Private canonical export jobs

Private exports are bounded owner-bound internal artifacts, not a downloadable commercial dataset SKU. A credential requires explicit export capability. The same canonical DTO/release definitions govern JSON reads and export content.

1. Preview the release and filters to read the bounded estimate.
2. Create a job with a stable Idempotency-Key.
3. Poll its status until ready or a terminal failure.
4. Read the manifest, formats, counts, hashes and expiry.
5. Download bounded single ranges with the manifest’s ETag in If-Match.
6. Assemble bytes in order and verify the full SHA before consuming the artifact.

Generation is asynchronous. GET never starts a job. Acceptance (202) and status polls are not generated data units. Repeating creation with the same canonical key does not create a second job.

Each job pins the release, schema, mapping, metric and quality definitions. Default generation bounds are 250,000 rows and 256 MiB across a job, subject to current access, capacity and disk reserve. Actual encoded bytes are measured, not guessed from the preview.

Single byte ranges use inclusive offsets or a suffix. Multiple ranges are rejected. The transport ceiling is 16 MiB only with an explicit credential budget; current private keys retain 128 KiB per request. Ownership, expiry and revoke are checked on every range. A foreign or unknown export ID returns 404.

Cancellation affects that job, not canonical facts. Already received bytes cannot be revoked retroactively. NDJSON and Parquet artifacts preserve the same canonical row hash after supported round trips.