Repository navigation
Cleanup: package docs, review notes to docs/, no shims, develop on Linux - #16
Merged
Merged
Conversation
The package existed only to keep modernc.org/sqlite in go.mod until the store imported it. The store, the cache and the host collector all import the driver now, and go mod tidy stays a no-op without the pin.
assets/branding/ holds the logo designs. They have never been committed and stay local, like plan/ and research/.
Four review files disclose that the critic came from the same model family as the code it reviewed. The disclosure stays; the vendor name goes.
go doc concatenates every comment attached to a package clause in file
order, so several packages were introduced by whichever file sorted first:
the authorization kernel by one of its phases, the attack-surface inventory
by its authentication helper, the comparator by Alpine's version ordering.
Each package's own summary paragraph moves, verbatim, into doc.go; every
other file comment stays where it was, separated from the package line by a
blank line, and references to "the package comment" now point at the file
that holds the text. test/hygiene's TestEveryPackageSummaryIsItsOwn requires a
doc.go per package whose summary starts "Package <name>" ("Command <dir>"
for a main package) and refuses a comment attached to any other file's
package clause; TestThePackageDocGuardFails is its negative control, and the
guard was seen failing on a reattached comment before it was trusted.
…er to docs/controls.md A package folder should read as the package. The nine adversarial review reports move out of internal/** into docs/reviews/, named after what they review, and the controls ledger moves from internal/SKIPPED-CONTROLS.md to docs/controls.md. Every citation in code, tests, CI and the fingerprint specification now uses the new path; the containment test that resolves ledger entry IDs reads docs/controls.md and still resolves all 15 pointers. CONTRACT.md and FINGERPRINT-SPEC.md stay beside their code: they are specifications, not history.
…n machine measures Development moved from a Windows 11 machine to Debian 13 in September 2026. Comments, tests and the controls ledger that described Windows as the development host now state what was measured on Debian on 2026-10-03: go1.26.5 linux/amd64 as uid 1000, dpkg-query listing 3,467 packages, gcc present so -race runs locally, an unprivileged user and network namespace available, and nft, docker, podman, runsc, nuclei, ZAP, Java, Trivy and opengrep absent. The ledger's skip column was re-measured: TestCollectAgainstTheRealHost no longer skips, leaving 4 tests and 14 SKIP lines, all classified legitimate. Dated Windows measurements stay as history, and the Windows CI job stays, because it is the only lane that takes containment's refusal branch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 4's cleanup: one commit per plan node, plus two housekeeping commits.
What changes
internal/buildpinis deleted. It existed only to keepmodernc.org/sqliteingo.moduntil something imported it; the store, the cache and the host collector all do now, andgo mod tidystays a no-op.go docconcatenates every comment attached to a package clause in file order, so the authorization kernel was introduced by one of its phases, the inventory by its authentication helper and the comparator by Alpine's version ordering. Each package's own summary moves verbatim into adoc.go; other file comments stay, separated from thepackageline.test/hygiene'sTestEveryPackageSummaryIsItsOwnkeeps it that way, with a negative control, and was seen failing on a reattached comment before it was trusted.internal/**todocs/reviews/, and the controls ledger frominternal/SKIPPED-CONTROLS.mdtodocs/controls.md. Every citation in code, tests, CI and the fingerprint specification uses the new path; the containment test that resolves ledger entry IDs still resolves all 15.CONTRACT.mdandFINGERPRINT-SPEC.mdstay beside their code.-raceruns locally; nft, Docker, runsc, Nuclei, ZAP, Java, Trivy and opengrep absent). The ledger's skip column was re-measured: the real-host collector test no longer skips. The Windows CI job stays: it is the only lane that takes containment's refusal branch.assets/branding/is ignored; the logo designs were never committed and stay local.Testing
gofmt -l,go vet ./...,go test -count=1 ./...andgo test -race -count=1 ./...are green on Debian 13 with Go 1.26.5.