Skip to content

Correct stale comments and the Hosted Relay audit migration list - #1185

Merged
nedtwigg merged 4 commits into
mainfrom
fix/stale-comments-oct19
Oct 20, 2026
Merged

nedtwigg merged 4 commits into
mainfrom
fix/stale-comments-oct19

Conversation

@dormouse-bot

@dormouse-bot dormouse-bot commented Oct 19, 2026 •

Copy link
Copy Markdown
Collaborator

Comment and doc corrections from tonight's sweep, with no behavior change. The one that matters most is in docs/specs/security-hosted.md: the "Hosted Relay" paragraph lists the migrations the nightly audit inspects for its checks, and the list stopped at 004_relay_enrollment_redeemed.sql. Two migrations now join it: 006_relay_setup_token_claim.sql adds the claimed column on dormouse_relay_setup_tokens that S99 depends on, and 007_independent_voice.sql (from #999) adds the approvals' purpose column and redefines the _redeemed constraint that the purpose-binding check relies on.

The rest are comments that point readers at the wrong place:

  • standalone/src/quit.ts: the quit-gate comment cited a "Confirmation dialog" heading that docs/specs/standalone.md doesn't have. The rule sits under "Quit protocol".
  • remote-lib-common/test/harness/fake-client.mjs: the comment said PocketClient "does not send these frames yet", but pocket-client.ts sends t: 'e2e' frames.
  • relay/test/helpers.mjs and hosted/server/tests/pocket.test.ts: in each, a function's doc comment was stacked above an unrelated const's comment, so tooling attached it to the const. Each doc comment now sits above its function.
  • scripts/pairing-walkthrough/proc.mjs: started is filled with push, so it is in start order, not "newest first". spawnedHandles is what reverses it.
  • lib/.storybook/preview-head.html: preview.css, which preview.ts imports, is what imports lib/src/index.css, not preview.ts directly.
  • dor-tools-builtin/viewer/markdown.tsx: two separate imports from ./document-session are merged into one, and a doubled blank line is removed from dor-tools-builtin.rationale.md.

node scripts/spec-lint.mjs passes. pnpm isn't available in this sandbox, so CI runs the rest.

- security-hosted.md: the Hosted Relay inspection list now names
  007_independent_voice.sql, which adds the approvals' purpose column
- quit.ts: cite the standalone spec's real "Quit protocol" heading
- fake-client.mjs: PocketClient does send e2e frames now
- relay/test/helpers.mjs, pocket.test.ts: move each doc comment back
  above the function it describes
- pairing-walkthrough/proc.mjs: started is in start order, not newest first
- preview-head.html: preview.css, not preview.ts, imports index.css
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 19, 2026 •

Copy link
Copy Markdown

Deploying mouseterm with  Cloudflare Pages  Cloudflare Pages

Latest commit: fc8972f
Status:⚡️  Build in progress...

View logs

@dormouse-bot dormouse-bot left a comment

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The migration list is still missing 006_relay_setup_token_claim.sql. It adds the claimed column on dormouse_relay_setup_tokens that S99 depends on ("a retire misses a setup token a finish claimed"), so an auditor working from this list never sees the schema behind that check. I'll push the fix below.

Comment thread docs/specs/security-hosted.md Outdated
@nedtwigg
nedtwigg merged commit 37f5b98 into main Oct 20, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants