| 1 | LIVE https://todo-go-rastrillo.bfj.oncarlos.com 1364616 |
| 2 | |
| 3 | ## Checks (2026-10-23, after the review round) |
| 4 | |
| 5 | - `make test`: vet, gofmt, Go tests under Rastrillo's budgets, and |
| 6 | `rastrillo migration check`, all green. `make perf` (first build): |
| 7 | every GET screen under 1 ms median locally, cold boot 64 ms. |
| 8 | - Shared suite locally on `dist/app`: 67 passed, 3 skipped (the suite's |
| 9 | own skips: the visual check and blur/Escape editing with JS off). |
| 10 | - `scripts/boot-check.sh dist/app-linux-arm64`: `/healthz` and |
| 11 | `/api/version` 200, clean exit on SIGTERM. |
| 12 | - `make deploy`: swapped on the live host; `/api/version` reports |
| 13 | `1364616`. |
| 14 | - Shared suite against the live host: 67 passed, 3 skipped. |
| 15 | |
| 16 | ## Review findings fixed |
| 17 | |
| 18 | 1. **Origin check.** `origin.go` no longer delegates to `csrf.Protect`. |
| 19 | A POST whose `Origin` isn't exactly the app's origin gets 403, whatever |
| 20 | `Sec-Fetch-Site` says. A new test sends a foreign `Origin` with |
| 21 | `Sec-Fetch-Site: same-origin` and with `none`, and expects 403. Also |
| 22 | checked by hand on the live host: 403. |
| 23 | 2. **Unread forms.** Every `/todos` post is capped at 1 MiB and parsed |
| 24 | before a handler runs, as `form.Parse`'s docs recommend. Too big gets |
| 25 | 413, malformed gets 400, and nothing changes. A new test posts an edit |
| 26 | over 2 MiB and checks that the item survives. |
| 27 | 3. **Typing during an add.** `app.js` clears `.new-todo` when the add is |
| 28 | sent. After the response, the swap keeps whatever is in the field |
| 29 | (and the caret). Checked in Chromium with the add response delayed by |
| 30 | 800 ms: text typed meanwhile was still there afterwards. |
| 31 | 4. **Loopback only.** `main.go` refuses any TCP address whose host isn't |
| 32 | `127.0.0.1` (`0.0.0.0`, `:8080`, `[::]`, `localhost` and so on) and |
| 33 | exits with an error. Unit-tested, and checked by hand with |
| 34 | `--listen 0.0.0.0:18432`. |
| 35 | |
| 36 | ## Review findings not fixed |
| 37 | |
| 38 | None. |
| 39 | |
| 40 | ## Notes |
| 41 | |
| 42 | - Rastrillo's local flag is `--addr`. `main.go` translates the bakeoff's |
| 43 | `--listen` to it before `rastrillo.Resolve`. |
| 44 | - `carlos.Host()` isn't in v0.28.0 (it's on Rastrillo's main branch), so |
| 45 | `main.go` reads `CARLOS_HOST` directly. |
| 46 | |
amadan