From f4754f0e84133e4a3db34ad64c9322c8a4b3c150 Mon Sep 17 00:00:00 2001 From: sneak Date: Wed, 11 Nov 2026 00:06:04 +0000 Subject: [PATCH] TODO.md: remove the work log, keep only open work (closes #167) Drop the Completed Steps log and the finished "commit this TODO.md" item. Git keeps the history. Model: opus-5-5 --- TODO.md | 426 -------------------------------------------------------- 1 file changed, 426 deletions(-) diff --git a/TODO.md b/TODO.md index 3eb1e5b..5e2c70b 100644 --- a/TODO.md +++ b/TODO.md @@ -19,434 +19,8 @@ prompts/FIXUP_CLEAN.md (currently a near-empty stub) and prompts/FIXUP_REPORT.md (a rough draft). Write the missing content, run `make fmt` so they pass fmt-check, and commit. -# Completed Steps - -- 2026-11-09: `script/update-policy` and `make update-policy` update a repo's - vendored policy files with one command - (https://git.eeqj.de/sneak/prompts/issues/162). They fetch the files from - `prompts`, keep the repo's own entries, commit and push. The canonical - `.dockerignore` now ends with the comment that the repo's own entries go - below. The template repositories get the script in their own issues. -- 2026-11-07: Go code is now formatted with `gofmt` and then `golines -m 77` - (https://git.eeqj.de/sneak/prompts/issues/160). `prompts/REPO_POLICIES.md` - says how `script/fmt`, `script/fmt-check` and `script/bootstrap` do it and - pins `golines`. The Go style guide and both checklists say the same. `lll` - stays at 88, since `golines` leaves long strings and comments as they are. -- 2026-11-06: The pinning rule in `prompts/REPO_POLICIES.md` now opens with its - scope: what we download and install ourselves in scripts and Dockerfiles - (https://git.eeqj.de/sneak/prompts/issues/154). Distribution packages are - outside the rule, and updating and upgrading them is allowed. Both checklists - say the same. -- 2026-11-04: Each repository now commits yarn 4 and installs with - `yarn install --immutable` (https://git.eeqj.de/sneak/prompts/issues/149), on - sneak's ruling at - https://git.eeqj.de/sneak/prompts/issues/149#issuecomment-167558. Product - repositories convert when they next have work. These changed: - - This repository carries `.yarn/releases/yarn-4.18.1.cjs`, and its - `yarn.lock` is in yarn 4's format. - - `script/bootstrap` no longer stops on yarn's major version. - - Node comes from the distribution's newest Node package, which on Alpine - 3.24 is `nodejs-current`. - - A `Dockerfile` stage that needs yarn also copies `.yarnrc.yml` and - `.yarn/releases/`, and may start from any distribution that packages node - and yarn. - - Both checklists give the steps, and the ignore files keep yarn's install - state out of git and the build context. -- 2026-11-04: An agent whose work is confined to one package may run `go test` - directly on that package's suite, or on individual tests in it, while - iterating (https://git.eeqj.de/sneak/prompts/issues/51), on sneak's ruling at - https://git.eeqj.de/sneak/prompts/issues/51#issuecomment-167600. The full - `make check` is still required before every push, and the `Makefile` gains - nothing. The rule on Docker now names the lint and test gates, because a run - while iterating is not one. -- 2026-11-04: node, yarn, npm, python, pip and venv now come from the - distribution with no version and no hash - (https://git.eeqj.de/sneak/prompts/issues/146), on sneak's ruling at - https://git.eeqj.de/sneak/prompts/issues/146#issuecomment-166033. Third-party - packages stay pinned by hash. These changed: - - `script/bootstrap` no longer uses nvm or corepack, and stops when yarn's - major version is not 1. - - `script/bootstrap` installs node, yarn and the node packages only when - `yarn.lock` is in the tree. - - `script/bootstrap`, `script/fmt` and `script/fmt-check` run `yarn` or - `yarnpkg`, whichever is present. - - This repository's `Dockerfile` starts from Alpine 3.24. - - The Python `test` phase example starts from `debian:trixie-slim`. - - A Python repository's `script/bootstrap` creates its virtual environment - at `$HOME/.pipenv`, so it works on a host and in a `Dockerfile`. - - `PIP_ONLY_BINARY=:all:` stops a package with no wheel, so pip downloads no - build tools without a hash check. -- 2026-11-04: Rewrote `prompts/REPO_POLICIES.md` sentence by sentence - (https://git.eeqj.de/sneak/prompts/issues/136), on sneak's yes at - https://git.eeqj.de/sneak/prompts/issues/136#issuecomment-165193. Every rule - keeps its meaning and its place, and `must` and `should` stay as they were. - Long sentences are split, comma-chained lists are now bulleted lists, and - every reason stays. Code blocks, digests, URLs, file names, commands and - quoted strings are unchanged. -- 2026-11-03: The canonical golangci-lint is now v2.15.0, still built with - go1.27.0, so the `go` directive rule is unchanged (issue 142). Repositories - pick this up on their next re-vendor. Each item in the canonical - `.golangci.yml` was tried on a scratch module. These changed: - - `canonicalheader` is enabled again, because v2.15.0 fixes the random - misses behind issue 105. - - The `depguard` exemption covers only the files directly inside a directory - whose name ends in `test`. It used to reach every directory below that one - too. The name of the directory a repository is cloned into no longer - counts. - - `gomodguard_v2` also blocks `github.com/go-redis/redis/v9`, whose - pre-releases can still be imported under that path. - - `uniq-by-line` is now `false`, so a line that trips two linters reports - both findings. - - Three comments are corrected: - - `exhaustruct` is listed as deprecated. - - The test double is named `github.com/go-redis/redismock/v9`. - - The claim that every blocked module is in the Go package defaults is - gone. - - A comment says the file has no `formatters` section, so - `golangci-lint run` does not run `gofmt`. -- 2026-11-03: A package from the distribution's own package index now needs no - version and no hash, and pulling that index is allowed - (https://git.eeqj.de/sneak/prompts/issues/72), on sneak's answer at - https://git.eeqj.de/sneak/prompts/issues/72#issuecomment-165196. The - distribution is the pinned base image's in a `Dockerfile` and the host's on a - host. It is trusted, and everything else stays pinned by hash. A package - source that a `Dockerfile` adds itself does not get the exception. The pinning - rule of `REPO_POLICIES.md` and both checklists say so, and the canonical Go - `Dockerfile`'s `apk add` line has a comment saying why it is allowed. -- 2026-11-03: A first test run that timed out now gets no verbose rerun - (https://git.eeqj.de/sneak/prompts/issues/61), on sneak's approval at - https://git.eeqj.de/sneak/prompts/issues/61#issuecomment-165195. The Go recipe - in `REPO_POLICIES.md` looks in the first run's output for - `panic: test timed out` or `*** Test killed`, and exits 1 when either is - there. The Python `make test` example takes the same `timeout 90 sh -c` - wrapper as its `Dockerfile` example. The 60 and 90 second rule and the - 5-minute rule now say a hung package uses the backstop once. The Go item in - both repo checklists now asks for this, so a repository with the old recipe - fails it. -- 2026-10-27: Added `prompts/API_POLICIES.md` - (https://git.eeqj.de/sneak/prompts/issues/137). It holds sneak's rule from - https://git.eeqj.de/sneak/routewatch/issues/199 that a value in an API - response is never a string with a label or unit in it. `REPO_POLICIES.md` and - the code style commands in the README name the new file. -- 2026-10-21: Check builds may now also keep the Python packages a `test` phase - installs from `Pipfile.lock` (issue 133), on sneak's ruling in - https://git.eeqj.de/sneak/rfscan/issues/80#issuecomment-153437. The install - comes before `ARG CACHEBUST`: `COPY script/ script/`, - `COPY Pipfile Pipfile.lock ./`, then `RUN script/bootstrap`. In that step - `script/bootstrap` installs nothing beyond system packages, pipenv and its - dependencies by hash, and the packages from the lockfile. It installs no - Python, because the tests use the base image's. `--deploy` installs only what - the lockfile names, checks every package against its hashes, and fails when - the lockfile is out of date with `Pipfile`. A kept layer holds nothing a new - install would refuse. A package built from source and the system packages may - differ in a new install. As with Go's modules, the packages are kept in a - layer, not a cache mount. The tests still run after `ARG CACHEBUST`, and every - other stage still installs its Python packages after it. `REPO_POLICIES.md` - gains a short Python `test` phase example, and both checklists and the README - state the rule the same way. rfscan picks this up on its next re-vendor. -- 2026-10-21: The canonical `.golangci.yml` now accepts a local `replace` of - `github.com/grafana/sobek` in a repository's root `go.mod` (issue 134), for - homoicon, which keeps a local copy of sobek on sneak's decision in - https://git.eeqj.de/sneak/homoicon/issues/1759#issuecomment-153261. Every - other local `replace` is still refused. It is an exclusion rather than a - `replace-allow-list` entry because gomoddirectives does not check that list - for a `replace` that points at a local path. homoicon picks this up on its - next re-vendor. -- 2026-10-18: Check builds may now also keep Go's downloaded modules, - golangci-lint's cache and the layers that install system packages (issue 130), - on sneak's ruling there. In each stage of the canonical Go `Dockerfile`, the - system-package install and the module download (`COPY go.mod go.sum ./`, - `RUN go mod download`) come before `ARG CACHEBUST`, so Docker keeps them until - the base image, the install line, `go.mod` or `go.sum` changes. The modules - are kept as a layer, not a cache mount, because Go does not check the files in - a cache mount again. `golangci-lint run` also mounts golangci-lint's cache, - `/root/.cache/golangci-lint`. Every step that lints, tests or compiles still - comes after `ARG CACHEBUST` and runs on every check build, and both `go test` - runs keep `-count=1`. `REPO_POLICIES.md`, both checklists, the Go style guide, - the README and the script comments state the rule the same way. This repo's - own `Dockerfile` is unchanged: its `script/bootstrap` step also installs node - packages, which the ruling does not cover. Repositories pick this up on their - next re-vendor. -- 2026-10-15: Check builds now keep Go's build cache between runs (issue 113), - on sneak's ruling there that Go's compile cache may survive. `script/lint`, - `script/test`, `script/cibuild` and `script/docker` pass a new `CACHEBUST` - build argument on every build in place of `--no-cache`, which also emptied the - cache mounts. Every `Dockerfile` stage declares `ARG CACHEBUST` first, so - every `RUN` step still runs on every check build. The canonical Go - `Dockerfile` mounts Go's build cache on the steps that compile and runs both - `go test` runs with `-count=1`, so no test result is reused. A stage without - the `ARG` line is served from cache, so repositories re-vendor the scripts and - the `ARG` lines in one commit. Not yet tried on the shared runner. -- 2026-10-08: The canonical `script/bootstrap` now uses the installed node only - when its major version is the pinned one (issue 118). Otherwise, as when node - is missing, it installs the pinned node under nvm and installs yarn and the - packages under it. It prints the version of the node it uses either way. The - CI runner image ships node 24, under which the pinned yarn 1.22.22 printed the - deprecation warning DEP0169 on every bootstrap. Only the major is compared - because the `Dockerfile` stages start from a node 22 alpine image whose exact - version is not the pin, and nvm cannot install a prebuilt node on alpine; the - version-comparison rule in `REPO_POLICIES.md` names node as its exception. - `script/fmt` and `script/fmt-check` pick their yarn with the same test: the - `yarn` on `PATH` when the installed node is the pinned major, and otherwise - yarn under the pinned node through nvm. `REPO_POLICIES.md` and both checklists - say so, and the checklists' final `script/cibuild` check names what the CI - runner image has: node 24 and no yarn. Not yet tried on the shared runner. - Repositories pick this up on their next re-vendor. -- 2026-10-07: The `script/cibuild` item in `NEW_REPO_CHECKLIST.md` now matches - the canonical `script/cibuild` (issue 125). Its image build carries the tag, - `-t "$tag"`, and the item says that `$version` comes from - `git describe --tags --always --dirty` (`unknown` if empty) and `$tag` from - `script/projectname`, each assigned on its own line before the build. A - repository written from the checklist got an untagged build, which leaves a - dangling image behind on every run, and was never told where `$version` comes - from. The other `docker build` commands the checklists and `REPO_POLICIES.md` - give for `script/` already matched their scripts. -- 2026-10-07: `script/lint` and `script/test` now build with - `--output type=cacheonly` in place of a tag (issue 123), so they still run - their phase uncached and fail on a failing step but write no image. Nothing - used those images, and writing one out cost about 16 seconds of a Go - repository's test build. `script/cibuild` and `script/docker` keep their tags. - `REPO_POLICIES.md`, both checklists and the README no longer say the gate - builds are tagged. Not yet tried on the shared runner. Repositories pick this - up on their next re-vendor. -- 2026-10-07: The canonical `.gitea/workflows/check.yml` now sets - `timeout-minutes: 20` on its `check` job (issue 120), so a hung build frees - the shared runner instead of holding it until the runner's own limit. - `script/cibuild` runs three Docker builds, each held to the 5-minute Docker - build limit, plus the bootstrap; if that limit changes (issue 113), the value - follows it. `REPO_POLICIES.md` and both checklists name the limit among what - the workflow sets. Not yet tried on the shared runner. Repositories pick this - up on their next re-vendor. -- 2026-10-07: The canonical `package.json` now has `"private": true` in place of - `"license": "MIT"` (issue 119), so a repository that copies it no longer - declares MIT whatever its own licence is. yarn does not print "No license - field" for a private package. This repository's own licence is unchanged. -- 2026-10-06: The canonical `.gitea/workflows/check.yml` now sets - `fetch-depth: 0` on its checkout step (issue 110), so CI fetches the history - and tags that `git describe --tags --always` needs, and a tagged repository - stamps the same version in CI as in a local build. `REPO_POLICIES.md` and both - checklists name `fetch-depth: 0` among what the workflow does, next to - `persist-credentials: false` and the `concurrency` block, instead of asking - each tagged repository to add it. Not yet tried on the shared runner, which is - out of disk space. Repositories pick this up on their next re-vendor. -- 2026-10-06: The canonical `script/bootstrap` now runs `apt-get update` once, - before the first `apt-get install` of a run (issue 115). The Gitea runner - image starts with empty package lists, so installing anything it lacks, such - as Go, failed with `Unable to locate package`. A repository's own section no - longer needs a refresh of its own; `sneak/bsfirehose` and `sneak/dnswatcher` - drop theirs at their next re-vendor. -- 2026-10-06: `REPO_POLICIES.md` and both checklists now say that a checkout - whose `.git` is a file, a linked worktree or a repository checked out as a - submodule, is the exception to a plain `docker build .` succeeding (issue - 111): that file points to a git directory outside the build context, so the - build cannot read the version and the version check in the canonical - `Dockerfile` stops it. Such a build is given its version with - `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already do. - The check itself is unchanged. -- 2026-10-06: The canonical `.gitea/workflows/check.yml` now has a `concurrency` - block, so a new push cancels the older run on the same branch and no other, - and its checkout step sets `persist-credentials: false`, so the job's token is - not left in `.git/config` (issue 107). `REPO_POLICIES.md` and both checklists - describe the workflow as it now is. Not yet tried on the shared runner, which - is out of disk space. Repositories pick this up on their next re-vendor. -- 2026-10-06: The canonical `.golangci.yml` now disables `canonicalheader` - (issue 105). In golangci-lint v2.14.0 it misses findings at random in a - package that also calls `ResponseWriter.Header()`, so the same tree can fail - lint on one run and pass on the next. It comes back once a pinned - golangci-lint release fixes it. -- 2026-10-06: The canonical `.gitignore` and `.editorconfig` now each end with a - comment saying the repository's own entries go below it and a re-vendor keeps - them (issue 103, which took in issue 104), as `.dockerignore`'s header already - does. `.editorconfig` gains a `[*.go]` section with tabs, since `gofmt` - decides Go indentation everywhere. `REPO_POLICIES.md` and both checklists say - that each of these two files is the canonical content followed by the - repository's own entries, which a re-vendor keeps, and the Go styleguide puts - `*.log`, `*.out`, `*.test` and binaries among those entries. Common outputs - stay out of the canonical `.gitignore`; each repository lists its own. -- 2026-10-05: `script/cibuild`, `script/docker`, `script/lint` and `script/test` - now assign the image tag from `script/projectname` on its own line before the - `docker build` (issue 101), so `set -e` stops the script where - `script/projectname` fails instead of running `docker build` with a broken - tag. The comment above it in each script says why, and the snippets in - `REPO_POLICIES.md` show the same form. Repositories pick this up on their next - re-vendor. -- 2026-10-04: Went through the fleet findings recorded on 2026-08-09 (issue 62) - and added the two rules `REPO_POLICIES.md` did not yet state: a new or changed - check is proven by planting a defect it must catch; and a change to a separate - workflow limited to `main` is first run from the feature branch, added to that - workflow's `branches` list and removed again before merging. The other - findings were already stated, replaced by `--no-cache`, about git worktrees, - or about how agents work together. The warning against - `golangci-lint config verify` is dropped because sneak ruled on - https://git.eeqj.de/sneak/prompts/issues/40 (2026-08-10) that there is no - config check step and the config is assumed valid; a vendored `.golangci.yml` - stays byte-identical to the canonical copy. The issue gives each reason. -- 2026-10-04: `REPO_POLICIES.md` now says which `Dockerfile` stages run - `script/bootstrap` (issue 90). The gate phases and the build stage start from - their pinned base images and install what those images lack either inline, as - the canonical Go `Dockerfile` does for `git`, or by running - `script/bootstrap`, as this repo's own `Dockerfile` does for its yarn - packages. The development environment stage, the final stage of a non-server - repo, runs `script/bootstrap`. The new repo checklist says the same. -- 2026-10-04: Added a root `.gitattributes` that merges `TODO.md` with git's - union merge (issue 98), so two branches that each add an entry at the top of - Completed Steps merge without a conflict. Git now never reports a conflict in - `TODO.md`: a real conflict elsewhere keeps both versions of the line, and when - two new entries share an identical line, one is inserted into the middle of - the other, which a rebase can do to an entry already on `next`. Read the - merged entries after every merge or rebase. This applies to this repository - only; no canonical file changed. -- 2026-10-04: The canonical `.dockerignore` now also keeps out the git `config` - of a submodule that keeps its own `.git` directory, which still reached the - image (issue 88): both git patterns now carry the `**/` prefix. A submodule - whose name has a `config` segment (`config`, `deploy/config`, `config/lib`) - still loses its whole git directory, so Go's version stamping fails the build; - the file records this as a `KNOWN GAP:` with the remedy, - `git submodule add --name`. Closing it would take a wildcard re-include, which - makes BuildKit walk every excluded directory, such as `node_modules`, on every - build. `REPO_POLICIES.md` and both checklists say so in the same words. -- 2026-10-04: The note under the canonical Go `Dockerfile` example in - `REPO_POLICIES.md` now installs lint-phase system libraries with `apt-get` - under their Debian package names (issue 83). The `golangci/golangci-lint` - image is Debian-based and has no `apk`, so the old `apk add` instruction - failed as written. Nothing is pinned or unpinned; that is still open on - issue 72. -- 2026-10-04: Fixed the server lifecycle example in - `prompts/GO_HTTP_SERVER_CONVENTIONS.md` (issue 86). Only fx handles SIGINT and - SIGTERM, and `Run()` in `main` exits with the shutdown's exit code. A listen - error asks fx to shut down with exit code 1 through `fx.Shutdowner`; a Sentry - start failure is returned from the server's start hook instead of calling - `os.Exit` from a goroutine, so the stop hooks of what had started still run. - The server's stop hook shuts the HTTP server down within 5 seconds and fails - when requests are still running. A new paragraph says who owns signals and the - exit code. -- 2026-10-04: `REPO_POLICIES.md` now says how a Go tool a repo needs on the host - is pinned (issue 37): installed with `go install` pinned to a commit hash, - never tracked as a `go.mod` tool dependency or through a `tools.go` file. - golangci-lint is unaffected, since no repo installs it on the host. -- 2026-10-04: The canonical `.gitignore` and `.dockerignore` now also keep out - `id_ecdsa_sk` and `id_ed25519_sk`, the private key files `ssh-keygen` writes - for keys backed by a hardware security key (issue 81). Their `.pub` halves - stay trackable. -- 2026-10-04: `package.json` now has `"license": "MIT"`, matching `LICENSE`, so - yarn no longer prints "No license field" when `script/bootstrap` runs it - inside the Docker phases (issue 76). That was the only yarn warning there. -- 2026-10-04: `REPO_POLICIES.md` now states that guidance for coding agents - lives in one `AGENTS.md` at the repository root, never under a file or - directory named after one agent tool and never in separate memory files (issue - 31). This retires the rule, still present in older vendored copies, that kept - agent memory as committed files under `.claude/memory/`. `AGENTS.md` joins the - list of files allowed in the root, and both checklists say so. -- 2026-10-04: Rewrote the note under the canonical Go `make test` example in - `REPO_POLICIES.md` (issue 77), which still named the cache-busting build - argument that `--no-cache` replaced. It now says where Go's test result cache - can replay a pass: on a developer's machine, where the Makefile target runs, - and not in the `test` phase of the `Dockerfile`, whose base image and earlier - steps hold no result for the repo's tests. -- 2026-10-04: The Makefile examples in the Go styleguide and the HTTP server - conventions now fall back to `dev` when `git describe` prints nothing (outside - a git checkout, or where git is missing or refuses the checkout), instead of - stamping an empty version (issue 74). The canonical `Dockerfile` already fails - on a `dev` version when `.git` is in the build context. -- 2026-10-04: The canonical `.dockerignore` now also keeps out each submodule's - `config` (issue 75). A submodule's git directory lives under `.git/modules/`, - nested again for its own submodules, and its `config` can hold a credential - just like `.git/config`. The pattern `.git/modules/**/config` covers every - depth and leaves the top-level `.git` that `git describe` reads untouched. - `REPO_POLICIES.md` and both checklists say so in the same words. -- 2026-10-03: Fixed two defects in the canonical Go `Dockerfile` example (issue - 73). The test phase now uses the Debian Go image, since `-race` needs cgo and - the alpine image has no C compiler, so the phase failed before running a test. - The stage that compiles runs `git config --system --add safe.directory /src`, - because a context sent as a tar stream keeps the sender's file owners and git - refuses that checkout, leaving the version empty. Both checklists state that - step in the same words. -- 2026-10-03: Moved the canonical golangci-lint to v2.14.0, built with go1.27, - because v2.12.2 refuses to lint a module whose `go` directive is 1.27 (issue - 65). Releases from v2.13.0 deprecate `exhaustruct` in favour of - `exhaustruct_v5`, which `default: all` switches on, so the canonical - `.golangci.yml` now disables `exhaustruct_v5` beside `exhaustruct`. v2.12.2 - rejects that file, so `REPO_POLICIES.md` and both repo checklists now say a - repo sets the lint phase digest and re-vendors `.golangci.yml` in one commit. -- 2026-10-03: Brought the canonical `.gitignore` level with `.dockerignore` on - secrets (issue 38): it now also ignores `prod.env`-style `*.env` files, - `.envrc`, `*.p12`, `*.pfx` and the extensionless SSH private keys, written to - `.gitignore`'s own rules (no `**/` prefix) and case-folded with character - ranges. `example.env` and `sample.env` stay trackable through negations. -- 2026-10-02: The image version now comes from git inside the build (issues 69 - and 71), superseding the 2026-09-08 entry that excluded `.git`. The canonical - `.dockerignore` sends `.git` but keeps out `.git/config`, which can hold a - credential. The Dockerfile example in `REPO_POLICIES.md` installs `git`, takes - the `VERSION` build argument when one is given and otherwise - `git describe --tags --always`, and fails when `.git` exists but the version - is empty, `dev` or `unknown`; a plain `docker build .` with no build arguments - must succeed. This repo's `script/docker` and `script/cibuild` still pass - `--build-arg VERSION`, since its own `Dockerfile` compiles nothing. -- 2026-09-08: Moved linting and testing into Docker as phases of the main - `Dockerfile`, per the owner ruling on issue 40. `script/lint` and - `script/test` build one phase each by name with `--no-cache` — the same answer - issue 26 got, so no separate cache-busting mechanism survives — and the final - stage copies a harmless file from both, so the image cannot be built unless - they pass. This also closes issue 30: a container has its own result cache and - its own lock, so a lint verdict can no longer belong to another checkout. No - separate lint Dockerfile, and no `golangci-lint config verify` step. - `script/check` runs the gates and nothing else, and `script/cibuild` - bootstraps first, since it is all CI runs and `script/fmt-check` is native. -- 2026-09-08: Kept in-repo agent scratch out of the Docker build context and out - of version control: `.claude/` is one full checkout of the repo per in-flight - agent, and under `COPY . .` all of it was reaching the image. Also closed the - consequence of excluding `.git` — `git describe` yields an empty version - inside a build stage without failing, so `script/docker` and `script/cibuild` - now compute the version on the host and pass `--build-arg VERSION`. -- 2026-09-08: Closed the secret exposure in the canonical `.dockerignore`: a - local `.env`, `*.pem` or `*.key` was reaching the build context under - `COPY . .`, invisible to every git-based check. The patterns are now written - to `.dockerignore`'s own semantics — `**/`-prefixed so they hold at every - depth, case-folded with character ranges — and `REPO_POLICIES.md` requires - verifying by enumerating the image rather than by reading the file. -- 2026-09-08: Made a pinned tool in `script/bootstrap` actually reach the host. - `REPO_POLICIES.md` now requires comparing the installed version against the - pin rather than testing `PATH` presence, and re-resolving the binary through - `PATH` after installing, so a version bump cannot be a silent no-op and a - shadowed install cannot report success. -- 2026-09-08: Closed the false green in the canonical CI gate: `script/cibuild` - and `script/docker` now build with `--no-cache`, so the Dockerfile's check - layers cannot be served from cache on an unchanged tree, and the text claiming - a bare `docker build .` proves the checks ran is corrected in - `REPO_POLICIES.md`, both checklists and the Go styleguide. -- 2026-09-03: Added `-count=1` to both `go test` invocations in the canonical Go - `make test` example in `REPO_POLICIES.md`, so the target cannot report a - cached pass it did not earn, and documented that Go's test-result cache is a - second, independent cache stacked below the Docker layer cache. -- 2026-08-31: Migrated the canonical `.golangci.yml` from the deprecated - `gomodguard` to `gomodguard_v2`: the old linter is disabled by name (which is - what silences the deprecation warning), the successor is named explicitly in - `linters.enable`, and it carries a `blocked` module list drawn only from - decisions already recorded in the Go package defaults. -- 2026-08-07: Set the canonical `.golangci.yml` to the org-standard v2-schema - config already deployed byte-identical across the org's Go repos (settings - under `linters.settings` so thresholds like lll/funlen/cyclop/dupl actually - apply under golangci-lint v2). Recorded the canonical golangci-lint version - (v2.12.2, commit-pinned) in REPO_POLICIES.md. -- 2026-03-20: Strengthened constructor naming and Params struct rules in the Go - styleguide. -- 2026-03-18: Documented fail-fast Dockerfile lint stage and conditional -v test - rerun patterns in REPO_POLICIES.md. -- 2026-03-11: Added HTTP service hardening policy for 1.0 releases. -- 2026-03-10: Added policy: no build artifacts in repos. -- 2026-03-04: Added LLM prose tells reference and copyediting checklist, then - several self-applied revision passes. -- 2026-02-28: Expanded the pre-1.0 schema migration rule; added clawpub - reference. -- 2026-02-23: Added Go style rules (no type-only packages, Stringer for - string-based types); template repos section in README. -- 2026-02-22: Initial policy corpus: REPO_POLICIES.md, code styleguides - (general, Go, JS, Python), repo checklists, CI policy, hash pinning, Go HTTP - server conventions, repo scaffolding. - # Future Steps - Finish, format, and commit FIXUP_CLEAN.md and FIXUP_REPORT.md (the Next Step). -- Commit this TODO.md at the repo root; it is the last missing policy file. - Decide the fate of untracked resume.sh: commit it or delete it. - Add more prompt templates for common development tasks (from README TODO).