Skip to content

Add peer review of the VANGO report - #1

Open
carolina-moron wants to merge 4 commits into
mainfrom
add-peer-review
Open

Add peer review of the VANGO report#1
carolina-moron wants to merge 4 commits into
mainfrom
add-peer-review

Conversation

@carolina-moron

@carolina-moron carolina-moron commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

Adds an academic peer review of the VANGO report under peer-review/ (Word .docx + Markdown source).

The review is generous-but-rigorous: it steelmans the contribution, then flags located, actionable major/minor issues and names what the report gets right.

🤖 Generated with Claude Code

carolina-moron and others added 4 commits July 22, 2026 16:12
@carolina-moron @claude
Add academic peer review of the VANGO report
da086dc 
Adds a structured, located peer review (Word .docx plus Markdown source)
under peer-review/. Reviews the report's argument, evidence, and claims.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@carolina-moron @claude
Add Peer Review section to README
16f8c95 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@carolina-moron @claude
Add root PEER-REVIEW.md and link it from README
0036e0c 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@carolina-moron @claude
Withdraw the "it works" conclusion and own the Bura entry
494ea37 
Two overclaims from the peer review.

13.1 previously answered "a qualified yes" to whether the national-park
passport idea works for individual works of art. It cannot: VANGO has never
been in a real exhibition or met a single museum visitor, as 1.7, 7.1 and
10.5 all state, and the premise that an attendance record is "a form of
value in itself" (12.3) is asserted rather than evidenced. The conclusion now
claims only feasibility -- one-sentence mechanism, a sheet of paper per
venue, guest mode with no personal data -- and names user testing in a real
venue as the next piece of work rather than a detail.

The Bura Ceramics catalogue entry is retained, because removing it would
imply provenance does not arise for an attendance record and would leave 9.4
with nothing concrete to bite on. Instead it is made deliberate:

- The venue "AABC", an unexplained initialism that read as a real
  institution while tying a Red List class of object to an unidentifiable
  holder, becomes "Unspecified holder (illustrative)" in the catalogue, the
  printable stamp page, the standalone export, and both catalogue tables.
  9.1 now states that the entry is illustrative and refers to no real
  object, holder, or exhibition.
- "This is not a criticism of the design" is dropped from 9.5. The
  criticism lands: a document styled as a passport implies an officialdom
  the record does not support, and issuing one beside an object of contested
  origin lends it a settled institutional context it may not have.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@carolina-moron

carolina-moron commented Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Round-2 peer review — 23 July 2026

Re-reviewed against origin/main as of today. Do not merge as-is — main has changed what this application is.

Blocking: main removed all authentication after hardening it

Three commits hardened auth:

  • 438be53 — sign stamp tokens, allowlist stamp codes server-side
  • 1aa3f49 — guard JWT secret, rate-limit auth, validate profile updates
  • 6393ec6 — make API base configurable, require HTTPS in production

Then 41557bf ("Remove all auth — app opens directly, stamps saved to localStorage") stripped 247 lines from src/App.jsx.

The result on main:

  • server/ is still present — jwt.js, middleware/auth.js, middleware/rateLimit.js, db.js — but the frontend no longer calls it
  • the README still describes server-backed features
  • this PR's review describes an application with accounts and server-side stamp validation

Removing auth is a defensible product decision for a demo passport. But the repo currently ships an unused authentication server, a README that describes it, and a review of a system that no longer exists.

Action — pick one before merging:

  1. Delete server/, rewrite the README around a local-only app, and revise the review to match; or
  2. Restore the auth path, in which case the three hardening commits above stand and the review is accurate again.

Status

8 commits behind main, 4 ahead, MERGEABLE / CLEAN. Rebase after the decision above.

Portfolio note

VANGO, arts-provenance-agent, and digital-passport-artworks are now three separate artwork-passport prototypes. The 22 July round flagged that the portfolio needs one page saying which question each answers and which is the line of development; that page still does not exist, and this auth change has since altered what one of the three is.

Part of the org-wide round-2 review of all 27 Ethical-Tech-CoLab repos.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@carolina-moron