# Workflow - branch (from `main`) - do the work in Next Step - move Next Step to the top of Completed Steps - move the top item of Future Steps into Next Step - commit (`TODO.md` changes in the same commit as the work) - merge to `main` if the branch is not protected, otherwise open a PR - push # Status pre-1.0 No git tags. The site is live and now has the scripts-to-rule-them-all scaffold (`Makefile`, `script/`, `Dockerfile`, `check.yml`), the canonical policy dotfiles and `LICENSE`, so the mandated minimum file list is complete. Every external reference in the repo is now pinned by cryptographic hash (or, for the wrangler CLI install, an exact version), and the Hugo that builds the published site is a deliberate pinned version rather than whatever the base image's package repo serves. The site now ships a Cloudflare Pages `_headers` file, so its response security headers are declared in the repo instead of being whatever the edge defaults to — unverified in production until the next deploy. The lint now runs inside a container and nowhere else: `script/lint` is a build of `Dockerfile.lint`, with no host path to fall back to. Formatting is not a lint and stays on the host. # Next Step Add the missing `cibuild` and `precommit` shims to the `Makefile`, so that every documented entrypoint has a make target and the documented "always use make targets" rule is actually satisfiable (https://git.eeqj.de/sneak/lora.vegas/issues/34). Done when `make cibuild` and `make precommit` exist, are declared `.PHONY`, and the README Entrypoints section matches. # Completed Steps - 2026-08-10: moved the lint into Docker (https://git.eeqj.de/sneak/lora.vegas/issues/38). A new root `Dockerfile.lint` runs `hugo --minify --printPathWarnings` as a build step, so a successful build is a clean lint, and `script/lint` is nothing but a build of that file — no host path and deliberately no "already inside a container?" branch, which would be a host lint path in disguise. The containerisation boundary is lint only, per the owner ruling of the same day: formatting is not a lint, so `script/fmt` and `script/fmt-check` stay on the host. `Dockerfile.lint` has exactly one stage on purpose. A whole-file `docker build -f Dockerfile.lint .` builds only the file's last stage, and sibling stages off a shared base have no ordering edge, so any second stage beside the lint would be silently skipped by the invocation the canonical org-wide `script/lint` uses — a green that linted nothing. With one stage there is nothing to skip and `script/lint` needs no `--target`. Its first four instructions are byte-identical to the main `Dockerfile`'s, so the expensive `RUN script/bootstrap` layer that compiles Hugo from source is shared between the two images rather than paid twice. The recursion this creates was resolved by direction, not detection: `make check` calls `script/lint`, so the main `Dockerfile` can no longer `RUN make check` — that would attempt a docker build inside a build step, in a bare Alpine with no docker client and no daemon socket. It runs the individual non-lint checks instead, `script/test` and `script/fmt-check`, matching the canonical shape upstream, and `script/cibuild` runs `script/lint` first for fail-fast feedback before the main image build starts. So CI still covers all three checks and cannot drift from what a developer runs. Caching is waived for the lint exactly as the main `Dockerfile` already does it: `ARG CHECK_EPOCH` with no default, guarded with `[ -n "$CHECK_EPOCH" ] || exit 1`, and the value expanded into the linted command as well as the guard, so invalidation never rests on BuildKit's handling of an unreferenced `ARG`. Every image-building entrypoint generates and passes it — `script/cibuild`, `script/docker`, `script/lint` — which is the failure mode this repo already hit once, a Dockerfile guard asserting a property one entrypoint did not supply. `script/lint` builds with `--output type=cacheonly`: the build is run for its exit status, not for an image, and since the lint layer is cache-busted every run an exporting build would leave one dangling image per lint on a host shared with other work. Verified rather than assumed: two consecutive `script/lint` runs on an unchanged tree both executed hugo for real (second run 0.85s wall, `RUN script/bootstrap` `CACHED`, distinct epochs echoed, real build tables printed); a whole-file `docker build -f Dockerfile.lint .` with the argument and no `--target` ran the lint for real, which is the regression test for the skipped-sibling hazard; a bare build with no argument failed closed on the guard; a planted template error failed the lint with hugo's own render error and made `script/cibuild` exit in 0.6s without the main image build starting at all; a planted over-long line failed the host `script/fmt-check` with `[warn] README.md`; both violations were reverted and re-run clean. Not changed here, and still true: the lint fails on hugo build errors but not on render-target collisions, which `--printPathWarnings` only prints (https://git.eeqj.de/sneak/lora.vegas/issues/25) — containerising the run neither fixes nor worsens that - 2026-08-10: added the `LICENSE` file and made the README say what it says (closes #10). The repo is public (`private: false` on the Gitea API, verified rather than assumed), so the owner's standing policy — MIT on any public repo lacking a license — applies. `LICENSE` is byte-identical to the canonical `sneak/homoicon` copy, confirmed by git blob hash rather than by eye (`3274443`), and its body is word-for-word the SPDX MIT text with only the line wrapping differing. The README's "Content is provided as-is for community use." — which granted nothing and matched no committed file — is replaced by `MIT. See [LICENSE](LICENSE).` plus an explicit statement that the licence covers the content in `content/` as well as the code, since this repo carries both and MIT names only "the Software". The Description first line now carries the licence, which `REPO_POLICIES.md` requires and which was the one field it was missing. Nothing published contradicts the choice: the built `public/` tree carries no copyright, all-rights-reserved or terms-of-use string anywhere, in `index.html`, `css/style.css`, `index.xml` or `sitemap.xml` — the footer `baseof.html` renders names `@sneak` and links the repo but asserts no reservation of rights, and the content is factual mesh channel data with no licence claim of its own. The fmt gate cannot reach `LICENSE` and needed no `.prettierignore` entry: `script/fmt` passes prettier the explicit globs `'**/*.md'` and `'**/*.css'`, and an extensionless root file matches neither. Measured, not assumed — a `script/fmt` run leaves the file's hash unchanged, and a counterfactual `LICENSE.md` copy was reflowed by the same run, which is the direct evidence that it is the extension and not an ignore rule doing the excluding. Deliberately not done, per the issue: per-file licence headers and SPDX identifiers, which no org standard mandates - 2026-08-09: added `static/_headers` so Cloudflare Pages serves baseline response security headers (closes #14). Hugo copies `static/` verbatim into `public/`, which is the deploy root Pages reads the file from; this is the first root-level `static/` in the repo, and the built tree confirms it unions with the theme's rather than shadowing it — `public/css/style.css` and `public/index.html` are byte-identical to the previous build and the static file count goes 1 to 2. The live "before" was measured, not assumed: Cloudflare already sends `X-Content-Type-Options` and `Referrer-Policy` by default, so the substance here is `Strict-Transport-Security`, `Content-Security-Policy`, `X-Frame-Options` and `Permissions-Policy`. The CSP is `default-src 'none'` with `style-src 'unsafe-inline'`, which the built page supports exactly: it has no script, img, link, iframe, form or media element and no `style=`/`on*=` attribute, only the one inline `