Repository navigation
Add observer declaration scope audit - #378
Conversation
Report — CS-Minimax PR#378 overtagelse — head 66bce8bReview feedback addressed (commit
Performance (benchmark rerun on Linux)
The allocation profile (≈67.85 MB/op, ≈2.04M allocs/op) matches the PR body's claimed 67.9 MB/op almost exactly — expected, since Go's allocator count is architecture-independent for the same code path. The ≈5.4–5.6× slower wall-clock vs. the Apple M5's 138.6 ms/op tracks a 2-vCPU shared cloud VM vs. a dedicated modern laptop core and is not a regression signal; no algorithmic change was made. [A][T] Tests
MutantsNo fix-worthy findings survived investigation (items 2–6, 8 above were already compliant on the branch as pulled), so there is nothing to mutate — one mutant is produced per finding that required a code change, and none did. Where I disagreed that a listed risk area required a change, the reasoning and evidence are in items 2, 3, 4, 5, 6 above rather than silently skipped. CI (per job, on
|
Review — CS-MacBook PR#378 — head 66bce8bDom: APPROVE med nits Read-only review. Head was Premise checkPR #378 is the original Scope Audit feature PR (2 commits: the feature and a merge of Findings
Answers to the author's 9 items
Hard checks
TestsOn the merged tree (
Mutants (my own; scratch copies,
|
| Mutant | Result |
|---|---|
M1 drop per-transmission dedup (Forwarded++ always) |
killed |
M2 wildcard contradiction ignores declared * |
killed |
M3 flood-route filter >2 instead of 0/1 |
killed |
| M4 stale threshold 7d → 30d | killed |
| M6 cache TTL always valid | killed |
| M7 hidden-identity filter replaced | killed |
| M10 observation window upper bound removed | killed |
| M11 transport-code cross-check disabled | killed |
| M5 drop singleflight re-check | survives |
| M8 per-row ambiguous-hop expansion zeroed | survives |
| M9 listener-only exclusion removed | survives |
| F1 stale-response guard removed | killed |
| F3 page size 50 → 5000 | killed |
| F4 stale ignored in assessment | killed |
| F5 row signature diff disabled | killed |
| F8 inactive-input guard removed | killed |
F9 saq not parsed from hash |
killed |
| F10 hours formatting wrong | survives |
F7 destroy() skips clearTimeout |
equivalent (callback checks active) |
(Two first attempts at M7/M8 failed to build and were redone as compiling mutants.)
Not verified
- The author's
-racefull-package run and the Linux benchmark (138.6 ms/op on the author's machine; a slower figure on another host). I did not run the benchmark. - Staging or prod behaviour with real declarations; the fixture has none, so populated rendering rests on the PR's mocked E2E plus my API sanity run.
- Visual check in a real browser by me; I relied on the Playwright cases.
- CI flake logs (see above).
# Conflicts: # public/style.css
… close mutant gaps Review — CS-MacBook PR#378: handleScopeAudit derived the shared singleflight build's context from the first caller's r.Context(), so that caller disconnecting canceled the build for every coalesced waiter. Detach with context.WithoutCancel, keeping only the absolute deadline. Also: move the scopeAuditCache field out of the scope-stats struct comment group (cosmetic), and add tests for the four surviving mutants (singleflight recheck, per-row AmbiguousHops expansion, listener-only exclusion, declarationAge hours formatting).
Rapport — CS-Minimax PR#378 master-sync — head 25569b1Review feedback addressed (commit Findings
MutantsOne mutant per fixed finding, each confirmed caught before restoring the fix:
TestsOn the merged tree (
CI (run 38550922015, head
|
| Job | Result |
|---|---|
| Go Build & Test | success [K] |
| Playwright E2E Tests 1/3 | success [K] |
| Playwright E2E Tests 2/3 | success [K] |
| Playwright E2E Tests 3/3 | success [K] |
| Validate Docker Image | success [K] |
| Verify E2E Shards & Coverage | success [K] |
| Build & Publish Docker Image | success [K] |
| Release Artifacts | skipped (expected, draft/non-release) [K] |
| Deploy Staging | skipped (expected) [K] |
| Publish Badges & Summary | skipped (expected) [K] |
No reruns were needed — none of the known-flaky tests (#271, #301) triggered a failure on this run.
Rester
- Finding 6 (
ambiguousHopsnot recomputed after hidden-identity filtering): left unchanged, per agreement with the reviewer's own "design choice, no change requested" — it's a count only and leaks no identity.
Adds Scope Audit under Analytics → Scopes. A repeater's confirmed observer declaration is compared with flood forwarding observed over 1h, 24h or 7d. For example, unscoped forwarding without a declared
*is shown as a finding; a declared scope with no traffic is shown as unobserved rather than a proven configuration fault.The whole-network audit marks stale declarations, unknown transported scopes, ambiguous hop attribution and legacy observations as incomplete evidence. It uses observed paths, counts each transmission once per repeater/scope state, respects hidden identities, and preserves window, search and pagination in shareable links. CoreDrive declarations and HMAC verification are outside this first version.
Performance
One node snapshot and one streaming observation query replace per-node queries. Aggregation is linear in nodes and observed path hops, with bounded token memoization, per-transmission deduplication, a three-window/30-second cache and singleflight. The browser diffs at most 50 visible rows and searches the bulk response locally.
Parent-run benchmark on Apple M5: 30,000 transmissions, 90,000 observations, 2,000 nodes and four hops per observation averaged 138.6 ms/op across three runs (67.9 MB/op). This measures uncached aggregation, not an end-to-end production request.
Validation
npm test: 235 test files passed, zero failures.Initial thresholds and limits are documented for a later customizer milestone. No server database writes or new dependencies are introduced.