docs(go): STATUS.md, live at d9bf9fc

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Paul Campbell pushed by claude agent, operated by paul@keymail.dev 7eaa392c060f038df05e647d7a7af9ed5ea57308 parent d9bf9fc
1 file changed, +54 −0
  • apps/go/STATUS.md +54 −0
diff --git a/apps/go/STATUS.md b/apps/go/STATUS.md
new file mode 100644
index 0000000..a482513
--- /dev/null
+++ b/apps/go/STATUS.md
@@ -0,0 +1,54 @@
+LIVE https://todo-go.bfj.oncarlos.com d9bf9fc
+
+# 🤖 Status: todo-go
+
+Deployed 2026-10-23. `carlos deploy` printed `live`, and both
+`/api/version` and `X-Carlos-Version` on the canonical host report
+`d9bf9fc`.
+
+## Tests
+
+- `make test` (go vet and 13 Go tests): pass.
+- Shared suite run locally on `--listen 127.0.0.1`: **67 passed, 3 skipped**,
+ the same as the reference fixture.
+- Shared suite run live on `https://todo-go.bfj.oncarlos.com`: **65 passed,
+ 2 failed, 3 skipped**. The two failures are the same test,
+ "round-trips UTF-8 and sends correct Content-Length", once with
+ JavaScript on and once with it off. I think the test is wrong, not the
+ app (see below).
+
+## The Content-Length failure is in the suite
+
+Carloku's edge gzips responses when the client accepts gzip, and sends
+the compressed size as `Content-Length`. That's correct HTTP: the header
+counts the bytes on the wire. Playwright's `res.body()` hands the test
+the decoded body, so the test compares the compressed size in the
+header with the uncompressed length of the body (`952` against `2828`
+for the same page). Any app served through a compressing edge fails it.
+
+Checked with curl against the live host:
+
+| Accept-Encoding | Content-Encoding | Content-Length | Bytes received |
+|---|---|---|---|
+| `gzip` | gzip | 952 | 952 |
+| `identity` | none | 2828 | 2828 |
+
+The app sets `Content-Length` to the exact byte count of every page it
+renders, and a Go test checks that. I didn't add `Cache-Control:
+no-transform` to stop the edge compressing: that would only be there to
+get around the test. Suggested fix for the suite: skip the comparison
+when `content-encoding` is set, or send `Accept-Encoding: identity` in
+that request.
+
+## Other notes
+
+- **`carlos vet --boot` doesn't run for a member.** It wants
+ `CARLOS_DEPLOYMENT_BUCKET` or `CARLOS_DEPLOYMENT_DIR`, so it only runs
+ in the operator's direct mode, and it has no console flag. I ran its
+ boot check by hand instead: the shipped arm64 binary, run under
+ `qemu-aarch64-static` with `-socket` and `-db`, answered `/healthz`
+ and `/api/version` over the socket and exited 0 on SIGTERM, removing
+ its socket. The brief and `platform.md` should say which `vet` route
+ a member has.
+- `make clean-deps` is the same as `make clean`. As the brief says for
+ Go, a cold build is `make build-arm64 COLD=1`.