SPEC.md ends with a "Questions for the owner" section of seven questions. This issue records each resolution; the closing unit folds every resolution into the SPEC body and deletes the section. Resolutions of 2026-09-22, in the SPEC's order:
Combining percentages (a visitor in both a listed AS number and a listed country): ADOPTED per the owner's standing follow-the-recommendation order — the LOWEST percentage applies. A config a person reads must predict behaviour; the product rule punishes overlap with no purpose-driven reason. The owner may reverse.
Meaning of a country percentage limit: RULED by the owner in chat — each visitor from the listed country gets that percentage of the normal per-visitor limits. A shared whole-country budget is rejected as unfit for purpose: one abuser could exhaust it and lock out the whole country, a denial of service the tool exists to prevent.
Sharing bans across the fleet: ADOPTED — per-sidecar bans in the first version; a per-host CrowdSec engine is reconsidered only after real ban volumes exist. The owner may reverse.
Lookup database source: OPEN with the owner — the recommended pick (IPinfo Lite fetched centrally to an internal URL) requires a free account the owner would hold, so the pick is his. Asked in chat 2026-09-22; the ruling lands here.
upaas second-container capability: converted from an owner question to an investigation — sneak/upaas#205. Whether upaas supports the shape is a fact to establish, not a preference.
Remote log library: ADOPTED — the RFC 5424 syslog sender is written in-project (the standard library's syslog package is frozen on the older format); RELP is not in the first release and is revisited against available packages afterwards. The owner may reverse.
Ban response: ADOPTED — HTTP 403 by default for debuggability, connection close available in config. The owner may reverse.
Definition of done: all seven carry a resolution on this issue, and one docs-only PR updates SPEC.md to state each resolution inline, removes the "Questions for the owner" section, and is prettier-formatted and merged green. The repo is paused under the 2026-09-22 priority ruling, so the folding unit runs when the repo resumes.
(model: claude-fable-5)
SPEC.md ends with a "Questions for the owner" section of seven questions. This issue records each resolution; the closing unit folds every resolution into the SPEC body and deletes the section. Resolutions of 2026-09-22, in the SPEC's order:
1. Combining percentages (a visitor in both a listed AS number and a listed country): ADOPTED per the owner's standing follow-the-recommendation order — the LOWEST percentage applies. A config a person reads must predict behaviour; the product rule punishes overlap with no purpose-driven reason. The owner may reverse.
2. Meaning of a country percentage limit: RULED by the owner in chat — each visitor from the listed country gets that percentage of the normal per-visitor limits. A shared whole-country budget is rejected as unfit for purpose: one abuser could exhaust it and lock out the whole country, a denial of service the tool exists to prevent.
3. Sharing bans across the fleet: ADOPTED — per-sidecar bans in the first version; a per-host CrowdSec engine is reconsidered only after real ban volumes exist. The owner may reverse.
4. Lookup database source: OPEN with the owner — the recommended pick (IPinfo Lite fetched centrally to an internal URL) requires a free account the owner would hold, so the pick is his. Asked in chat 2026-09-22; the ruling lands here.
5. upaas second-container capability: converted from an owner question to an investigation — https://git.eeqj.de/sneak/upaas/issues/205. Whether upaas supports the shape is a fact to establish, not a preference.
6. Remote log library: ADOPTED — the RFC 5424 syslog sender is written in-project (the standard library's syslog package is frozen on the older format); RELP is not in the first release and is revisited against available packages afterwards. The owner may reverse.
7. Ban response: ADOPTED — HTTP 403 by default for debuggability, connection close available in config. The owner may reverse.
Definition of done: all seven carry a resolution on this issue, and one docs-only PR updates SPEC.md to state each resolution inline, removes the "Questions for the owner" section, and is prettier-formatted and merged green. The repo is paused under the 2026-09-22 priority ruling, so the folding unit runs when the repo resumes.
(model: claude-fable-5)
Q5 resolved: the upaas investigation (sneak/upaas#205 (comment)) found upaas deploys exactly one container per app with all labels attached to it — the proxy-in-front shape is NOT supported today. The minimal feature (optional per-app second container, ingress-label routing to it, app on an internal-only network) is filed as sneak/upaas#206. Consequence for this SPEC: until upaas 206 lands, deployment beside a upaas app is manual compose only; the SPEC's deployment section gets a note to that effect in the folding unit. (model: claude-fable-5)
Q5 resolved: the upaas investigation (https://git.eeqj.de/sneak/upaas/issues/205#issuecomment-99507) found upaas deploys exactly one container per app with all labels attached to it — the proxy-in-front shape is NOT supported today. The minimal feature (optional per-app second container, ingress-label routing to it, app on an internal-only network) is filed as https://git.eeqj.de/sneak/upaas/issues/206. Consequence for this SPEC: until upaas 206 lands, deployment beside a upaas app is manual compose only; the SPEC's deployment section gets a note to that effect in the folding unit. (model: claude-fable-5)
Q4 resolved (sneak, 2026-09-22, chat): the program never fetches the database and holds no account or token — the operator supplies the database file and bind-mounts it read-only into the container; refresh cadence is the operator's concern, outside the program. The pick among sources was delegated; adopted: IPinfo Lite, per the evaluation already in the SPEC — the one free file carrying both country and AS number (DB-IP and MaxMind split them across files, and MaxMind adds redistribution terms). Its attribution requirement goes into the README in the folding unit, which also pins the exact file format and reader library.
Config consequence, derived from the standing invalid-config ruling (config-fails-loudly): the database path is configuration — a configured path that is missing or unreadable at startup fails startup loudly; omitting the path is valid only when no configured rule needs country or AS lookups.
With this all seven questions are resolved; only the folding unit remains, queued for reactivation.
(model: claude-fable-5)
Q4 resolved (sneak, 2026-09-22, chat): the program never fetches the database and holds no account or token — the operator supplies the database file and bind-mounts it read-only into the container; refresh cadence is the operator's concern, outside the program. The pick among sources was delegated; adopted: IPinfo Lite, per the evaluation already in the SPEC — the one free file carrying both country and AS number (DB-IP and MaxMind split them across files, and MaxMind adds redistribution terms). Its attribution requirement goes into the README in the folding unit, which also pins the exact file format and reader library.
Config consequence, derived from the standing invalid-config ruling (config-fails-loudly): the database path is configuration — a configured path that is missing or unreadable at startup fails startup loudly; omitting the path is valid only when no configured rule needs country or AS lookups.
With this all seven questions are resolved; only the folding unit remains, queued for reactivation.
(model: claude-fable-5)
Q5 amended by owner ruling (sneak/upaas#206 (comment)): the upaas feature is rejected — upaas stays out of it entirely. Deployment shape: the app is deployed by upaas with no traefik labels; the sidecar runs beside it under docker-compose, carries the traefik labels, and points at the app's hostname. The SPEC's deployment section documents this compose-based shape in the folding unit; upaas issue 206 is closed declined. (model: claude-fable-5)
Q5 amended by owner ruling (https://git.eeqj.de/sneak/upaas/issues/206#issuecomment-99535): the upaas feature is rejected — upaas stays out of it entirely. Deployment shape: the app is deployed by upaas with no traefik labels; the sidecar runs beside it under docker-compose, carries the traefik labels, and points at the app's hostname. The SPEC's deployment section documents this compose-based shape in the folding unit; upaas issue 206 is closed declined. (model: claude-fable-5)
his 2026-09-23 directive in #7: internet-ready out of the box, with 2026 real-world defaults and minimal required configuration.
Amended definition of done. One docs-only PR to next:
states the seven resolutions above inline and removes the "Questions for the owner" section, as before;
states issues 2 to 5 in the spec body;
meets the definition of done of issue 7;
closes issues 2, 3, 4, 5, 6 and 7;
is prettier-formatted and merged green.
Where the owner's later words conflict with earlier spec text or with a 2026-09-21 ruling, the later words win. For example, issue 2's live reload replaces "loaded once at startup".
Model: opus-5-5
Scope expanded on 2026-09-23. This folding unit also folds in:
- the owner's four spec issues of 2026-09-21, which no unit had picked up:
- https://git.eeqj.de/sneak/smallwebwaf/issues/2: the ban model and live reload of files edited on disk
- https://git.eeqj.de/sneak/smallwebwaf/issues/3: the biased limits always end in a ban
- https://git.eeqj.de/sneak/smallwebwaf/issues/4: notes on ban records, and per-netblock history kept across restarts
- https://git.eeqj.de/sneak/smallwebwaf/issues/5: size and time limits in both directions
- his 2026-09-23 directive in https://git.eeqj.de/sneak/smallwebwaf/issues/7: internet-ready out of the box, with 2026 real-world defaults and minimal required configuration.
Amended definition of done. One docs-only PR to `next`:
- states the seven resolutions above inline and removes the "Questions for the owner" section, as before;
- states issues 2 to 5 in the spec body;
- meets the definition of done of issue 7;
- closes issues 2, 3, 4, 5, 6 and 7;
- is prettier-formatted and merged green.
Where the owner's later words conflict with earlier spec text or with a 2026-09-21 ruling, the later words win. For example, issue 2's live reload replaces "loaded once at startup".
Model: opus-5-5
clawbot
changed title from SPEC: resolve the seven owner questions and fold the rulings into SPEC.md to SPEC update: fold the seven resolutions, issues 2 to 5 and the internet-ready directive (issue 7) into SPEC.md2026-09-23 13:45:07 +02:00
clawbot
self-assigned this 2026-09-23 13:45:08 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
SPEC.md ends with a "Questions for the owner" section of seven questions. This issue records each resolution; the closing unit folds every resolution into the SPEC body and deletes the section. Resolutions of 2026-09-22, in the SPEC's order:
Definition of done: all seven carry a resolution on this issue, and one docs-only PR updates SPEC.md to state each resolution inline, removes the "Questions for the owner" section, and is prettier-formatted and merged green. The repo is paused under the 2026-09-22 priority ruling, so the folding unit runs when the repo resumes.
(model: claude-fable-5)
Q5 resolved: the upaas investigation (sneak/upaas#205 (comment)) found upaas deploys exactly one container per app with all labels attached to it — the proxy-in-front shape is NOT supported today. The minimal feature (optional per-app second container, ingress-label routing to it, app on an internal-only network) is filed as sneak/upaas#206. Consequence for this SPEC: until upaas 206 lands, deployment beside a upaas app is manual compose only; the SPEC's deployment section gets a note to that effect in the folding unit. (model: claude-fable-5)
Q4 resolved (sneak, 2026-09-22, chat): the program never fetches the database and holds no account or token — the operator supplies the database file and bind-mounts it read-only into the container; refresh cadence is the operator's concern, outside the program. The pick among sources was delegated; adopted: IPinfo Lite, per the evaluation already in the SPEC — the one free file carrying both country and AS number (DB-IP and MaxMind split them across files, and MaxMind adds redistribution terms). Its attribution requirement goes into the README in the folding unit, which also pins the exact file format and reader library.
Config consequence, derived from the standing invalid-config ruling (config-fails-loudly): the database path is configuration — a configured path that is missing or unreadable at startup fails startup loudly; omitting the path is valid only when no configured rule needs country or AS lookups.
With this all seven questions are resolved; only the folding unit remains, queued for reactivation.
(model: claude-fable-5)
Q5 amended by owner ruling (sneak/upaas#206 (comment)): the upaas feature is rejected — upaas stays out of it entirely. Deployment shape: the app is deployed by upaas with no traefik labels; the sidecar runs beside it under docker-compose, carries the traefik labels, and points at the app's hostname. The SPEC's deployment section documents this compose-based shape in the folding unit; upaas issue 206 is closed declined. (model: claude-fable-5)
Scope expanded on 2026-09-23. This folding unit also folds in:
Amended definition of done. One docs-only PR to
next:Where the owner's later words conflict with earlier spec text or with a 2026-09-21 ruling, the later words win. For example, issue 2's live reload replaces "loaded once at startup".
Model: opus-5-5
SPEC: resolve the seven owner questions and fold the rulings into SPEC.mdto SPEC update: fold the seven resolutions, issues 2 to 5 and the internet-ready directive (issue 7) into SPEC.md