From a21c290b29d9b813f91b14301f99eb529949ba8f Mon Sep 17 00:00:00 2001 From: wshallwshall Date: Tue, 28 Jul 2026 13:42:53 -0500 Subject: [PATCH] =?UTF-8?q?docs:=20correct=20post-cutover=20claims=20outsi?= =?UTF-8?q?de=20the=20workflows=20=E2=80=94=20a=20feature=20map=20advertis?= =?UTF-8?q?ing=20a=20deleted=20pipeline,=20a=20skip=20reason=20for=20a=20d?= =?UTF-8?q?ead=20topology?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The docs half of the slug-rot sweep (#21 did the workflows). Of the 55 remaining detector hits, most were FALSE POSITIVES and are deliberately untouched: * INSTALL-GUIDE / VERSION-CONTROL "private repo" = the ADOPTER's own repo, correct advice; * "mirror image" in PLAN-PHASE4-GROUP-COMMIT and test_ledger_check = the English idiom; * SECURITY.md's "GHAS on a private repo" = a true statement about GitHub's pricing; * test comments narrating what "failed on the mirror" = accurate history of a past failure. A detector that flags an idiom and a genuine defect identically is why this was triaged by hand rather than swept with sed. Fixed here are the ones that assert something FALSE about the project today: FEATURE-MAP.md advertised "Public OSS mirror + curated publish pipeline (forbidden-string/gitleaks gate) | ✅ | Owner runs the push (exfil guard)". The mirror and the publish pipeline were deleted at the cutover; what actually ships is the leak gate, on every commit and in CI. A feature map is what an adopter or auditor reads to learn what exists, so a ✅ against a removed capability is the most expensive kind of stale doc. Rewritten to describe the gate that exists, including that it fails closed without a token source. test_backlog_status_check.py skipped with reason "docs/BACKLOG.md is private-only (OSS-mirror deny-list); absent on the mirror snapshot". True while the backlog was git-ignored; false since it was committed. The skip cannot fire in a source checkout now, but had it fired, that reason would have told the reader it was EXPECTED rather than a missing file -- the same "green for the wrong reason" shape as the guard the test protects. Reason and docstring now say the skip should never fire here. CI-SELFHOSTED-RUNNER.md explained the retirement as "the OSS mirror is a public repo ... hosted minutes are free THERE", and described the per-repo matrix as "ubuntu-only on the private source repo". Both inverted: this repo is the public one, and that matrix branch now serves FORKS. .github/SECURITY.md offered the advisory channel "on both this repository and the public mirror" -- there is one repository, so the sentence pointed a reporter at somewhere to choose between. pyproject.toml's sdist allowlist rationale credited "the mirror's leak gate (publish.ps1 + scan_forbidden.py)" for governing the git side. publish.ps1 is gone; the leak gate governs what is COMMITTED, never what an sdist packages. That separation is the reason the allowlist exists at all, so the comment was undermining its own guard -- restated, with why the allowlist still matters now that those docs are git-ignored rather than deny-listed. Verified: pyproject still parses with its version source intact, the feature-map / backlog / release-pipeline / docs-pathway suites pass (49), and the backlog skip does NOT fire (15 passed, 0 skipped) -- i.e. the corrected reason describes a branch that genuinely never runs here. --- .github/SECURITY.md | 2 +- docs/CI-SELFHOSTED-RUNNER.md | 8 ++++---- docs/FEATURE-MAP.md | 2 +- pyproject.toml | 6 ++++-- tests/test_backlog_status_check.py | 9 ++++++--- 5 files changed, 16 insertions(+), 11 deletions(-) diff --git a/.github/SECURITY.md b/.github/SECURITY.md index 96faa172..02bb9da5 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -14,7 +14,7 @@ verify a report against current `main` before filing. - **Preferred (always available, fully private):** open a [GitHub private security advisory](https://github.com/MEFORORG/MessageFoundry/security/advisories/new) ("Report a vulnerability") — GitHub keeps it private to the maintainers until coordinated disclosure. - This is the recommended channel on both this repository and the public mirror. + This is the recommended channel. - Alternatively, email the maintainer at the address on the GitHub profile. If you cannot reach a maintainer privately within a few business days, you may request a contact via a diff --git a/docs/CI-SELFHOSTED-RUNNER.md b/docs/CI-SELFHOSTED-RUNNER.md index abb3203c..a900330e 100644 --- a/docs/CI-SELFHOSTED-RUNNER.md +++ b/docs/CI-SELFHOSTED-RUNNER.md @@ -5,15 +5,15 @@ > **The self-hosted runners described here have been de-registered and their services removed.** The repo > has **zero** self-hosted runners, and no workflow targets a self-hosted label for the `test` legs. > -> **Why:** the OSS mirror is a **public** repo, where GitHub-hosted minutes are **free** — so the Windows -> test matrix now runs on **hosted** runners there at no cost, and self-hosting bought nothing. It also +> **Why:** this repo is **public**, where GitHub-hosted minutes are **free** — so the Windows test +> matrix runs on **hosted** runners at no cost, and self-hosting bought nothing. It also > removed three liabilities: (1) a **SPOF** — self-hosted *required* checks had no hosted fallback, so an > offline box left PRs queued ~24h and then failing, freezing auto-merge repo-wide; (2) a **security** > concern — a self-hosted runner must never be reachable from a public repo (a fork PR would mean code > execution on the maintainer's LAN); (3) ongoing **maintenance** (tool caches, PATH, service accounts). > -> The Windows `test` legs are now selected by a **per-repo matrix** in `ci.yml`: ubuntu-only on the private -> source repo, full ubuntu + Windows on the public mirror. +> The Windows `test` legs are selected by a **per-repo matrix** in `ci.yml`: full ubuntu + Windows here, +> ubuntu-only on a fork (so a contributor's own minutes are not spent on the 2x-billed Windows legs). > > Follow this guide **only** if you are deliberately re-introducing a self-hosted runner. Note > `selfhosted-win2025-sql.yml` remains dispatch-only and is currently **runner-less**. diff --git a/docs/FEATURE-MAP.md b/docs/FEATURE-MAP.md index 0ac0d483..01671e6a 100644 --- a/docs/FEATURE-MAP.md +++ b/docs/FEATURE-MAP.md @@ -204,7 +204,7 @@ IDE are separate surfaces over the localhost API. | Feature | Status | Notes | |---------|:--:|-------| | AGPL-3.0 license + dual-licensing plan | ✅ | | -| Public OSS mirror + curated publish pipeline (forbidden-string/gitleaks gate) | ✅ | Owner runs the push (exfil guard) | +| Customer/PHI leak gate — forbidden-string + gitleaks, on every commit and in CI | ✅ | Fails closed with no token source | | CI: quartet (ruff/format/mypy/pytest) + security scans | ✅ | PG/SQL Server store jobs are service-container-gated | | Version single-sourcing (drop the duplicate literal) | 🔨 | Workstream F | | CHANGELOG.md + README roadmap refresh | 🔨 | Workstream F | diff --git a/pyproject.toml b/pyproject.toml index b217fc40..4046bf26 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -11,8 +11,10 @@ path = "messagefoundry/__init__.py" # `python -m build` packs every git-tracked file (docs/, tests/, scripts/, CLAUDE.md, .claude/ …) into the # sdist, and release.yml uploads that sdist to PUBLIC PyPI — which shipped the private security-posture # docs (docs/security/*, docs/reviews/*, Secure_Development_Standards.md — the publish-denylist set) on -# every release 0.1.0..0.2.15. The mirror's leak gate (publish.ps1 + scan_forbidden.py) governs only the -# git mirror, NOT the PyPI path, so the sdist is pinned here to the package + its metadata. (The wheel was +# every release 0.1.0..0.2.15. The leak gate (scan_forbidden.py, in pre-commit and CI) governs what is +# COMMITTED, NOT what an sdist packages, so the sdist is pinned here to the package + its metadata. That +# separation is the whole point: those docs are git-ignored now, but an allowlist is what keeps a future +# tracked-but-private file out of a release tarball. (The wheel was # already package-only.) pyproject.toml + PKG-INFO are always added by hatchling; LICENSE/NOTICE also ship # via [project].license-files. release.yml has a belt-and-suspenders "sdist is package-only" gate. [tool.hatch.build.targets.sdist] diff --git a/tests/test_backlog_status_check.py b/tests/test_backlog_status_check.py index e436e9f8..9cddd1bf 100644 --- a/tests/test_backlog_status_check.py +++ b/tests/test_backlog_status_check.py @@ -139,13 +139,16 @@ def test_changelog_crossref_is_quiet_for_closed_items() -> None: @pytest.mark.skipif( not _BACKLOG.exists(), - reason="docs/BACKLOG.md is private-only (OSS-mirror deny-list); absent on the mirror snapshot", + reason="docs/BACKLOG.md absent — only expected in an installed wheel with no docs/ tree", ) def test_the_real_backlog_satisfies_the_invariant() -> None: """The operative guard: `docs/BACKLOG.md` itself must pass on every PR. - On the public mirror the file is deny-listed (never published), so this test skips there — - the guard is enforced by the private repo's CI, where the file always exists. + THE SKIP ABOVE SHOULD NEVER FIRE IN A SOURCE CHECKOUT. It used to read "private-only (OSS-mirror + deny-list); absent on the mirror snapshot" — true while the backlog was git-ignored and this repo + was a published mirror, and quietly false afterwards: the file was un-ignored and committed, but + the reason still described a topology that had ended, so a reader who saw a skip would have + concluded it was expected rather than a missing file. Same shape as the guard it protects. """ errors, _ = bsc.scan(_BACKLOG.read_text(encoding="utf-8")) assert errors == [], "docs/BACKLOG.md violates the status invariant:\n" + "\n".join(errors)