Mahesh Ghamand

S3-Split sits transparently between client applications and upstream object storage providers (AWS S3, Cloudflare R2, MinIO, Wasabi). It intercepts incoming S3 REST requests, validates SigV4 HMAC signatures, verifies real-time byte quota limits against a PostgreSQL object registry, and reserves chunk parts during multipart uploads to prevent concurrent over-allocation leaks.

• Engineered via Specification-Driven Agentic workflows: validated SigV4 HMAC compliance and quota locks using automated integration test suites and concurrent multipart stress tests.
• Partitions a single physical bucket into hundreds of virtual prefix 'Managed Buckets' authenticated via scoped Client Keys (s3s_ck_...).
• Transparently proxies PUT, GET, DELETE, and multipart operations with 100% AWS SDK drop-in compatibility and zero client code rewrites.
• Maintains relational PostgreSQL object registry with continuous baseline upstream scanning for sub-millisecond quota lookups.
• Protects master upstream credentials using AES-256-GCM authenticated encryption at rest.

// Drop-in AWS SDK v3 configuration with zero client changes
import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";

const s3 = new S3Client({
  region: "us-east-1",
  endpoint: "https://s3-split.mahesh0.dev",      // S3-Split Gateway
  credentials: {
    accessKeyId: "s3s_ck_live_9a7d2e4f1b8c",   // Scoped Client Key
    secretAccessKey: "s3s_sec_4f1b8c9a7d2e4f", // Scoped Secret Key
  },
});

// Byte-accurate storage quotas enforced transparently before writing upstream
await s3.send(
  new PutObjectCommand({
    Bucket: "marketing-assets", // Managed Bucket (Virtual Prefix)
    Key: "reports/q3-summary.pdf",
    Body: fileStream,
  })
);

Repo Backups connects GitHub organizations with strict read-only permissions to archive complete commit graphs into deterministic, point-in-time Git bundles (.bundle). Unlike flat tarballs or zip archives that discard branch pointers and tag histories, native Git bundles preserve every commit SHA, merge parent, branch ref, and annotated tag cryptographically.

• Engineered via Specification-Driven Agentic workflows: validated packfile integrity and ref completeness via automated git bundle verify checks and round-trip clone test suites.
• Headless automated worker streams verified Git bundle packfiles directly to AES-256 KMS / SSE-S3 encrypted private object storage.
• 1-command native disaster recovery: 'git clone <bundle-file>' restores all local and remote branches offline without proprietary tooling.
• Implements automated rolling retention windows per repository, safely pruning older bundles to control storage growth.
• Strict data governance: Disconnection halts backup jobs while preserving archives; user-initiated Archive Purge permanently cleans S3 and DB records.

# Step 1: Download timestamped bundle via presigned URL
curl -o core-api-2026-09-22T040000Z.bundle "https://s3.amazonaws.com/vault/..."

# Step 2: Cryptographically verify packfile and ref completeness
git bundle verify core-api-2026-09-22T040000Z.bundle
# Output: The bundle records a complete commit graph. OK.

# Step 3: 1-command complete restoration with full branch trees
git clone core-api-2026-09-22T040000Z.bundle restored-core-api
# Rebuilds main, all release branches, and annotated tags natively

SQL Backups provides enterprise-grade database backups engineered around a memory-bounded streaming architecture. It extracts database records in batched cursor streams and pipes them on-the-fly through Gzip compression directly into S3-compatible storage, completely eliminating temporary dump files and local disk exhaustion on large production databases.

• Engineered via Specification-Driven Agentic workflows: validated zero-disk memory-bounded streaming via heap profilers and database round-trip restore integrity tests across PostgreSQL, MySQL, and libSQL.
• Dedicated dialect exporters for PostgreSQL (DDL, constraints, sequences), MySQL (connection pools, table locks, auto-increment), and SQLite / libSQL / Turso (sqlite_schema, sequence capture).
• Dual-object upload generates companion .manifest.json sidecars recording table names, row counts, and sizes for instant inspection without downloading large dumps.
• Native interoperability with self-hosted SeaweedFS, AWS S3, Cloudflare R2, and MinIO backends using multipart upload protocols.
• Timezone-aware cron scheduler with automated retention pruning and AES-256-GCM credential encryption at rest.

-- Direct in-process streaming backup: remote libSQL / Turso SQLite
PRAGMA foreign_keys = OFF;
BEGIN TRANSACTION;
CREATE TABLE "users" (
  "id" INTEGER PRIMARY KEY AUTOINCREMENT,
  "email" TEXT NOT NULL UNIQUE,
  "created_at" TEXT NOT NULL DEFAULT (CURRENT_TIMESTAMP)
);
INSERT INTO "sqlite_sequence" ("name", "seq") VALUES ('users', 4281);
INSERT INTO "users" ("id", "email") VALUES (1, 'admin@example.com');
COMMIT;

/* Companion .manifest.json generated alongside:
{
  "engine": "libsql",
  "tables": [{ "name": "users", "rows": 4281 }],
  "uncompressedBytes": 1428570,
  "checksum": "sha256:7a4f912c4e..."
}
*/