---
id: ADR-PFM-DJE-012
title: Direct multipart upload with recorded object identity
product_area: platform
module: data-job-engine
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
decision: >-
  Input bytes travel directly to signed storage parts; completion assembles the
  object before recording its size, version and available digest in the upload
  session.
constrains:
  - DOM-PFM-DJE-003
  - STATE-PFM-DJE-003
  - WF-PFM-DJE-010
  - SVC-PFM-DJE-data-jobs
origin: >-
  services-platform:docs/proposals/rhythm-data-job-engine-plan.md §6.2 inputs,
  §16 source files (approved 2026-10-12)
alternatives:
  - option: Proxy file bytes through the API
    why_not: API payload and execution limits would restrict supported files.
  - option: Accept caller-chosen storage locations
    why_not: >-
      Uncontrolled locations would weaken workspace isolation and stable input
      references.
consequences:
  - The multipart design supports the declared maximum of 5 TiB.
  - >-
    Large-file digests can remain producer claims when storage supplies no
    digest.
  - >-
    A crash after storage completion but before the session write lacks a proven
    recovery path.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a65: services/uploads/upload-sessions.ts (module
    comment); docs/data-jobs/uploads.md
---

# Direct Multipart Upload With Recorded Object Identity

## Context

Input files can exceed request and function limits.

## Decision and Origin

Input bytes travel directly to signed storage parts; completion assembles the object before recording its size, version and available digest in the upload session. The origin recorded above supplies the authority for this choice; implementation evidence supplies the limits described here.

## Alternative Comparison

Proxy file bytes through the API: API payload and execution limits would restrict supported files.

Accept caller-chosen storage locations: Uncontrolled locations would weaken workspace isolation and stable input references.

## Consequences

The multipart design supports the declared maximum of 5 TiB.

Large-file digests can remain producer claims when storage supplies no digest.

A crash after storage completion but before the session write lacks a proven recovery path.