3 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
clawbot	407b0a0d79	Add the MIT LICENSE and state it in the README (closes #10) ... The repo had no LICENSE, which REPO_POLICIES.md lists as a mandatory minimum file, and the README's License section said "Content is provided as-is for community use." That granted nothing explicitly and matched no committed file. The repo is public, verified on the Gitea API rather than assumed, so the standing policy applies: MIT on any public repo lacking a license. LICENSE is byte-identical to the canonical sneak/homoicon copy (same git blob, 3274443) and its body is word-for-word the SPDX MIT text, with only the line wrapping differing. The README License section now reads "MIT. See LICENSE.", and says explicitly that the licence covers content/ as well as the code: this repo carries both a Hugo site and its community content, while MIT's own text speaks only of "the Software". The Description first line gains the licence, which the README requirements call for and which was the one field it was missing. Nothing published contradicts the choice. The built public/ tree carries no copyright, all-rights-reserved or terms-of-use string in index.html, css/style.css, index.xml or sitemap.xml; the rendered footer names @sneak and links the repo but reserves no rights, and the RSS carries no copyright element. The content is factual mesh channel data asserting no licence of its own. LICENSE needed no .prettierignore entry, measured rather than assumed: script/fmt passes prettier the explicit globs '**/*.md' and '**/*.css', and an extensionless root file matches neither. A script/fmt run leaves the file's hash unchanged, and a counterfactual LICENSE.md copy was reflowed by that same run, which is the direct evidence that the extension is what excludes it and not an ignore rule. Per-file licence headers and SPDX identifiers are deliberately omitted; no org standard mandates them. Nothing on the deploy path is touched.	2026-08-10 12:31:30 +00:00
clawbot	5f998c6e70	Add a Cloudflare Pages _headers file with security headers (closes #14) ... Hugo copies static/ verbatim into public/, so static/_headers lands at the deploy output root, which is where Pages reads it from. This is the first root-level static/ in the repo; Hugo unions it with the theme's static/ per path rather than shadowing it, and the built tree confirms that: public/css/style.css and public/index.html are byte-identical to the previous build and the static file count goes from 1 to 2. The live "before" was measured rather than assumed. Cloudflare already sends X-Content-Type-Options and Referrer-Policy by default, so those two lines are restatements; the substance is Strict-Transport-Security, Content-Security-Policy, X-Frame-Options and Permissions-Policy, none of which the site sends today. Every value is checked against the built page, which loads nothing: no script, img, link, iframe, form or media element, no style= and no on*= attribute. It has exactly one inline <style> block, filled by readFile in baseof.html. So default-src 'none' with style-src 'unsafe-inline' is both achievable and tight, and 'unsafe-inline' is required by, and only by, that deliberate inlining. There is no script-src allowance because there are no scripts. X-Frame-Options: DENY and frame-ancestors 'none' agree. HSTS carries neither preload nor includeSubDomains. www.lora.vegas is the only other name in DNS and it is served by this same Pages project, so this file sets HSTS on its responses directly; includeSubDomains would instead bind every future subdomain for a year, with no way to walk it back inside the max-age window without also dropping the apex protection. Verified in a headless Chrome against a local server that parses the committed _headers and applies it as real response headers: zero CSP violations, the inlined stylesheet parses to 17 rules with the computed body padding, tagline colour and link colour all coming from the theme CSS, framing from another origin refused by frame-ancestors, and all five named outbound links still navigating with status 200. Whether Pages actually parses the file cannot be verified from here. Pages silently ignores a malformed _headers, so the green build proves nothing about it; that check belongs after the next deploy and must be made on Strict-Transport-Security or Content-Security-Policy, since X-Content-Type-Options would pass either way. It has to be run against both lora.vegas and www.lora.vegas: dropping includeSubDomains rests on www being served by this same Pages project, which was established from identical response bodies rather than from the Cloudflare dashboard.	2026-08-09 17:01:59 +00:00
clawbot	bcb90e74b4	Run script/lint from script/check (closes #9) ... script/check ran only fmt-check then test, so script/lint was never invoked anywhere in the gate: make check shims to script/check, the Dockerfile runs make check, script/cibuild builds the Dockerfile, and the pre-commit hook calls script/check. The script was dead code that the README advertised as part of the gate. It now runs test, lint, fmt-check in the canonical order. script/lint is hugo --minify --printPathWarnings, which reports render-target collisions that the plain hugo --minify in script/test does not; that signal was being discarded. The gate still modifies no tracked files. script/test and script/lint both write to public/, which is gitignored and was already written by script/test before this change. Corrects the two documents that enumerated the old two-step gate: the README Entrypoints line for script/check, and the Dockerfile header comment above the RUN make check that executes it.	2026-08-09 10:09:13 +00:00