feat: declare governed external provider state

README.md

@@ -119,14 +119,20 @@ access fails closed in both public-only and private-network deployments. It will
 remain disabled until every initial connection and referral target can be
 policy-validated and pinned.
 
-S3 browse/import and arbitrary external S3 managed-storage endpoints currently
-fail closed before creating a `boto3` client. Botocore does not yet use the
-GovOPlaN pinned HTTP transport and may manage redirects itself. The only
-exception is the deployment-owned Garage service installed at the exact
-`http://garage:3900` endpoint with
-`FILE_STORAGE_S3_DEPLOYMENT_MANAGED=true`; this flag cannot authorize another
-host. External endpoints remain disabled until peer pinning and redirect
-revalidation are enforced.
+S3 connector browse/import remains fail-closed because a user-governed connector
+endpoint must use the GovOPlaN pinned HTTP trust model. Durable platform storage
+has a separate deployment boundary: installer-owned Garage is accepted only at
+its exact generated endpoint, while an operator-selected external backend
+requires a clean HTTPS origin and
+`FILE_STORAGE_S3_ENDPOINT_TRUSTED=true`. That flag is deployment configuration,
+cannot be supplied through a Files connector profile, and does not replace
+operator responsibility for DNS, certificates, egress, bucket policy,
+versioning, and recovery.
+
+The actual local/S3 backend implementation is owned by Core so Files, Campaign,
+and workers resolve the same object namespace. Files owns file metadata and key
+layout. Node-local storage is supported only for `local` or one-host
+`host-shared` profiles; multi-host `shared` deployments require S3.
 
 Destructive Files-module retirement applies the same credential lifecycle before
 dropping tables. Every remaining Files-owned encrypted connector secret is