feat: remove legacy direct-send uploader

.dockerignore

@@ -0,0 +1,18 @@
+.git
+__pycache__
+*.pyc
+data
+uploads
+config
+.env
+dist
+build
+
+# Keep the runtime image context minimal
+app/
+scripts/
+installer/
+tests/
+examples/
+.github/
+*.md

.env.example

@@ -0,0 +1,12 @@
+# Host process identity and timezone. The ONLY service settings that live
+# here; every other setting comes from config/config.yaml (copy the
+# config.example.yaml template). Do not commit real values.
+PUID=1000
+PGID=1000
+TZ=Europe/Istanbul
+
+# Host-side bind ports for the loopback port mapping. The service itself
+# binds 0.0.0.0 inside the container; keep 127.0.0.1 unless a reverse
+# proxy or private network explicitly publishes the ports.
+TELEDRIVE_WEB_PORT=8080
+TELEDRIVE_S3_PORT=9000

.github/ci/fault-injection/Dockerfile

@@ -0,0 +1,9 @@
+FROM python:3.12.14-slim@sha256:eeb8088e67610b37583880c7627e3931f087cba55a35810819e34a398f624a47
+ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PYTHONPATH=/app
+WORKDIR /app
+COPY requirements.txt /app/requirements-server.txt
+RUN pip install --no-cache-dir -r /app/requirements-server.txt
+COPY teledrive /app/teledrive
+COPY scripts /app/scripts
+COPY tests /app/tests
+USER 10001:10001

.github/ci/fault-injection/Dockerfile.dockerignore

@@ -0,0 +1,20 @@
+.git
+__pycache__/
+*.pyc
+data/
+uploads/
+config/
+.env
+*.session
+*.session-journal
+*.log
+dist/
+build/
+.venv/
+website/
+app/
+installer/
+examples/
+.github/
+*.md
+.docker-fault-evidence/

.github/ci/fault-injection/compose.yml

@@ -0,0 +1,87 @@
+# Compose file is under .github/ci/fault-injection; ../../.. is the repo root.
+# Isolated Docker fault-injection and acceptance test ONLY. No host ports, no production credentials,
+# no real Telegram messages, unique Compose project/ephemeral workspace.
+x-web: &web
+  build:
+    context: ../../..
+    dockerfile: Dockerfile
+  user: "${TELEDRIVE_FAULT_UID:?}:${TELEDRIVE_FAULT_GID:?}"
+  read_only: true
+  cap_drop: [ALL]
+  security_opt: ["no-new-privileges:true"]
+  environment: &web-env
+    TELEDRIVE_CONFIG: /config/config.yaml
+    # All other settings live in /config/config.yaml generated by the runner.
+  depends_on:
+    postgres:
+      condition: service_healthy
+  networks: [dev-isolated]
+  healthcheck:
+    test: ["CMD", "python", "-c", "import urllib.request;urllib.request.urlopen('http://127.0.0.1:8080/api/health',timeout=4)"]
+    interval: 5s
+    timeout: 5s
+    retries: 24
+    start_period: 15s
+
+services:
+  postgres:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_USER: teledrive
+      POSTGRES_DB: teledrive_dev
+      POSTGRES_PASSWORD: ${TELEDRIVE_FAULT_DB_PASSWORD:?}
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U teledrive -d teledrive_dev"]
+      interval: 3s
+      timeout: 3s
+      retries: 30
+    networks: [dev-isolated]
+    volumes:
+      - db-state:/var/lib/postgresql/data
+    security_opt: ["no-new-privileges:true"]
+    # No ports: never expose the test database on the host.
+  web-a:
+    <<: *web
+    volumes:
+      - ${TELEDRIVE_FAULT_WORKSPACE:?}/config:/config
+      - ${TELEDRIVE_FAULT_WORKSPACE:?}/web-a:/data
+      - ${TELEDRIVE_FAULT_WORKSPACE:?}/uploads:/uploads:ro
+  web-b:
+    <<: *web
+    volumes:
+      - ${TELEDRIVE_FAULT_WORKSPACE:?}/config:/config
+      - ${TELEDRIVE_FAULT_WORKSPACE:?}/web-b:/data
+      - ${TELEDRIVE_FAULT_WORKSPACE:?}/uploads:/uploads:ro
+  scenarios:
+    build:
+      context: ../../..
+      dockerfile: .github/ci/fault-injection/Dockerfile
+    user: "${TELEDRIVE_FAULT_UID:?}:${TELEDRIVE_FAULT_GID:?}"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      web-a:
+        condition: service_healthy
+      web-b:
+        condition: service_healthy
+    environment:
+      TELEDRIVE_FAULT_DB_URL: postgresql+psycopg://teledrive:${TELEDRIVE_FAULT_DB_PASSWORD:?}@postgres:5432/teledrive_dev
+      TELEDRIVE_FAULT_RESTORED_DB_URL: postgresql+psycopg://teledrive:${TELEDRIVE_FAULT_DB_PASSWORD:?}@postgres:5432/teledrive_restore
+      TELEDRIVE_FAULT_WEB_PASSWORD: ${TELEDRIVE_FAULT_WEB_PASSWORD:?}
+      TELEDRIVE_FAULT_REMOTE_DIR: /work-data/remote
+      TELEDRIVE_FAULT_EVIDENCE_DIR: /work-data/evidence
+      TELEDRIVE_FAULT_SOURCES: /work-data/sources
+    volumes:
+      - ${TELEDRIVE_FAULT_WORKSPACE:?}/scenario:/work-data
+    networks: [dev-isolated]
+    security_opt: ["no-new-privileges:true"]
+    cap_drop: [ALL]
+    read_only: true
+    tmpfs:
+      - /tmp:rw,nosuid,nodev,size=128m
+    entrypoint: ["python", "scripts/dev/docker_fault_scenarios.py"]
+networks:
+  dev-isolated:
+    internal: true
+volumes:
+  db-state:

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5

.github/workflows/delivery-release.yml

@@ -0,0 +1,213 @@
+name: 05 · Delivery | Release Gate & Packages
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+    # On these branch updates validate the release gate without publishing.
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Release gate · regression and security
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out source and history
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Require release tags to point into main
+        if: github.ref_type == 'tag'
+        shell: bash
+        run: |
+          set -euo pipefail
+          git show-ref --verify --quiet refs/remotes/origin/main
+          if ! git merge-base --is-ancestor HEAD refs/remotes/origin/main; then
+            echo "::error::Release tag does not point to a commit reachable from main"
+            exit 1
+          fi
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: requirements.txt
+      - name: Install test runtime
+        run: |
+          python -m pip install -r requirements.txt
+          python -m pip install pytest httpx bandit pip-audit boto3
+          python -m pip check
+      - name: Compile application
+        run: python -m compileall -q teledrive web tests
+      - name: Offline storage, API, recovery and security regression tests
+        run: |
+          python -m pytest -q \
+            tests/web/test_security.py tests/web/test_openapi.py \
+            tests/storage/test_storage_engine.py \
+            tests/storage/test_storage_recovery.py tests/storage/test_storage_rebuild.py tests/storage/test_storage_pending_admin.py tests/storage/test_storage_jobs.py tests/storage/test_storage_versions.py tests/storage/test_storage_ops_health.py tests/meta/test_host_soak.py tests/meta/test_acceptance_cli.py tests/storage/test_storage_gc_retention.py tests/s3/test_s3_version_reads.py tests/storage/test_storage_catalog.py \
+            tests/storage/test_storage_user_mode.py tests/storage/test_mtproto_rate_guard.py tests/storage/test_mtproto_multi_credentials.py tests/storage/test_telegram_dr_rehearsal.py tests/meta/test_production_bundle.py tests/meta/test_capacity_probe.py tests/storage/test_legacy_cutover_acceptance.py tests/storage/test_telegram_target_resolution.py tests/meta/test_ci_workflows.py tests/meta/test_release_matrix.py \
+            tests/web/test_api_keys.py tests/web/test_rest_api.py tests/web/test_rest_transfer.py tests/web/test_unified_service.py \
+            tests/s3/test_s3_fail_closed.py tests/s3/test_s3_contract.py tests/storage/test_metadata_backup.py tests/storage/test_storage_sigkill.py tests/storage/test_metadata_snapshot_rehearsal.py tests/s3/test_s3_multipart_preconditions.py
+      - name: Security checks
+        run: |
+          bandit -q -r teledrive web -ll
+          pip-audit -r requirements.txt
+
+      - name: Publish CI run summary
+        if: always()
+        shell: bash
+        run: |
+          echo '### 05 · Delivery | Release Gate & Packages' >> "$GITHUB_STEP_SUMMARY"
+          echo '| Detail | Value |' >> "$GITHUB_STEP_SUMMARY"
+          echo '| --- | --- |' >> "$GITHUB_STEP_SUMMARY"
+          echo '| Scope | Mainline release gate; no publishing on branch push |' >> "$GITHUB_STEP_SUMMARY"
+          echo '| Result | ${{ job.status }} |' >> "$GITHUB_STEP_SUMMARY"
+          printf '| Ref | %s |\n' "$GITHUB_REF_NAME" >> "$GITHUB_STEP_SUMMARY"
+          printf '| Commit | %s |\n' "$GITHUB_SHA" >> "$GITHUB_STEP_SUMMARY"
+
+  cleanup-merged-branches:
+    name: Housekeeping · delete merged PR branches
+    needs: verify
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write
+      pull-requests: read
+    steps:
+      - name: Checkout reviewed cleanup script
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+      - name: Remove only closed and merged same-head PR branches
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: python scripts/ops/cleanup_merged_branches.py --execute
+      - name: Publish CI run summary
+        if: always()
+        shell: bash
+        run: |
+          echo '### 05 · Housekeeping | Merged PR branches' >> "$GITHUB_STEP_SUMMARY"
+          echo '| Detail | Value |' >> "$GITHUB_STEP_SUMMARY"
+          echo '| --- | --- |' >> "$GITHUB_STEP_SUMMARY"
+          echo '| Scope | Deleted only verified merged, unchanged and unprotected branches |' >> "$GITHUB_STEP_SUMMARY"
+          echo '| Result | ${{ job.status }} |' >> "$GITHUB_STEP_SUMMARY"
+          printf '| Ref | %s |\\n' "$GITHUB_REF_NAME" >> "$GITHUB_STEP_SUMMARY"
+          printf '| Commit | %s |\\n' "$GITHUB_SHA" >> "$GITHUB_STEP_SUMMARY"
+
+  build:
+    name: Package · single-container Docker image
+    needs: verify
+    if: github.ref_type == 'tag' || (github.ref == 'refs/heads/main' && contains(github.event.head_commit.message, '[publish-release]'))
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out source
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+
+      - name: Build the single teledrive service image
+        shell: bash
+        run: |
+          mkdir -p dist
+          docker build -t teledrive:service .
+          docker save -o dist/teledrive-service-image.tar teledrive:service
+
+      - name: Upload package artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: TeleDrive-docker-image
+          path: dist/teledrive-service-image.tar
+          if-no-files-found: error
+
+      - name: Publish CI run summary
+        if: always()
+        shell: bash
+        run: |
+          echo '### 05 · Delivery | Release Gate & Packages' >> "$GITHUB_STEP_SUMMARY"
+          echo '| Detail | Value |' >> "$GITHUB_STEP_SUMMARY"
+          echo '| --- | --- |' >> "$GITHUB_STEP_SUMMARY"
+          echo '| Scope | Single-container Docker image package |' >> "$GITHUB_STEP_SUMMARY"
+          echo '| Result | ${{ job.status }} |' >> "$GITHUB_STEP_SUMMARY"
+          printf '| Ref | %s |\n' "$GITHUB_REF_NAME" >> "$GITHUB_STEP_SUMMARY"
+          printf '| Commit | %s |\n' "$GITHUB_SHA" >> "$GITHUB_STEP_SUMMARY"
+
+  publish:
+    name: Publish · GitHub Release
+    needs: build
+    if: github.event_name == 'push' && (github.ref_type == 'tag' || (github.ref == 'refs/heads/main' && contains(github.event.head_commit.message, '[publish-release]')))
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    permissions:
+      contents: write
+      actions: read
+    steps:
+      - name: Checkout approved release source
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+
+      - name: Verify complete same-SHA P0/P1 matrix
+        if: github.ref_type != 'tag'
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          ready=0
+          for attempt in $(seq 1 30); do
+            gh api "repos/${GITHUB_REPOSITORY}/actions/runs?head_sha=${GITHUB_SHA}&per_page=100" > "$RUNNER_TEMP/release-runs.json"
+            set +e
+            python scripts/ops/check_release_matrix.py --input "$RUNNER_TEMP/release-runs.json" --sha "$GITHUB_SHA"
+            result=$?
+            set -e
+            if [[ "$result" -eq 0 ]]; then ready=1; break; fi
+            if [[ "$result" -eq 1 ]]; then exit 1; fi
+            sleep 20
+          done
+          if [[ "$ready" -ne 1 ]]; then echo "::error::Release blocked: incomplete same-SHA acceptance"; exit 1; fi
+
+      - name: Download built packages
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
+        with:
+          path: release-assets
+          merge-multiple: true
+
+      - name: Publish release and attach packages
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          version="$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml","rb"))["project"]["version"])')"
+          tag="v$version"
+          if [[ "$GITHUB_REF_TYPE" == "tag" && "$GITHUB_REF_NAME" != "$tag" ]]; then
+            echo "::error::Tag/version mismatch"; exit 1
+          fi
+          if gh release view "$tag" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            if [[ "$GITHUB_REF_TYPE" != "tag" ]]; then
+              echo "::error::Existing release cannot be overwritten"; exit 1
+            fi
+            gh release upload "$tag" release-assets/* --repo "$GITHUB_REPOSITORY" --clobber
+          else
+            gh release create "$tag" release-assets/* \
+              --repo "$GITHUB_REPOSITORY" --target "$GITHUB_SHA" \
+              --generate-notes \
+              --title "TeleDrive $tag"
+          fi
+      - name: Publish CI run summary
+        if: always()
+        shell: bash
+        run: |
+          echo '### 05 · Delivery | Release Gate & Packages' >> "$GITHUB_STEP_SUMMARY"
+          echo '| Detail | Value |' >> "$GITHUB_STEP_SUMMARY"
+          echo '| --- | --- |' >> "$GITHUB_STEP_SUMMARY"
+          echo '| Scope | Version-tagged GitHub release assets |' >> "$GITHUB_STEP_SUMMARY"
+          echo '| Result | ${{ job.status }} |' >> "$GITHUB_STEP_SUMMARY"
+          printf '| Ref | %s |\n' "$GITHUB_REF_NAME" >> "$GITHUB_STEP_SUMMARY"
+          printf '| Commit | %s |\n' "$GITHUB_SHA" >> "$GITHUB_STEP_SUMMARY"