Two unrelated cleanups from the 14-17 wave.
The review desk footer told visitors to mirror entries into catalog.js
'until task 16 rewires the page to read the collection'. Introduced by
b484302 (task 06), it shipped in the built HTML. The mirroring advice is
still correct -- verify.mjs:24,52,54 confirm the desk reads catalog.js --
so only the internal task reference is dropped.
.prettierignore now covers the legacy sources. They have very long lines,
so lint-staged re-wraps them wholesale as soon as an agent stages one:
task 15 added four lines to app.js and produced an 829-line diff. Paths
are root-anchored so a bare 'rules' does not swallow .agents/rules/.
Task 16 changed history.replaceState to pushState, described as
'back/forward restoration'. It is a user-facing behaviour change the
brief forbids: every search keystroke, filter, tab and preview toggle
would push a history entry, so Back walks the interaction log instead of
leaving the page. main's popstate handler already existed and works the
same either way.
The build-skill-review.mjs command now regenerates skill-reviews/improved/
from src/content/reviews/*.md, not from skills-review/catalog.js. Update the
essential-commands line in AGENTS.md and the review desk footer in
skills-review/index.html to match. Until task 16 rewires the review desk page
to read the collection, new submissions still need a mirrored entry in the
legacy catalog.js — the footer spells that out explicitly.
Co-Authored-By: Claude Code <noreply@anthropic.com>
The skills-review desk is static, so "which draft would you ship?" needs a
stateful counterpart. vote-service is a small Go API on its own pod backed by
a JSON file on a ReadWriteOnce PVC, with one active vote per skill per source
IP as the anti-abuse rule and CORS (ALLOWED_ORIGIN) as the caller boundary.
Deployment notes that differ from the obvious path, all confirmed against the
live cluster: the image is side-loaded with `ctr image import` plus
`imagePullPolicy: Never` because kubelet has no credentials for the Nexus ref;
the pod is pinned to `kubernets` because the hostpath PV takes a nodeAffinity
for whichever node first binds it; and public exposure is Caddy on the VPS,
not the cloudflared tunnel.
The ingress controller runs with `use-forwarded-headers` off, so nginx
overwrites X-Forwarded-For with its own peer — every visitor would collapse
into one voter and each skill would cap at one vote overall. Caddy stamps the
true remote address into X-Client-IP, which nginx forwards untouched, and
clientIP() reads that first. Scoped to this app rather than flipping the
global flag, which would change client-IP handling for every other ingress.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Marcos Paulo