safekeep 0.5.2__tar.gz → 0.6.0__tar.gz

{safekeep-0.5.2/safekeep.egg-info → safekeep-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: safekeep
-Version: 0.5.2
+Version: 0.6.0
 Summary: Selective always-on backups for macOS and Linux: fswatch-driven copy of allow-listed files, never deletes
 License-Expression: MIT
 Project-URL: Repository, https://github.com/foxhound87/safekeep
@@ -21,6 +21,8 @@ Classifier: Topic :: System :: Archiving :: Backup
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Provides-Extra: s3
+Requires-Dist: botocore<2,>=1.31; extra == "s3"
 Dynamic: license-file
 
 # safekeep
@@ -56,13 +58,19 @@ Documentation: https://foxhound87.github.io/safekeep/
   `.sync` file can neither add nor remove destinations (a `dest:` line is an
   invalid line), so a repo cloned from a third party can't redirect the backup
   somewhere else.
+- **S3-compatible destination** (optional `safekeep[s3]` extra): one
+  S3-compatible bucket alongside the filesystem destinations — same
+  size/mtime idempotency, metadata-based, and **never deletes anything**
+  (`--prune` only touches filesystem destinations).
 
 ## Installation
 
 ```bash
-pipx install safekeep     # recommended for a CLI
+pipx install safekeep        # recommended for a CLI
+pipx install "safekeep[s3]"  # + S3-compatible destination (botocore)
 # or
 pip install safekeep
+pip install "safekeep[s3]"
 ```
 
 **Requirements**: macOS or Linux (POSIX with systemd), Python >= 3.9 and
@@ -171,6 +179,55 @@ safekeep sync-once --dry-run   # prints what would be copied, copies nothing
 safekeep run                   # daemon: watch + copy (foreground)
 ```
 
+## S3-compatible destinations
+
+safekeep can push every project to **one S3-compatible bucket**
+(S3 = Simple Storage Service) in addition to (or instead of) the filesystem
+destinations. The client is [botocore](https://botocore.amazonaws.com/),
+installed via the optional extra — the core package stays stdlib-only:
+
+```bash
+pipx install "safekeep[s3]"
+```
+
+`~/.safekeep` (the `s3_*` keys are valid **only** in this file — a `.sync`
+can't add them; keep the file at `chmod 600`):
+
+```ini
+s3_endpoint: https://s3.example.com:443   # http:// → cleartext warning
+s3_bucket: my-backup-bucket               # at least one dest: OR s3_bucket:
+s3_prefix: safekeep                       # optional, no '..'
+s3_region: us-east-1                      # default
+s3_access_key: REPLACEME_ACCESS_KEY       # required when s3_bucket is set
+s3_secret_key: REPLACEME_SECRET_KEY       # chmod 600 — or use s3_secret_key_env:
+# s3_secret_key_env: SAFEKEEP_S3_SECRET   # secret from env, never in the file
+s3_addressing: path                       # path (default) | virtual
+s3_tls_check: true                        # false = self-signed certificates
+```
+
+Semantics (see [SPEC.md](SPEC.md) §18): upload-only with `needs_copy` based on
+object metadata (`x-amz-meta-mtime` in nanoseconds, `x-amz-meta-mode`,
+symlinks = zero-byte objects with `x-amz-meta-symlink`), same 1s mtime
+tolerance as filesystem destinations, network errors → `pending` with
+backoff, and **no deletions ever** — `--prune` never touches S3. A slow PUT
+blocks the single-process daemon until it times out (connect 10s / read 60s);
+that's an accepted v1 limitation.
+
+Compatible services:
+
+| Service | Example `s3_endpoint` | `s3_addressing` | Notes |
+|---|---|---|---|
+| MinIO (self-hosted) | `https://minio.example.com:9000` | `path` | SigV4 (Signature Version 4), any region |
+| Silo | `https://s3.example.com:443` | `path` | fork of MinIO — same settings |
+| Ceph RGW | `https://rgw.example.com` | `path` | S3-compatible API |
+| Wasabi | `https://s3.wasabisys.com` | `path` | region required, must match the bucket |
+| Backblaze B2 | `https://s3.<region>.backblazeb2.com` | `virtual` | use an Application Key as access/secret |
+| AWS S3 | *(omit `s3_endpoint`)* | `virtual` | default endpoint, region must match |
+
+`safekeep status` shows the bucket as `[ok]`/`[offline]` (cached HeadBucket),
+and `safekeep doctor` reports credentials, file permissions and bucket
+reachability — all as **non-fatal** warnings.
+
 ## CLI commands
 
 ```

{safekeep-0.5.2 → safekeep-0.6.0}/README.md

@@ -31,13 +31,19 @@ Documentation: https://foxhound87.github.io/safekeep/
   `.sync` file can neither add nor remove destinations (a `dest:` line is an
   invalid line), so a repo cloned from a third party can't redirect the backup
   somewhere else.
+- **S3-compatible destination** (optional `safekeep[s3]` extra): one
+  S3-compatible bucket alongside the filesystem destinations — same
+  size/mtime idempotency, metadata-based, and **never deletes anything**
+  (`--prune` only touches filesystem destinations).
 
 ## Installation
 
 ```bash
-pipx install safekeep     # recommended for a CLI
+pipx install safekeep        # recommended for a CLI
+pipx install "safekeep[s3]"  # + S3-compatible destination (botocore)
 # or
 pip install safekeep
+pip install "safekeep[s3]"
 ```
 
 **Requirements**: macOS or Linux (POSIX with systemd), Python >= 3.9 and
@@ -146,6 +152,55 @@ safekeep sync-once --dry-run   # prints what would be copied, copies nothing
 safekeep run                   # daemon: watch + copy (foreground)
 ```
 
+## S3-compatible destinations
+
+safekeep can push every project to **one S3-compatible bucket**
+(S3 = Simple Storage Service) in addition to (or instead of) the filesystem
+destinations. The client is [botocore](https://botocore.amazonaws.com/),
+installed via the optional extra — the core package stays stdlib-only:
+
+```bash
+pipx install "safekeep[s3]"
+```
+
+`~/.safekeep` (the `s3_*` keys are valid **only** in this file — a `.sync`
+can't add them; keep the file at `chmod 600`):
+
+```ini
+s3_endpoint: https://s3.example.com:443   # http:// → cleartext warning
+s3_bucket: my-backup-bucket               # at least one dest: OR s3_bucket:
+s3_prefix: safekeep                       # optional, no '..'
+s3_region: us-east-1                      # default
+s3_access_key: REPLACEME_ACCESS_KEY       # required when s3_bucket is set
+s3_secret_key: REPLACEME_SECRET_KEY       # chmod 600 — or use s3_secret_key_env:
+# s3_secret_key_env: SAFEKEEP_S3_SECRET   # secret from env, never in the file
+s3_addressing: path                       # path (default) | virtual
+s3_tls_check: true                        # false = self-signed certificates
+```
+
+Semantics (see [SPEC.md](SPEC.md) §18): upload-only with `needs_copy` based on
+object metadata (`x-amz-meta-mtime` in nanoseconds, `x-amz-meta-mode`,
+symlinks = zero-byte objects with `x-amz-meta-symlink`), same 1s mtime
+tolerance as filesystem destinations, network errors → `pending` with
+backoff, and **no deletions ever** — `--prune` never touches S3. A slow PUT
+blocks the single-process daemon until it times out (connect 10s / read 60s);
+that's an accepted v1 limitation.
+
+Compatible services:
+
+| Service | Example `s3_endpoint` | `s3_addressing` | Notes |
+|---|---|---|---|
+| MinIO (self-hosted) | `https://minio.example.com:9000` | `path` | SigV4 (Signature Version 4), any region |
+| Silo | `https://s3.example.com:443` | `path` | fork of MinIO — same settings |
+| Ceph RGW | `https://rgw.example.com` | `path` | S3-compatible API |
+| Wasabi | `https://s3.wasabisys.com` | `path` | region required, must match the bucket |
+| Backblaze B2 | `https://s3.<region>.backblazeb2.com` | `virtual` | use an Application Key as access/secret |
+| AWS S3 | *(omit `s3_endpoint`)* | `virtual` | default endpoint, region must match |
+
+`safekeep status` shows the bucket as `[ok]`/`[offline]` (cached HeadBucket),
+and `safekeep doctor` reports credentials, file permissions and bucket
+reachability — all as **non-fatal** warnings.
+
 ## CLI commands
 
 ```

{safekeep-0.5.2 → safekeep-0.6.0}/pyproject.toml

@@ -25,7 +25,11 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
     "Topic :: System :: Archiving :: Backup",
 ]
-# zero runtime dependencies: solo stdlib (fswatch è un binario esterno)
+# zero runtime dependencies: solo stdlib (fswatch è un binario esterno).
+# L'extra `s3` (botocore, import lazy in s3dest.py) è l'unica dipendenza
+# opzionale: serve SOLO se il config usa le chiavi `s3_*` (SPEC.md §18).
+[project.optional-dependencies]
+s3 = ["botocore>=1.31,<2"]
 
 [project.urls]
 Repository = "https://github.com/foxhound87/safekeep"

{safekeep-0.5.2 → safekeep-0.6.0}/safekeep/__init__.py

@@ -3,4 +3,4 @@ import logging
 
 logging.getLogger('safekeep').addHandler(logging.NullHandler())
 
-__version__ = '0.5.2'
+__version__ = '0.6.0'

{safekeep-0.5.2 → safekeep-0.6.0}/safekeep/cli.py

@@ -31,6 +31,7 @@ from safekeep.platform import (
     systemd_user_available,
     wsl_distro,
 )
+from safekeep.s3dest import S3ExtraMissing, secret_perms_insecure
 from safekeep.volumes import dest_state
 
 # Radice del repo quando si gira da checkout; in un install pip punta altrove
@@ -60,7 +61,8 @@ def build_parser():
                       help='stampa cosa copierebbe, senza copiare')
     once.add_argument('--prune', action='store_true',
                       help='rimuove dalla dest i file il cui sorgente esiste ancora ma '
-                           'non è più incluso dal matcher (default: mai cancellare)')
+                           'non è più incluso dal matcher (default: mai cancellare; '
+                           'solo dest fs — la dest S3 non viene toccata, SPEC §18.2)')
     sub.add_parser('status', parents=[common],
                    help='config, progetti e stato delle dest — sola lettura')
     doc = sub.add_parser('doctor', parents=[common],
@@ -78,6 +80,7 @@ def cmd_sync_once(args):
     daemon = Daemon(args.config)
     daemon.load_config()
     setup_logging('debug' if args.v else daemon.cfg.log_level)
+    daemon.log_s3_secret_perms()          # §18.4: warning una-tantum, dopo gli handler
     daemon.validate_dests()               # CR-02: dest dentro source/$HOME → exit ≠ 0
     daemon.load_projects()
     rows = daemon.sync_once(dry_run=args.dry_run, only=args.project,
@@ -123,6 +126,11 @@ def cmd_status(args):
         print('progetto  nessuno (.sync non trovato)')
     for dest in daemon.cfg.dests:
         print(f'dest      {dest} [{dest_state(dest)}]')
+    if daemon.s3 is not None:
+        # HeadBucket con cache 30s (§18.3): ok/offline, senza toccare la
+        # config — `status` resta sola lettura
+        print(f's3        {daemon.s3.root} [{daemon.s3.state()}] '
+              f'— {daemon.s3.endpoint_label} (region {daemon.s3.cfg.region})')
     return 0
 
 
@@ -180,6 +188,7 @@ def cmd_doctor(args):
     cfg_path = os.path.expanduser(args.config or '~/.safekeep')
     cfg = None
     daemon = None
+    s3_missing = None
     if not os.path.exists(cfg_path):
         if os.path.exists(EXAMPLE):
             hint = f'creala: cp {EXAMPLE} {cfg_path}'
@@ -193,14 +202,23 @@ def cmd_doctor(args):
         try:
             daemon = Daemon(cfg_path)
             cfg = daemon.load_config()
+        except S3ExtraMissing as e:
+            # extra `safekeep[s3]` mancante: riga NON fatale con hint (§18).
+            # `load_config` ha già validato il resto → daemon/cfg restano
+            # utilizzabili per tutti gli altri check, solo senza dest S3.
+            cfg = daemon.cfg
+            s3_missing = e
         except ConfigError as e:
             daemon = None
             out(False, f'config non valida: {e}', is_fatal=True)
-        else:
-            # nessuna `source` → auto-discovery da $HOME: info, non warning (SPEC §6)
-            mode = (f'{len(cfg.sources)} source' if cfg.sources
-                    else f'auto-discovery da {os.path.expanduser("~")}')
-            out(True, f'config valida: {cfg_path} ({mode}, {len(cfg.dests)} dest)')
+
+    if cfg is not None:
+        # nessuna `source` → auto-discovery da $HOME: info, non warning (SPEC §6)
+        mode = (f'{len(cfg.sources)} source' if cfg.sources
+                else f'auto-discovery da {os.path.expanduser("~")}')
+        out(True, f'config valida: {cfg_path} ({mode}, {len(cfg.dests)} dest)')
+        if s3_missing is not None:
+            out(False, f'{s3_missing} — warning non fatale', is_fatal=False)
 
     if daemon is not None:
         # base = source, oppure $HOME in auto-mode: copre anche "dest dentro $HOME"
@@ -211,6 +229,37 @@ def cmd_doctor(args):
         else:
             out(True, 'dest non annidate nelle source/$HOME (nessun loop di copia)')
 
+    # --- dest S3 (SPEC.md §18): tutti check NON fatali ---------------------
+    if cfg is not None and cfg.s3 is not None:
+        s3 = cfg.s3
+        orig = (f'variabile d\'ambiente {s3.secret_env!r}' if s3.secret_env
+                else 'file di config')
+        out(True, f's3 credenziali risolte da {orig} (bucket {s3.bucket})')
+        if s3.secret_env:
+            out(True, f's3 secret non nel file (da {s3.secret_env}): '
+                      'chmod 600 non pertinente')
+        elif secret_perms_insecure(cfg_path, s3):
+            out(False, f's3_secret_key in {cfg_path} con permessi > 0600 — '
+                       f'remedio: chmod 600 {cfg_path} — warning non fatale')
+        else:
+            out(True, f's3_secret_key: permessi del config ≤ 0600')
+        if s3.endpoint and s3.endpoint.startswith('http://'):
+            out(False, f's3 endpoint cleartext {s3.endpoint}: il secret e i '
+                       'dati viaggiano in chiaro — usa https:// — '
+                       'warning non fatale')
+        else:
+            out(True, f's3 endpoint: {s3.endpoint or "AWS default"} '
+                      f'(region {s3.region}, addressing {s3.addressing})')
+    if daemon is not None and daemon.s3 is not None:
+        # extra installato: HeadBucket con cache 30s (§18.3)
+        state = daemon.s3.state()
+        if state == 'ok':
+            out(True, f's3 HeadBucket {daemon.s3.root}: ok')
+        else:
+            out(False, f's3 HeadBucket {daemon.s3.root}: offline — endpoint '
+                       f'{daemon.s3.endpoint_label} non raggiungibile — '
+                       'warning non fatale')
+
     if daemon is not None:
         total, broken, discarded = check_sync_files(daemon)
         if broken:

{safekeep-0.5.2 → safekeep-0.6.0}/safekeep/config.py

@@ -10,6 +10,7 @@ Una riga a forma di chiave non nota (`dest:`, `-dest:`, …) resta invalida: con
 import logging
 import os
 import re
+from dataclasses import dataclass
 
 from .matcher import BUILTIN_RULES, Matcher, parse_rule, strip_comment
 
@@ -20,10 +21,29 @@ class ConfigError(ValueError):
     """Errore di config: il messaggio contiene sempre l'origine e la riga."""
 
 
+@dataclass
+class S3Config:
+    """Blocco `s3_*` del config globale (SPEC.md §18.1). Solo una dest S3.
+
+    `secret_key` è già **risolto** a parse-time: da `s3_secret_key` oppure
+    dalla variabile `s3_secret_key_env` (assente → ConfigError fail-fast).
+    """
+    endpoint: str = None            # None → endpoint AWS default
+    bucket: str = None
+    prefix: str = ''                # normalizzato: niente / iniziale/finali
+    region: str = 'us-east-1'
+    access_key: str = None
+    secret_key: str = None
+    secret_env: str = None          # nome var se il secret viene da env
+    addressing: str = 'path'        # path (default) | virtual
+    tls_check: bool = True
+
+
 class GlobalConfig:
     def __init__(self):
         self.sources = []             # radici osservate (ripetibili, opzionali)
         self.dests = []               # destinazioni globali (ripetibili) — le UNICHE
+        self.s3 = None                # S3Config | None (una sola dest S3, §18)
         self.layout = 'relative'      # relative | full
         self.defaults = []            # regole a bassa priorità (list[Rule])
         self.log_level = 'info'       # debug | info | warn | error
@@ -38,10 +58,19 @@ class SyncConfig:
 
 
 _SYNC_KEY = re.compile(r'(name|defaults|include|exclude)\s*:\s*(.*)')
-_CONF_KEY = re.compile(r'([A-Za-z_]+)\s*:\s*(.*)')
+# Chiave globale: inizia con lettera/_, poi [A-Za-z0-9_] (serve a `s3_endpoint`,
+# cifra inclusa); una riga che non matcha resta "riga non valida" (fail-fast).
+_CONF_KEY = re.compile(r'([A-Za-z_][A-Za-z0-9_]*)\s*:\s*(.*)')
 # Riga a forma di chiave (`dest:`, `-dest:`, `foo:`): NON è una riga nuda.
 _KEY_SHAPE = re.compile(r'[A-Za-z_-][A-Za-z0-9_-]*\s*:')
 
+# Chiavi del blocco S3 (SPEC.md §18.1): `s3_*` fuori da questo insieme è
+# errore fail-fast, come ogni altra chiave ignota del config globale.
+_S3_KEYS = frozenset({
+    's3_endpoint', 's3_bucket', 's3_prefix', 's3_region', 's3_access_key',
+    's3_secret_key', 's3_secret_key_env', 's3_addressing', 's3_tls_check',
+})
+
 
 def bare_rule(line):
     """Riga nuda stile gitignore → regola (SPEC.md §4.2): `pattern` include,
@@ -114,9 +143,10 @@ def parse_config(text, origin='config'):
     """Parse del config globale → GlobalConfig. Errori fatali sempre (fail-fast).
 
     `source` è opzionale (nessuna riga → modalità auto-discovery da `$HOME`,
-    SPEC.md §6); `dest` è obbligatoria: è l'unico posto dove vivono le
-    destinazioni (SPEC.md §3)."""
+    SPEC.md §6); serve almeno una `dest:` **oppure** `s3_bucket` (dest
+    S3-compatible, SPEC.md §18 — backward compat: senza `s3_*` nulla cambia)."""
     cfg = GlobalConfig()
+    s3raw = {}                      # chiave → (valore, riga) del blocco s3_*
     for lineno, raw in enumerate(text.splitlines(), 1):
         line = strip_comment(raw).strip()
         if not line:
@@ -137,6 +167,10 @@ def parse_config(text, origin='config'):
             if not val:
                 raise ConfigError(f'{origin}:{lineno}: dest vuota')
             cfg.dests.append(os.path.expanduser(val))
+        elif key.startswith('s3_'):
+            if key not in _S3_KEYS:
+                raise ConfigError(f'{origin}:{lineno}: chiave s3 sconosciuta: {key}')
+            s3raw[key] = (val, lineno)   # ultima occorrenza vince (come layout)
         elif key == 'layout':
             if val not in ('relative', 'full'):
                 raise ConfigError(f'{origin}:{lineno}: layout non valido: {val!r} (relative|full)')
@@ -155,12 +189,88 @@ def parse_config(text, origin='config'):
             cfg.log_level = val
         else:
             raise ConfigError(f'{origin}:{lineno}: chiave sconosciuta: {key}')
-    if not cfg.dests:
+    cfg.s3 = _build_s3(s3raw, origin)
+    if not cfg.dests and (cfg.s3 is None or not cfg.s3.bucket):
         raise ConfigError(f'{origin}: nessuna dest: serve almeno una riga '
-                          f'`dest: <path>` (esempio: examples/safekeep.example)')
+                          f'`dest: <path>` oppure `s3_bucket: <nome>` '
+                          f'(esempio: examples/safekeep.example)')
     return cfg
 
 
+def _build_s3(raw, origin):
+    """Validazione fail-fast del blocco `s3_*` → S3Config (SPEC.md §18.1).
+
+    `raw` = {chiave: (valore, riga)}: ogni errore riporta origine e riga.
+    Ritorna None se nessuna chiave `s3_*` presente (config solo-fs invariata).
+    """
+    if not raw:
+        return None
+
+    def err(key, detail):
+        # riga del campo mancante, altrimenti quella di s3_bucket (l'inizio
+        # del blocco incompleto), altrimenti la prima riga s3_* presente
+        entry = raw.get(key) or raw.get('s3_bucket') or next(iter(raw.values()))
+        raise ConfigError(f'{origin}:{entry[1]}: {detail}')
+
+    def get(key, default=''):
+        return raw[key][0] if key in raw else default
+
+    bucket = get('s3_bucket').strip()
+    if not bucket:
+        err('s3_bucket',
+            's3_bucket vuota o assente: serve `s3_bucket: <nome>` '
+            '(SPEC.md §18.1, almeno una dest: oppure s3_bucket)')
+    access = get('s3_access_key').strip()
+    if not access:
+        err('s3_access_key',
+            f's3_bucket senza s3_access_key: serve `s3_access_key: <chiave>` '
+            f'(bucket {bucket!r})')
+    secret, env = get('s3_secret_key'), get('s3_secret_key_env').strip()
+    if secret and env:
+        err('s3_secret_key',
+            's3_secret_key e s3_secret_key_env insieme: ne va scelta una sola '
+            '(SPEC.md §18.4)')
+    if not secret and not env:
+        err('s3_secret_key',
+            's3_bucket senza credenziali: serve `s3_secret_key: <secret>` '
+            '(chmod 600 il config) oppure `s3_secret_key_env: <NOME_VAR>`')
+    if env:
+        secret = os.environ.get(env)
+        if secret is None:
+            err('s3_secret_key_env',
+                f's3_secret_key_env: variabile d\'ambiente {env!r} assente')
+    prefix = get('s3_prefix').strip().strip('/')
+    if '..' in prefix.split('/'):
+        err('s3_prefix', f's3_prefix con "..": {get("s3_prefix")!r} non è ammesso')
+    addressing = get('s3_addressing', 'path').strip()
+    if addressing not in ('path', 'virtual'):
+        err('s3_addressing',
+            f's3_addressing non valido: {addressing!r} (path|virtual)')
+    tls = get('s3_tls_check', 'true').strip()
+    if tls not in ('true', 'false'):
+        err('s3_tls_check', f's3_tls_check non valido: {tls!r} (true|false)')
+    endpoint = get('s3_endpoint').strip()
+    if endpoint and not endpoint.startswith(('http://', 'https://')):
+        err('s3_endpoint',
+            f's3_endpoint senza scheme http(s): {endpoint!r} '
+            f'(esempio: https://s3.example.com:443)')
+    if endpoint.startswith('http://'):
+        log.warning('%s:%d: s3_endpoint cleartext %s: il secret e i dati '
+                    'viaggiano in chiaro — usa https:// (SPEC.md §18.1)',
+                    origin, raw['s3_endpoint'][1], endpoint)
+    return S3Config(
+        endpoint=endpoint or None,
+        bucket=bucket,
+        prefix=prefix,
+        region=get('s3_region').strip() or 'us-east-1',
+        access_key=access,
+        secret_key=secret,
+        secret_env=env or None,
+        addressing=addressing,
+        tls_check=(tls == 'true'),
+    )
+
+
 def source_root_for(sources, path):
     """La `source` configurata più profonda che contiene `path`; `path` se nessuna.
 

{safekeep-0.5.2 → safekeep-0.6.0}/safekeep/copier.py

@@ -206,7 +206,8 @@ def needs_copy(src: str, dst: str) -> bool:
 
 
 def reconcile_project(source_root, dest_root, matcher, layout, dest_path_fn,
-                      stats=None, dry_run=False, dest_base=None) -> int:
+                      stats=None, dry_run=False, dest_base=None,
+                      copy_fn=None, needs_copy_fn=None) -> int:
     """Walk della sorgente con pruning delle dir con verdict escluso; copia ogni
     file con verdict incluso che differisce (un file non matchato da nessuna
     regola NON viene copiato: allow-list, SPEC.md §4.3). Ritorna il numero di copie.
@@ -223,12 +224,22 @@ def reconcile_project(source_root, dest_root, matcher, layout, dest_path_fn,
     fermato la passata: il caller metta quella dest in pending (CR-05).
     `dry_run`: conta ed elenca senza copiare.
 
+    Seam destinazioni (SPEC.md §18.2): `copy_fn(src, dst)` e
+    `needs_copy_fn(src, dst)` — default invariati (`copier.copy_one` con
+    containment + `copier.needs_copy`); una dest S3 passa i propri. Gli
+    errori di rete S3 arrivano come `OSError(ENODEV)` e cadono nel percorso
+    pending già esistente.
+
     Nessun errore I/O di un singolo file abortisce il walk: viene loggato e
     contato, e gli altri file vengono processati comunque.
     """
     root = os.path.abspath(os.path.expanduser(source_root))
     base_root = os.path.abspath(os.path.expanduser(dest_base)) if dest_base else root
     prefix = os.path.relpath(root, base_root)   # radice del walk rispetto a base_root
+    # default invariati: le dest fs continuano a usare copy_one/needs_copy
+    do_copy = copy_fn if copy_fn is not None else (
+        lambda src, dst: copy_one(src, dst, dest_root))
+    do_need = needs_copy_fn if needs_copy_fn is not None else needs_copy
     copied = 0
     excluded = 0
     skipped = 0
@@ -266,7 +277,7 @@ def reconcile_project(source_root, dest_root, matcher, layout, dest_path_fn,
                     dst = dest_path_fn(dest_root, base_root,
                                        os.path.join(prefix, r), layout)
                     try:
-                        if dry_run or copy_one(full, dst, dest_root):
+                        if dry_run or do_copy(full, dst):
                             copied += 1
                             if plan is not None:
                                 plan.append((full, dst))
@@ -288,8 +299,8 @@ def reconcile_project(source_root, dest_root, matcher, layout, dest_path_fn,
             dst = dest_path_fn(dest_root, base_root,
                                os.path.join(prefix, r), layout)
             try:
-                if needs_copy(src, dst):
-                    if dry_run or copy_one(src, dst, dest_root):
+                if do_need(src, dst):
+                    if dry_run or do_copy(src, dst):
                         copied += 1
                         if plan is not None:
                             plan.append((src, dst))