From c829d9612864a6fc3b1c374de1008378a21df183 Mon Sep 17 00:00:00 2001 From: cproudlock Date: Fri, 14 Aug 2026 15:23:04 -0400 Subject: [PATCH] docs: take two leaks off the public wiki, and say where the files come from An ACCEPTED ADR ended with a stray tool-call fragment - it said nothing to a reader and everything about how the document was produced, which is not what a decision record is for. And the cutover playbook carried a real internal IP in a file otherwise correctly scrubbed to documentation ranges. Both were published. The publishability gate now catches all three shapes, so the next one fails a build instead of reaching the wiki. The adoption guide also told a site to copy two files that ship from nowhere: the asset reporter and EventSaver are both on the reference site's imaging share, not in this repository, and the guide never said so - it could not be followed as written. It now states, per artifact, where each comes from, which of them are pending a move into this repository, and that EventSaver can be rebuilt from its one source file rather than taken on trust as a binary. --- docs/ADOPTING-AT-ANOTHER-SITE.md | 16 ++++++++++++++++ docs/adr/ADR-010-frontend-plugin-hooks.md | 2 -- docs/geenforce-api-cutover.md | 2 +- tests/test_docs_publishable.py | 6 ++++++ 4 files changed, 23 insertions(+), 3 deletions(-) diff --git a/docs/ADOPTING-AT-ANOTHER-SITE.md b/docs/ADOPTING-AT-ANOTHER-SITE.md index 2ec363a..5951085 100644 --- a/docs/ADOPTING-AT-ANOTHER-SITE.md +++ b/docs/ADOPTING-AT-ANOTHER-SITE.md @@ -13,6 +13,22 @@ API key, and which PCs it runs on - and all three are inputs, not code. > (every example below does) until that default is removed. See > [ADR-015](adr/ADR-015-site-specific-configuration.md). +## Where these files come from + +The commands below copy files. This is where each one is obtained, because they +do not all ship from the same place and two of them are not in this repository +at all yet. + +| Artifact | Where it is today | +|---|---| +| GE-Enforce client (`Install-GEEnforce.ps1`, `Invoke-ShopdbEnforce.ps1`, `ShopdbEnforceClient.psm1`) | This repository, `plugins/geenforce/client/`. Present on any installed server under the install directory. | +| `Report-AssetToShopDB.ps1` | **Not in this repository.** It lives on the reference site's imaging share and is provided on request. It is planned to move to `plugins/computers/client/` so it versions with the collector contract it implements. | +| EventSaver (`EventSaver.scr`, `EventSaver.ini`, `EventSaver.cs`) | **Not in this repository.** Provided on request; the source is a single C# file that builds with the in-box .NET Framework compiler, so a site can rebuild it rather than trust a binary. See [EVENTSAVER.md](EVENTSAVER.md). | + +Ask the maintainers for the two that are not here. A site that would rather not +run a binary it cannot rebuild should take EventSaver's source and compile it +locally - the build needs no SDK and is one command. + --- ## Part 1: the asset reporter diff --git a/docs/adr/ADR-010-frontend-plugin-hooks.md b/docs/adr/ADR-010-frontend-plugin-hooks.md index d5c4dde..389139b 100644 --- a/docs/adr/ADR-010-frontend-plugin-hooks.md +++ b/docs/adr/ADR-010-frontend-plugin-hooks.md @@ -316,5 +316,3 @@ sites. - docs/CONTRACT-STABILITY.md (the expected-churn line this ADR answers) - shopdb/plugins/base.py (existing declarative hooks this pattern extends) - shopdb/core/api/dashboard.py, shopdb/core/api/reports.py (consumer precedent) - - diff --git a/docs/geenforce-api-cutover.md b/docs/geenforce-api-cutover.md index 5e07ea2..235cbf2 100644 --- a/docs/geenforce-api-cutover.md +++ b/docs/geenforce-api-cutover.md @@ -618,7 +618,7 @@ git pipeline. ### Channel 1: backend + frontend (the git .cmd pipeline) Prod is air-gapped from dev; code moves via a git bundle on the share -(`\\172.16.9.9\pxe-images\github\shopdb-flask-pub.bundle`) and the .cmd +(`\\\github\shopdb-flask-pub.bundle`) and the .cmd scripts in the imaging share (`github/`), run on the work PC: 1. `pull-shopdb-bundle.cmd` - fetch the bundle into the local clone diff --git a/tests/test_docs_publishable.py b/tests/test_docs_publishable.py index c5dbc61..44dd89b 100644 --- a/tests/test_docs_publishable.py +++ b/tests/test_docs_publishable.py @@ -54,6 +54,12 @@ FORBIDDEN = [ # nor meaningful to any other site reading these pages. Assembled from # fragments for the same reason as the terms above. ('tsg' + 'wp00525', 'names a production server'), + (r'\b' + r'172\.16\.' + r'\d', 'names an internal network'), + # A tool-call fragment reached the end of an ACCEPTED ADR and published to + # the wiki. It says nothing to a reader and everything about how the + # document was produced, which is not what a decision record is for. + ('', 'contains a tool-call artifact'), + ('', 'contains a tool-call artifact'), (r'\bwjs\.' + r'geaerospace\.net\b', 'names a site FQDN'), (r'10\.134\.48\.', 'names an internal network'), (r'10\.48\.249\.', 'names an internal network'),