The testnet instance

https://testnet.permafrost.live is a hosted testnet instance of Permafrost: an authenticated S3 endpoint behind a TLS edge, storing to Walrus on Sui testnet under the operator’s own key, with a tenant per user.

This page is written from witnesses on this instance only. A claim that was proven somewhere else is listed under not proven here, not under proven.

What runs

• The root is an S3 endpoint. An unauthenticated request there is answered 401 by the authorization filter. That is the edge working, not an outage.
• /portal is the human door — a page where a key holder can see their tier, quota and keys, and rotate a key. It needs no credential to open.
• /v1/api/verify needs no credential. Anyone can ask whether Permafrost holds provenance for a hash.
• Everything else is authenticated: your issuer’s token, or a key from an invite.

When it is up

The instance is stopped between evaluation windows. That is deliberate: it is a testnet instance run by one operator, not a production service, and it costs nothing to leave it stopped. While a team is evaluating or integrating, it runs continuously for that window.

If you arrive and the host does not answer, it is off, not broken. Ask for a window when you request access; the resume is one command on our side.

While it is up, nobody is watching it automatically. A failure would be noticed by you before it is noticed by us. When a team’s use makes the instance run continuously, that is the moment monitoring goes on — until then, the honest statement is the one above.

What is proven on this instance

Every line below was exercised on this instance, through its public edge, as a team would script it. The run that proved it is named in the page badge.

Claim	Where it is exercised
Reachable over TLS at a stable name; only ssh, http and https are open from outside	this page
A team onboards with its own issuer; a tenant appears on first use, no key minted	Bring your own issuer
The invite path works: minted, redeemed once, a second redemption refused, revocable	Onboard with an invite
Bucket · PUT · GET byte-equal · HEAD carrying the blob id once certified · DELETE · 404 after	Store, read back, and know when it is certified
Objects reach Walrus and are read back from it, not from a local copy	same guide
Media in parts: a many-part upload completes, reads back byte-identical, serves a correct byte range	Upload media in parts
A tenant’s data is isolated on the S3 surface; every cross-tenant operation refused and logged	Tenancy
Objects are encrypted at rest; the daemon reports the engine enabled at start-up	Encryption at rest
An ordinary upload mints its manifest receipt on Sui	Read your receipt on Sui
Custody: store → serve → incinerate → certificate on Sui → 410 from then on	Hold, serve, incinerate
One tenant cannot starve another: one tenant throttled at its ceiling while a second, bursting at the same moment, was answered	Headers, status codes, 401 and 429

What is not proven here

• Quota enforcement. Quota is recorded and shown; driving a tenant past its ceiling has not been exercised on this instance.
• Lease renewal. The renewal sweep and the expiry alarm are live but have not run against a stored asset on this instance.
• Monitoring. Nothing watches the instance; see When it is up.

Known and deliberate

• Bucket names are visible across tenants. Contents are not. A HEAD on someone else’s bucket name answers.
• Token-lane tenants have no self-service view. /portal and /me authenticate by key. A team on the issuer lane sees its usage on our operator surface, on request.
• Multipart parts are not encrypted by us, even though single objects are. A team that needs it encrypts before upload.
• Rate isolation holds within one instance. This is one instance.

How a team starts

1. With an invite (the quickest first touch): we mint a one-time link, you redeem it and receive a key, and /portal shows you your tenant. → Onboard with an invite
2. With your issuer (the integration path): you send one JSON object describing your issuer, we enable it, and your users’ signed tokens are their credentials. → Bring your own issuer
3. Then the Quickstart.

Requests, windows and issuer configuration: hello@permafrost.live.