feat(integrations): add validation framework and 21 integration guides

docs/integrations/backup/acronis-cyber-protect.mdx

@@ -0,0 +1,38 @@
+---
+title: Acronis Cyber Protect
+description: Configure a Fil One storage location for Acronis backup and restore.
+integration_status: Not currently tested
+tested_versions: []
+verified_regions: []
+verification_date: null
+evidence: null
+---
+
+# Acronis Cyber Protect
+
+Acronis Cyber Protect writes to Fil One as an S3-compatible backup location, using SigV4 (AuthV4), path-style addressing, and a key scoped to the bucket's region.
+
+| Setting | Value |
+| --- | --- |
+| Endpoint | `https://eu-west-1.s3.fil.one` or `https://us-east-1.s3.fil.one`, matching the bucket's region |
+| Region | `eu-west-1` or `us-east-1` |
+| Addressing | Path style |
+| Authentication | SigV4 (AuthV4) access key and secret scoped to the bucket's region |
+
+## Configure
+
+In the Acronis administration console, add an S3-compatible storage location. Enter the regional endpoint, the matching access key, and AuthV4 signing from [Connection settings](/integrations/connection-settings). Select an existing Fil One bucket when prompted, then assign the location to a protection plan.
+
+## Examples
+
+1. Protect the fixture directory with the plan, run it, and confirm the activity completes.
+2. Restore to a new location and compare size and SHA-256 for every restored file.
+3. Confirm that retention and cleanup operations affect only the test backup set.
+
+## Troubleshooting
+
+| Symptom | Check |
+| --- | --- |
+| Connection failure | Recheck endpoint, regional key, AuthV4, and TLS validation. |
+| Missing bucket | Create it first and ensure the key is scoped to it. |
+| Immutability option | This depends on Object Lock semantics. Review [S3 Compatibility](/reference/s3-compatibility) and validate it with the exact Acronis release before enabling it. |

docs/integrations/backup/comet-backup.mdx

@@ -0,0 +1,39 @@
+---
+title: Comet Backup
+description: Configure and validate a Comet S3-compatible Storage Vault with Fil One.
+integration_status: Not currently tested
+tested_versions: []
+verified_regions: []
+verification_date: null
+evidence: null
+---
+
+# Comet Backup
+
+Comet Backup writes to Fil One through an S3-compatible Storage Vault, using SigV4, path-style addressing, and a key scoped to the bucket's region.
+
+| Setting | Value |
+| --- | --- |
+| Endpoint | `https://eu-west-1.s3.fil.one` or `https://us-east-1.s3.fil.one`, matching the bucket's region (some Comet fields expect the hostname without `https://`; follow the field label) |
+| Region | `eu-west-1` or `us-east-1` |
+| Addressing | Path style |
+| Authentication | SigV4 access key and secret scoped to the bucket's region |
+
+## Configure
+
+Create either a Comet Storage Template or a user's Custom Storage Vault, select the S3-compatible type, and enter the regional hostname, region, existing bucket, and matching credentials. Enable encrypted transmission. Use the same values described in [Connection settings](/integrations/connection-settings).
+
+## Examples
+
+1. Run Comet's connection test, protect the fixture directory, and complete an on-demand backup.
+2. Restore to a separate directory, run Comet's vault integrity check, and inspect the job history for partial failures.
+3. Remove only the test snapshot and prefix.
+
+## Troubleshooting
+
+| Symptom | Check |
+| --- | --- |
+| Connection test fails | Confirm whether the Comet field expects a hostname or a full URL. |
+| Access errors | Check that the key can read, write, list, and delete within the selected bucket. |
+| Object Lock vault type | Use the standard S3-compatible storage type unless the Object Lock workflow has been validated with your Comet release; see [S3 Compatibility](/reference/s3-compatibility). |
+| Slow or failing large backups | Test concurrency and recovery time from the same network where the Comet server runs. |

docs/integrations/backup/msp360.mdx

@@ -0,0 +1,38 @@
+---
+title: MSP360
+description: Add Fil One as S3-compatible storage for MSP360 backup plans.
+integration_status: Not currently tested
+tested_versions: []
+verified_regions: []
+verification_date: null
+evidence: null
+---
+
+# MSP360
+
+MSP360 writes to Fil One as an S3-compatible storage account, using SigV4, path-style addressing, and a key scoped to the bucket's region.
+
+| Setting | Value |
+| --- | --- |
+| Endpoint | `https://eu-west-1.s3.fil.one` or `https://us-east-1.s3.fil.one`, matching the bucket's region |
+| Region | `eu-west-1` or `us-east-1` |
+| Addressing | Path style |
+| Authentication | SigV4 (signature version 4) access key and secret scoped to the bucket's region |
+
+## Configure
+
+Add an S3-compatible storage account. Put the regional URL in the HTTPS endpoint field, choose signature version 4, keep certificate validation enabled, and select an existing bucket. Enable native multipart upload after validating it with your MSP360 release. The desktop agent exposes the same core settings.
+
+## Examples
+
+1. Create a test plan for the fixture directory and run it.
+2. Confirm the remote objects are listed, restore to a new directory, and compare size and SHA-256.
+3. Delete only the isolated test backup set.
+
+## Troubleshooting
+
+| Symptom | Check |
+| --- | --- |
+| Connection or signature errors | Use the S3-compatible provider rather than an AWS preset, confirm path-style addressing, and keep HTTPS enabled. |
+| Bucket discovery fails | Check the bucket's region and the key's scope. |
+| Backup succeeds but restore fails | Preserve the job logs and rerun the round trip after correcting the settings. |

docs/integrations/backup/nakivo.mdx

@@ -0,0 +1,37 @@
+---
+title: NAKIVO Backup and Replication
+description: Configure Fil One as an S3-compatible NAKIVO repository.
+integration_status: Not currently tested
+tested_versions: []
+verified_regions: []
+verification_date: null
+evidence: null
+---
+
+# NAKIVO Backup and Replication
+
+NAKIVO Backup and Replication writes to Fil One as an S3-compatible repository, using SigV4, path-style addressing, and a key scoped to the bucket's region.
+
+| Setting | Value |
+| --- | --- |
+| Endpoint | `https://eu-west-1.s3.fil.one` or `https://us-east-1.s3.fil.one`, matching the bucket's region |
+| Region | `eu-west-1` or `us-east-1` |
+| Addressing | Path style |
+| Authentication | SigV4 access key and secret scoped to the bucket's region |
+
+## Configure
+
+Add an S3-compatible repository. Enter the regional endpoint, region, matching credentials, and an existing bucket. Keep HTTPS certificate validation enabled. Ensure the Transporter that performs data movement can reach the endpoint.
+
+## Examples
+
+1. Back up a disposable workload with known file hashes, then perform file-level recovery to a different location and compare size and SHA-256.
+2. Run NAKIVO's repository verification if available.
+3. Exercise retention against only the test recovery point and confirm unrelated prefixes remain untouched.
+
+## Troubleshooting
+
+| Symptom | Check |
+| --- | --- |
+| Connection errors | Endpoint, key region, and path-style settings must match. |
+| Retention or immutability options | Validate against the named NAKIVO release and current [S3 Compatibility](/reference/s3-compatibility) behavior. |

docs/integrations/connection-settings.mdx

@@ -0,0 +1,20 @@
+---
+title: Integration connection settings
+description: Shared endpoint, region, authentication, and addressing settings for Fil One integrations.
+---
+
+# Integration connection settings
+
+Use the values shown in your bucket's **Access endpoints** panel. Keep endpoint values in configuration rather than embedding them in scripts or application code.
+
+| Setting | Value |
+| --- | --- |
+| Endpoint | `https://eu-west-1.s3.fil.one` or `https://us-east-1.s3.fil.one`, matching the bucket's region (also shown in the bucket's **Access endpoints** panel) |
+| Region | The bucket's region: `eu-west-1` or `us-east-1` |
+| Authentication | AWS Signature Version 4 (SigV4) |
+| Addressing | Path style required |
+| Access key and secret | A key created for the same region, scoped to the target bucket |
+
+Create the bucket before configuring an integration. Endpoint, region, key, and bucket must belong to the same region. Keep TLS certificate validation enabled. Never place a secret key in documentation, screenshots, source control, or command-line history.
+
+Third-party tools may attempt optional S3 operations after a transfer. Review [S3 Compatibility](/reference/s3-compatibility) for current regional behavior and [Encryption](/security/encryption) for security settings. Feature availability differs between the S3 API and the app.fil.one dashboard; see S3 Compatibility for API behavior.

docs/integrations/data-ai/apache-iceberg.mdx

@@ -0,0 +1,38 @@
+---
+title: Apache Iceberg
+description: Evaluate Apache Iceberg object storage workflows with Fil One.
+integration_status: Not currently tested
+tested_versions: []
+verified_regions: []
+verification_date: null
+evidence: null
+---
+
+# Apache Iceberg
+
+Apache Iceberg reads and writes table data in Fil One through `S3FileIO`, with `s3.endpoint` set to the regional endpoint, `s3.path-style-access=true`, and a key scoped to the bucket's region.
+
+| Setting | Value |
+| --- | --- |
+| Endpoint | `https://eu-west-1.s3.fil.one` or `https://us-east-1.s3.fil.one`, matching the bucket's region (`s3.endpoint`) |
+| Region | `eu-west-1` or `us-east-1` (`client.region`) |
+| Addressing | Path style (`s3.path-style-access=true`) |
+| Authentication | SigV4 access key and secret scoped to the bucket's region, supplied through the engine's secret mechanism |
+
+## Configure
+
+Use Iceberg's `S3FileIO` when your engine supports it. Configure the warehouse on an existing bucket, the regional endpoint and region, path-style access, and credentials through the engine's secret mechanism. Catalog configuration is separate: REST, JDBC, Hive, Glue-compatible, and filesystem catalogs have different correctness and concurrency properties.
+
+## Examples
+
+1. Create a disposable table, append and update data, and read it from a fresh session.
+2. Validate partition pruning and inspect metadata and manifest objects under the dedicated warehouse prefix.
+3. Run concurrent commits and confirm one writer does not silently overwrite another.
+4. Preserve the metadata tree, recover the table from its catalog, and compare row counts and content hashes.
+
+## Troubleshooting
+
+| Symptom | Check |
+| --- | --- |
+| Some components reach an AWS hostname | An engine may use more than one S3 client; apply endpoint and path-style settings to every execution component. |
+| Reads work but commits fail | Check the catalog configuration and the engine and catalog versions. |

docs/integrations/data-ai/databricks.mdx

@@ -0,0 +1,37 @@
+---
+title: Databricks
+description: Evaluate Databricks access to data stored in Fil One.
+integration_status: Not currently tested
+tested_versions: []
+verified_regions: []
+verification_date: null
+evidence: null
+---
+
+# Databricks
+
+Availability of custom S3-compatible endpoints varies by Databricks compute mode. On compute that permits a custom endpoint, Databricks reads and writes Fil One through the S3 connector with the regional endpoint, path-style access, and a key scoped to the bucket's region.
+
+| Setting | Value |
+| --- | --- |
+| Endpoint | `https://eu-west-1.s3.fil.one` or `https://us-east-1.s3.fil.one`, matching the bucket's region |
+| Region | `eu-west-1` or `us-east-1` |
+| Addressing | Path style |
+| Authentication | SigV4 access key and secret scoped to the bucket's region, stored in a Databricks secret scope |
+
+## Configure
+
+Use a cluster or SQL environment that permits a custom S3-compatible endpoint. Store credentials in a Databricks secret scope and inject them into the supported filesystem or connector configuration. Set the regional endpoint, region, and path-style access from [Connection settings](/integrations/connection-settings). Keep secret values out of notebooks and cluster policies.
+
+## Examples
+
+1. Read a disposable Parquet dataset, write results to a dedicated prefix, terminate the compute, and read the output from a fresh cluster.
+2. Compare row counts, schema, and deterministic aggregates.
+3. For managed table formats, validate their transaction and concurrency behavior separately.
+
+## Troubleshooting
+
+| Symptom | Check |
+| --- | --- |
+| Serverless or governed mode blocks custom endpoints | Use a compute mode that permits them, or treat the integration as unavailable for that workspace. |
+| Driver works but jobs fail | Confirm that executors as well as the driver receive endpoint and credential settings. |

docs/integrations/data-ai/delta-lake.mdx

@@ -0,0 +1,37 @@
+---
+title: Delta Lake
+description: Evaluate Delta Lake transaction-log workflows on Fil One.
+integration_status: Not currently tested
+tested_versions: []
+verified_regions: []
+verification_date: null
+evidence: null
+---
+
+# Delta Lake
+
+Delta Lake on Spark reads and writes Fil One through the `s3a` connector, with `fs.s3a.endpoint` set to the regional endpoint, `fs.s3a.path.style.access=true`, and a key scoped to the bucket's region.
+
+| Setting | Value |
+| --- | --- |
+| Endpoint | `https://eu-west-1.s3.fil.one` or `https://us-east-1.s3.fil.one`, matching the bucket's region (`fs.s3a.endpoint`) |
+| Region | `eu-west-1` or `us-east-1` (`fs.s3a.endpoint.region`) |
+| Addressing | Path style (`fs.s3a.path.style.access=true`) |
+| Authentication | SigV4 access key and secret scoped to the bucket's region, supplied through the platform's secret mechanism |
+
+## Configure
+
+Configure Spark's S3 connector with the existing bucket, regional endpoint and region, path-style access, and credentials supplied through the platform's secret mechanism. Keep a dedicated table prefix. Ensure the driver and every executor receive the same settings.
+
+## Examples
+
+1. Create a disposable Delta table, append and update rows, produce a checkpoint, and read the table from a fresh session.
+2. Run concurrent writers and verify conflicts do not cause silent data loss.
+3. Restore a prior table version after confirming the required log and data objects exist, then compare row counts and deterministic hashes.
+
+## Troubleshooting
+
+| Symptom | Check |
+| --- | --- |
+| Parquet reads work but Delta commits fail | Connector retry, rename, conditional-write, and consistency assumptions vary by release; check the Delta, Spark, and connector version set. |
+| Executors reach an AWS hostname | Apply the endpoint and path-style settings to executors as well as the driver. |

docs/integrations/data-ai/duckdb.mdx

@@ -0,0 +1,51 @@
+---
+title: DuckDB
+description: Read and write Fil One objects with DuckDB httpfs.
+integration_status: Not currently tested
+tested_versions: []
+verified_regions: []
+verification_date: null
+evidence: null
+---
+
+# DuckDB
+
+DuckDB reads and writes Fil One through the `httpfs` extension with an S3 secret that sets `ENDPOINT` to the regional hostname, `URL_STYLE 'path'`, and a key scoped to the bucket's region.
+
+| Setting | Value |
+| --- | --- |
+| Endpoint | `eu-west-1.s3.fil.one` or `us-east-1.s3.fil.one`, matching the bucket's region (`ENDPOINT`, hostname without `https://`, with `USE_SSL true`) |
+| Region | `eu-west-1` or `us-east-1` (`REGION`) |
+| Addressing | Path style (`URL_STYLE 'path'`) |
+| Authentication | SigV4 access key and secret scoped to the bucket's region (`KEY_ID` and `SECRET`) |
+
+## Configure
+
+Install and load DuckDB's `httpfs` extension. Create an S3 secret with the regional key, region, endpoint hostname, `USE_SSL true`, and `URL_STYLE 'path'`. Use a secret provider appropriate to your environment and keep credentials out of SQL files.
+
+```sql
+INSTALL httpfs;
+LOAD httpfs;
+CREATE SECRET filone (
+  TYPE S3,
+  KEY_ID 'ACCESS_KEY',
+  SECRET 'SECRET_KEY',
+  REGION 'eu-west-1',
+  ENDPOINT 'eu-west-1.s3.fil.one',
+  USE_SSL true,
+  URL_STYLE 'path'
+);
+```
+
+## Examples
+
+1. Read a disposable Parquet file from the bucket and compare row count and deterministic aggregates.
+2. Use `COPY` to write a result under a unique prefix, start a fresh DuckDB process, and read the output back. Compare schema, row count, byte size, and content-level checks before removing the prefix.
+
+## Troubleshooting
+
+| Symptom | Check |
+| --- | --- |
+| Requests target a bucket subdomain | Set `URL_STYLE 'path'`. |
+| Endpoint rejected | The `ENDPOINT` field expects a hostname rather than a full URL. |
+| Large datasets | Test range reads and multipart writes separately. |

docs/integrations/data-ai/hugging-face-datasets.mdx

@@ -0,0 +1,37 @@
+---
+title: Hugging Face Datasets
+description: Evaluate Hugging Face Datasets access to files stored in Fil One.
+integration_status: Not currently tested
+tested_versions: []
+verified_regions: []
+verification_date: null
+evidence: null
+---
+
+# Hugging Face Datasets
+
+Hugging Face `datasets` reads files in Fil One through `fsspec` and `s3fs`, passing the regional endpoint, region, path-style addressing, and a key scoped to the bucket's region as storage options.
+
+| Setting | Value |
+| --- | --- |
+| Endpoint | `https://eu-west-1.s3.fil.one` or `https://us-east-1.s3.fil.one`, matching the bucket's region (`client_kwargs={"endpoint_url": ...}`) |
+| Region | `eu-west-1` or `us-east-1` (`client_kwargs={"region_name": ...}`) |
+| Addressing | Path style (`config_kwargs={"s3": {"addressing_style": "path"}}`) |
+| Authentication | SigV4 access key and secret scoped to the bucket's region (`key` and `secret`) |
+
+## Configure
+
+Pass the regional endpoint, region, matching credentials, and path-style behavior through the storage options supported by the installed `s3fs` release. Load credentials from a secret store or environment and keep them out of notebooks. Use explicit object paths under an existing bucket. Pin and record the complete Python package set, because endpoint and addressing options can change across `datasets`, `fsspec`, and `s3fs`.
+
+## Examples
+
+1. Load a disposable dataset normally and in streaming mode. Compare feature schema, row count, and deterministic sample hashes.
+2. Clear the local cache and load it again to confirm the remote path is sufficient.
+3. If preprocessing writes cache or transformed data remotely, isolate that output under a unique prefix and validate its cleanup.
+
+## Troubleshooting
+
+| Symptom | Check |
+| --- | --- |
+| Load works once, then fails | A local cache can mask remote errors; clear the cache and repeat. |
+| Requests target a bucket subdomain | Set the path-style addressing option for the installed `s3fs` release. |