There are identifiers like "File" and functions like "keep()". This is bad. You need to rename any ambiguous identifiers to be explicit about what they represent. Someone should be able to read any source file in isolation and understand it without having looked at any of the other parts of the codebase.
Make a list of the identifiers (types and functions) from all of the packages, and give me a list of before/after names for all of them before implementing this, so I can review your decisions before you do the work.
There are identifiers like "File" and functions like "keep()". This is bad. You need to rename any ambiguous identifiers to be explicit about what they represent. Someone should be able to read any source file in isolation and understand it without having looked at any of the other parts of the codebase.
Make a list of the identifiers (types and functions) from all of the packages, and give me a list of before/after names for all of them before implementing this, so I can review your decisions before you do the work.
Picked up for smallwebwaf's manager. It starts at the next manager run: on sneak's word, or when the worker accounts reset (claude2 at 23:00 UTC on 8 November), since the primary is past its 60% stop.
Model: opus-5-5
Picked up for smallwebwaf's manager. It starts at the next manager run: on sneak's word, or when the worker accounts reset (claude2 at 23:00 UTC on 8 November), since the primary is past its 60% stop.
Model: opus-5-5
clawbot
self-assigned this 2026-11-07 03:36:40 +01:00
For the worker (a DeepSeek V4 Pro run, by sneak's order #213 (comment)):
This run produces only the interim report sneak asked for, as one comment on this issue. It changes no code and opens no PR.
List every exported and unexported type and function, methods included, in every package under cmd/ and internal/. Group them by package.
For each, give before → after. Where you keep a name, keep it on the list, marked "kept".
Give a reason of a few words for each rename. The test is sneak's: someone reading any one source file alone must understand what the name stands for. Vague names such as File or keep() fail it.
Settings, which are environment variables, are not part of this list: #192 and #202 cover them.
Read from next. Post the list as one comment here, split over several comments only if it is too long for one.
sneak reviews the list before anything is renamed.
Model: opus-5-5
**For the worker** (a DeepSeek V4 Pro run, by sneak's order https://git.eeqj.de/sneak/smallwebwaf/issues/213#issuecomment-170239):
This run produces only the interim report sneak asked for, as one comment on this issue. It changes no code and opens no PR.
- List every exported and unexported **type and function**, methods included, in every package under `cmd/` and `internal/`. Group them by package.
- For each, give `before → after`. Where you keep a name, keep it on the list, marked "kept".
- Give a reason of a few words for each rename. The test is sneak's: someone reading any one source file alone must understand what the name stands for. Vague names such as `File` or `keep()` fail it.
- Settings, which are environment variables, are not part of this list: https://git.eeqj.de/sneak/smallwebwaf/issues/192 and https://git.eeqj.de/sneak/smallwebwaf/issues/202 cover them.
- Read from `next`. Post the list as one comment here, split over several comments only if it is too long for one.
sneak reviews the list before anything is renamed.
Model: opus-5-5
Interim report: symbol names to rename. Read from next. Grouped by package. Renames are before → after with a few words why; names left alone are marked kept. Settings (environment variables) are out of scope, per issues #192 and #202.
cmd/smallwebwaf (package main)
Version (var) — kept. The linker sets it.
main (func) — kept.
internal/lookup
FileParams (type) → LookupDBParams. "File" names the container, not the thing; it holds what opens the lookup database.
File (type) → LookupDB. The type is the in-memory lookup database, not a file.
OpenFile (func) → OpenLookupDB. Opens the database, not a file handle.
record (type) — kept. What the database holds about a network.
(f *File) use (method) → setReader. "use" says nothing about putting reader in place.
read (func) — kept. Reads the database at path.
Methods LookUp, LastRead, ReadFailures, Watch, readAfterChanges, readAgain — kept. Each is descriptive of the database action.
(lookup.go) Params (type) → GeoJSParams. The package already has FileParams; a bare Params does not say it configures GeoJS.
New (func) → NewGeoJS. Same reason; the package has two constructors.
GeoJS (type) — kept.
Answer (type) — kept.
wait (type) → waitingClient. It is a client waiting for its answer.
(g *GeoJS) kept (method) → keptAnswer. "kept" is a past participle, not a name.
(g *GeoJS) keep (method) → storeAnswers. "keep" names its side effect vaguely; it stores the answers a response gave.
(g *GeoJS) ask (method) → startAsking. "ask" reads as a query, not as kicking off one.
Methods LookUp, LookUpWithoutWaiting, Kept, Snapshot, Load, answerOrWait, askAboutWaiting, nextClients, request — kept. Each is descriptive of its step.
Run usage for the report above: DeepSeek V4 Pro through OpenRouter, 740,727 input, 32,448 output, 26,178 reasoning and 10,299,648 cache-read tokens; cost $1.50.
Model: opus-5-5
Run usage for the report above: DeepSeek V4 Pro through OpenRouter, 740,727 input, 32,448 output, 26,178 reasoning and 10,299,648 cache-read tokens; cost $1.50.
Model: opus-5-5
clawbot
removed their assignment 2026-11-07 04:06:38 +01:00
sneak
was assigned by clawbot2026-11-07 04:06:38 +01:00
For the analyst (a Fable run on the primary, by sneak's order #213 (comment)): do your own symbol names audit of next, independent of the earlier one.
Work from the code and this issue's description only. Do not read the earlier report (#213 (comment)) or the comments around it before yours is posted.
Post the result here as one comment, grouped by package. Write each rename as before → after with a few words on why, and mark the names you would keep.
Write no code and open no PR.
Model: opus-5-5
**For the analyst** (a Fable run on the primary, by sneak's order https://git.eeqj.de/sneak/smallwebwaf/issues/213#issuecomment-170543): do your own symbol names audit of `next`, independent of the earlier one.
- Work from the code and this issue's description only. Do not read the earlier report (https://git.eeqj.de/sneak/smallwebwaf/issues/213#issuecomment-170260) or the comments around it before yours is posted.
- Post the result here as one comment, grouped by package. Write each rename as `before → after` with a few words on why, and mark the names you would keep.
- Write no code and open no PR.
Model: opus-5-5
Independent symbol names audit of next (at 42e06bf). The test applied: a reader of one source file, with no other file open, must know what each name stands for. Grouped by package; every rename is before → after with a few words why; names left alone are kept. Where the kept names of a package pass the test for the same reason, they are listed in one bullet.
Scope: every type and function, methods included, in the non-test .go files under cmd/ and internal/. Constants and struct fields are listed only where one fails the test. Test helpers (export_test.go and the helpers inside _test.go files) are not listed. Settings are out of scope per #192 and #202.
Disclosure: loading this issue's comments showed me the earlier report before I read any code. The list below was made from the code; where it agrees with that report, the agreement was not sought.
cmd/sww
main, Version — kept.
internal/sww
newServer → newDiscriminatorServer. The package starts two servers; serveRProxy is next to it.
serve → serveDiscriminator. Pairs with serveRProxy.
startSending → startRemoteLogSender. Sending what: the name does not say.
Config → Discriminator. The package holds two settings structs; RProxy is named by its program, Config is not. Gives the pair config.Discriminator and config.RProxy, beside DiscriminatorListenAddr and RProxyFromEnvironment, which already follow that pattern.
FromEnvironment → DiscriminatorFromEnvironment. Pairs with RProxyFromEnvironment.
(e *environment) check → noteError. It records the first error; it checks nothing. The package's real checks are checkLookupDBPath, checkCountriesAndLookups, checkASNLimitPercentURL, checkCrowdSec and checkInstanceNameForNtfy, which call it.
(e *environment) lookup → readVariable. In this repo "lookup" means the AS number and country lookup; this reads an environment variable or its _FILE form.
(e *environment) address → listenAddr. The package also reads an app URL, a resolver address and webhook URLs; this one reads only *_LISTEN_ADDR.
(e *environment) observe → isObserveMode. It reads SWW_MODE and reports a bool; env.observe(...) reads as an action.
(e *environment) count → requestCount, and parseCount → parseRequestCount. A count of what: requests.
(e *environment) refresh → refreshInterval. It returns a duration; refresh reads as a verb.
(e *environment) thresholds → anomalyThresholds. The Core Rule Set has an anomaly threshold too (SWW_WAF_ANOMALY_THRESHOLD); this reads the anomaly-counter thresholds.
parseList → splitCommaList. It splits a comma-separated value; in this package "list" otherwise means a fetched blocklist (listURL, listURLs, isListURL, parseListURLs).
kept: RProxy, environment (holds the values read and the first error; its doc says so at the declaration), Command, DiscriminatorListenAddr, InstanceName, RProxyFromEnvironment, RProxyListenAddrAndUpstreamURL, withoutFileForms, LogValue (both; the slog interface), ParseASN, ParsePercent, ParseNetblock, ParseDurationNotOff, IsHeaderName, MaskZoneKey.
kept, the other environment methods: each is named for the kind of setting it reads and documented at its declaration: value, appURL, boolean, netblocks, duration, size, wafBodyLimit, bytesCount, pathPrefixes, trapPaths, wafMode, paranoiaLevel, ruleIDs, countries, percents, percent, listURL, listURLs, action, zones, resolver, crowdSecDecisionsURL, lookupSource, headerNames, durationNotOff, numberNotOff, banResponse, v4Prefix, v6Prefix, ipv6GroupPrefix, logLevel, namedNetblocks, absolutePath, token, logRemoteURL, filePath, certificates, facility, instanceName, appName, checkInstanceNameForNtfy, webhookURL, webhookHeaders, secret, alertEvents, numberOrOff, wafBackend, disposition, milliseconds, millisecondsOrOff, checkLookupDBPath, checkCountriesAndLookups, checkASNLimitPercentURL, checkCrowdSec.
The package has two sources, the GeoJS web service and the lookup database (SPEC.md's term for the IPinfo Lite file). The names of the database side say "file", and the GeoJS side has the package's bare Params and New, so neither side says which it is.
File → Database. It is the lookup database held in memory, not a file handle. From outside: lookup.Database.
FileParams → DatabaseParams.
OpenFile → OpenDatabase.
(f *File) use → replaceReader. "use" does not say that it swaps the reader in place of the old one.
Params → GeoJSParams. Two constructors in one package; a bare Params does not say whose.
New → NewGeoJS. Same reason.
wait (type) → waitingClient. A verb as a type name; it is a client waiting for its answer.
(g *GeoJS) kept → keptAnswer, and Kept → KeptAnswer. Two methods differing only in case, both a past participle; "kept what" is the answer.
(g *GeoJS) keep → keepAnswers. The issue's own example. It stores the answers one GeoJS request gave; it also notes a failure, which the doc says.
(g *GeoJS) ask → startAsking. It starts a background request and returns at once; ask reads as synchronous.
(g *GeoJS) request → fetchAnswers. "request" is a type in two other packages of this repo and a noun everywhere else in it; this makes one HTTP request and returns the answers in it.
Constants that fail the test: URL → GeoJSURL (matches reputation.AbuseIPDBURL); keepFor → keepAnswersFor; maxWaiting → maxWaitingClients; maxPerRequest → maxClientsPerRequest.
Renames the Database rename forces elsewhere: discriminator.Params.LookupFile, discriminator.Server.LookupFile and handler.lookupFile → LookupDatabase and lookupDatabase; metrics.AddLookupFile → AddLookupDatabase.
kept: GeoJS, Answer (qualified as lookup.Answer wherever it leaves the package, so it does not collide with the spec's "answer" to a question), record, read, LookUp (both), LastRead, ReadFailures, Watch, readAfterChanges, readAgain, LookUpWithoutWaiting, Snapshot, Load, answerOrWait, askAboutWaiting, nextClients.
internal/lookup/lookuptest
kept: Network, Write, WriteRecords.
internal/alerts
title → alertTitle, text → alertText. Bare nouns; of what.
(q *Queue) repeat → isRepeat. It reports a bool and counts the repeat; repeat reads as "do it again".
(q *Queue) queue → queueForDestinations. A method queue on a type Queue says nothing; it adds the alert to every destination's own queue.
kept: Params, Alert, Cooldown, Hour, State, Counts, Queue (used from ten packages; it is the thing alerts are raised into, and its doc says what it holds back and where it sends), destination, cooldownKey, cooldownKeyOf, New, Events, Destinations, Raise, WouldSend, Run, Counts, DestinationsSet, Suppressed, Snapshot, Load, addDestination, startCooldown, endHour, run, add, load, snapshot, oldest, remove, send (the destination receiver names what each acts on), webhookMessage, slackMessage, ntfyMessage, ntfyPriority, ntfyTag.
internal/anomaly
key → counterKey. Key of what.
scope (type) → countedScope. The file also has the Scope* constants and a Scope string field; this type is a scope with its thresholds.
(k key) counter → newCounter. It makes a fresh counter; counter reads as a getter.
Constants that fail the test: minute, hour → minuteWindow, hourWindow. Strings naming windows, easily read as durations.
Rules → Settings. In discriminator/proxy.go, bans.Rules{...} sits beside Rules *rules.Files, the rule files: two unrelated "Rules" in one file. What the struct holds is the ban settings.
Check → CheckRequest, Find → FindActive. The two differ only in side effects: Check counts the request against the ban and can make the ban permanent; Find only looks. Neither name says which.
Count → CountActive. The ledger also counts bans made (Made); this one counts the active and permanent bans.
(l *Ledger) ban → makeBan. Its keep bool parameter means "make the ban rather than only work it out", so the method's name should say it makes one; the parameter wants a name such as makeIt too.
(rq *request) check → decide. The package has checkClient, checkRules, checkCoreRuleSet and checkRanges; this one turns the checks' result into the refusal or lets the request through, which is the decision.
(rq *request) checkClient → runChecks. It runs every check, the trap paths, rule files, header limits and Core Rule Set included, which are checks of the request, not of the client.
(h *handler) finishWith → finishWithReport. With what: the report.
given → percentageFor. "given" says nothing; it returns the percentage a setting gives a code.
(p percentage) logged → asLogged. A past participle as a method name; it returns the form the log line takes.
(rq *request) noted → requestForNotes. Same: it returns the request as a ban's notes keep it.
(h *handler) netblock → banScope. SPEC.md's term is the ban scope (SWW_BAN_SCOPE_V4_PREFIX); and the same package has banNetblock, which parses an admin's string, so two "netblock" methods do unrelated things.
(h *handler) banNetblock → parseBanNetblock. It parses the body of a ban request.
(rq *request) trapPath → asksForTrapPath. It reports a bool and bans; trapPath reads as a getter returning the path.
Constants that fail the test: deny → actionDeny. The same package has the method deny; cfg.BlocklistAction == deny and rq.deny(r) sit lines apart. whole → fullPercent. "whole" alone does not say it is 100 percent of a limit.
newTransport → newAppTransport, and the handler field transport → appTransport. The file also has newDiscriminatorTransport and discriminatorTransport; the unqualified one is the app's.
(rq *request) forward → proxyToApp. passToApp checks the limits and then calls forward; two names for one hand-over, and forward does not say to whom.
(rq *request) endRequest → noteRequestEnd. It records the time the request ended, or returns the time recorded; it ends nothing.
list (type) → heldList. The same file has the exported List; one word, two types.
New → NewLists, and Params → ListsParams. The package has three constructors; NewDNSBL and NewAbuseIPDB say what they make, New does not, and DNSBLParams and AbuseIPDBParams say whose they are.
(l *Lists) get → fetchLines. fetch calls get; get is the HTTP part and returns the lines.
(a *AbuseIPDB) alert → alertFailure. Which alert: a source failure.
kept: Line (the request line, as docs/request-log.md calls it; renaming it to say "discriminator" would collide with its field DiscriminatorLine, which names which of discriminator's two lines it is), RProxyLine, WriteRProxyLine, writeJSONLine, FormatTime, Milliseconds, NewProcessLogger.
internal/remotelog
(s *Sender) put → putInBuffer. Put where.
(s *Sender) send → connectAndSend. The file has send, sendOn and write; this one is the loop that connects, hands the connection to sendOn, and reconnects after a failure.
(l *Limiter) get → getOrAdd. It adds a missing client and makes it the most recently seen; get hides both.
A field that fails the test: Client.Client → Client.Address. The type and its field share a name, so client.Client reads as nothing; it is the client's address or IPv6 group.
kept: Limits, Limiter (see the note at the end), Client, Buckets, History, Responses, Offences, Request, Hit, Counts, window, New, Count, OverARateLimit, CountBytes, CountRefusal, Reset, AddToHistory, AddLookup, Requests, Client (method), Len, Snapshot, Load, count, buckets, byteBuckets, percentOf, Add, Passed, add.
Params and New are kept wherever a package has one constructor: the Go idiom, documented at the declaration. They are renamed only in lookup and reputation, which have more than one.
Snapshot and Load are kept everywhere: one vocabulary for what the state files take and give.
For sneak's judgement, not a rename on this list: SPEC.md calls the two stores "the table of bans" and "the table of clients". bans.Ledger and ratelimit.Limiter say neither "table" nor, for Limiter, that it also keeps each client's history. Both are used from six packages, and inside discriminator the package name bans is already taken, so a rename costs more than the others here.
ratelimit: get → getOrAdd; field Client.Client → Client.Address.
Checked: every new name above is free in its package today. SPEC.md's package list names two Go identifiers, check and answerOwnEndpoint; the rename of check to decide must update that line too. No other document under docs/ or README.md names an identifier this list touches. Not checked: that the code compiles after the renames; that is the implementer's first step.
Model: fable-5-1
Independent symbol names audit of `next` (at `42e06bf`). The test applied: a reader of one source file, with no other file open, must know what each name stands for. Grouped by package; every rename is `before → after` with a few words why; names left alone are **kept**. Where the kept names of a package pass the test for the same reason, they are listed in one bullet.
Scope: every type and function, methods included, in the non-test `.go` files under `cmd/` and `internal/`. Constants and struct fields are listed only where one fails the test. Test helpers (`export_test.go` and the helpers inside `_test.go` files) are not listed. Settings are out of scope per https://git.eeqj.de/sneak/smallwebwaf/issues/192 and https://git.eeqj.de/sneak/smallwebwaf/issues/202.
Disclosure: loading this issue's comments showed me the earlier report before I read any code. The list below was made from the code; where it agrees with that report, the agreement was not sought.
## `cmd/sww`
- `main`, `Version` — **kept**.
## `internal/sww`
- `newServer` → `newDiscriminatorServer`. The package starts two servers; `serveRProxy` is next to it.
- `serve` → `serveDiscriminator`. Pairs with `serveRProxy`.
- `startSending` → `startRemoteLogSender`. Sending what: the name does not say.
- **kept**: `Params`, `Main`, `printUsage`, `RunDiscriminator`, `RunRProxy`, `HealthCheck`, `loadStateFiles`, `newAlertQueue`, `newRemoteLogSender`, `inBackground`, `checkDiscriminator`, `checkRProxyAndApp`, `askHealthEndpoint`, `appAddress`.
## `internal/config`
- `Config` → `Discriminator`. The package holds two settings structs; `RProxy` is named by its program, `Config` is not. Gives the pair `config.Discriminator` and `config.RProxy`, beside `DiscriminatorListenAddr` and `RProxyFromEnvironment`, which already follow that pattern.
- `FromEnvironment` → `DiscriminatorFromEnvironment`. Pairs with `RProxyFromEnvironment`.
- `(e *environment) check` → `noteError`. It records the first error; it checks nothing. The package's real checks are `checkLookupDBPath`, `checkCountriesAndLookups`, `checkASNLimitPercentURL`, `checkCrowdSec` and `checkInstanceNameForNtfy`, which call it.
- `(e *environment) lookup` → `readVariable`. In this repo "lookup" means the AS number and country lookup; this reads an environment variable or its `_FILE` form.
- `(e *environment) address` → `listenAddr`. The package also reads an app URL, a resolver address and webhook URLs; this one reads only `*_LISTEN_ADDR`.
- `(e *environment) observe` → `isObserveMode`. It reads `SWW_MODE` and reports a bool; `env.observe(...)` reads as an action.
- `(e *environment) count` → `requestCount`, and `parseCount` → `parseRequestCount`. A count of what: requests.
- `(e *environment) refresh` → `refreshInterval`. It returns a duration; `refresh` reads as a verb.
- `(e *environment) thresholds` → `anomalyThresholds`. The Core Rule Set has an anomaly threshold too (`SWW_WAF_ANOMALY_THRESHOLD`); this reads the anomaly-counter thresholds.
- `parseList` → `splitCommaList`. It splits a comma-separated value; in this package "list" otherwise means a fetched blocklist (`listURL`, `listURLs`, `isListURL`, `parseListURLs`).
- **kept**: `RProxy`, `environment` (holds the values read and the first error; its doc says so at the declaration), `Command`, `DiscriminatorListenAddr`, `InstanceName`, `RProxyFromEnvironment`, `RProxyListenAddrAndUpstreamURL`, `withoutFileForms`, `LogValue` (both; the `slog` interface), `ParseASN`, `ParsePercent`, `ParseNetblock`, `ParseDurationNotOff`, `IsHeaderName`, `MaskZoneKey`.
- **kept**, the other `environment` methods: each is named for the kind of setting it reads and documented at its declaration: `value`, `appURL`, `boolean`, `netblocks`, `duration`, `size`, `wafBodyLimit`, `bytesCount`, `pathPrefixes`, `trapPaths`, `wafMode`, `paranoiaLevel`, `ruleIDs`, `countries`, `percents`, `percent`, `listURL`, `listURLs`, `action`, `zones`, `resolver`, `crowdSecDecisionsURL`, `lookupSource`, `headerNames`, `durationNotOff`, `numberNotOff`, `banResponse`, `v4Prefix`, `v6Prefix`, `ipv6GroupPrefix`, `logLevel`, `namedNetblocks`, `absolutePath`, `token`, `logRemoteURL`, `filePath`, `certificates`, `facility`, `instanceName`, `appName`, `checkInstanceNameForNtfy`, `webhookURL`, `webhookHeaders`, `secret`, `alertEvents`, `numberOrOff`, `wafBackend`, `disposition`, `milliseconds`, `millisecondsOrOff`, `checkLookupDBPath`, `checkCountriesAndLookups`, `checkASNLimitPercentURL`, `checkCrowdSec`.
- **kept**, the parse helpers: `parseDuration`, `durationOrDays`, `parseSize`, `parseWAFBodyLimit`, `splitUnit`, `parseNumberNotOff`, `parseBanResponse`, `parseV4Prefix`, `parseV6Prefix`, `parseNetblocks`, `parseNamedNetblocks`, `parsePathPrefixes`, `parseTrapPaths`, `parseRuleIDs`, `parseCountries`, `parseCountry`, `parsePercents`, `parseHeaderNames`, `parseListenAddr`, `parseUpstreamURL`, `parseLogRemoteURL`, `parseFacility`, `parseWebhookURL`, `isHTTPURL`, `isListURL`, `parseListURLs`, `parseZones`, `isZone`, `parseResolver`, `parseWebhookHeaders`, `parseAlertEvents`, `parseNumberOrOff`, `isAppName`, `parseMilliseconds`.
## `internal/lookup`
The package has two sources, the GeoJS web service and the lookup database (SPEC.md's term for the IPinfo Lite file). The names of the database side say "file", and the GeoJS side has the package's bare `Params` and `New`, so neither side says which it is.
- `File` → `Database`. It is the lookup database held in memory, not a file handle. From outside: `lookup.Database`.
- `FileParams` → `DatabaseParams`.
- `OpenFile` → `OpenDatabase`.
- `(f *File) use` → `replaceReader`. "use" does not say that it swaps the reader in place of the old one.
- `Params` → `GeoJSParams`. Two constructors in one package; a bare `Params` does not say whose.
- `New` → `NewGeoJS`. Same reason.
- `wait` (type) → `waitingClient`. A verb as a type name; it is a client waiting for its answer.
- `(g *GeoJS) kept` → `keptAnswer`, and `Kept` → `KeptAnswer`. Two methods differing only in case, both a past participle; "kept what" is the answer.
- `(g *GeoJS) keep` → `keepAnswers`. The issue's own example. It stores the answers one GeoJS request gave; it also notes a failure, which the doc says.
- `(g *GeoJS) ask` → `startAsking`. It starts a background request and returns at once; `ask` reads as synchronous.
- `(g *GeoJS) request` → `fetchAnswers`. "request" is a type in two other packages of this repo and a noun everywhere else in it; this makes one HTTP request and returns the answers in it.
- Constants that fail the test: `URL` → `GeoJSURL` (matches `reputation.AbuseIPDBURL`); `keepFor` → `keepAnswersFor`; `maxWaiting` → `maxWaitingClients`; `maxPerRequest` → `maxClientsPerRequest`.
- Renames the `Database` rename forces elsewhere: `discriminator.Params.LookupFile`, `discriminator.Server.LookupFile` and `handler.lookupFile` → `LookupDatabase` and `lookupDatabase`; `metrics.AddLookupFile` → `AddLookupDatabase`.
- **kept**: `GeoJS`, `Answer` (qualified as `lookup.Answer` wherever it leaves the package, so it does not collide with the spec's "answer" to a question), `record`, `read`, `LookUp` (both), `LastRead`, `ReadFailures`, `Watch`, `readAfterChanges`, `readAgain`, `LookUpWithoutWaiting`, `Snapshot`, `Load`, `answerOrWait`, `askAboutWaiting`, `nextClients`.
## `internal/lookup/lookuptest`
- **kept**: `Network`, `Write`, `WriteRecords`.
## `internal/alerts`
- `title` → `alertTitle`, `text` → `alertText`. Bare nouns; of what.
- `(q *Queue) repeat` → `isRepeat`. It reports a bool and counts the repeat; `repeat` reads as "do it again".
- `(q *Queue) queue` → `queueForDestinations`. A method `queue` on a type `Queue` says nothing; it adds the alert to every destination's own queue.
- **kept**: `Params`, `Alert`, `Cooldown`, `Hour`, `State`, `Counts`, `Queue` (used from ten packages; it is the thing alerts are raised into, and its doc says what it holds back and where it sends), `destination`, `cooldownKey`, `cooldownKeyOf`, `New`, `Events`, `Destinations`, `Raise`, `WouldSend`, `Run`, `Counts`, `DestinationsSet`, `Suppressed`, `Snapshot`, `Load`, `addDestination`, `startCooldown`, `endHour`, `run`, `add`, `load`, `snapshot`, `oldest`, `remove`, `send` (the `destination` receiver names what each acts on), `webhookMessage`, `slackMessage`, `ntfyMessage`, `ntfyPriority`, `ntfyTag`.
## `internal/anomaly`
- `key` → `counterKey`. Key of what.
- `scope` (type) → `countedScope`. The file also has the `Scope*` constants and a `Scope` string field; this type is a scope with its thresholds.
- `(k key) counter` → `newCounter`. It makes a fresh counter; `counter` reads as a getter.
- Constants that fail the test: `minute`, `hour` → `minuteWindow`, `hourWindow`. Strings naming windows, easily read as durations.
- **kept**: `Thresholds`, `NamedNetblock`, `Params`, `Counter`, `Request`, `Counters`, `overThreshold`, `bucketCount`, `New`, `Scopes`, `Count`, `Snapshot`, `Load`, `scopesOf`, `netAround`, `add`, `counts`, `lastStart`, `key` (method), `alertFor`.
## `internal/bans`
- `Rules` → `Settings`. In `discriminator/proxy.go`, `bans.Rules{...}` sits beside `Rules *rules.Files`, the rule files: two unrelated "Rules" in one file. What the struct holds is the ban settings.
- `Check` → `CheckRequest`, `Find` → `FindActive`. The two differ only in side effects: `Check` counts the request against the ban and can make the ban permanent; `Find` only looks. Neither name says which.
- `Count` → `CountActive`. The ledger also counts bans made (`Made`); this one counts the active and permanent bans.
- `(l *Ledger) ban` → `makeBan`. Its `keep bool` parameter means "make the ban rather than only work it out", so the method's name should say it makes one; the parameter wants a name such as `makeIt` too.
- **kept**: `Ban`, `Notes`, `ReputationHit`, `EarlierBans`, `Request`, `Ledger` (see the note at the end), `New`, `Changed`, `Permanent`, `ActiveAt`, `BanForLimit`, `WouldBanForLimit`, `BanForAttack`, `WouldBanForAttack`, `BanForCrowdSec`, `WouldBanForCrowdSec`, `WouldBePermanent`, `BanForAdmin`, `Lift`, `Covering`, `Bans`, `AddLookup`, `Made`, `Snapshot`, `Load`, `LoadEdit`, `activeBan`, `limitReason`, `attackReason`, `crowdSecReason`, `load`, `holds`, `earlierBans`, `total`, `markChanged`, `active`, `covering`, `add`, `limitExpiry`, `attackExpiry`, `dropOne`, `cut`, `cutText`.
## `internal/discriminator`
- `(rq *request) check` → `decide`. The package has `checkClient`, `checkRules`, `checkCoreRuleSet` and `checkRanges`; this one turns the checks' result into the refusal or lets the request through, which is the decision.
- `(rq *request) checkClient` → `runChecks`. It runs every check, the trap paths, rule files, header limits and Core Rule Set included, which are checks of the request, not of the client.
- `(h *handler) finishWith` → `finishWithReport`. With what: the report.
- `given` → `percentageFor`. "given" says nothing; it returns the percentage a setting gives a code.
- `(p percentage) logged` → `asLogged`. A past participle as a method name; it returns the form the log line takes.
- `(rq *request) noted` → `requestForNotes`. Same: it returns the request as a ban's notes keep it.
- `(h *handler) netblock` → `banScope`. SPEC.md's term is the ban scope (`SWW_BAN_SCOPE_V4_PREFIX`); and the same package has `banNetblock`, which parses an admin's string, so two "netblock" methods do unrelated things.
- `(h *handler) banNetblock` → `parseBanNetblock`. It parses the body of a ban request.
- `(rq *request) trapPath` → `asksForTrapPath`. It reports a bool and bans; `trapPath` reads as a getter returning the path.
- Constants that fail the test: `deny` → `actionDeny`. The same package has the method `deny`; `cfg.BlocklistAction == deny` and `rq.deny(r)` sit lines apart. `whole` → `fullPercent`. "whole" alone does not say it is 100 percent of a limit.
- **kept**: `Params`, `Server`, `handler`, `request`, `decision`, `refusal`, `responseWriter`, `percentage`, `banToAdd`, `clientAnswer`, `Report`, `New`, `newHandler`, `newReputation`, `NewCoreRuleSet`, `ServeHTTP`, `answerQuestion`, `readQuestion`, `refuseQuestion`, `asTheVisitorSentIt`, `refusedWhateverTheAnswer`, `overHeaderLimits`, `allow`, `holdForReport`, `deny` (method), `answerOwnEndpoint`, `takeReport`, `readReport`, `checkRanges`, `startRequest`, `requestHeaders`, `countedByRateLimits`, `pathExempt`, `finish`, `writeLine`, `timing`, `addToHistory`, `countAnomalies`, `anomalyThresholdsSet`, `answerAtTheEnd`, `WriteHeader`, `Write`, `peerAddress`, `requestID`, `scheme`, `clientGroup`, `isInside`, `countryDenied`, `biasedThresholdsSet`, `limitPercentages`, `lowest`, `banResponse`, `banned`, `limitBroken`, `countBytes`, `countRefusal`, `countedBytes`, `banForLimit`, `banForAttack`, `banForCrowdSec`, `wouldAlertBan`, `alertBan`, `netblockRequests`, `banExpires`, `checkRules`, `checkCoreRuleSet`, `alertWAFBlock`, `lookUp`, `addLookup`, `setLookupHeaders`, `canBePlaced`, `blocklistDenied`, `crowdSecBanned`, `dnsblDenied`, `abuseIPDBDenied`, `noteListed`, `noteHit`, `answerHealth`, `answerAdmin`, `endpoint`, `hasToken`, `listBans`, `addBan`, `readBanToAdd`, `expiry`, `liftBans`, `showClient`, `pathAddress`, `answerBans`, `answerJSON`.
## `internal/rproxy`
- `newTransport` → `newAppTransport`, and the `handler` field `transport` → `appTransport`. The file also has `newDiscriminatorTransport` and `discriminatorTransport`; the unqualified one is the app's.
- `(rq *request) forward` → `proxyToApp`. `passToApp` checks the limits and then calls `forward`; two names for one hand-over, and `forward` does not say to whom.
- `(rq *request) endRequest` → `noteRequestEnd`. It records the time the request ended, or returns the time recorded; it ends nothing.
- **kept**: `Params`, `Server`, `handler`, `request`, `requestBody`, `responseBody`, `upgradedConn`, `responseWriter`, `discriminatorAnswer`, `New`, `WaitForReports`, `newDiscriminatorTransport`, `ServeHTTP`, `passToApp`, `newRequest`, `answerHealth`, `readFirstPartOfBody`, `setPathAsSent`, `rewrite`, `modifyResponse`, `answerError` (the three are `httputil.ReverseProxy`'s hook names), `answer`, `send`, `prepareOwnAnswer`, `refuse`, `finish`, `bytesEachWay`, `requestDeadline`, `stopReadingBody`, `startRequestTimer`, `requestTimedOut`, `gotFirstResponseByte`, `wroteRequest` (the two are `httptrace` hook names), `responseTimedOut`, `responseReceived`, `setResponseDeadline`, `stopTimers`, `stopTimer`, `noteAnswer`, `handleNoUsableAnswer`, `ask` (SPEC.md's own verb: rproxy asks discriminator), `canBeAsked`, `newQuestion`, `answerWith`, `sendReport`, `postReport`, `peerAddress`, `clientAddress`, `scheme`, `isInside`, `setForwardedHeaders`, `Read`, `Close`, `Write`, `CloseWrite`, `limitBody`, `WriteHeader`, `FlushError`, `Hijack`, `Unwrap`.
## `internal/rules`
- `value` → `targetValue`. Value of what: the request's value for a rule's target.
- **kept**: `Rule`, `Params`, `Files`, `Load`, `Match`, `Len`, `Watch`, `readAfterChanges`, `readAgain`, `logRead`, `read`, `readFile`, `parse`, `isTarget`, `matches`, `Path`, `pathAndQuery`, `header`, `DecodeOnce`.
## `internal/reputation`
- `list` (type) → `heldList`. The same file has the exported `List`; one word, two types.
- `New` → `NewLists`, and `Params` → `ListsParams`. The package has three constructors; `NewDNSBL` and `NewAbuseIPDB` say what they make, `New` does not, and `DNSBLParams` and `AbuseIPDBParams` say whose they are.
- `(l *Lists) get` → `fetchLines`. `fetch` calls `get`; `get` is the HTTP part and returns the lines.
- `(a *AbuseIPDB) alert` → `alertFailure`. Which alert: a source failure.
- **kept**: `List`, `Lists`, `entries`, `Decision`, `URLs`, `ListedBy` (both), `ASNLimitPercent`, `CrowdSecDecision`, `Fetched`, `Failures` (all three), `Run`, `Snapshot` (all three), `Load` (all three), `fetchDue`, `due`, `fetch`, `raiseFailure`, `parse`, `parseNetblocks`, `parseNetblock`, `parsePercents`, `parseDecisions`, `withoutComment`, `contain`, `Verdict`, `DNSBLParams`, `DNSBL`, `query`, `NewDNSBL`, `Zones`, `Queries`, `ask` (both; each doc says what is asked), `lookUp`, `queryName`, `readAnswer`, `Score`, `Checks`, `AbuseIPDBParams`, `AbuseIPDB`, `NewAbuseIPDB`, `Hit`, `Checked`, `BudgetLeft`, `check`.
## `internal/requestlog`
- `Write` → `WriteLine`. Pairs with `WriteRProxyLine`; `requestlog.Write(w, line)` says write what.
- **kept**: `Line` (the request line, as `docs/request-log.md` calls it; renaming it to say "discriminator" would collide with its field `DiscriminatorLine`, which names which of discriminator's two lines it is), `RProxyLine`, `WriteRProxyLine`, `writeJSONLine`, `FormatTime`, `Milliseconds`, `NewProcessLogger`.
## `internal/remotelog`
- `(s *Sender) put` → `putInBuffer`. Put where.
- `(s *Sender) send` → `connectAndSend`. The file has `send`, `sendOn` and `write`; this one is the loop that connects, hands the connection to `sendOn`, and reconnects after a failure.
- **kept**: `Params`, `Sender`, `New`, `Write`, `Sent`, `Dropped`, `Depth`, `Run`, `record`, `sendOn`, `write`, `dial`.
## `internal/state`
- `(f *Files) logFailure` → `logWriteFailure`. Which failure: a write's.
- `(f *Files) read` → `readAtStart`. The file has `read`, `readChanged` and `takeIn`; this one is the start-up read, as its doc says.
- `missing` → `missingField`. Missing what.
- `position` → `errorPosition`. Position of what: where in the file the JSON error is.
- `write` → `writeThenRename`. The file has `write`, `writeSynced` and `writeFile`; this one is the temp-file-and-rename step.
- **kept**: `Params`, `Files`, `bansFile`, `BanEntry`, `clientsFile`, `lookupsFile`, `reputationFile`, `alertsFile`, `stateFile`, `Load`, `Run`, `WriteAll`, `Watch`, `fileChanged`, `takeInEdit`, `readChanged`, `takeIn`, `takeInAlerts`, `writeFile`, `setAside`, `encode`, `encodeIndented`, `encodeOnePerLine`, `BanEntries`, `newBanEntry`, `ban`, `check` (all five; the receiver names the file), `checkScores`, `checkAnomalyCounters`, `missingFromCounter`, `countsWithoutStart`, `checkWritable`, `parse`, `syncDirectory`, `writeSynced`.
## `internal/metrics`
- `AddLookupFile` → `AddLookupDatabase`. Follows the `lookup` rename.
- `(m *Metrics) count` → `countRequest`. Count what.
- **kept**: `Metrics`, `busiest`, `New`, `newCountries`, `newASNs`, `newBusiest`, `counterVec`, `gaugeVec`, `statusClass`, `AddBansAndClients`, `AddRules`, `AddRemoteLog`, `AddReputation`, `AddAbuseIPDB`, `ReputationHit`, `AddAlerts`, `ServeHTTP`, `RequestStarted`, `RequestEnded`, `RequestAllowed`, `RequestReported`, `LimitHit`, `Offences`, `RuleMatched`, `WAFMatched`, `StateFileWritten`, `StateFileEditTakenIn`, `StateFileEditSetAside`, `addReputationQueries`, `addReputationFailures`, `Describe`, `Collect`, `vecs`, `add`, `label`.
## `internal/ratelimit`
- `(l *Limiter) get` → `getOrAdd`. It adds a missing client and makes it the most recently seen; `get` hides both.
- A field that fails the test: `Client.Client` → `Client.Address`. The type and its field share a name, so `client.Client` reads as nothing; it is the client's address or IPv6 group.
- **kept**: `Limits`, `Limiter` (see the note at the end), `Client`, `Buckets`, `History`, `Responses`, `Offences`, `Request`, `Hit`, `Counts`, `window`, `New`, `Count`, `OverARateLimit`, `CountBytes`, `CountRefusal`, `Reset`, `AddToHistory`, `AddLookup`, `Requests`, `Client` (method), `Len`, `Snapshot`, `Load`, `count`, `buckets`, `byteBuckets`, `percentOf`, `Add`, `Passed`, `add`.
## `internal/waf`
- **kept**: `Params`, `CoreRuleSet`, `Result`, `New`, `directivesIn`, `checkExclusions`, `Inspect`, `readBody`, `score`, `withoutCookiesNotRead`.
## Across packages
- `Params` and `New` are kept wherever a package has one constructor: the Go idiom, documented at the declaration. They are renamed only in `lookup` and `reputation`, which have more than one.
- `Snapshot` and `Load` are kept everywhere: one vocabulary for what the state files take and give.
- For sneak's judgement, not a rename on this list: SPEC.md calls the two stores "the table of bans" and "the table of clients". `bans.Ledger` and `ratelimit.Limiter` say neither "table" nor, for `Limiter`, that it also keeps each client's history. Both are used from six packages, and inside `discriminator` the package name `bans` is already taken, so a rename costs more than the others here.
## Summary of renames
- `sww`: `newServer` → `newDiscriminatorServer`; `serve` → `serveDiscriminator`; `startSending` → `startRemoteLogSender`.
- `config`: `Config` → `Discriminator`; `FromEnvironment` → `DiscriminatorFromEnvironment`; `check` → `noteError`; `lookup` → `readVariable`; `address` → `listenAddr`; `observe` → `isObserveMode`; `count` → `requestCount`; `parseCount` → `parseRequestCount`; `refresh` → `refreshInterval`; `thresholds` → `anomalyThresholds`; `parseList` → `splitCommaList`.
- `lookup`: `File` → `Database`; `FileParams` → `DatabaseParams`; `OpenFile` → `OpenDatabase`; `use` → `replaceReader`; `Params` → `GeoJSParams`; `New` → `NewGeoJS`; `wait` → `waitingClient`; `kept` → `keptAnswer`; `Kept` → `KeptAnswer`; `keep` → `keepAnswers`; `ask` → `startAsking`; `request` → `fetchAnswers`; constants `URL` → `GeoJSURL`, `keepFor` → `keepAnswersFor`, `maxWaiting` → `maxWaitingClients`, `maxPerRequest` → `maxClientsPerRequest`.
- `alerts`: `title` → `alertTitle`; `text` → `alertText`; `repeat` → `isRepeat`; `queue` → `queueForDestinations`.
- `anomaly`: `key` → `counterKey`; `scope` → `countedScope`; `(key).counter` → `newCounter`; constants `minute`, `hour` → `minuteWindow`, `hourWindow`.
- `bans`: `Rules` → `Settings`; `Check` → `CheckRequest`; `Find` → `FindActive`; `Count` → `CountActive`; `ban` → `makeBan`.
- `discriminator`: `check` → `decide`; `checkClient` → `runChecks`; `finishWith` → `finishWithReport`; `given` → `percentageFor`; `logged` → `asLogged`; `noted` → `requestForNotes`; `netblock` → `banScope`; `banNetblock` → `parseBanNetblock`; `trapPath` → `asksForTrapPath`; `LookupFile`, `lookupFile` → `LookupDatabase`, `lookupDatabase`; constants `deny` → `actionDeny`, `whole` → `fullPercent`.
- `rproxy`: `newTransport` → `newAppTransport`; `transport` → `appTransport`; `forward` → `proxyToApp`; `endRequest` → `noteRequestEnd`.
- `rules`: `value` → `targetValue`.
- `reputation`: `list` → `heldList`; `New` → `NewLists`; `Params` → `ListsParams`; `get` → `fetchLines`; `alert` → `alertFailure`.
- `requestlog`: `Write` → `WriteLine`.
- `remotelog`: `put` → `putInBuffer`; `send` → `connectAndSend`.
- `state`: `logFailure` → `logWriteFailure`; `read` → `readAtStart`; `missing` → `missingField`; `position` → `errorPosition`; `write` → `writeThenRename`.
- `metrics`: `AddLookupFile` → `AddLookupDatabase`; `count` → `countRequest`.
- `ratelimit`: `get` → `getOrAdd`; field `Client.Client` → `Client.Address`.
Checked: every new name above is free in its package today. `SPEC.md`'s package list names two Go identifiers, `check` and `answerOwnEndpoint`; the rename of `check` to `decide` must update that line too. No other document under `docs/` or `README.md` names an identifier this list touches. Not checked: that the code compiles after the renames; that is the implementer's first step.
Model: fable-5-1
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
There are identifiers like "File" and functions like "keep()". This is bad. You need to rename any ambiguous identifiers to be explicit about what they represent. Someone should be able to read any source file in isolation and understand it without having looked at any of the other parts of the codebase.
Make a list of the identifiers (types and functions) from all of the packages, and give me a list of before/after names for all of them before implementing this, so I can review your decisions before you do the work.
Picked up for smallwebwaf's manager. It starts at the next manager run: on sneak's word, or when the worker accounts reset (claude2 at 23:00 UTC on 8 November), since the primary is past its 60% stop.
Model: opus-5-5
do this now with deepseek. the interim report i've asked for should be in a comment on this issue.
For the worker (a DeepSeek V4 Pro run, by sneak's order #213 (comment)):
This run produces only the interim report sneak asked for, as one comment on this issue. It changes no code and opens no PR.
cmd/andinternal/. Group them by package.before → after. Where you keep a name, keep it on the list, marked "kept".Fileorkeep()fail it.next. Post the list as one comment here, split over several comments only if it is too long for one.sneak reviews the list before anything is renamed.
Model: opus-5-5
Interim report: symbol names to rename. Read from
next. Grouped by package. Renames arebefore → afterwith a few words why; names left alone are marked kept. Settings (environment variables) are out of scope, per issues #192 and #202.cmd/smallwebwaf (package main)
Version(var) — kept. The linker sets it.main(func) — kept.internal/lookup
FileParams(type) →LookupDBParams. "File" names the container, not the thing; it holds what opens the lookup database.File(type) →LookupDB. The type is the in-memory lookup database, not a file.OpenFile(func) →OpenLookupDB. Opens the database, not a file handle.record(type) — kept. What the database holds about a network.(f *File) use(method) →setReader. "use" says nothing about putting reader in place.read(func) — kept. Reads the database at path.Methods
LookUp,LastRead,ReadFailures,Watch,readAfterChanges,readAgain— kept. Each is descriptive of the database action.(
lookup.go)Params(type) →GeoJSParams. The package already hasFileParams; a bareParamsdoes not say it configures GeoJS.New(func) →NewGeoJS. Same reason; the package has two constructors.GeoJS(type) — kept.Answer(type) — kept.wait(type) →waitingClient. It is a client waiting for its answer.(g *GeoJS) kept(method) →keptAnswer. "kept" is a past participle, not a name.(g *GeoJS) keep(method) →storeAnswers. "keep" names its side effect vaguely; it stores the answers a response gave.(g *GeoJS) ask(method) →startAsking. "ask" reads as a query, not as kicking off one.Methods
LookUp,LookUpWithoutWaiting,Kept,Snapshot,Load,answerOrWait,askAboutWaiting,nextClients,request— kept. Each is descriptive of its step.Consts
URL,keepFor,maxAnswers,maxWaiting,maxPerRequest,unknownASN,firstRetryDelay,retryDelayFactor,maxRetryDelay,maxResponseBytes; varserrStatus,errLeftOut— kept.internal/lookup/lookuptest
fileMode(const) — kept.Network(type) — kept.Write,WriteRecords(funcs) — kept.internal/alerts
EventBan…EventSummary(consts) — kept.Events,Destinations(funcs) — kept.DestinationWebhook,DestinationSlack,DestinationNtfy(consts) — kept.Params,Alert,Cooldown,Hour,State,Counts,Queue,destination,cooldownKey(types) — kept.New,cooldownKeyOf(funcs) — kept.title(func) →alertTitle. "title" of what?text(func) →alertText. "text" of what?ntfyPriority,ntfyTag,slackMessage(funcs) — kept.(q *Queue)methodsRaise,WouldSend,Run,Counts,DestinationsSet,Suppressed,Snapshot,Load,addDestination,repeat,startCooldown,endHour,queue,webhookMessage,ntfyMessage— kept.(d *destination) run(method) →sendWaiting. It sends the alerts waiting; a bare "run" does not say.(d *destination)methodsadd,load,snapshot,oldest,remove,send— kept. Receivers make each unambiguous.queueSize,sendTimeout,firstRetryDelay,retryDelayFactor,maxRetryDelay,maxAnswerBytes; varserrStatus,errRefused— kept.internal/anomaly
ScopeClient…ScopeWatch(consts),Scopes(func) — kept.Thresholds,NamedNetblock,Params,Counter,Request,Counters(types) — kept.key(type) →counterKey. "key" of what?scope(type) →countedScope. A scope a request is counted in; "scope" alone collides with the scope constants.overThreshold,bucketCount(types) — kept.New,alertFor(funcs) — kept.(c *Counters)methodsCount,Snapshot,Load,scopesOf,netAround— kept.(c *Counter)methodsadd,counts,lastStart,key— kept.(k key) counter(method) →newCounter(receiver type renamed). Returns a fresh counter for the key.minute,hour,maxCounters— kept.internal/bans
CauseLimit…CauseCrowdSec(consts) — kept.Rules,Ban,Notes,ReputationHit,EarlierBans,Request,Ledger(types) — kept.New,activeBan,limitReason,attackReason,crowdSecReason,earlierBans,cutText(funcs) — kept.(l *Ledger)methodsChanged,Check,Find,BanForLimit,WouldBanForLimit,BanForAttack,WouldBanForAttack,BanForCrowdSec,WouldBanForCrowdSec,WouldBePermanent,BanForAdmin,Lift,Covering,Bans,AddLookup,Made,Count,Snapshot,Load,LoadEdit,ban,load,holds,active,covering,add,limitExpiry,attackExpiry,dropOne,markChanged— kept. Each names what it does with bans.(e EarlierBans) total,(r Request) cut(methods) — kept.repeatFactor,maxTextBytes— kept.internal/config
Config,RProxy,environment(types) — kept.FromEnvironment,Command,ServeWAFListenAddr,InstanceName,RProxyFromEnvironment,RProxyListenAddrAndUpstreamURL,withoutFileForms(funcs) — kept.(c *Config) LogValue,(c *RProxy) LogValue(methods) — kept.(e *environment)methodsvalue,lookup,check,address,appURL,observe,boolean,netblocks,duration,size,wafBodyLimit,count,bytesCount,pathPrefixes,trapPaths,wafMode,paranoiaLevel,ruleIDs,countries,percents,percent,listURL,listURLs,refresh,action,zones,resolver,crowdSecDecisionsURL,lookupSource,checkLookupDBPath,checkCountriesAndLookups,checkASNLimitPercentURL,checkCrowdSec,headerNames,durationNotOff,numberNotOff,banResponse,v4Prefix,v6Prefix,ipv6GroupPrefix,logLevel,thresholds,namedNetblocks,absolutePath,token,logRemoteURL,certificates,facility,instanceName,appName,checkInstanceNameForNtfy,webhookURL,webhookHeaders,secret,alertEvents,numberOrOff,wafBackend,disposition,milliseconds,millisecondsOrOff— kept. Each names the setting it reads.parse…,is…,splitUnit,durationOrDaysfuncs — kept.ParseASN,ParsePercent,ParseNetblock,ParseDurationNotOff,IsHeaderName,MaskZoneKey(exported funcs) — kept.off,WAFModeOff/Detect/Block,fileSource,day,kibibyte…masked,defaultListenAddr,defaultUpstreamURL,privateRanges,countryCodes,headerNameChars,maxZoneLength,maxLabelLength,labelChars,dnsPort,appNameMaxLength— kept.err…— kept.internal/metrics
Metrics,busiest(types) — kept.New,newCountries,newASNs,newBusiest,counterVec,gaugeVec,statusClass(funcs) — kept.(m *Metrics)methodsAddBansAndClients,AddRules,AddRemoteLog,AddLookupFile,AddReputation,AddAbuseIPDB,ReputationHit,AddAlerts,ServeHTTP,RequestStarted,RequestEnded,RequestAllowed,RequestReported,LimitHit,Offences,RuleMatched,WAFMatched,StateFileWritten,StateFileEditTakenIn,StateFileEditSetAside,count,addReputationQueries,addReputationFailures— kept.(b *busiest)methodsDescribe,Collect,vecs,add,label— kept.other,sourceLabel— kept.internal/ratelimit
KindRequests,KindBytes,KindRefusals(consts) — kept.Limits,Limiter,Client,Buckets,History,Responses,Offences,Request,Hit,Counts,window(types) — kept.New,percentOf(funcs) — kept.(l *Limiter)methodsCount,OverARateLimit,CountBytes,CountRefusal,Reset,AddToHistory,AddLookup,Requests,Client,Len,Snapshot,Load,count,get— kept.(c *Client)methodsbuckets,byteBuckets— kept.(b *Buckets)methodsAdd,Passed— kept.(r *Responses) add(method) — kept (receiver names it).day— kept.internal/remotelog
SchemeUDP,SchemeTCP,SchemeTLS(consts) — kept.Params,Sender(types) — kept.New(func) — kept.(s *Sender)methodsWrite,Sent,Dropped,Depth,Run,record,put,send,sendOn,write,dial— kept.severities,informational,dialTimeout,firstRetryDelay,retryDelayFactor,maxRetryDelay,resetRetryDelayAfter— kept.internal/reputation
abuseipdb.go)AbuseIPDBURL,AbuseIPDBSource(consts) — kept.Score,Checks,AbuseIPDBParams,AbuseIPDB(types) — kept.NewAbuseIPDB(func) — kept.(a *AbuseIPDB)methodsHit,Checked,Failures,BudgetLeft,Snapshot,Load,check,ask,alert— kept.dnsbl.go)Verdict,DNSBLParams,DNSBL,query(types) — kept.NewDNSBL,queryName,readAnswer(funcs) — kept.(d *DNSBL)methodsZones,ListedBy,Queries,Failures,Snapshot,Load,ask,lookUp— kept.reputation.go)List,Params,Lists,list,entries,Decision(types).list(type) →heldList. One list and what its copy says; "list" shadows the concept of a list.entries,Decision— kept.New,parseNetblocks,parseNetblock,parsePercents,parseDecisions,withoutComment,raiseFailure(funcs) — kept.(l *Lists)methodsURLs,ListedBy,ASNLimitPercent,CrowdSecDecision,Fetched,Failures,Run,Snapshot,Load,fetchDue,due,fetch,get,parse— kept.(e entries) contain(method) — kept.maxVerdicts,maxQueries,failureDelay,maxListBytes,fetchTimeout,crowdSecRefresh,mappedBits— kept.errStatus,errTooLong, … — kept.internal/requestlog
Line,RProxyLine(types) — kept.Write,WriteRProxyLine,writeJSONLine,FormatTime,Milliseconds,NewProcessLogger(funcs) — kept.Action…,OffenceLimit,LimitHitErrorBurst,ServeWAFLine…,timeLayout— kept.internal/rules
ActionLog,ActionBlock,ActionBan(consts) — kept.Rule,Params,Files(types) — kept.Load,read,readFile,parse,isTarget,value,pathAndQuery,header,Path,DecodeOnce(funcs) — kept.(f *Files)methodsMatch,Len,Watch,readAfterChanges,readAgain,logRead— kept.(rule Rule) matches(method) — kept.extension,quietTime,headerTarget,pathTarget,uriTarget,escapeLength; varsruleLine,idChars, err vars — kept.internal/rproxy
Params,Server,handler,request,requestBody,responseBody,upgradedConn,responseWriter,servewafAnswer(types) — kept.New,newTransport,newServeWAFTransport,peerAddress,clientAddress,scheme,isInside,setForwardedHeaders,canBeAsked,limitBody,stopTimer(funcs) — kept.(s *Server)methodsWaitForReports— kept.(h *handler)methodsServeHTTP,newRequest,sendReport,postReport— kept.(rq *request)methodspassToApp,forward,rewrite,modifyResponse,answerError,answer,send,prepareOwnAnswer,refuse,finish,bytesEachWay,requestDeadline,stopReadingBody,startRequestTimer,requestTimedOut,gotFirstResponseByte,wroteRequest,responseTimedOut,responseReceived,setResponseDeadline,endRequest,stopTimers,noteAnswer,handleNoUsableAnswer,ask,newQuestion,answerWith,answerHealth,readFirstPartOfBody— kept.(b *requestBody)methodsRead,Close;(b *responseBody)Read,Close;(c *upgradedConn)Read,Write,CloseWrite;(w *responseWriter)WriteHeader,Write,FlushError,Hijack,Unwrap— kept.idleConns,idleConnTimeout,requestHeaderMaxBytes,goServerExtraHeaderBytes,idleTimeout,adminPrefix,allowedMethods,requestIDHeader,asnHeader,countryHeader,flushAfterEachWrite,reportStatusMax,plainText,answerBodyMaxBytes,reportAnswerMaxBytes; varserrResponseTooLarge,errCannotPassOn,errReportRefused— kept.internal/servewaf
Server,handler,request,decision,refusal,responseWriter,percentage,banToAdd,clientAnswer,Params(types) — kept.New,newHandler,newReputation,newCoreRuleSet,asTheVisitorSentIt,readReport,peerAddress,requestID,scheme,isInside,biasedThresholdsSet,requestHeaders,pathExempt,timing,anomalyThresholdsSet,given,lowest,hasToken,expiry,pathAddress,banExpires,canBePlaced,setLookupHeaders(funcs) — kept.(h *handler)methodsServeHTTP,answerQuestion,readQuestion,refuseQuestion,answerOwnEndpoint,takeReport,finishWith,clientGroup,addLookup,netblock,banNetblock— kept.(rq *request)methodsrefusedWhateverTheAnswer,overHeaderLimits,allow,holdForReport,deny,answerHealth,answerAdmin,endpoint,listBans,addBan,readBanToAdd,liftBans,showClient,answerBans,answerJSON,banResponse,banned,limitBroken,countBytes,countRefusal,countedBytes,banForLimit,banForAttack,banForCrowdSec,wouldAlertBan,alertBan,noted,netblockRequests,lookUp,startRequest,check,checkClient,countedByRateLimits,finish,writeLine,addToHistory,countAnomalies,answerAtTheEnd,countryDenied,blocklistDenied,crowdSecBanned,dnsblDenied,abuseIPDBDenied,noteListed,noteHit,trapPath,checkRules,checkCoreRuleSet,alertWAFBlock,limitPercentages— kept.(report *Report) checkRanges,(p percentage) logged,(w *responseWriter)WriteHeader/Write— kept.ClientHeader,PeerHeader,ContentLengthHeader,DispositionHeader,DispositionAllow/Deny/Close,ReportPath,QuestionBodyMaxBytes,maxCookies,maxHeaderFields,maxAwaitingReport,maxRequestIDBytes,reportBodyMaxBytes,maxHTTPStatus,maxReportedBytes,maxReportedMilliseconds,serveWAFTimeout,serveWAFIdleTimeout,HealthPath,MetricsPath,BansPath,ClientsPath,adminPrefix,requestIDHeader,asnHeader,countryHeader,banBodyMaxBytes,permanent,deny,whole— kept.errReportFieldMissing,errReportValue,errNotBanToAdd, … — kept.internal/smallwebwaf
Params(type) — kept.Main,printUsage,RunServeWAF,RunRProxy,HealthCheck,newServer,loadStateFiles,newAlertQueue,newRemoteLogSender,startSending,serve,serveRProxy,inBackground,checkServeWAF,checkRProxyAndApp,askHealthEndpoint,appAddress(funcs) — kept.shutdownTimeout,remoteLogStopTimeout,usageStatus,usage,healthCheckTimeout; varerrHealthEndpoint— kept.internal/state
Params,Files,bansFile,BanEntry,clientsFile,lookupsFile,reputationFile,alertsFile,stateFile(types) — kept.Load,BanEntries,newBanEntry,encodeIndented,encodeOnePerLine,checkWritable,parse,position,write,syncDirectory,writeSynced,checkScores,checkAnomalyCounters,missingFromCounter,countsWithoutStart,missing(funcs) — kept.(f *Files)methodsRun,WriteAll,Watch,logFailure,fileChanged,takeInEdit,read,readChanged,takeIn,takeInAlerts,writeFile,setAside,encode— kept.(e BanEntry) ban(method) — kept.(f *bansFile) check,(f *clientsFile) check,(f *lookupsFile) check,(f *reputationFile) check,(f *alertsFile) check(methods) — kept.version,fileMode,bansJSON,clientsJSON,lookupsJSON,reputationJSON,alertsJSON; varserrVersion,errMissing, … — kept.internal/waf
Params,CoreRuleSet,Result(types) — kept.New,score,withoutCookiesNotRead(funcs) — kept.(c *CoreRuleSet)methodsInspect,readBody— kept.directives,bodyDirectives; varcookiesNotRead— kept.Summary of renames (17):
lookup.FileParams→LookupDBParamslookup.File→LookupDBlookup.OpenFile→OpenLookupDBlookup.Params→GeoJSParamslookup.New→NewGeoJSlookup.wait→waitingClientlookup.(*File).use→setReaderlookup.(*GeoJS).kept→keptAnswerlookup.(*GeoJS).keep→storeAnswerslookup.(*GeoJS).ask→startAskingalerts.title→alertTitlealerts.text→alertTextalerts.(*destination).run→sendWaitinganomaly.key→counterKeyanomaly.scope→countedScopeanomaly.(key).counter→newCounterreputation.list→heldListModel: deepseek-v4-pro
Run usage for the report above: DeepSeek V4 Pro through OpenRouter, 740,727 input, 32,448 output, 26,178 reasoning and 10,299,648 cache-read tokens; cost $1.50.
Model: opus-5-5
run a fable on a primary to do its own analysis independent of this one. post it here.
For the analyst (a Fable run on the primary, by sneak's order #213 (comment)): do your own symbol names audit of
next, independent of the earlier one.before → afterwith a few words on why, and mark the names you would keep.Model: opus-5-5
Independent symbol names audit of
next(at42e06bf). The test applied: a reader of one source file, with no other file open, must know what each name stands for. Grouped by package; every rename isbefore → afterwith a few words why; names left alone are kept. Where the kept names of a package pass the test for the same reason, they are listed in one bullet.Scope: every type and function, methods included, in the non-test
.gofiles undercmd/andinternal/. Constants and struct fields are listed only where one fails the test. Test helpers (export_test.goand the helpers inside_test.gofiles) are not listed. Settings are out of scope per #192 and #202.Disclosure: loading this issue's comments showed me the earlier report before I read any code. The list below was made from the code; where it agrees with that report, the agreement was not sought.
cmd/swwmain,Version— kept.internal/swwnewServer→newDiscriminatorServer. The package starts two servers;serveRProxyis next to it.serve→serveDiscriminator. Pairs withserveRProxy.startSending→startRemoteLogSender. Sending what: the name does not say.Params,Main,printUsage,RunDiscriminator,RunRProxy,HealthCheck,loadStateFiles,newAlertQueue,newRemoteLogSender,inBackground,checkDiscriminator,checkRProxyAndApp,askHealthEndpoint,appAddress.internal/configConfig→Discriminator. The package holds two settings structs;RProxyis named by its program,Configis not. Gives the pairconfig.Discriminatorandconfig.RProxy, besideDiscriminatorListenAddrandRProxyFromEnvironment, which already follow that pattern.FromEnvironment→DiscriminatorFromEnvironment. Pairs withRProxyFromEnvironment.(e *environment) check→noteError. It records the first error; it checks nothing. The package's real checks arecheckLookupDBPath,checkCountriesAndLookups,checkASNLimitPercentURL,checkCrowdSecandcheckInstanceNameForNtfy, which call it.(e *environment) lookup→readVariable. In this repo "lookup" means the AS number and country lookup; this reads an environment variable or its_FILEform.(e *environment) address→listenAddr. The package also reads an app URL, a resolver address and webhook URLs; this one reads only*_LISTEN_ADDR.(e *environment) observe→isObserveMode. It readsSWW_MODEand reports a bool;env.observe(...)reads as an action.(e *environment) count→requestCount, andparseCount→parseRequestCount. A count of what: requests.(e *environment) refresh→refreshInterval. It returns a duration;refreshreads as a verb.(e *environment) thresholds→anomalyThresholds. The Core Rule Set has an anomaly threshold too (SWW_WAF_ANOMALY_THRESHOLD); this reads the anomaly-counter thresholds.parseList→splitCommaList. It splits a comma-separated value; in this package "list" otherwise means a fetched blocklist (listURL,listURLs,isListURL,parseListURLs).RProxy,environment(holds the values read and the first error; its doc says so at the declaration),Command,DiscriminatorListenAddr,InstanceName,RProxyFromEnvironment,RProxyListenAddrAndUpstreamURL,withoutFileForms,LogValue(both; thesloginterface),ParseASN,ParsePercent,ParseNetblock,ParseDurationNotOff,IsHeaderName,MaskZoneKey.environmentmethods: each is named for the kind of setting it reads and documented at its declaration:value,appURL,boolean,netblocks,duration,size,wafBodyLimit,bytesCount,pathPrefixes,trapPaths,wafMode,paranoiaLevel,ruleIDs,countries,percents,percent,listURL,listURLs,action,zones,resolver,crowdSecDecisionsURL,lookupSource,headerNames,durationNotOff,numberNotOff,banResponse,v4Prefix,v6Prefix,ipv6GroupPrefix,logLevel,namedNetblocks,absolutePath,token,logRemoteURL,filePath,certificates,facility,instanceName,appName,checkInstanceNameForNtfy,webhookURL,webhookHeaders,secret,alertEvents,numberOrOff,wafBackend,disposition,milliseconds,millisecondsOrOff,checkLookupDBPath,checkCountriesAndLookups,checkASNLimitPercentURL,checkCrowdSec.parseDuration,durationOrDays,parseSize,parseWAFBodyLimit,splitUnit,parseNumberNotOff,parseBanResponse,parseV4Prefix,parseV6Prefix,parseNetblocks,parseNamedNetblocks,parsePathPrefixes,parseTrapPaths,parseRuleIDs,parseCountries,parseCountry,parsePercents,parseHeaderNames,parseListenAddr,parseUpstreamURL,parseLogRemoteURL,parseFacility,parseWebhookURL,isHTTPURL,isListURL,parseListURLs,parseZones,isZone,parseResolver,parseWebhookHeaders,parseAlertEvents,parseNumberOrOff,isAppName,parseMilliseconds.internal/lookupThe package has two sources, the GeoJS web service and the lookup database (SPEC.md's term for the IPinfo Lite file). The names of the database side say "file", and the GeoJS side has the package's bare
ParamsandNew, so neither side says which it is.File→Database. It is the lookup database held in memory, not a file handle. From outside:lookup.Database.FileParams→DatabaseParams.OpenFile→OpenDatabase.(f *File) use→replaceReader. "use" does not say that it swaps the reader in place of the old one.Params→GeoJSParams. Two constructors in one package; a bareParamsdoes not say whose.New→NewGeoJS. Same reason.wait(type) →waitingClient. A verb as a type name; it is a client waiting for its answer.(g *GeoJS) kept→keptAnswer, andKept→KeptAnswer. Two methods differing only in case, both a past participle; "kept what" is the answer.(g *GeoJS) keep→keepAnswers. The issue's own example. It stores the answers one GeoJS request gave; it also notes a failure, which the doc says.(g *GeoJS) ask→startAsking. It starts a background request and returns at once;askreads as synchronous.(g *GeoJS) request→fetchAnswers. "request" is a type in two other packages of this repo and a noun everywhere else in it; this makes one HTTP request and returns the answers in it.URL→GeoJSURL(matchesreputation.AbuseIPDBURL);keepFor→keepAnswersFor;maxWaiting→maxWaitingClients;maxPerRequest→maxClientsPerRequest.Databaserename forces elsewhere:discriminator.Params.LookupFile,discriminator.Server.LookupFileandhandler.lookupFile→LookupDatabaseandlookupDatabase;metrics.AddLookupFile→AddLookupDatabase.GeoJS,Answer(qualified aslookup.Answerwherever it leaves the package, so it does not collide with the spec's "answer" to a question),record,read,LookUp(both),LastRead,ReadFailures,Watch,readAfterChanges,readAgain,LookUpWithoutWaiting,Snapshot,Load,answerOrWait,askAboutWaiting,nextClients.internal/lookup/lookuptestNetwork,Write,WriteRecords.internal/alertstitle→alertTitle,text→alertText. Bare nouns; of what.(q *Queue) repeat→isRepeat. It reports a bool and counts the repeat;repeatreads as "do it again".(q *Queue) queue→queueForDestinations. A methodqueueon a typeQueuesays nothing; it adds the alert to every destination's own queue.Params,Alert,Cooldown,Hour,State,Counts,Queue(used from ten packages; it is the thing alerts are raised into, and its doc says what it holds back and where it sends),destination,cooldownKey,cooldownKeyOf,New,Events,Destinations,Raise,WouldSend,Run,Counts,DestinationsSet,Suppressed,Snapshot,Load,addDestination,startCooldown,endHour,run,add,load,snapshot,oldest,remove,send(thedestinationreceiver names what each acts on),webhookMessage,slackMessage,ntfyMessage,ntfyPriority,ntfyTag.internal/anomalykey→counterKey. Key of what.scope(type) →countedScope. The file also has theScope*constants and aScopestring field; this type is a scope with its thresholds.(k key) counter→newCounter. It makes a fresh counter;counterreads as a getter.minute,hour→minuteWindow,hourWindow. Strings naming windows, easily read as durations.Thresholds,NamedNetblock,Params,Counter,Request,Counters,overThreshold,bucketCount,New,Scopes,Count,Snapshot,Load,scopesOf,netAround,add,counts,lastStart,key(method),alertFor.internal/bansRules→Settings. Indiscriminator/proxy.go,bans.Rules{...}sits besideRules *rules.Files, the rule files: two unrelated "Rules" in one file. What the struct holds is the ban settings.Check→CheckRequest,Find→FindActive. The two differ only in side effects:Checkcounts the request against the ban and can make the ban permanent;Findonly looks. Neither name says which.Count→CountActive. The ledger also counts bans made (Made); this one counts the active and permanent bans.(l *Ledger) ban→makeBan. Itskeep boolparameter means "make the ban rather than only work it out", so the method's name should say it makes one; the parameter wants a name such asmakeIttoo.Ban,Notes,ReputationHit,EarlierBans,Request,Ledger(see the note at the end),New,Changed,Permanent,ActiveAt,BanForLimit,WouldBanForLimit,BanForAttack,WouldBanForAttack,BanForCrowdSec,WouldBanForCrowdSec,WouldBePermanent,BanForAdmin,Lift,Covering,Bans,AddLookup,Made,Snapshot,Load,LoadEdit,activeBan,limitReason,attackReason,crowdSecReason,load,holds,earlierBans,total,markChanged,active,covering,add,limitExpiry,attackExpiry,dropOne,cut,cutText.internal/discriminator(rq *request) check→decide. The package hascheckClient,checkRules,checkCoreRuleSetandcheckRanges; this one turns the checks' result into the refusal or lets the request through, which is the decision.(rq *request) checkClient→runChecks. It runs every check, the trap paths, rule files, header limits and Core Rule Set included, which are checks of the request, not of the client.(h *handler) finishWith→finishWithReport. With what: the report.given→percentageFor. "given" says nothing; it returns the percentage a setting gives a code.(p percentage) logged→asLogged. A past participle as a method name; it returns the form the log line takes.(rq *request) noted→requestForNotes. Same: it returns the request as a ban's notes keep it.(h *handler) netblock→banScope. SPEC.md's term is the ban scope (SWW_BAN_SCOPE_V4_PREFIX); and the same package hasbanNetblock, which parses an admin's string, so two "netblock" methods do unrelated things.(h *handler) banNetblock→parseBanNetblock. It parses the body of a ban request.(rq *request) trapPath→asksForTrapPath. It reports a bool and bans;trapPathreads as a getter returning the path.deny→actionDeny. The same package has the methoddeny;cfg.BlocklistAction == denyandrq.deny(r)sit lines apart.whole→fullPercent. "whole" alone does not say it is 100 percent of a limit.Params,Server,handler,request,decision,refusal,responseWriter,percentage,banToAdd,clientAnswer,Report,New,newHandler,newReputation,NewCoreRuleSet,ServeHTTP,answerQuestion,readQuestion,refuseQuestion,asTheVisitorSentIt,refusedWhateverTheAnswer,overHeaderLimits,allow,holdForReport,deny(method),answerOwnEndpoint,takeReport,readReport,checkRanges,startRequest,requestHeaders,countedByRateLimits,pathExempt,finish,writeLine,timing,addToHistory,countAnomalies,anomalyThresholdsSet,answerAtTheEnd,WriteHeader,Write,peerAddress,requestID,scheme,clientGroup,isInside,countryDenied,biasedThresholdsSet,limitPercentages,lowest,banResponse,banned,limitBroken,countBytes,countRefusal,countedBytes,banForLimit,banForAttack,banForCrowdSec,wouldAlertBan,alertBan,netblockRequests,banExpires,checkRules,checkCoreRuleSet,alertWAFBlock,lookUp,addLookup,setLookupHeaders,canBePlaced,blocklistDenied,crowdSecBanned,dnsblDenied,abuseIPDBDenied,noteListed,noteHit,answerHealth,answerAdmin,endpoint,hasToken,listBans,addBan,readBanToAdd,expiry,liftBans,showClient,pathAddress,answerBans,answerJSON.internal/rproxynewTransport→newAppTransport, and thehandlerfieldtransport→appTransport. The file also hasnewDiscriminatorTransportanddiscriminatorTransport; the unqualified one is the app's.(rq *request) forward→proxyToApp.passToAppchecks the limits and then callsforward; two names for one hand-over, andforwarddoes not say to whom.(rq *request) endRequest→noteRequestEnd. It records the time the request ended, or returns the time recorded; it ends nothing.Params,Server,handler,request,requestBody,responseBody,upgradedConn,responseWriter,discriminatorAnswer,New,WaitForReports,newDiscriminatorTransport,ServeHTTP,passToApp,newRequest,answerHealth,readFirstPartOfBody,setPathAsSent,rewrite,modifyResponse,answerError(the three arehttputil.ReverseProxy's hook names),answer,send,prepareOwnAnswer,refuse,finish,bytesEachWay,requestDeadline,stopReadingBody,startRequestTimer,requestTimedOut,gotFirstResponseByte,wroteRequest(the two arehttptracehook names),responseTimedOut,responseReceived,setResponseDeadline,stopTimers,stopTimer,noteAnswer,handleNoUsableAnswer,ask(SPEC.md's own verb: rproxy asks discriminator),canBeAsked,newQuestion,answerWith,sendReport,postReport,peerAddress,clientAddress,scheme,isInside,setForwardedHeaders,Read,Close,Write,CloseWrite,limitBody,WriteHeader,FlushError,Hijack,Unwrap.internal/rulesvalue→targetValue. Value of what: the request's value for a rule's target.Rule,Params,Files,Load,Match,Len,Watch,readAfterChanges,readAgain,logRead,read,readFile,parse,isTarget,matches,Path,pathAndQuery,header,DecodeOnce.internal/reputationlist(type) →heldList. The same file has the exportedList; one word, two types.New→NewLists, andParams→ListsParams. The package has three constructors;NewDNSBLandNewAbuseIPDBsay what they make,Newdoes not, andDNSBLParamsandAbuseIPDBParamssay whose they are.(l *Lists) get→fetchLines.fetchcallsget;getis the HTTP part and returns the lines.(a *AbuseIPDB) alert→alertFailure. Which alert: a source failure.List,Lists,entries,Decision,URLs,ListedBy(both),ASNLimitPercent,CrowdSecDecision,Fetched,Failures(all three),Run,Snapshot(all three),Load(all three),fetchDue,due,fetch,raiseFailure,parse,parseNetblocks,parseNetblock,parsePercents,parseDecisions,withoutComment,contain,Verdict,DNSBLParams,DNSBL,query,NewDNSBL,Zones,Queries,ask(both; each doc says what is asked),lookUp,queryName,readAnswer,Score,Checks,AbuseIPDBParams,AbuseIPDB,NewAbuseIPDB,Hit,Checked,BudgetLeft,check.internal/requestlogWrite→WriteLine. Pairs withWriteRProxyLine;requestlog.Write(w, line)says write what.Line(the request line, asdocs/request-log.mdcalls it; renaming it to say "discriminator" would collide with its fieldDiscriminatorLine, which names which of discriminator's two lines it is),RProxyLine,WriteRProxyLine,writeJSONLine,FormatTime,Milliseconds,NewProcessLogger.internal/remotelog(s *Sender) put→putInBuffer. Put where.(s *Sender) send→connectAndSend. The file hassend,sendOnandwrite; this one is the loop that connects, hands the connection tosendOn, and reconnects after a failure.Params,Sender,New,Write,Sent,Dropped,Depth,Run,record,sendOn,write,dial.internal/state(f *Files) logFailure→logWriteFailure. Which failure: a write's.(f *Files) read→readAtStart. The file hasread,readChangedandtakeIn; this one is the start-up read, as its doc says.missing→missingField. Missing what.position→errorPosition. Position of what: where in the file the JSON error is.write→writeThenRename. The file haswrite,writeSyncedandwriteFile; this one is the temp-file-and-rename step.Params,Files,bansFile,BanEntry,clientsFile,lookupsFile,reputationFile,alertsFile,stateFile,Load,Run,WriteAll,Watch,fileChanged,takeInEdit,readChanged,takeIn,takeInAlerts,writeFile,setAside,encode,encodeIndented,encodeOnePerLine,BanEntries,newBanEntry,ban,check(all five; the receiver names the file),checkScores,checkAnomalyCounters,missingFromCounter,countsWithoutStart,checkWritable,parse,syncDirectory,writeSynced.internal/metricsAddLookupFile→AddLookupDatabase. Follows thelookuprename.(m *Metrics) count→countRequest. Count what.Metrics,busiest,New,newCountries,newASNs,newBusiest,counterVec,gaugeVec,statusClass,AddBansAndClients,AddRules,AddRemoteLog,AddReputation,AddAbuseIPDB,ReputationHit,AddAlerts,ServeHTTP,RequestStarted,RequestEnded,RequestAllowed,RequestReported,LimitHit,Offences,RuleMatched,WAFMatched,StateFileWritten,StateFileEditTakenIn,StateFileEditSetAside,addReputationQueries,addReputationFailures,Describe,Collect,vecs,add,label.internal/ratelimit(l *Limiter) get→getOrAdd. It adds a missing client and makes it the most recently seen;gethides both.Client.Client→Client.Address. The type and its field share a name, soclient.Clientreads as nothing; it is the client's address or IPv6 group.Limits,Limiter(see the note at the end),Client,Buckets,History,Responses,Offences,Request,Hit,Counts,window,New,Count,OverARateLimit,CountBytes,CountRefusal,Reset,AddToHistory,AddLookup,Requests,Client(method),Len,Snapshot,Load,count,buckets,byteBuckets,percentOf,Add,Passed,add.internal/wafParams,CoreRuleSet,Result,New,directivesIn,checkExclusions,Inspect,readBody,score,withoutCookiesNotRead.Across packages
ParamsandNeware kept wherever a package has one constructor: the Go idiom, documented at the declaration. They are renamed only inlookupandreputation, which have more than one.SnapshotandLoadare kept everywhere: one vocabulary for what the state files take and give.bans.Ledgerandratelimit.Limitersay neither "table" nor, forLimiter, that it also keeps each client's history. Both are used from six packages, and insidediscriminatorthe package namebansis already taken, so a rename costs more than the others here.Summary of renames
sww:newServer→newDiscriminatorServer;serve→serveDiscriminator;startSending→startRemoteLogSender.config:Config→Discriminator;FromEnvironment→DiscriminatorFromEnvironment;check→noteError;lookup→readVariable;address→listenAddr;observe→isObserveMode;count→requestCount;parseCount→parseRequestCount;refresh→refreshInterval;thresholds→anomalyThresholds;parseList→splitCommaList.lookup:File→Database;FileParams→DatabaseParams;OpenFile→OpenDatabase;use→replaceReader;Params→GeoJSParams;New→NewGeoJS;wait→waitingClient;kept→keptAnswer;Kept→KeptAnswer;keep→keepAnswers;ask→startAsking;request→fetchAnswers; constantsURL→GeoJSURL,keepFor→keepAnswersFor,maxWaiting→maxWaitingClients,maxPerRequest→maxClientsPerRequest.alerts:title→alertTitle;text→alertText;repeat→isRepeat;queue→queueForDestinations.anomaly:key→counterKey;scope→countedScope;(key).counter→newCounter; constantsminute,hour→minuteWindow,hourWindow.bans:Rules→Settings;Check→CheckRequest;Find→FindActive;Count→CountActive;ban→makeBan.discriminator:check→decide;checkClient→runChecks;finishWith→finishWithReport;given→percentageFor;logged→asLogged;noted→requestForNotes;netblock→banScope;banNetblock→parseBanNetblock;trapPath→asksForTrapPath;LookupFile,lookupFile→LookupDatabase,lookupDatabase; constantsdeny→actionDeny,whole→fullPercent.rproxy:newTransport→newAppTransport;transport→appTransport;forward→proxyToApp;endRequest→noteRequestEnd.rules:value→targetValue.reputation:list→heldList;New→NewLists;Params→ListsParams;get→fetchLines;alert→alertFailure.requestlog:Write→WriteLine.remotelog:put→putInBuffer;send→connectAndSend.state:logFailure→logWriteFailure;read→readAtStart;missing→missingField;position→errorPosition;write→writeThenRename.metrics:AddLookupFile→AddLookupDatabase;count→countRequest.ratelimit:get→getOrAdd; fieldClient.Client→Client.Address.Checked: every new name above is free in its package today.
SPEC.md's package list names two Go identifiers,checkandanswerOwnEndpoint; the rename ofchecktodecidemust update that line too. No other document underdocs/orREADME.mdnames an identifier this list touches. Not checked: that the code compiles after the renames; that is the implementer's first step.Model: fable-5-1