CENSUS WATCH(1)

NAME
census-watch - Watch a directory for changes and attest...

SYNOPSIS
census watch [OPTIONS] DIRECTORY

DESCRIPTION
Watch a directory for changes and attest new/modified files.

    Monitors the filesystem using native OS events (inotify on Linux,
    FSEvents on macOS) and processes changes in batches with configurable
    debouncing.

    With --on-t1 / --on-t2 and --webhook-secret-file, an embedded webhook
    receiver starts alongside the watcher to capture T1 (TSA) and T2
    (Bitcoin) lifecycle events — enabling the full forensic flow:
    file change -> attest T0 -> certified T1 -> anchored Bitcoin T2.

    Requires: pip install certisigma-census[watch]

OPTIONS

--debounce FLOAT
    Quiet period before processing (seconds). Default: 2.0

--batch-interval FLOAT
    Max seconds between attestation batches. Default: 30

--scan-on-start / --no-scan-on-start
    Full baseline scan before watching. Default: on

--on-delete [ignore|mark|remove]
    Action on file deletion. Default: ignore

--polling
    Use polling observer (for NFS/CIFS mounts).

--poll-interval FLOAT
    Polling interval in seconds (only with --polling). Default: 5

--source TEXT
    Source label for attestations.

--manifest PATH
    Path to manifest. Default: <directory>/.census-manifest.db

--api-key TEXT
    CertiSigma API key.

--base-url TEXT
    API base URL override.

--dry-run
    Hash and index only, do not attest.

--include TEXT
    Only include files matching this glob (repeatable).

--exclude TEXT
    Exclude files matching this glob (repeatable).

--min-size TEXT
    Skip files smaller than this (e.g. 1K, 10M).

--max-size TEXT
    Skip files larger than this (e.g. 100M, 1G). Default: 5G.

--on-change TEXT
    Shell command to run on file change (receives JSON on stdin). Runs via shell; do not pass untrusted input.

--on-attest TEXT
    Shell command to run after attestation (receives JSON on stdin). Runs via shell; do not pass untrusted input.

--on-t1 TEXT
    Shell command on T1 (TSA) webhook event (JSON on stdin). Requires --webhook-secret-file.

--on-t2 TEXT
    Shell command on T2 (Bitcoin) webhook event (JSON on stdin). Requires --webhook-secret-file.

--webhook-secret-file PATH
    Signing secret file for embedded webhook receiver.

--webhook-port INTEGER
    Port for embedded webhook receiver. Default: 9514

--webhook-bind TEXT
    Bind address for webhook receiver. Default: 127.0.0.1