Not blocking: need not be fixed before real traffic. Found by the end-to-end check of sww rproxy (#321) on next at f7e3190.
Where
internal/waf/waf.go, the comment above readQuestion (lines 216 to 219).
What is wrong
The comment says waf answers a question it does not take "with 400 and no disposition, which rproxy treats as it treats no answer".
rproxy does not treat it so. It passes that 400 to the visitor, and SWRP_DEFAULT_DISPOSITION does not apply. SPEC.md ("What rproxy does with a request", step 7, and "Without an answer from waf") and internal/rproxy/waf.go agree with each other and not with the comment.
Why it matters
A reader of waf concludes that a refused question still reaches the app. It does not: the visitor gets 400. The next change to either side may be built on the wrong one.
Acceptable
The comment says what happens: rproxy passes the 400 to the visitor. No behaviour changes.
Definition of done
One PR to next that changes the comment only.
make check passes.
Model: fable-5-2
Not blocking: need not be fixed before real traffic. Found by the end-to-end check of `sww rproxy` (https://git.eeqj.de/sneak/smallwebwaf/issues/321) on `next` at `f7e3190`.
## Where
`internal/waf/waf.go`, the comment above `readQuestion` (lines 216 to 219).
## What is wrong
The comment says `waf` answers a question it does not take "with 400 and no disposition, which rproxy treats as it treats no answer".
`rproxy` does not treat it so. It passes that `400` to the visitor, and `SWRP_DEFAULT_DISPOSITION` does not apply. `SPEC.md` ("What `rproxy` does with a request", step 7, and "Without an answer from `waf`") and `internal/rproxy/waf.go` agree with each other and not with the comment.
## Why it matters
A reader of `waf` concludes that a refused question still reaches the app. It does not: the visitor gets `400`. The next change to either side may be built on the wrong one.
## Acceptable
The comment says what happens: `rproxy` passes the `400` to the visitor. No behaviour changes.
## Definition of done
- One PR to `next` that changes the comment only.
- `make check` passes.
Model: fable-5-2
Plan. The comment above readQuestion in internal/waf/waf.go says what SPEC.md and internal/rproxy/waf.go do: rproxy passes the 400 to the visitor, and SWRP_DEFAULT_DISPOSITION does not apply. Comment only; no behaviour changes.
Follow AGENTS.md: checks only through make targets. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. Edit by hand. Title ending (closes #326). Label the PR needs-review.
Model: opus-5-5
**Plan.** The comment above `readQuestion` in `internal/waf/waf.go` says what `SPEC.md` and `internal/rproxy/waf.go` do: `rproxy` passes the `400` to the visitor, and `SWRP_DEFAULT_DISPOSITION` does not apply. Comment only; no behaviour changes.
Follow `AGENTS.md`: checks only through `make` targets. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. Edit by hand. Title ending ` (closes #326)`. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-11 04:11:38 +01:00
Built in #333: the comment above readQuestion now says rproxy passes the 400 to the visitor and its default disposition does not apply. Comment only.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/333: the comment above `readQuestion` now says `rproxy` passes the `400` to the visitor and its default disposition does not apply. Comment only.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Not blocking: need not be fixed before real traffic. Found by the end-to-end check of
sww rproxy(#321) onnextatf7e3190.Where
internal/waf/waf.go, the comment abovereadQuestion(lines 216 to 219).What is wrong
The comment says
wafanswers a question it does not take "with 400 and no disposition, which rproxy treats as it treats no answer".rproxydoes not treat it so. It passes that400to the visitor, andSWRP_DEFAULT_DISPOSITIONdoes not apply.SPEC.md("Whatrproxydoes with a request", step 7, and "Without an answer fromwaf") andinternal/rproxy/waf.goagree with each other and not with the comment.Why it matters
A reader of
wafconcludes that a refused question still reaches the app. It does not: the visitor gets400. The next change to either side may be built on the wrong one.Acceptable
The comment says what happens:
rproxypasses the400to the visitor. No behaviour changes.Definition of done
nextthat changes the comment only.make checkpasses.Model: fable-5-2
Plan. The comment above
readQuestionininternal/waf/waf.gosays whatSPEC.mdandinternal/rproxy/waf.godo:rproxypasses the400to the visitor, andSWRP_DEFAULT_DISPOSITIONdoes not apply. Comment only; no behaviour changes.Follow
AGENTS.md: checks only throughmaketargets.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output. Edit by hand. Title ending(closes #326). Label the PRneeds-review.Model: opus-5-5
Built in #333: the comment above
readQuestionnow saysrproxypasses the400to the visitor and its default disposition does not apply. Comment only.Model: opus-5-5