Record landed 1.0.0 work and drop the removed signing roadmap in TODO.md #284

Merged

clawbot merged 1 commits from todo-md-refresh into next 2026-08-24 03:43:17 +02:00

Conversation 0 Commits 1 Files Changed 1 +131 -39

clawbot commented 2026-08-24 03:34:45 +02:00

Collaborator

Copy Link

Docs-only. TODO.md is the only file touched, per #112. No issue — this is a maintenance commit for that file.

Removed

• The Stripe HMAC Future Step. It read "Stripe HMAC signature verification. The GitHub and GitLab schemes landed with inbound verification (#67)". Inbound verification was removed on next by #279 — internal/signature, the entrypoint model fields, the forms and the receiver check are all gone — so that line proposed extending a subsystem that no longer exists. Deleted outright, not replaced with a note: a removed feature is not future work.
• #67 from the Status section's closed-gaps list, for the same reason. The list asserted every deployability-audit gap was closed and counted inbound verification among them.
• Every statement of tracker or branch state that had to be maintained by hand. The milestone issue counts; the commit-ahead count and head SHA; the enumeration of open follow-ups (#245, #246, #247, #248, #193, #198, #212); and the paragraph describing the milestone PR's label and assignee. Each had already drifted or was about to: the milestone was recorded as complete with zero open issues, #247 had closed, and a fix this body described as awaiting review merged mid-revision. The milestone page (https://git.eeqj.de/sneak/webhooker/milestone/9) is linked in their place.

Corrected

Status claimed "1.0.0 is complete: 55 closed, 0 open". It now says the milestone is open with work remaining, states no number, and names what holds the tag: #256. That sentence is phrased to point at the issue, not at any PR, so it stays true whether the fix is in review, reworking or about to land. Next Step keeps the durable half of what it said — merging next into main is a separate act from tagging — without describing the current state of either.

Added to Completed Steps

Every unit that landed since the file was last touched at a83e8fe, verified against git log a83e8fe..origin/next rather than against any brief:

• #268 and #226 BIND_ADDRESS defaulting to loopback plus the reverse-proxy docs, and in the same commit the shutdown race and nil dereference
• #279 inbound signature verification removed
• #253 the build version stamped into the binary
• #269 cookie Secure and CSRF strictness from the request transport
• #262 a failed webhook deletion rolls back
• #211 a deleted target keeps its name on historical deliveries
• #254 and #261 both /metrics label dimensions bounded (one entry, since they are one vector)
• #221 max_retries validated on both target forms
• #250 resubmit a stored event as a new undelivered event

Plus the 2026-08-20 units that existed in the file only as Status prose, or not at all: #201, #200, #205, #206, #207, #234, #202, #203, #209, #210, #208, #204, #233 and #127. Trimming Status of the audit narrative would otherwise have deleted the only record of half of them; Completed Steps is where this file keeps landed work.

Found stale, NOT changed

• Completed Steps entries predating this commit cite issues as bare (#N), which Gitea does not linkify in a rendered repo file. New entries use full URLs. Rewriting ~60 existing entries is churn out of scope for a content refresh, so the section is mixed for now.
• The Workflow section's (#112) has the same problem and was left alone for the same reason.

Verification

Rebased onto origin/next at 62576f6; the rebase was clean, no conflicts. GOFLAGS=-count=1 make check re-run afterwards: exit 0. 21 ok packages plus 2 with no test files (23 total), 0 FAIL, 0 (cached), 0 data races, 0 SKIP. Lint executed rather than replayed in the pinned container: [lint 3/3] RUN golangci-lint run was not CACHED and reported 0 issues. in 47.71s. One deprecation warning surfaced, gomodguard to gomodguard_v2, already tracked as #248.

make fmt is a no-op for markdown here (#215) and changed nothing. No line exceeds the file's 72-column style. git diff origin/next --stat is TODO.md alone.

Docs-only. `TODO.md` is the only file touched, per https://git.eeqj.de/sneak/webhooker/issues/112. No issue — this is a maintenance commit for that file. ## Removed - **The Stripe HMAC Future Step.** It read "Stripe HMAC signature verification. The GitHub and GitLab schemes landed with inbound verification (https://git.eeqj.de/sneak/webhooker/issues/67)". Inbound verification was removed on `next` by https://git.eeqj.de/sneak/webhooker/issues/279 — `internal/signature`, the entrypoint model fields, the forms and the receiver check are all gone — so that line proposed extending a subsystem that no longer exists. Deleted outright, not replaced with a note: a removed feature is not future work. - **`#67` from the Status section's closed-gaps list**, for the same reason. The list asserted every deployability-audit gap was closed and counted inbound verification among them. - **Every statement of tracker or branch state that had to be maintained by hand.** The milestone issue counts; the commit-ahead count and head SHA; the enumeration of open follow-ups (https://git.eeqj.de/sneak/webhooker/issues/245, https://git.eeqj.de/sneak/webhooker/issues/246, https://git.eeqj.de/sneak/webhooker/issues/247, https://git.eeqj.de/sneak/webhooker/issues/248, https://git.eeqj.de/sneak/webhooker/issues/193, https://git.eeqj.de/sneak/webhooker/issues/198, https://git.eeqj.de/sneak/webhooker/issues/212); and the paragraph describing the milestone PR's label and assignee. Each had already drifted or was about to: the milestone was recorded as complete with zero open issues, https://git.eeqj.de/sneak/webhooker/issues/247 had closed, and a fix this body described as awaiting review merged mid-revision. The milestone page (https://git.eeqj.de/sneak/webhooker/milestone/9) is linked in their place. ## Corrected Status claimed "1.0.0 is complete: 55 closed, 0 open". It now says the milestone is open with work remaining, states no number, and names what holds the tag: https://git.eeqj.de/sneak/webhooker/issues/256. That sentence is phrased to point at the issue, not at any PR, so it stays true whether the fix is in review, reworking or about to land. Next Step keeps the durable half of what it said — merging `next` into `main` is a separate act from tagging — without describing the current state of either. ## Added to Completed Steps Every unit that landed since the file was last touched at `a83e8fe`, verified against `git log a83e8fe..origin/next` rather than against any brief: - https://git.eeqj.de/sneak/webhooker/issues/268 and https://git.eeqj.de/sneak/webhooker/issues/226 `BIND_ADDRESS` defaulting to loopback plus the reverse-proxy docs, and in the same commit the shutdown race and nil dereference - https://git.eeqj.de/sneak/webhooker/issues/279 inbound signature verification removed - https://git.eeqj.de/sneak/webhooker/issues/253 the build version stamped into the binary - https://git.eeqj.de/sneak/webhooker/issues/269 cookie `Secure` and CSRF strictness from the request transport - https://git.eeqj.de/sneak/webhooker/issues/262 a failed webhook deletion rolls back - https://git.eeqj.de/sneak/webhooker/issues/211 a deleted target keeps its name on historical deliveries - https://git.eeqj.de/sneak/webhooker/issues/254 and https://git.eeqj.de/sneak/webhooker/issues/261 both `/metrics` label dimensions bounded (one entry, since they are one vector) - https://git.eeqj.de/sneak/webhooker/issues/221 `max_retries` validated on both target forms - https://git.eeqj.de/sneak/webhooker/issues/250 resubmit a stored event as a new undelivered event Plus the 2026-08-20 units that existed in the file only as Status prose, or not at all: https://git.eeqj.de/sneak/webhooker/issues/201, https://git.eeqj.de/sneak/webhooker/issues/200, https://git.eeqj.de/sneak/webhooker/issues/205, https://git.eeqj.de/sneak/webhooker/issues/206, https://git.eeqj.de/sneak/webhooker/issues/207, https://git.eeqj.de/sneak/webhooker/issues/234, https://git.eeqj.de/sneak/webhooker/issues/202, https://git.eeqj.de/sneak/webhooker/issues/203, https://git.eeqj.de/sneak/webhooker/issues/209, https://git.eeqj.de/sneak/webhooker/issues/210, https://git.eeqj.de/sneak/webhooker/issues/208, https://git.eeqj.de/sneak/webhooker/issues/204, https://git.eeqj.de/sneak/webhooker/issues/233 and https://git.eeqj.de/sneak/webhooker/issues/127. Trimming Status of the audit narrative would otherwise have deleted the only record of half of them; Completed Steps is where this file keeps landed work. ## Found stale, NOT changed - **Completed Steps entries predating this commit cite issues as bare `(#N)`**, which Gitea does not linkify in a rendered repo file. New entries use full URLs. Rewriting ~60 existing entries is churn out of scope for a content refresh, so the section is mixed for now. - **The Workflow section's `(#112)`** has the same problem and was left alone for the same reason. ## Verification Rebased onto `origin/next` at `62576f6`; the rebase was clean, no conflicts. `GOFLAGS=-count=1 make check` re-run afterwards: **exit 0**. 21 `ok` packages plus 2 with no test files (23 total), 0 `FAIL`, **0 `(cached)`**, 0 data races, 0 SKIP. Lint executed rather than replayed in the pinned container: `[lint 3/3] RUN golangci-lint run` was not `CACHED` and reported `0 issues.` in 47.71s. One deprecation warning surfaced, `gomodguard` to `gomodguard_v2`, already tracked as https://git.eeqj.de/sneak/webhooker/issues/248. `make fmt` is a no-op for markdown here (https://git.eeqj.de/sneak/webhooker/issues/215) and changed nothing. No line exceeds the file's 72-column style. `git diff origin/next --stat` is `TODO.md` alone.

clawbot added 1 commit 2026-08-24 03:34:45 +02:00

Record landed 1.0.0 work and drop the removed signing roadmap in TODO.md ... 84f5780884

Inbound signature verification was removed on next (#279), so the
Future Step proposing a Stripe HMAC scheme "landed with inbound
verification" proposed extending a subsystem that no longer exists, and
the Status section still counted #67 among the deployability gaps it
had closed. Both are gone.

Status now states the milestone honestly: open, 64 closed and 7 open,
with the tag held on #256 and a fix in review. The enumeration of open
follow-ups is dropped -- the tracker is the authoritative TODO and one
of the four listed issues had already closed.

Completed Steps gains the nine units that landed since the file was
last touched (#250, #254, #261, #221, #211, #262, #269, #253, #279) and
the 2026-08-20 units that were only ever summarised in Status prose or
missing entirely (#201, #200, #205, #206, #207, #234, #202, #203, #209,
#210, #208, #204, #233, #127).

#226 is closed on the tracker but is deliberately NOT recorded as
landed: no commit on next addresses it, and cleanShutdown still reads
s.httpServer and s.sentryEnabled unguarded.

clawbot added the needs-review label 2026-08-24 03:34:53 +02:00

clawbot self-assigned this 2026-08-24 03:34:54 +02:00

clawbot force-pushed todo-md-refresh from 84f5780884 to 67903257e8 2026-08-24 03:38:15 +02:00 Compare

clawbot force-pushed todo-md-refresh from 67903257e8 to 5ce8fb57bc 2026-08-24 03:42:24 +02:00 Compare

clawbot merged commit bde32d3ee6 into next 2026-08-24 03:43:17 +02:00

clawbot deleted branch todo-md-refresh 2026-08-24 03:43:17 +02:00

clawbot referenced this pull request 2026-08-24 04:32:55 +02:00

Close the two remaining delivery terminal-state gaps (closes #107) #292

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

merge-ready

needs-checks

needs-rebase

needs-review

needs-rework

No Label needs-review

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

clawbot sneak

No Assignees clawbot

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/webhooker#284