Connectome Mirror — Operational Template

This document provides recommended templates and operational guidance for hosting a connectome JSON/NPZ mirror and integrating it with a bootstrap-connectome CI workflow.

Goals - Provide a stable URL for CONNECTOME_DOWNLOAD_URL (store as a repository secret) - Allow maintainers to publish connectome assets via CI and rotate URLs

Options 1. S3 bucket (recommended): upload asset and use HTTPS or presigned GET URL 2. Presigned PUT URL from object store: use a presigned PUT to upload and store the resulting GET URL as a secret 3. Static hosting (GCS / GitHub Releases): upload immutable release assets

Example GitHub Actions flow: upload to S3 and emit a presigned URL or artifact containing the URL; copy the URL into repository secret CONNECTOME_DOWNLOAD_URL.

Security notes - Use least-privilege publish roles (PutObject to specific prefix) - Prefer short-lived presigned GET URLs for consumers - Avoid embedding credentials in workflow inputs; use organization/repo secrets

Operational checklist - Create S3 bucket with lifecycle policy for old artifacts - Configure a publish role and store PUBLISH_ROLE_ARN as an org secret - Add CI workflow to upload and emit presigned URL; rotate CONNECTOME_DOWNLOAD_URL after publishing