From f0fa7bf37c586546dd019d3a25d8a3e957a40c43 Mon Sep 17 00:00:00 2001 From: Nils Lehnen <30603423+iderex@users.noreply.github.com> Date: Sat, 5 Sep 2026 14:45:56 +0200 Subject: [PATCH] Record the answers to entries 8 and 9 where the work reads them [#7] The Done-when on #7 asks that every entry carry an answer written down where the work that depends on it can read it, and that an entry whose answer belongs in a decision record point at the record carrying it. Entries 8 and 9 were answered on 2026-08-24 and were written only on the tracker. I measured that at 2add524 before writing: nothing under decisions/, docs/, content/ or data/ carried the words imprint or funding. 0017 carries what the site says about who publishes it: full provider identification through a paid imprint-address service rather than a home address, and a rotatable contact alias, with the alternatives and their costs as the entry laid them out. 0018 carries whether the site asks for money: a plain text link to the existing funding providers, with the embedded button left refused by the byte budget. Neither record decides anything. Both state answers already taken, and where a record and the entry differ, the entry is the authority. The reading of 2026-08-26 on #7 left these two unwritten because the pages they belong to wait on work outside this repository. I have written them anyway, because the directory's own rule is that a record exists before the code that assumes it, and the legal notice already reads a file whose every value points at the entry rather than at anything in this tree. Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com> --- ...at-the-site-says-about-who-publishes-it.md | 125 ++++++++++++++++++ ...he-site-asks-for-money-and-in-what-form.md | 114 ++++++++++++++++ 2 files changed, 239 insertions(+) create mode 100644 decisions/0017-what-the-site-says-about-who-publishes-it.md create mode 100644 decisions/0018-whether-the-site-asks-for-money-and-in-what-form.md diff --git a/decisions/0017-what-the-site-says-about-who-publishes-it.md b/decisions/0017-what-the-site-says-about-who-publishes-it.md new file mode 100644 index 0000000..dc6188f --- /dev/null +++ b/decisions/0017-what-the-site-says-about-who-publishes-it.md @@ -0,0 +1,125 @@ +# 0017. What the site says about who publishes it + +Publishing a site under a name of one's own carries a provider identification +duty in some jurisdictions, and the page that would carry the answer exists and +states nothing: it was built to hold no words that identify anybody, because +what goes on it is a personal cost rather than a design question. That is a +page that can stay open indefinitely, and a duty that is not decided is not +thereby absent. Entry 8 of #7 is where the question was held, and it was +answered on 2026-08-24. This record is that answer written where the work that +reads it can find it, rather than on a tracker. + +## What was measured + +The served site named nobody and offered no route to anybody at the time the +question was taken, and the organisation profile carried a donation link, which +is the kind of detail that decides whether a site is read as private or as +commercial: + + curl -sS https://flowfin.dev/ | grep -o -i -E 'impressum|imprint|datenschutz|privacy' + exit=1 + gh api repos/Flowfin/.github/contents/profile/README.md --jq '.content' \ + | base64 -d | grep -c -i 'buymeacoffee' + 1 + +Run 2026-08-08, and carried here from the entry that took the question rather +than re-run, because what it establishes is the state the decision was taken +against. + +The legal notice this repository builds reads its values out of a file, and +every value in that file is still waiting on the entry: + + jq -r 'to_entries[] | "\(.key) \(.value.state) \(.value.waiting)"' data/publisher.json + publisher undecided entry 8 of issue 7 + contact undecided entry 8 of issue 7 + postal undecided entry 8 of issue 7 + go run . build | grep legal + wrote dist/legal/index.html (3562 bytes, 0 of 3 answered) + +Run 2026-09-05 at `2add524`. So the page points a reader at a question that has +an answer, and the answer is written nowhere the page could point at instead. +That is what this record is for. + +## The decision + +Full provider identification, carried by a paid imprint-address service rather +than a home address, and a rotatable contact alias on the legal page. + +The service booking happens outside this repository. Once the address exists, +the legal page and the privacy statement are ordinary build work: the values +arrive in the file the page reads, and the lines saying the question is open +become answers. Professional advice stays sensible and this decision does not +replace it. What it ends is the state of publishing nothing. + +## Why + +The duty, read at its strictest, asks for an address at which documents can be +served, and the only two answers that meet it put an address on a page built to +be indexed. One of them is a home. A private address published once is +collected within days and kept by scrapers after any later change, so that +answer is paid for permanently, by a person, and cannot be withdrawn. The +service costs money every year and puts a third party in the chain, and in +return the address is real for service of documents without being anybody's +home. That is the trade, and it is the only one of the four options that meets +the strictest reading at a price that can be stopped paying. + +The alias is the same reasoning applied to the contact route. A route printed on +a public page is collected within days, so one that can be rotated without +changing anything else is worth more here than a memorable one, and the page +renders it from data so that rotating it is a change to one value rather than an +edit to prose. + +Whether the site reads as private or as commercial is what decides which duty +applies, and this answer does not wait on that reading. Full identification +satisfies the stricter of the two, so how the site reads, which the donation +link and entry 9 bear on, stops being a question the legal page has to settle +first. + +## What the alternatives cost + +A full provider identification with a home address. Cost: a private address +becomes permanently public on a page built to be indexed, and scrapers keep a +copy after any later change. It is what the strictest reading of the duty asks +for, and it costs the most in the one currency that cannot be recovered. + +A name and a contact route with no postal address. Cost: a reader can reach +somebody, and a jurisdiction that asks for a summonable address is not +satisfied. It is what most personal projects do, and it leaves the obligation +half met. + +A name and nothing else. Cost: cheapest, and it leaves both a reader and any +obligation with nothing. + +Publishing nothing, which is the state the page was in. Cost: the page says who +publishes this site by saying nothing, for as long as nobody decides, and the +duty is not smaller for being undecided. + +## When this is worth revisiting + +When the service stops being available or stops being worth its price. The +answer rests on the address being real for service of documents without being a +home, so a replacement that carries the address is a new record naming what +carries it instead. + +When professional advice says the identification should carry more or less than +this. The decision ends the state of publishing nothing and is not a legal +opinion, so advice that arrives later changes it without contradicting it. + +A compromised alias is not a revisit. Rotating it is the data change the answer +was built for, and this record does not name the alias. + +## What this record does not decide + +The values. The name, the address and the alias are what the legal page will +show, they exist once the booking is done, and this record names none of them. +Until they arrive the page states that the question is open, and what it should +state in the meantime about an answer that is decided and a value that is not +yet available is a page question rather than this record's. + +Whether the site asks for money, and in what form. That is entry 9 of #7, it +was answered on the same day, and 0018 carries it. The two touch where the +donation link bears on how the site reads, and this record already says why +that reading does not have to be settled first. + +Which jurisdiction's duty applies. Nothing in this repository decides that, and +nothing here is legal advice. diff --git a/decisions/0018-whether-the-site-asks-for-money-and-in-what-form.md b/decisions/0018-whether-the-site-asks-for-money-and-in-what-form.md new file mode 100644 index 0000000..37835cb --- /dev/null +++ b/decisions/0018-whether-the-site-asks-for-money-and-in-what-form.md @@ -0,0 +1,114 @@ +# 0018. Whether the site asks for money, and in what form + +A sponsor button already applies to every repository in the organisation, from +a single file, and a button on a repository page is not a page of this site. +Whether the site itself carries the same ask is a separate question, and it +would otherwise have been answered silently in two places: the byte budget +refuses a request to a domain the project does not own, and the question of who +publishes the site treats the existing donation link as one of the details that +decides whether the site reads as private or as commercial. Entry 9 of #7 is +where the question was held, and it was answered on 2026-08-24. This record is +that answer written where the work that reads it can find it, rather than on a +tracker. + +## What was measured + +The organisation-wide file names two providers, and it applies to every +repository in the organisation that does not carry a file of its own: + + gh api repos/Flowfin/.github/contents/.github/FUNDING.yml --jq '.content' \ + | base64 -d | grep -v '^#' | grep . | cut -d: -f1 + github + buy_me_a_coffee + +Run 2026-09-05. The keys are pasted and the values are cut, because this record +is about the form of the ask and not about whose account it reaches. The entry +read the same file at a different path on 2026-08-08 and found one provider; +the file has moved and gained one since, which is one reason the link itself is +not this record's to spell out. + +Nothing the build produces carries the ask today: + + go run . build >/dev/null && grep -ril 'sponsor\|coffee\|donat\|funding' dist | wc -l + 0 + +Run 2026-09-05 at `2add524`. + +The budget row that the embedded form would meet draws its line between a fetch +and a link, in its own words: + + git grep -h -o 'Refuses: "a produced file fetching[^"]*"' -- internal/invariant/invariant.go + Refuses: "a produced file fetching a stylesheet, a font, an image, a script or anything else from a host that is not on the allowlist, while leaving a link a reader clicks alone" + +Run 2026-09-05 at `2add524`. + +## The decision + +A plain text link to the existing funding providers. The embedded button stays +refused by the byte budget. + +## Why + +It is honest. The ask exists already, on every repository page in the +organisation, and a site that hid it while its source carried it would be saying +two different things to two audiences. + +It is tiny in the byte budget. A link is text, and a link is not a fetch, so no +reader's address reaches a provider before they have chosen to go there. That is +the line the budget draws and the row above enforces, and a plain link sits on +the right side of it without asking the budget to move. + +The commercial reading a funding link invites is already carried. The question +of who publishes the site was answered on the same day with full provider +identification, so a reader or a jurisdiction that takes the site as commercial +finds the identification that reading asks for, and the link adds no obligation +the legal page does not already meet. + +## What the alternatives cost + +Nothing on the site, with the button staying where it is. Cost: the ask reaches +somebody browsing the source and nobody reading the pages, which is most +readers. + +The provider's own button or badge embedded in a page. Cost: refused by the +budget rather than merely expensive, because the image and the script come from +a domain the project does not own and every reader's address reaches that domain +before they have done anything. Taking this answer means changing the budget +record and saying so there. + +A page of its own explaining what money would be for. Cost: the most honest and +the most work, and a page that has to stay true as the answer to who publishes +the site changes. + +## When this is worth revisiting + +When there is something specific the money would be for. A page of its own is +the alternative that becomes right on that day, and it arrives as a second +record rather than a reversal, because a plain link and a page are not +exclusive. + +When the providers change shape rather than membership. A provider that cannot +be reached by a plain link is not covered by the form decided here. A change in +which providers are listed is not a revisit: the file that names them has moved +once and gained one already, and how the link follows it is a build question +named below. + +When the budget record changes what it refuses. The embedded form is refused by +the budget rather than by this record, so a change there re-opens that +alternative here. + +## What this record does not decide + +Which page carries the link. The entry named the legal notice and the landing +page as the two candidates, and this record chooses neither. That is a build +question, and the legal notice in particular is waiting on values this +repository does not hold yet, which 0017 says. + +How the link is kept current against the organisation file that names the +providers, and whether it names one provider or every one. A copy of a file in +another repository is what this site already compares on a schedule for the +roster and the tokens, and whether the funding providers join that set is a +question for whoever lands the link. + +What the site says about who publishes it. That is entry 8 of #7, it was +answered on the same day, and 0017 carries it.