From 3339869c64919896cca994e92a793eb095e92108 Mon Sep 17 00:00:00 2001 From: sneak Date: Wed, 12 Aug 2026 11:21:24 +0000 Subject: [PATCH] Record the last four milestone units in TODO.md Adds Completed Steps for the receiver aggregate rate limit (#139), the documentation accuracy pass (#141), the CI gate repair (#119) and the RETENTION_SWEEP_INTERVAL bound (#140). Drops the commit hash that pinned the Status paragraph to a specific next head, since it goes stale on every merge, and rewrites Next Step now that the gate repair it named has landed. --- TODO.md | 50 ++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 40 insertions(+), 10 deletions(-) diff --git a/TODO.md b/TODO.md index 2b341dc..e4e0296 100644 --- a/TODO.md +++ b/TODO.md @@ -24,22 +24,52 @@ event retention (#63), the database archiving target (#43), the admin password change flow (#65), policy compliance (#6), pinned lint tooling (#55), and fail-loud configuration parsing (#80). -`next` (9bfd033) holds the completed 1.0.0 milestone: every issue in it -is closed, and it is verified green by cache-defeated container runs -rather than by the CI badge, which can pass without executing anything -(#119). Note: TODO.md was deliberately deleted from this repo in f9a9569 -(2026-03-01, #6); its content was folded into the README TODO section, -which this draft reconstructs as of 2026-07-06. +`next` holds the completed 1.0.0 milestone: every issue in it is closed, +and it is verified green both by CI and by cache-defeated container +runs. The two were only made to mean the same thing this cycle — before +#119, a warm layer cache let the gate report success without executing +anything, and replayed the previous build's console log so the lie +looked like a real run. Note: TODO.md was deliberately deleted from this +repo in f9a9569 (2026-03-01, #6); its content was folded into the README +TODO section, which this draft reconstructs as of 2026-07-06. # Next Step -Tag 1.0.0 from `main` once the milestone PR merges, then repair the CI -gate (#119) before the next cycle's work lands — a gate that can report -success without running is the one thing every other guarantee here -rests on. +Merge the milestone PR to `main` and tag 1.0.0 from it. + +Two decisions are open and belong to the owner, neither blocking the +tag: #115 (mask the `http` target's destination URL, implemented +speculatively and awaiting a yes or no) and #125 (whether IPv6 +rate-limit keys should bucket by `/64`). # Completed Steps +- 2026-08-12 Bound the receiver rate limit per client IP across the + whole `/webhook/*` route. The existing limiter keyed on the request + path and `/webhook/{uuid}` matches any single segment, so a client + that invented a fresh path per request minted a fresh bucket per + request: the limit on the only unauthenticated endpoint bounded + nothing in aggregate, and every request still cost an entrypoint + lookup before it 404ed. An outer limiter keyed on the client address + alone now bounds that, chained in front of the unchanged + per-entrypoint limiter (#139) +- 2026-08-12 Correct release-blocking documentation inaccuracies: the + README promised manual redelivery in the present tense in three + places when nothing implements it (the same false claim also sat in + the doc comment that was its source text), the env table omitted + `RETENTION_SWEEP_INTERVAL`, and `TODO.md` itself omitted five landed + units (#141) +- 2026-08-12 Make the CI gate execute the checks it reports on. The + workflow now writes a build-context fingerprint before calling + `script/cibuild`, so a code commit invalidates the `COPY` layer of + the lint and builder stages while a docs-only commit still replays + from cache; a superseding run also rewrites the `failure` status + Gitea leaves on commits it cancelled and never tested. Verified by + pushing a deliberately broken test and watching CI go red (#119) +- 2026-08-12 Require a positive `RETENTION_SWEEP_INTERVAL`: a + non-positive value reached `time.NewTicker` in both the retention + reaper and the archive sweeper, panicking two goroutines with no + recover after startup had already reported success (#140) - 2026-08-12 Bound the `X-Forwarded-For` scan's allocation to the hop cap: the reverse walk cuts entries with `strings.LastIndexByte` instead of joining and splitting, so a 1 MB header allocates 16 bytes