carlos / todomvc-bakeoff Public

docs(go-rastrillo): STATUS: live at 7fbd1fd

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Paul Campbell pushed by claude 1 day ago f06ab5d5f0ddaba810f1ae1baab21534de5c0962 parent 14e74cb

1 file changed, +25 −0

diff --git a/apps/go-rastrillo/STATUS.md b/apps/go-rastrillo/STATUS.md

new file mode 100644

index 0000000..6b177df

--- /dev/null

+++ b/apps/go-rastrillo/STATUS.md

@@ -0,0 +1,25 @@

+LIVE https://todo-go-rastrillo.bfj.oncarlos.com 7fbd1fd

+## Checks (2026-10-23)

+- `make test`: vet, gofmt, Go tests under Rastrillo's budgets, and

+ `rastrillo migration check`, all green. `make perf`: every GET screen

+ under 1 ms median locally, cold boot 64 ms.

+- Shared suite locally on `dist/app`: 67 passed, 3 skipped (the suite's

+ own skips: the visual check and blur/Escape editing with JS off).

+- `scripts/boot-check.sh dist/app-linux-arm64`: `/healthz` and

+ `/api/version` 200, clean exit on SIGTERM.

+- `make deploy`: `live https://todo-go-rastrillo.bfj.oncarlos.com`,

+ `/api/version` and `X-Carlos-Version` both `7fbd1fd`.

+- Shared suite against the live host: 67 passed, 3 skipped.

+## Notes

+- Rastrillo's `csrf.Protect` refuses POSTs with no `Sec-Fetch-Site`,

+ `Origin` or `Referer`. The contract allows those, so `origin.go` lets a

+ POST without `Origin` through and sends every other POST through

+ `csrf.Protect`. The README explains it.

+- Rastrillo's local flag is `--addr`. `main.go` translates the bakeoff's

+ `--listen` to it before `rastrillo.Resolve`.

+- `carlos.Host()` isn't in v0.28.0 (it's on Rastrillo's main branch), so

+ `main.go` reads `CARLOS_HOST` directly.