Skip to content

docs: audit before the 1.0.0 tag - #19

Merged
mar0ls merged 1 commit into
mainfrom
dev
Sep 6, 2026
Merged

mar0ls merged 1 commit into
mainfrom
dev

Conversation

@mar0ls

@mar0ls mar0ls commented Sep 6, 2026

Copy link
Copy Markdown
Owner

One commit. A mechanical pass over all six tracked .md files and the comments
in backend/app, run before tagging because the CHANGELOG that ships with 1.0.0
is not something a patch release can quietly fix.

What was checked

Markdown links; file paths in backticks; environment variables against their use
in code; make targets; API paths against tests/api_contract.json; the twenty
feature claims in README; third-party versions against the vendored files and the
Dockerfile ARG; the behaviour README attributes to backup.sh and
restore.sh; and the file modes, cookie flags, CSP directives and headers listed
in SECURITY.md's enforcement table.

What was wrong

Three things, all introduced during this release:

  • CHANGELOG quoted a coverage floor of 81 and a total of 81.99%. The floor is 82
    and the total 82.35% — the CSRF tests landed after those lines were written.
  • CHANGELOG reported the release balance as 77.83% → 81.99%, true halfway
    through. It is 77.83% → 82.35%, 736 → 844 cases.
  • README's restore example named a 0.1.0 backup archive.

Everything else held: lockout thresholds, session TTL, scrypt parameters,
operation count, the cache list, library versions and the security table all
match the code.

The remaining changes are register, not fact. Several paragraphs added during
this release ended on an aphorism, README carried the only bold rhetorical
question in the repository, and the 1.0.0 heading was an abstract statement where
0.9.0 and 0.8.0 open with what changed.

Verification

844 tests, coverage 82.35% against a floor of 82, mypy clean. No code paths
changed; the only file under backend/app is a docstring edit in main.py.

Went through all six tracked .md files and the comments in backend/app, checking
every claim that can be checked mechanically: markdown links, file paths in
backticks, environment variables against their use in code, make targets, API
paths against the contract snapshot, the twenty feature claims in README,
third-party versions against the vendored files and the Dockerfile ARG, the
behaviour README attributes to backup.sh and restore.sh, and the file modes,
cookie flags, CSP directives and headers SECURITY.md lists.

Three things were wrong, all introduced during this release:

- CHANGELOG quoted a coverage floor of 81 and a total of 81.99%. The floor is 82
  and the total 82.35%; the CSRF tests landed after those lines were written.
- CHANGELOG reported the release balance as 77.83% -> 81.99%, true halfway
  through. It is 77.83% -> 82.35%, 736 -> 844 cases.
- README's restore example named a 0.1.0 backup archive.

Everything else held: the lockout numbers, the session TTL, the scrypt
parameters, the operation count, the cache list, the library versions and the
security table all match the code.

The remaining edits are register. Several paragraphs added during this release
ended on an aphorism, README had the only bold rhetorical question in the
repository, and the 1.0.0 heading was an abstract statement where 0.9.0 and
0.8.0 open with what changed. The explanations stay; the punchlines go.
@codecov

codecov Bot commented Sep 6, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@mar0ls
mar0ls merged commit 830a714 into main Sep 6, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant