Private artifact storage

researcher/artifacts/private/ is an ignored local default for SPEC-003 content-addressed bodies, reference records, storage bindings, freeze receipts, and locks. Deployments should configure a private root outside the public checkout.

ArtifactRef is portable and contains no storage locator. It records the target's native or legacy ID origin, and validation resolves the target kind and version before enforcing that schema's typed-ID prefix. StorageBinding is private metadata. Neither is authority. Callers supply an ArtifactAuthority for every read, and authorization occurs before object existence is checked. Every read loads and validates both records and proves that the binding locator matches the reference digest.

LocalArtifactStore.put() is for registered JSON records, not arbitrary bytes. It validates the body, kind, version, typed ID, and classification before writing. Candidate file bodies use the lower-level CAS only after a candidate record and editable-surface policy have passed freeze validation.

head() may inspect a validated tombstoned or unavailable reference for audit purposes. put(), get(), verify(), and materialize() deny that state even if bytes remain in CAS; a writer cannot silently resurrect an immutable reference.