Repository navigation
[PAC-114] docs+test(nginx): PAC-14 §4 pointer, D-8 amendment marker, build-time VITE_SENTRY_DSN rollback; whitespace-only Sentry origin fails closed - #280
Merged
Conversation
…build-time VITE_SENTRY_DSN rollback; whitespace-only Sentry origin fails closed PAC-86 review follow-ups, items 2 and 4 (item 1, DSN rotation, is an operator action and is not part of this change). - contracts/features/PAC-14.md: §4 points to the PAC-86 frontend amendment in §2; §7 rollback item 3 gets an amendment note: VITE_SENTRY_DSN is inlined at build time, so it is not a runtime kill switch (rebuild, or unset NGINX_CSP_SENTRY_ORIGIN to block events). Approved text kept. - contracts/features/PAC-14.yaml: rollback line corrected the same way. - docs/specs/NEW-deploy-hardening.md: amendment marker on D-8, which still described the default Sentry origin. - nginx/test/nginx_test.go: TestWhitespaceOnlySentryOriginRefusesToStart: " ", " " and a space-padded origin are refused by the render step (nginx does not start). Mutation-checked: trimming spaces in the render script makes it fail. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PAC-86 review follow-ups (PAC-114), items 2 and 4. Paired with Enach/smart-calendar-flow
impl/pac-114-web(item 3). Item 1, rotating the Sentry DSNs, is an operator action and is not in this PR. The DSNs stay in the contract text.Docs (item 2). The approved text is kept. Amendment notes are added the way PAC-81 and PAC-86 did it.
contracts/features/PAC-14.md§4: a pointer to the PAC-86 frontend amendment in §2.contracts/features/PAC-14.md§7: an amendment note on rollback item 3.VITE_SENTRY_DSNis inlined at build time, so it is not a runtime kill switch. To turn web monitoring off, rebuild without it, or unsetNGINX_CSP_SENTRY_ORIGINand restart nginx so the CSP blocks the events.contracts/features/PAC-14.yaml: therollbackline is corrected the same way.docs/specs/NEW-deploy-hardening.mdD-8: an amendment marker, because it still described a default Sentry origin.Test (item 4).
TestWhitespaceOnlySentryOriginRefusesToStartcovers" "," "and a space-padded valid origin. In each case the render step refuses the value and names the setting, so nginx does not start. I mutation-checked it: when the render script trims spaces, the test fails.Checks run locally:
cd nginx/test && go test -run TestWhitespaceOnlySentryOriginRefusesToStart ./...: okgofmtandgo vet: clean🤖 Generated with Claude Code
Factory merge record: PAC-114 items 2 and 4; reviewed in the factory main loop: amendment notes only (approved text kept) plus a whitespace-only NGINX_CSP_SENTRY_ORIGIN fail-closed test (mutation-checked). Item 1 (DSN rotation) remains an operator action. CI verify pass @ 09bec97.