other in-app identity mechanisms.

Archive Formats

• Zstandard-compressed tar archives.
• Additional content negotiation rules for future archive formats.

Status And Queue Durability

• Durable status persistence across process restarts.
• Database-backed queueing.
• Recovery semantics for queued or running uploads after a restart.

Producer Coordination

• Producer-supplied idempotency keys.
• Run retry endpoints.
• Run cancellation endpoints.
• Run listing endpoints.

Deployment Surface

• In-app TLS.
• Public exposure defaults.
• Browser UI.

Boundaries

Current HTTP upload behavior remains intentionally small:

• http_upload is source-only and is not a durable storage backend.
• Upload status is memory-only.
• Producers submit complete tar or gzip-compressed tar source bundles.
• Producers authenticate with Authorization: Bearer <token>.
• Public access policy, TLS termination, and rate limiting belong outside distributor unless a future roadmap explicitly changes that boundary.

Do not document deferred extensions as available outside docs/roadmap/.