sneak/mfer

Files

check / check (push) Successful in 4s

Details

Add TODO section to README with 1.0 roadmap, remove TODO.md (#54 )

## Summary

Performs a design and status review of the codebase and adds a comprehensive TODO section to `README.md` listing remaining work for a 1.0 release.

### What changed

- **README.md**: Added a `TODO: Remaining Work for 1.0` section covering:
  - **7 design questions** requiring @sneak's input before implementation (manifest type export, Go module path, GPG vs pure-Go crypto, format framing, etc.) — each with an answer field for inline decisions
  - **Implementation tasks** organized by category: repo infrastructure, format & correctness, library, CLI, testing & robustness, documentation, and release checklist
  - Updated build status section (removed stale Drone CI badge, replaced with description of current Docker-based CI)
- **TODO.md**: Removed — items integrated into README TODO section
- **AGENTS.md**: Updated reference from `TODO.md` to README TODO section

### Design review findings

**What works well:**
- Core library (Builder, Scanner, Checker) is solid with good test coverage
- Format specification is well-designed (protobuf + zstd, multihash, deterministic serialization)
- CLI covers all major operations (gen, check, list, export, freshen, fetch)
- Test suite is thorough — builder, scanner, checker, GPG, CLI integration, corruption detection
- afero abstraction enables clean testing without filesystem side effects

**Key gaps for 1.0:**
- Missing repo infrastructure (`.golangci.yml`, `.editorconfig`, CI workflow)
- `manifest` type is unexported — consumers can't use it in their own type declarations
- GPG signing shells out to `gpg` subprocess — fragile and may not be installed
- Go module path inconsistency between `go.mod` and proto `go_package`
- `fetch` command lacks retry logic and has no HTTP timeout
- Missing fuzz tests for untrusted input deserialization
- Freshen CLI command has incomplete integration test coverage

closes #47
closes #50

Co-authored-by: user <user@Mac.lan guest wan>
Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de>
Co-authored-by: Jeffrey Paul <sneak@noreply.example.org>
Reviewed-on: #54
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

2026-04-07 00:43:56 +02:00

1.1 KiB

Raw Blame History

Agent Instructions

Read REPO_POLICIES.md before making any changes. It is the authoritative source for coding standards, formatting, linting, and workflow rules.

Workflow

When fixing a bug, write a failing test FIRST. Only after the test fails, write the code to fix the bug. Then ensure the test passes. Leave the test in place and commit it with the bugfix. Don't run shell commands to test bugfixes or reproduce bugs. Write tests!
After each change, run make fmt, then make test, then make lint. Fix any failures before committing.
After each change, commit only the files you've changed. Push after committing.

Attribution

Never mention Claude, Anthropic, or any AI/LLM tooling in commit messages. Do not use attribution.

Repository-Specific Notes

This is a Go library + CLI tool for generating .mf manifest files.
The proto definition is in mfer/mf.proto; generated .pb.go files are committed (required for go get compatibility).
The format specification is in FORMAT.md.
See the TODO section in README.md for the 1.0 implementation plan and open design questions.

1.1 KiB Raw Blame History

Agent Instructions

Workflow

Attribution

Repository-Specific Notes

1.1 KiB

Raw Blame History