Looks interesting. I'm curious about why there's a 32bit cookie added to the volume,filename -- it seems like a rather weak protection -- and as such, it becomes an unnecessary complication? As have been shown with facebook, relying on (permanent) secret urls to grant/deny access is a bad idea.
So, why not just use volume,id, and then deploy a proxy that handless access based on tokens in front -- if access control is wanted? (Not all uses of files will need/want access control).
I suppose one reason for a "cookie" would be cache invalidation in case of volume,id reuse.
I'm thinking that IPFS (http://ipfs.io/) has more of an opportunity to fill the distributed-filesystem role de jeur, alas .. Seaweed-FS seems flakey and not quite ready for primetime. Poor conclusion?
I gave a talk about Haystack at PWL: http://www.meetup.com/papers-we-love-too/events/220795812/ with the relevant video here: https://www.youtube.com/watch?v=EuNumdi1Do0