The Problem

Deploying fullstack applications typically means stitching together separate concerns—functions, hosting, databases, object storage, and messaging—across different providers with different APIs. Tau (forked from Taubyte) packages these into a single workspace where developers and AI agents can define infrastructure and application code in one place, then push it to a local or production environment without managing the underlying plumbing.

What This Does

Tau is a collection of 9 self-contained projects, not one unified codebase. The substantial ones are pkg/ (1,849 files, the core library), services/ (480 files, the runtime components), and tools/ (542 files, CLI and build tooling). The README markets it as a "fullstack workspace for humans and AI agents" with functions, web hosting, KV databases, object storage, and pub/sub messaging.

Recurring techniques across the projects: Go for core logic (2,874 files), protocol buffers for service definitions (16 files), TypeScript and Python clients under pkg/spore-drive/clients/, and a local development simulation environment called "dream" (78 files). The cli/ directory (34 files) provides the user-facing entry point.

How It Is Wired

Execution starts at main in main.go:10, which reaches 7 functions. From there, the flow splits: Run in tools/tau/cli/run.go:8 is the CLI's command dispatcher, called from 5 places. The init function in dream/fixtures/dreamland.go:5 sets up the local simulation environment.

The internal call graph shows 103 resolved edges. The most-connected functions are New (called from 16 places), Write (9), Join (8), and Run (5). New is the hub—changing its signature breaks the most code. The clients/http/auth/git/client.go file defines New and is called from 15 other files, making it the widest blast radius for a single change.

The wiring for network effects is minimal: only 1 function makes an outbound network call, and 4 functions read or write files. tools/tau/lib/repository/push.go defines Push, which writes files—this is how application code gets sent to the runtime. The core/services/substrate/components/database/context.go defines Context, called from 4 files, and is the database abstraction layer.

How To Use It

Setup: Clone and build:

git clone https://github.com/moses-y/tau
cd tau
make build

Configuration: The CLI reads testConfig.yaml (see cli/app/fixtures/testConfig.yaml). The cli/app/parse_config.go handles config parsing. Environment variables are not documented in the repo.

Running it: Start with the CLI:

./tau start

The dream environment provides local simulation—use dream new universe to initialize a local test network before pushing applications.

Real-World Use

A developer defines a project with functions and storage, pushes it to the local dream environment, tests it, then deploys to production with the same workflow. The pkg/spore-drive/clients/ directory provides JS and Python SDKs for programmatic access to deployed services.

Code Health & Issues

Static analysis found 7 findings (0 critical, 1 high, 5 medium, 1 low):

  • High – Unpinned GitHub Actions – .github/workflows/: pre-commit/action@v3.0.1 and goreleaser/goreleaser-action@v4 use mutable tags. A moved tag runs arbitrary code with your token. Pin to commit SHAs.
  • Medium – No Dependabot/Renovate – 7 manifests, no update bot. Advisories go unpatched.
  • Medium – Mutable Docker base image – pkg/containers/fixtures/docker/Dockerfile uses alpine:3.22.2. Pin by digest.
  • Medium – No dependency vulnerability scan in CI – .github/workflows/. Add dependency-review-action or osv-scanner.
  • Medium – Large binary committed – services/substrate/components/storage/tests/assets/test2.webm (16.2MB). Move to LFS or object storage.
  • Medium – persist-credentials: false not set – .github/workflows/pre-commit.yml. The checkout token remains available to later steps.
  • Low – No job timeouts – .github/workflows/pre-commit.yml. Wedged steps run to the platform default.

Tests are present (1,131 test files) and CI runs via GitHub Actions. A secret-shaped path exists at pkg/spore-drive/config/fixtures/config/keys/test.pem—verify whether it's a real credential.

The Bottom Line

This is a serious Go codebase with real architecture and test coverage—not a toy. The multi-project structure makes it harder to navigate but keeps concerns separated. The security posture needs work before production use, particularly around CI and dependency management. Teams wanting a self-hosted edge platform with local simulation would benefit; anyone looking for a simple deploy tool should look elsewhere.