docs: correct post-cutover claims outside the workflows — a feature map advertising a deleted pipeline - #22
Merged
Merged
Conversation
…ap advertising a deleted pipeline, a skip reason for a dead topology The docs half of the slug-rot sweep (#21 did the workflows). Of the 55 remaining detector hits, most were FALSE POSITIVES and are deliberately untouched: * INSTALL-GUIDE / VERSION-CONTROL "private repo" = the ADOPTER's own repo, correct advice; * "mirror image" in PLAN-PHASE4-GROUP-COMMIT and test_ledger_check = the English idiom; * SECURITY.md's "GHAS on a private repo" = a true statement about GitHub's pricing; * test comments narrating what "failed on the mirror" = accurate history of a past failure. A detector that flags an idiom and a genuine defect identically is why this was triaged by hand rather than swept with sed. Fixed here are the ones that assert something FALSE about the project today: FEATURE-MAP.md advertised "Public OSS mirror + curated publish pipeline (forbidden-string/gitleaks gate) | ✅ | Owner runs the push (exfil guard)". The mirror and the publish pipeline were deleted at the cutover; what actually ships is the leak gate, on every commit and in CI. A feature map is what an adopter or auditor reads to learn what exists, so a ✅ against a removed capability is the most expensive kind of stale doc. Rewritten to describe the gate that exists, including that it fails closed without a token source. test_backlog_status_check.py skipped with reason "docs/BACKLOG.md is private-only (OSS-mirror deny-list); absent on the mirror snapshot". True while the backlog was git-ignored; false since it was committed. The skip cannot fire in a source checkout now, but had it fired, that reason would have told the reader it was EXPECTED rather than a missing file -- the same "green for the wrong reason" shape as the guard the test protects. Reason and docstring now say the skip should never fire here. CI-SELFHOSTED-RUNNER.md explained the retirement as "the OSS mirror is a public repo ... hosted minutes are free THERE", and described the per-repo matrix as "ubuntu-only on the private source repo". Both inverted: this repo is the public one, and that matrix branch now serves FORKS. .github/SECURITY.md offered the advisory channel "on both this repository and the public mirror" -- there is one repository, so the sentence pointed a reporter at somewhere to choose between. pyproject.toml's sdist allowlist rationale credited "the mirror's leak gate (publish.ps1 + scan_forbidden.py)" for governing the git side. publish.ps1 is gone; the leak gate governs what is COMMITTED, never what an sdist packages. That separation is the reason the allowlist exists at all, so the comment was undermining its own guard -- restated, with why the allowlist still matters now that those docs are git-ignored rather than deny-listed. Verified: pyproject still parses with its version source intact, the feature-map / backlog / release-pipeline / docs-pathway suites pass (49), and the backlog skip does NOT fire (15 passed, 0 skipped) -- i.e. the corrected reason describes a branch that genuinely never runs here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The docs half of the slug-rot sweep (#21 covered the workflows).
Most of the remaining 55 hits were false positives
Deliberately untouched:
INSTALL-GUIDE/VERSION-CONTROL— "private repo" means the adopter's own repo. Correct advice.PLAN-PHASE4-GROUP-COMMIT,test_ledger_check— "mirror image" is the English idiom.SECURITY.md— "GHAS on a private repo" is a true statement about GitHub's pricing.A detector that flags an idiom and a genuine defect identically is exactly why this was triaged by hand rather than swept with
sed.Fixed: things that assert something false about the project today
FEATURE-MAP.mdadvertised a deleted capability. The row read "Public OSS mirror + curated publish pipeline (forbidden-string/gitleaks gate) | ✅ | Owner runs the push (exfil guard)". The mirror and the publish pipeline were deleted at the cutover. A feature map is what an adopter or auditor reads to learn what exists, so a ✅ against a removed capability is the most expensive kind of stale doc. Rewritten to describe the gate that does ship — including that it fails closed without a token source.test_backlog_status_check.py's skip reason described a dead topology — "private-only (OSS-mirror deny-list); absent on the mirror snapshot". True while the backlog was git-ignored, false since it was committed. It cannot fire in a source tree now, but had it fired, that reason would have told the reader the skip was expected rather than a missing file — the same "green for the wrong reason" shape as the guard the test protects.CI-SELFHOSTED-RUNNER.mdhad it inverted — explained the retirement as "the OSS mirror is a public repo… hosted minutes are free THERE" and called the matrix branch "ubuntu-only on the private source repo". This repo is the public one, and that branch now serves forks..github/SECURITY.mdoffered the advisory channel "on both this repository and the public mirror" — pointing a vulnerability reporter at a choice that no longer exists.pyproject.toml's sdist allowlist rationale credited "the mirror's leak gate (publish.ps1 + scan_forbidden.py)" for governing the git side.publish.ps1is gone, and the leak gate governs what is committed, never what an sdist packages. That separation is the reason the allowlist exists — so the comment was undermining its own guard.Verification
pyprojectstill parses with its version source intact; feature-map / backlog / release-pipeline / docs-pathway suites pass (49); and the backlog skip does not fire — 15 passed, 0 skipped — confirming the corrected reason describes a branch that genuinely never runs here.🤖 Generated with Claude Code