truf-server/WORKSPACE.md

Remote Worker Development Workspace

This is an independent source-only snapshot of the current D:\truf-docker working tree, not a copy of its running system.

Snapshot

• Source HEAD for provenance: 1b3c7fc4948c5cf2fc389065db3693a27b65300c.
• Current modified and selected untracked source files are included; this snapshot is not equivalent to that commit alone.
• Copied 325 files, 8,150,338 bytes (about 7.8 MiB), with SHA-256 equality checked for every copied file.
• Source-side deletions are preserved, including the absence of app/config.yaml.
• No database, PGDATA, runtime directory, finding/keycheck output, logs, imports, caches, dependencies, or executable binaries were copied.
• No actual .env, secrets file, provider credential pool, or source Git history was copied. The tracked .env.postgres.example is only a template.
• Git was initialized independently. No commit, remote, runtime container, or Docker data volume was created for this workspace.
• Source .opencode skills, the old session handoff, and the loose operator note were not copied. Existing OpenSpec change artifacts remain unchanged and unarchived.

Active Plan

openspec/changes/add-minimal-remote-scan-workers/ contains the completed proposal, design, requirements, implementation checklist, and isolated worker implementation. It preserves existing scan and server-side keycheck logic.

Safe Local Checks

Run from this directory:

python -I -S -B docker/test_verify.py -v
python -I -S -B tests/container_unit.py --check-selection
openspec validate add-minimal-remote-scan-workers --strict --no-interactive

The first two commands use the standard library only, do not import the application, and do not start Docker, PostgreSQL, a scanner, or provider checks. The selection check validates test declarations, not their execution.

The original planning-stage verification passed. Current implementation evidence is recorded by the change checklist and isolated test outputs, including cross-platform packaged-client scans and the empty-database end-to-end gates.

Before Runtime Testing

The inherited deployment files are SOURCE REFERENCES, not an isolated test setup. In particular, compose.yaml still names the production-style truf-docker project and shared truf-local:* image tags; docker-compose.postgres.yml and import overrides must not be used here. Do not run plain docker compose up, import a snapshot, invoke old native launchers, or run unrestricted pytest.

The first implementation tasks must establish unique test project/image/volume names, neutral configuration, scrubbed inherited credentials/DSNs/proxies, disabled live discovery, and synthetic source/provider transports. Review existing compose.e2e.yaml, docker/verify.py, and tests/container_unit.py for reuse before adding any new test infrastructure. Never mount D:\truf, D:\truf-docker, their runtime directories, or existing Docker data volumes. A future test database must initialize empty and contain only synthetic fixtures.

Local test implementation and worker packaging must use this workspace, not the active source or runtime. Production deployment/import and archiving unrelated changes require separate authorization.