Work Done
Read-only probe of the failing AGGC Subset1_Test_1_0.tiff through vxData-signed HTTPS and fsspec HTTPFile into tifffile. Object size 779,326,663 bytes. 64KiB blocks: 9 GETs, 562,375 bytes, 1.95s; 256KiB: 8 GETs, 2,069,703 bytes, 1.25s. Retrieved seven YXS pyramid levels and 0.5um/px resolution, without decoding pixels. Timings are single sequential local-client measurements, not a cluster benchmark. Presign measured 0.32s separately on the successful probe.
Pitfalls
Current virdx-ome TIFF reader treats S3 URLs as local paths. vxData storage.open downloads the whole file. Installed fsspec lacks aiohttp; s3fs is also absent. Probe used temporary aiohttp dependencies in /tmp, no repository/environment lock edits. Signed URL generation used private SDK control-plane API for investigation only; production needs a supported interface. GET-signed URLs should use known object size instead of relying on HEAD authorization.
Improvements
Prefer existing vxData auth plus signed HTTP range reads over new raw S3 secrets. Keep bounded block caches, reuse a file handle for all metadata, batch presigning near consumption, and preserve fatal auth/network errors. Validate representative TIFF layouts and local/remote metadata equivalence before deployment. Full-dataset performance and concurrency remain untested.