Docs-only. TODO.md is the only file touched, per #112. No issue — this is a maintenance commit for that file.
Removed
The Stripe HMAC Future Step. It read "Stripe HMAC signature verification. The GitHub and GitLab schemes landed with inbound verification (#67)". Inbound verification was removed on next by #279 — internal/signature, the entrypoint model fields, the forms and the receiver check are all gone — so that line proposed extending a subsystem that no longer exists. Deleted outright, not replaced with a note: a removed feature is not future work.
#67 from the Status section's closed-gaps list, for the same reason. The list asserted every deployability-audit gap was closed and counted inbound verification among them.
Every statement of tracker or branch state that had to be maintained by hand. The milestone issue counts; the commit-ahead count and head SHA; the enumeration of open follow-ups (#245, #246, #247, #248, #193, #198, #212); and the paragraph describing the milestone PR's label and assignee. Each had already drifted or was about to: the milestone was recorded as complete with zero open issues, #247 had closed, and a fix this body described as awaiting review merged mid-revision. The milestone page (https://git.eeqj.de/sneak/webhooker/milestone/9) is linked in their place.
Corrected
Status claimed "1.0.0 is complete: 55 closed, 0 open". It now says the milestone is open with work remaining, states no number, and names what holds the tag: #256. That sentence is phrased to point at the issue, not at any PR, so it stays true whether the fix is in review, reworking or about to land. Next Step keeps the durable half of what it said — merging next into main is a separate act from tagging — without describing the current state of either.
Added to Completed Steps
Every unit that landed since the file was last touched at a83e8fe, verified against git log a83e8fe..origin/next rather than against any brief:
#268 and #226BIND_ADDRESS defaulting to loopback plus the reverse-proxy docs, and in the same commit the shutdown race and nil dereference
#250 resubmit a stored event as a new undelivered event
Plus the 2026-08-20 units that existed in the file only as Status prose, or not at all: #201, #200, #205, #206, #207, #234, #202, #203, #209, #210, #208, #204, #233 and #127. Trimming Status of the audit narrative would otherwise have deleted the only record of half of them; Completed Steps is where this file keeps landed work.
Found stale, NOT changed
Completed Steps entries predating this commit cite issues as bare (#N), which Gitea does not linkify in a rendered repo file. New entries use full URLs. Rewriting ~60 existing entries is churn out of scope for a content refresh, so the section is mixed for now.
The Workflow section's (#112) has the same problem and was left alone for the same reason.
Verification
Rebased onto origin/next at 62576f6; the rebase was clean, no conflicts. GOFLAGS=-count=1 make check re-run afterwards: exit 0. 21 ok packages plus 2 with no test files (23 total), 0 FAIL, 0 (cached), 0 data races, 0 SKIP. Lint executed rather than replayed in the pinned container: [lint 3/3] RUN golangci-lint run was not CACHED and reported 0 issues. in 47.71s. One deprecation warning surfaced, gomodguard to gomodguard_v2, already tracked as #248.
make fmt is a no-op for markdown here (#215) and changed nothing. No line exceeds the file's 72-column style. git diff origin/next --stat is TODO.md alone.
Docs-only. `TODO.md` is the only file touched, per https://git.eeqj.de/sneak/webhooker/issues/112. No issue — this is a maintenance commit for that file.
## Removed
- **The Stripe HMAC Future Step.** It read "Stripe HMAC signature verification. The GitHub and GitLab schemes landed with inbound verification (https://git.eeqj.de/sneak/webhooker/issues/67)". Inbound verification was removed on `next` by https://git.eeqj.de/sneak/webhooker/issues/279 — `internal/signature`, the entrypoint model fields, the forms and the receiver check are all gone — so that line proposed extending a subsystem that no longer exists. Deleted outright, not replaced with a note: a removed feature is not future work.
- **`#67` from the Status section's closed-gaps list**, for the same reason. The list asserted every deployability-audit gap was closed and counted inbound verification among them.
- **Every statement of tracker or branch state that had to be maintained by hand.** The milestone issue counts; the commit-ahead count and head SHA; the enumeration of open follow-ups (https://git.eeqj.de/sneak/webhooker/issues/245, https://git.eeqj.de/sneak/webhooker/issues/246, https://git.eeqj.de/sneak/webhooker/issues/247, https://git.eeqj.de/sneak/webhooker/issues/248, https://git.eeqj.de/sneak/webhooker/issues/193, https://git.eeqj.de/sneak/webhooker/issues/198, https://git.eeqj.de/sneak/webhooker/issues/212); and the paragraph describing the milestone PR's label and assignee. Each had already drifted or was about to: the milestone was recorded as complete with zero open issues, https://git.eeqj.de/sneak/webhooker/issues/247 had closed, and a fix this body described as awaiting review merged mid-revision. The milestone page (https://git.eeqj.de/sneak/webhooker/milestone/9) is linked in their place.
## Corrected
Status claimed "1.0.0 is complete: 55 closed, 0 open". It now says the milestone is open with work remaining, states no number, and names what holds the tag: https://git.eeqj.de/sneak/webhooker/issues/256. That sentence is phrased to point at the issue, not at any PR, so it stays true whether the fix is in review, reworking or about to land. Next Step keeps the durable half of what it said — merging `next` into `main` is a separate act from tagging — without describing the current state of either.
## Added to Completed Steps
Every unit that landed since the file was last touched at `a83e8fe`, verified against `git log a83e8fe..origin/next` rather than against any brief:
- https://git.eeqj.de/sneak/webhooker/issues/268 and https://git.eeqj.de/sneak/webhooker/issues/226 `BIND_ADDRESS` defaulting to loopback plus the reverse-proxy docs, and in the same commit the shutdown race and nil dereference
- https://git.eeqj.de/sneak/webhooker/issues/279 inbound signature verification removed
- https://git.eeqj.de/sneak/webhooker/issues/253 the build version stamped into the binary
- https://git.eeqj.de/sneak/webhooker/issues/269 cookie `Secure` and CSRF strictness from the request transport
- https://git.eeqj.de/sneak/webhooker/issues/262 a failed webhook deletion rolls back
- https://git.eeqj.de/sneak/webhooker/issues/211 a deleted target keeps its name on historical deliveries
- https://git.eeqj.de/sneak/webhooker/issues/254 and https://git.eeqj.de/sneak/webhooker/issues/261 both `/metrics` label dimensions bounded (one entry, since they are one vector)
- https://git.eeqj.de/sneak/webhooker/issues/221 `max_retries` validated on both target forms
- https://git.eeqj.de/sneak/webhooker/issues/250 resubmit a stored event as a new undelivered event
Plus the 2026-08-20 units that existed in the file only as Status prose, or not at all: https://git.eeqj.de/sneak/webhooker/issues/201, https://git.eeqj.de/sneak/webhooker/issues/200, https://git.eeqj.de/sneak/webhooker/issues/205, https://git.eeqj.de/sneak/webhooker/issues/206, https://git.eeqj.de/sneak/webhooker/issues/207, https://git.eeqj.de/sneak/webhooker/issues/234, https://git.eeqj.de/sneak/webhooker/issues/202, https://git.eeqj.de/sneak/webhooker/issues/203, https://git.eeqj.de/sneak/webhooker/issues/209, https://git.eeqj.de/sneak/webhooker/issues/210, https://git.eeqj.de/sneak/webhooker/issues/208, https://git.eeqj.de/sneak/webhooker/issues/204, https://git.eeqj.de/sneak/webhooker/issues/233 and https://git.eeqj.de/sneak/webhooker/issues/127. Trimming Status of the audit narrative would otherwise have deleted the only record of half of them; Completed Steps is where this file keeps landed work.
## Found stale, NOT changed
- **Completed Steps entries predating this commit cite issues as bare `(#N)`**, which Gitea does not linkify in a rendered repo file. New entries use full URLs. Rewriting ~60 existing entries is churn out of scope for a content refresh, so the section is mixed for now.
- **The Workflow section's `(#112)`** has the same problem and was left alone for the same reason.
## Verification
Rebased onto `origin/next` at `62576f6`; the rebase was clean, no conflicts. `GOFLAGS=-count=1 make check` re-run afterwards: **exit 0**. 21 `ok` packages plus 2 with no test files (23 total), 0 `FAIL`, **0 `(cached)`**, 0 data races, 0 SKIP. Lint executed rather than replayed in the pinned container: `[lint 3/3] RUN golangci-lint run` was not `CACHED` and reported `0 issues.` in 47.71s. One deprecation warning surfaced, `gomodguard` to `gomodguard_v2`, already tracked as https://git.eeqj.de/sneak/webhooker/issues/248.
`make fmt` is a no-op for markdown here (https://git.eeqj.de/sneak/webhooker/issues/215) and changed nothing. No line exceeds the file's 72-column style. `git diff origin/next --stat` is `TODO.md` alone.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Docs-only.
TODO.mdis the only file touched, per #112. No issue — this is a maintenance commit for that file.Removed
nextby #279 —internal/signature, the entrypoint model fields, the forms and the receiver check are all gone — so that line proposed extending a subsystem that no longer exists. Deleted outright, not replaced with a note: a removed feature is not future work.#67from the Status section's closed-gaps list, for the same reason. The list asserted every deployability-audit gap was closed and counted inbound verification among them.Corrected
Status claimed "1.0.0 is complete: 55 closed, 0 open". It now says the milestone is open with work remaining, states no number, and names what holds the tag: #256. That sentence is phrased to point at the issue, not at any PR, so it stays true whether the fix is in review, reworking or about to land. Next Step keeps the durable half of what it said — merging
nextintomainis a separate act from tagging — without describing the current state of either.Added to Completed Steps
Every unit that landed since the file was last touched at
a83e8fe, verified againstgit log a83e8fe..origin/nextrather than against any brief:BIND_ADDRESSdefaulting to loopback plus the reverse-proxy docs, and in the same commit the shutdown race and nil dereferenceSecureand CSRF strictness from the request transport/metricslabel dimensions bounded (one entry, since they are one vector)max_retriesvalidated on both target formsPlus the 2026-08-20 units that existed in the file only as Status prose, or not at all: #201, #200, #205, #206, #207, #234, #202, #203, #209, #210, #208, #204, #233 and #127. Trimming Status of the audit narrative would otherwise have deleted the only record of half of them; Completed Steps is where this file keeps landed work.
Found stale, NOT changed
(#N), which Gitea does not linkify in a rendered repo file. New entries use full URLs. Rewriting ~60 existing entries is churn out of scope for a content refresh, so the section is mixed for now.(#112)has the same problem and was left alone for the same reason.Verification
Rebased onto
origin/nextat62576f6; the rebase was clean, no conflicts.GOFLAGS=-count=1 make checkre-run afterwards: exit 0. 21okpackages plus 2 with no test files (23 total), 0FAIL, 0(cached), 0 data races, 0 SKIP. Lint executed rather than replayed in the pinned container:[lint 3/3] RUN golangci-lint runwas notCACHEDand reported0 issues.in 47.71s. One deprecation warning surfaced,gomodguardtogomodguard_v2, already tracked as #248.make fmtis a no-op for markdown here (#215) and changed nothing. No line exceeds the file's 72-column style.git diff origin/next --statisTODO.mdalone.84f5780884to67903257e867903257e8to5ce8fb57bcclawbot referenced this pull request2026-08-24 04:32:55 +02:00