fix: take the production fleet out of the test corpus - #72
Merged
Conversation
…README at the site
internal/app/testdata/corpus/ named five live hosts, each with the account used
to reach them:
root@monk.labstack.net root@goal.labstack.net
root@fanout.labstack.net root@recast.labstack.net
root@167.233.193.130
All five resolve today. Beside them the same files carry each application's
topology, images, ports, replica counts and health endpoints, so the corpus was
a machine-readable inventory of what runs where, and as whom. That was private
information in a private repository until the repository went public.
The server field does not reach the rendered runtime, so the frozen contract
digests do not move: the corpus keeps exactly the shapes it was written to
freeze, addressed at example.com and the RFC 5737 documentation range instead.
Checked by rewriting one file and watching TestContractDidNotMove stay green
before doing the rest.
The README also never linked to onebox.run — its only mentions of the domain
were schema identifiers. Anyone arriving at the repository had no route to the
published documentation, and the installation guide pointed at a source path
rather than the page. Both now point at the site.
Two issues still name a live host in their bodies, #13 and #3, and are not
fixable from here: editing them leaves the original visible in GitHub's edit
history. They need redacting or deleting through the UI.
`just check` and `go test -race ./...` pass.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vishr
added a commit
that referenced
this pull request
Aug 18, 2026
fix: take the production fleet out of the test corpus
vishr
added a commit
that referenced
this pull request
Aug 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found while auditing what became visible when the repository went public.
The corpus named five live hosts
internal/app/testdata/corpus/contained real production targets, each with the account used to reach them:monk.ymlroot@<host>goal.ymlroot@<host>fanout.ymlroot@<host>recast.ymlroot@<host>pursue.ymlroot@<ip>All five resolve. Beside them the same files carry each application's topology, images, ports, replica counts and health endpoints — so the corpus was a machine-readable inventory of what runs where, and as whom.
Fine in a private repository. Not fine now.
Anonymised at no cost
The
serverfield never reaches the rendered runtime, so the frozen contract digests do not move. The corpus keeps exactly the shapes it was written to freeze, addressed atexample.comand the RFC 5737 documentation range instead.Verified by rewriting one file first and watching
TestContractDidNotMovestay green before touching the rest.README now links to onebox.run
Its only mentions of the domain were schema identifiers. Someone arriving at the repository had no route to the published documentation, and the installation guide pointed at a source path rather than the page.
Not fixable from here
Two issues name a live host in their bodies — #13 (
root@<host>) and #3. Editing them leaves the original in GitHub's publicly visible edit history, so they need redacting or deleting through the UI, and the exposure should be assumed to have happened.Verified
just check,go test -race ./.... No real hostname or public IP remains in any tracked file.