# Remote Worker Development Workspace

This is an independent source-only snapshot of the current `D:\truf-docker` working tree, not a copy of its running system.

## Snapshot

- Source HEAD for provenance: `1b3c7fc4948c5cf2fc389065db3693a27b65300c`.
- Current modified and selected untracked source files are included; this snapshot is not equivalent to that commit alone.
- Copied 325 files, 8,150,338 bytes (about 7.8 MiB), with SHA-256 equality checked for every copied file.
- Source-side deletions are preserved, including the absence of `app/config.yaml`.
- No database, PGDATA, runtime directory, finding/keycheck output, logs, imports, caches, dependencies, or executable binaries were copied.
- No actual `.env`, secrets file, provider credential pool, or source Git history was copied. The tracked `.env.postgres.example` is only a template.
- Git was initialized independently. No commit, remote, runtime container, or Docker data volume was created for this workspace.
- Source `.opencode` skills, the old session handoff, and the loose operator note were not copied. Existing OpenSpec change artifacts remain unchanged and unarchived.

## Active Plan

`openspec/changes/add-minimal-remote-scan-workers/` contains the completed proposal, design, requirements, implementation checklist, and isolated worker implementation. It preserves existing scan and server-side keycheck logic.

## Safe Local Checks

Run from this directory:

```powershell
python -I -S -B docker/test_verify.py -v
python -I -S -B tests/container_unit.py --check-selection
openspec validate add-minimal-remote-scan-workers --strict --no-interactive
```

The first two commands use the standard library only, do not import the application, and do not start Docker, PostgreSQL, a scanner, or provider checks. The selection check validates test declarations, not their execution.

The original planning-stage verification passed. Current implementation evidence is recorded by the change checklist and isolated test outputs, including cross-platform packaged-client scans and the empty-database end-to-end gates.

## Before Runtime Testing

The inherited deployment files are SOURCE REFERENCES, not an isolated test setup. In particular, `compose.yaml` still names the production-style `truf-docker` project and shared `truf-local:*` image tags; `docker-compose.postgres.yml` and import overrides must not be used here. Do not run plain `docker compose up`, import a snapshot, invoke old native launchers, or run unrestricted pytest.

The first implementation tasks must establish unique test project/image/volume names, neutral configuration, scrubbed inherited credentials/DSNs/proxies, disabled live discovery, and synthetic source/provider transports. Review existing `compose.e2e.yaml`, `docker/verify.py`, and `tests/container_unit.py` for reuse before adding any new test infrastructure. Never mount `D:\truf`, `D:\truf-docker`, their runtime directories, or existing Docker data volumes. A future test database must initialize empty and contain only synthetic fixtures.

Local test implementation and worker packaging must use this workspace, not the active source or runtime. Production deployment/import and archiving unrelated changes require separate authorization.