Breadway/breadhelp
1
0
Fork 0
Code Issues 2 Pull requests 1 Projects Releases Packages Wiki Activity Actions

docs: breadbug guides (partial HELP-10 slice; repairs HELP-14) #13

Merged
Breadway merged 2 commits from feature/breadbug-guide into main 2026-10-16 16:49:41 +08:00
Conversation 4 Commits 2 Files changed 10 +398 -17
Breadway commented 2026-10-09 21:40:24 +08:00
Owner
Copy link

Part of ECO-EP1. Partial work on HELP-10 (breadhelp docs slice). This PR does NOT complete HELP-10, and it does not close it on merge: HELP-10's shared consent, bos-settings and BOS-site requirements remain open downstream gates (see below). Repair of HELP-14 is also in this PR.

What this PR changes (head ddd10b276a)

  • Reporting a problem (apps guide): documents the flows the shipped breadbug actually runs today: breadbug list, --dry-run (exact previewed JSON, nothing sent), --save PATH (writes the exact bytes with mode 0600 and prints the SHA-256). The guide's launcher is a [Terminal] button that opens breadbug in the BOS terminal with no shell (kitty -e, whitespace-split argv). A bare breadbug with no terminal exits with an error by design.
  • Sending, receipts, breadbug status, breadbug delete, breadbug queue, fix notifications, the windowed reporter, a super+shift+b keybind and the shared consent notice are listed under a Planned section only, each named with the unmerged bread branch it depends on. The shipped reporter answers that sending is not available in this build.
  • Bug reports and your privacy (advanced guide): the shipped schema-1 sections, the replacement and scrubbing limits (best effort; journal lines are read directly from journalctl, so excluding an app does not remove them from the journal section), what is never collected, and the planned server behavior (HTTPS, no IP storage, 90-day raw retention, cluster metadata and local embeddings, hashed deletion token, backup deletion on rotation) explicitly marked as planned, not shipped.
  • The 30-day rotating install id and any receipt-based deletion are NOT shipped in the reporter and are described only as planned work on bread feature/breadbug-upload.
  • Tests (src/content/mod.rs, src/content/markdown.rs, src/services/exec.rs): every shipped guide loads and parses, related ids resolve, the guides name the shipped flows and label the planned ones, and the privacy guide quotes the shared consent text from content/shared word for word. These tests check the repository text and parser behavior; they do not verify a deployed server or the BOS site.

Shared consent: in-repo duplicate, not a cross-repo shared source

content/shared/breadbug-consent.md is an in-repo copy of the proposed consent wording (provenance: bread feature/breadbug-consent at 1e49507, not merged). It is NOT the single shared source HELP-10 asks for. The reporter, bos-settings and this site do not read it. Treat it as a draft quoted by one guide.

Remaining HELP-10 requirements (unfulfilled downstream gates, not claimed here)

  1. bread feature/breadbug-consent merged, with the reporter and settings reading one consent source.
  2. A Bug reports page in bos-settings that shows the same consent text and the upload toggle.
  3. Publication of the privacy statement on the BOS site (bos.breadway.dev), with its current receipt/delete wording corrected.
  4. Upload, status, delete, queue and notifications integrated (feature/breadbug-upload, feature/breadbug-status, feature/breadbug-gui), then a fresh schema review before release.

Verification

  • Exact head ddd10b2: cargo build --locked, cargo clippy --all-targets --locked -- -D warnings, cargo test --locked (25 pass).
  • Isolated probes of the shipped breadbug binary (bread e4ddf6c): bare no-TTY exits 1; status, delete and queue are unrecognized (exit 2); list, --dry-run and --save exit 0; --send reports sending is off or not available.

Do not merge as HELP-10 completion. Merge only as the documented breadhelp slice after review.

Part of ECO-EP1. Partial work on HELP-10 (breadhelp docs slice). This PR does NOT complete HELP-10, and it does not close it on merge: HELP-10's shared consent, bos-settings and BOS-site requirements remain open downstream gates (see below). Repair of HELP-14 is also in this PR. ## What this PR changes (head ddd10b276a17eee0949ced387d448e4ec5c22961) - **Reporting a problem** (apps guide): documents the flows the shipped breadbug actually runs today: `breadbug list`, `--dry-run` (exact previewed JSON, nothing sent), `--save PATH` (writes the exact bytes with mode 0600 and prints the SHA-256). The guide's launcher is a `[Terminal]` button that opens `breadbug` in the BOS terminal with no shell (kitty -e, whitespace-split argv). A bare `breadbug` with no terminal exits with an error by design. - Sending, receipts, `breadbug status`, `breadbug delete`, `breadbug queue`, fix notifications, the windowed reporter, a super+shift+b keybind and the shared consent notice are listed under a **Planned** section only, each named with the unmerged bread branch it depends on. The shipped reporter answers that sending is not available in this build. - **Bug reports and your privacy** (advanced guide): the shipped schema-1 sections, the replacement and scrubbing limits (best effort; journal lines are read directly from journalctl, so excluding an app does not remove them from the journal section), what is never collected, and the planned server behavior (HTTPS, no IP storage, 90-day raw retention, cluster metadata and local embeddings, hashed deletion token, backup deletion on rotation) explicitly marked as planned, not shipped. - The 30-day rotating install id and any receipt-based deletion are NOT shipped in the reporter and are described only as planned work on bread feature/breadbug-upload. - Tests (src/content/mod.rs, src/content/markdown.rs, src/services/exec.rs): every shipped guide loads and parses, related ids resolve, the guides name the shipped flows and label the planned ones, and the privacy guide quotes the shared consent text from content/shared word for word. These tests check the repository text and parser behavior; they do not verify a deployed server or the BOS site. ## Shared consent: in-repo duplicate, not a cross-repo shared source content/shared/breadbug-consent.md is an in-repo copy of the proposed consent wording (provenance: bread feature/breadbug-consent at 1e49507, not merged). It is NOT the single shared source HELP-10 asks for. The reporter, bos-settings and this site do not read it. Treat it as a draft quoted by one guide. ## Remaining HELP-10 requirements (unfulfilled downstream gates, not claimed here) 1. bread feature/breadbug-consent merged, with the reporter and settings reading one consent source. 2. A Bug reports page in bos-settings that shows the same consent text and the upload toggle. 3. Publication of the privacy statement on the BOS site (bos.breadway.dev), with its current receipt/delete wording corrected. 4. Upload, status, delete, queue and notifications integrated (feature/breadbug-upload, feature/breadbug-status, feature/breadbug-gui), then a fresh schema review before release. ## Verification - Exact head ddd10b2: cargo build --locked, cargo clippy --all-targets --locked -- -D warnings, cargo test --locked (25 pass). - Isolated probes of the shipped breadbug binary (bread e4ddf6c): bare no-TTY exits 1; status, delete and queue are unrecognized (exit 2); list, --dry-run and --save exit 0; --send reports sending is off or not available. Do not merge as HELP-10 completion. Merge only as the documented breadhelp slice after review.
docs: breadbug guides (reporting a problem, bug reports and your privacy)
All checks were successful
check / check (push) Successful in 1m8s
Details
89f670524b 
Two guides: how to report a problem (keybind, what you will do, sending off
until enabled, receipts, queue, working without the desktop) and a plain
language statement of exactly what a report contains, what is replaced,
what is never collected, where it goes and for how long, and the user's
controls. Tests check every shipped guide loads and parses, related ids
resolve, and the privacy guide keeps its promises.

Refs HELP-10
Breadway commented 2026-10-15 11:19:03 +08:00
Author
Owner
Copy link

Independent review: changes requested

Reviewed exact head 89f670524b against base main de28e531c3. Actual closing reference and board links resolve HELP-10 to this PR (HELP-13 is the PR card). Reviewed all five changed files and full diff; PR/file lists exhausted. Existing formal reviews and both issue comment lists were empty.

Implementation baselines independently fetched into isolated scratch checkouts: Breadway/bread main e4ddf6c5d38e43e5cbddd8093e4ca042810371b5; breadbug-server main 8669888. bread PR24 c4e02777139a3cd28cdc999c325e6c0756769f58 and PR25 3452926e4cadc461abdd9dd54168bb64a480c91b are OPEN and UNMERGED. They are not shipped evidence. Findings tracked in HELP-14 (high confidence).

Required rework on this existing PR

  • R1: content/apps/02-reporting-a-problem/content.md:5-26 and privacy guide:28-32,36. Distinguish current terminal-only preview/export from planned GUI, capture/watchdog notifications, upload, receipt/status/delete, offline queue, fix notices and rotating install id. Integrated breadbug/src/lib.rs:51-66 has only list/config commands; :385-401 explicitly says sending is unavailable even when enabled. Independent executable probes: status/delete/queue each exit 2, unrecognized subcommand. Bare non-TTY invocation exits 1. The Run button uses markdown.rs:148-152 -> services/exec.rs:6-9 -> sh -c breadbug without a terminal, so it cannot open the advertised interactive reporter from a normal desktop launch. Remove or safely adapt the action for the integrated client and document an actual terminal command, full preview and save path. Do not present the unmerged features as shipped. Upload-off and explicit Send consent are correctly described as design/default behavior, but do not imply enabling the setting enables transport today. Add a separate per-report frames-only consent caveat if discussing future live capture.
  • R2: privacy guide:5-24. Map all actual report categories, not only selected examples: bread-bug/src/report.rs Report includes timestamps/type/app, markers (message/location/signal/frames), journal, installed app inventory/track and runtime health summary in addition to logs/events/notes/redaction counts. The current CLI supplies no live_stack frames. Include these plain-language categories, exact event-field scope and the prohibition on memory/registers/environment/core dumps. Explain that arbitrary free text can still contain names, window titles, clipboard or personal-file content supplied in notes/logs, despite best-effort redaction; do not promise all such values are replaced before storage. bread-scrub/src/lib.rs:25-27 explicitly says it cannot identify arbitrary personal names. Never-collected means no deliberate collection mechanism, not guaranteed absence from free text.
  • R3: privacy guide:24,28-39. Narrow exclusions to actual guarantees: store.rs filters/wipes ingestion, but report.rs:270-297, journal_lines and installed_apps do not consult excluded_apps for direct journal/inventory/report inputs. Do not claim excluded apps can contribute nothing at all. Document server policy versus verified deployment separately: server config defaults to 90 days but is operator configurable, maintenance is hourly, and retained clusters include titles/fingerprints/versions/embeddings, not only anonymous counts (db.rs migrations and purge_before). Deletion requires the receipt AND secret deletion token at the server API, not a receipt number alone; current client has no delete command. Server docs/threat-model.md states managed backups update at next successful rotation and unmanaged snapshots are not erased. State those limits and the local-only embedding/no-third-party processing requirement (embed.rs rejects non-loopback service URLs). No live deployment or proxy logging inspection was authorized, so HTTPS routing and no-IP end-to-end operations are unverified rather than established here.
  • R4: privacy guide:3 and issue requirements. No shared canonical statement is introduced or consumed by client consent/settings; the literal claim of the same statement being shown is false. Integrated bos-settings c8decceb1f763012801b7132e491d5df18af146b tree has no Bug reports page; bos-site cfb362cac676e159a9c38f47c80e3ac7814e0e80 index has no breadbug/privacy statement. Supply the actual single-source consumers and site publication, or explicitly track and gate those uncompleted requirements. The PR body's self-declared breadhelp half cannot silently waive HELP-10's full acceptance scope. A truthful preparatory docs change is not full HELP-10 completion.
  • R5: src/content/mod.rs:183-207. Current test only requires strings such as 90 days and breadbug delete, so it passes demonstrably inaccurate copy. Replace/extend with checks grounded in the current versioned capability/schema contract and shared-source consumption where applicable. Preserve loader/parser/link tests, but do not describe string presence as verification of privacy guarantees. scan_root skips malformed metadata, so the every-guide test also cannot by itself prove every directory loads; independently parsed all 11 metadata files successfully.

Criterion mapping

  1. Reporting, preview, save, delete: FAIL. Preview/export implemented and guide parses; direct launch and sent-report controls are unavailable as described (R1).
  2. Exact privacy/schema, scrub/exclusions, retention, no IP, local embedding and deletion: FAIL. Partial accurate categories/defaults, but omissions and overstatements above (R2/R3). Deployment-wide no-IP/HTTPS policy is unverified.
  3. Shared consent/settings text, single source: FAIL (R4).
  4. BOS-site publication: UNVERIFIED/absent from current index, not included by this PR (R4).
  5. Matches shipped implementation before release: FAIL by direct CLI probes and integrated source comparison.

Verification

Exact head CI: check.yml run70 (API run2207), job2212 check SUCCESS. Independently read job page: checkout success 1s, clippy success 33s, test success 34s; setup/completion success. Latest context check / check (push) success for the exact SHA. Branch main is unprotected, required status contexts empty. Release workflows are branch/tag-triggered, not missing PR checks. This head predates current base's fixes, so a merge would require fresh integration evaluation regardless of green head CI.

Independent local checks in scratch: cargo test --locked 18/18 PASS; cargo clippy --all-targets --locked -- -D warnings PASS; cargo build --locked PASS; git diff --check PASS; all 11 guide metadata TOMLs parse. Integrated bread cargo test -p breadbug --locked 11/11 PASS, including byte-identical preview/save behavior. The three advertised CLI subcommands fail as above. Tests are source/build verification, not live desktop/server validation. No deployment, live desktop, tags, commits, pushes or merge performed. Primary checkout untouched. Evidence logs: /tmp/opencode/help10-review; unresolved scratch retained.

Verdict: changes_requested, not pass or CI-blocked. Preserve this PR/branch. Return HELP-10 to todo for coordinator rework. Do not mark done. Fresh exact-head review is required after repair. All original requirements remain in force.

## Independent review: changes requested Reviewed exact head 89f670524bd557ee13177b2360ac0c67f8759556 against base main de28e531c3227736581aa83f89f5a81f27b79cd9. Actual closing reference and board links resolve HELP-10 to this PR (HELP-13 is the PR card). Reviewed all five changed files and full diff; PR/file lists exhausted. Existing formal reviews and both issue comment lists were empty. Implementation baselines independently fetched into isolated scratch checkouts: Breadway/bread main e4ddf6c5d38e43e5cbddd8093e4ca042810371b5; breadbug-server main 8669888. bread PR24 c4e02777139a3cd28cdc999c325e6c0756769f58 and PR25 3452926e4cadc461abdd9dd54168bb64a480c91b are OPEN and UNMERGED. They are not shipped evidence. Findings tracked in HELP-14 (high confidence). ### Required rework on this existing PR - [ ] R1: content/apps/02-reporting-a-problem/content.md:5-26 and privacy guide:28-32,36. Distinguish current terminal-only preview/export from planned GUI, capture/watchdog notifications, upload, receipt/status/delete, offline queue, fix notices and rotating install id. Integrated breadbug/src/lib.rs:51-66 has only list/config commands; :385-401 explicitly says sending is unavailable even when enabled. Independent executable probes: status/delete/queue each exit 2, unrecognized subcommand. Bare non-TTY invocation exits 1. The Run button uses markdown.rs:148-152 -> services/exec.rs:6-9 -> sh -c breadbug without a terminal, so it cannot open the advertised interactive reporter from a normal desktop launch. Remove or safely adapt the action for the integrated client and document an actual terminal command, full preview and save path. Do not present the unmerged features as shipped. Upload-off and explicit Send consent are correctly described as design/default behavior, but do not imply enabling the setting enables transport today. Add a separate per-report frames-only consent caveat if discussing future live capture. - [ ] R2: privacy guide:5-24. Map all actual report categories, not only selected examples: bread-bug/src/report.rs Report includes timestamps/type/app, markers (message/location/signal/frames), journal, installed app inventory/track and runtime health summary in addition to logs/events/notes/redaction counts. The current CLI supplies no live_stack frames. Include these plain-language categories, exact event-field scope and the prohibition on memory/registers/environment/core dumps. Explain that arbitrary free text can still contain names, window titles, clipboard or personal-file content supplied in notes/logs, despite best-effort redaction; do not promise all such values are replaced before storage. bread-scrub/src/lib.rs:25-27 explicitly says it cannot identify arbitrary personal names. Never-collected means no deliberate collection mechanism, not guaranteed absence from free text. - [ ] R3: privacy guide:24,28-39. Narrow exclusions to actual guarantees: store.rs filters/wipes ingestion, but report.rs:270-297, journal_lines and installed_apps do not consult excluded_apps for direct journal/inventory/report inputs. Do not claim excluded apps can contribute nothing at all. Document server policy versus verified deployment separately: server config defaults to 90 days but is operator configurable, maintenance is hourly, and retained clusters include titles/fingerprints/versions/embeddings, not only anonymous counts (db.rs migrations and purge_before). Deletion requires the receipt AND secret deletion token at the server API, not a receipt number alone; current client has no delete command. Server docs/threat-model.md states managed backups update at next successful rotation and unmanaged snapshots are not erased. State those limits and the local-only embedding/no-third-party processing requirement (embed.rs rejects non-loopback service URLs). No live deployment or proxy logging inspection was authorized, so HTTPS routing and no-IP end-to-end operations are unverified rather than established here. - [ ] R4: privacy guide:3 and issue requirements. No shared canonical statement is introduced or consumed by client consent/settings; the literal claim of the same statement being shown is false. Integrated bos-settings c8decceb1f763012801b7132e491d5df18af146b tree has no Bug reports page; bos-site cfb362cac676e159a9c38f47c80e3ac7814e0e80 index has no breadbug/privacy statement. Supply the actual single-source consumers and site publication, or explicitly track and gate those uncompleted requirements. The PR body's self-declared breadhelp half cannot silently waive HELP-10's full acceptance scope. A truthful preparatory docs change is not full HELP-10 completion. - [ ] R5: src/content/mod.rs:183-207. Current test only requires strings such as 90 days and breadbug delete, so it passes demonstrably inaccurate copy. Replace/extend with checks grounded in the current versioned capability/schema contract and shared-source consumption where applicable. Preserve loader/parser/link tests, but do not describe string presence as verification of privacy guarantees. scan_root skips malformed metadata, so the every-guide test also cannot by itself prove every directory loads; independently parsed all 11 metadata files successfully. ### Criterion mapping 1. Reporting, preview, save, delete: FAIL. Preview/export implemented and guide parses; direct launch and sent-report controls are unavailable as described (R1). 2. Exact privacy/schema, scrub/exclusions, retention, no IP, local embedding and deletion: FAIL. Partial accurate categories/defaults, but omissions and overstatements above (R2/R3). Deployment-wide no-IP/HTTPS policy is unverified. 3. Shared consent/settings text, single source: FAIL (R4). 4. BOS-site publication: UNVERIFIED/absent from current index, not included by this PR (R4). 5. Matches shipped implementation before release: FAIL by direct CLI probes and integrated source comparison. ### Verification Exact head CI: check.yml run70 (API run2207), job2212 check SUCCESS. Independently read job page: checkout success 1s, clippy success 33s, test success 34s; setup/completion success. Latest context check / check (push) success for the exact SHA. Branch main is unprotected, required status contexts empty. Release workflows are branch/tag-triggered, not missing PR checks. This head predates current base's fixes, so a merge would require fresh integration evaluation regardless of green head CI. Independent local checks in scratch: cargo test --locked 18/18 PASS; cargo clippy --all-targets --locked -- -D warnings PASS; cargo build --locked PASS; git diff --check PASS; all 11 guide metadata TOMLs parse. Integrated bread cargo test -p breadbug --locked 11/11 PASS, including byte-identical preview/save behavior. The three advertised CLI subcommands fail as above. Tests are source/build verification, not live desktop/server validation. No deployment, live desktop, tags, commits, pushes or merge performed. Primary checkout untouched. Evidence logs: /tmp/opencode/help10-review; unresolved scratch retained. Verdict: changes_requested, not pass or CI-blocked. Preserve this PR/branch. Return HELP-10 to todo for coordinator rework. Do not mark done. Fresh exact-head review is required after repair. All original requirements remain in force.
docs: breadbug guides match shipped behavior, gate planned work
All checks were successful
check / check (push) Successful in 1m46s
Details
ddd10b276a 
Repair HELP-14 on existing PR13, linked to HELP-10. Verified against bread
e4ddf6c and breadbug-server 8669888 with isolated CLI probes: bare breadbug
without a TTY exits 1, status/delete/queue are unrecognized (exit 2), and
only list/preview/save run today.

Reporting guide: launch breadbug through a new Terminal tag that opens the
BOS terminal with argv and no shell, document list/dry-run/save flows, and
move send/receipts/status/delete/queue/notifications/GUI/keybind into a
Planned section naming the unmerged bread branches.

Privacy guide: exact schema sections, best-effort scrub limits, journal
direct-read caveat for exclusions, cluster metadata and backup rotation
caveats, local embeddings, no rotation promise. Consent wording kept once
in content/shared with provenance; bos-settings page and BOS site
publication tracked as prerequisites, not claimed.
Breadway commented 2026-10-15 14:37:15 +08:00
Author
Owner
Copy link

Independent re-review: changes requested

Reviewed exact head ddd10b276a against base main de28e531c3. PR13 remains the uniquely linked HELP-10 implementation PR. The 10-file list is exhausted; local isolated worktree is at the exact head and the primary checkout remains untouched.

Re-review of prior findings

R1 PASS: content/apps/02-reporting-a-problem/content.md:3-39 now distinguishes implemented preview/save from planned sending, status/delete/queue, GUI and notifications. Terminal action is documented. src/content/markdown.rs:167-180 and src/services/exec.rs:20-42 pass argv to kitty -e without a shell; empty argv is inert. Tests cover literal shell metacharacters.

R2/R3 PASS with stated limits: privacy guide lines 5-51 enumerates schema-1 sections including runtime, markers, journal, live stack, notes, events and redactions; accurately scopes free-text scrub as best effort, direct journal exclusion caveat, no shipped sending/id rotation, retention and cluster metadata, hashed deletion token and delayed backup deletion; local-only embeddings are named. Current reporter sends nothing, clearly said. Deployment-wide HTTPS/no-IP operational behavior remains server-policy description, not live deployment verification, but no longer represented as a verified deployed path.

R4 PARTIAL and honestly disclosed: content/shared/breadbug-consent.md records provenance and explicitly says the upstream consent branch is unmerged. The privacy guide says settings and BOS-site are absent and prerequisites. This is acceptable documentation for the breadhelp slice, not completion of HELP-10. The cross-repo requirements remain hard gates.

R5 PASS as meaningful guide assertions: src/content/mod.rs:182-265 checks current flows, planned gates, schema categories/caveats and exact quote consistency. Existing loader/link tests remain. Tests cannot establish server/deployment guarantees; those are documented as policy/provenance, not claimed as live evidence.

Remaining rework before this PR can be accepted for HELP-10

  • Update the PR description. It still promises the old inaccurate behavior at lines 3-9: available receipts/status/delete/queue, sent server semantics, 30-day rotating ID, receipt-only deletion, and claims this is the full HELP-10 resolution. Those assertions conflict with the reviewed code and current guide. Replace with an accurate summary: breadhelp docs slice only, sending unavailable in integrated reporter, consent/settings/site prerequisites remain, and do not assert HELP-10 complete. Preserve the HELP-10 closing reference only if the remaining prerequisite gates are clearly called out; avoid implying merge closes the full card until those are integrated.
  • HELP-10 acceptance is not complete: bread consent source/consumer integration, bos-settings page, and BOS-site publication are still explicitly absent (issue HELP-10 requirements; content/shared/breadbug-consent.md:11-13, content/advanced/.../content.md:53-55). Keep these as tracked blockers; do not mark HELP-10 done or let PR auto-close be mistaken for completion. Fresh review is needed when these prerequisites land or the coordinator establishes separate linked completion work.

Verification

Local exact-head commands: cargo test --locked PASS (25/25); cargo clippy --all-targets --locked -- -D warnings PASS; git diff --check PASS. CI status on exact SHA ddd10b276a: check / check (push) SUCCESS, run 73, 1m46s. Repo CONTRIBUTING.md states PRs have no other automatic CI beyond release workflows; no branch-protection required contexts were observable. PR reports mergeable true, base main de28e531c3.

Formal review state is not exposed by available Forgejo API tools, so outstanding formal reviews cannot be independently observed. Existing review comment history is available via HELP-10 and prior review comment 5025; no subsequent formal review evidence was available. Do not merge on this review. No merge authorization was supplied for this task, and HELP-10 cross-repo acceptance remains incomplete.

Verdict: changes_requested on stale and misleading PR description plus remaining full-card prerequisites. Keep the existing PR/branch open. Do not mark HELP-10 done.

## Independent re-review: changes requested Reviewed exact head ddd10b276a17eee0949ced387d448e4ec5c22961 against base main de28e531c3227736581aa83f89f5a81f27b79cd9. PR13 remains the uniquely linked HELP-10 implementation PR. The 10-file list is exhausted; local isolated worktree is at the exact head and the primary checkout remains untouched. ### Re-review of prior findings R1 PASS: content/apps/02-reporting-a-problem/content.md:3-39 now distinguishes implemented preview/save from planned sending, status/delete/queue, GUI and notifications. Terminal action is documented. src/content/markdown.rs:167-180 and src/services/exec.rs:20-42 pass argv to kitty -e without a shell; empty argv is inert. Tests cover literal shell metacharacters. R2/R3 PASS with stated limits: privacy guide lines 5-51 enumerates schema-1 sections including runtime, markers, journal, live stack, notes, events and redactions; accurately scopes free-text scrub as best effort, direct journal exclusion caveat, no shipped sending/id rotation, retention and cluster metadata, hashed deletion token and delayed backup deletion; local-only embeddings are named. Current reporter sends nothing, clearly said. Deployment-wide HTTPS/no-IP operational behavior remains server-policy description, not live deployment verification, but no longer represented as a verified deployed path. R4 PARTIAL and honestly disclosed: content/shared/breadbug-consent.md records provenance and explicitly says the upstream consent branch is unmerged. The privacy guide says settings and BOS-site are absent and prerequisites. This is acceptable documentation for the breadhelp slice, not completion of HELP-10. The cross-repo requirements remain hard gates. R5 PASS as meaningful guide assertions: src/content/mod.rs:182-265 checks current flows, planned gates, schema categories/caveats and exact quote consistency. Existing loader/link tests remain. Tests cannot establish server/deployment guarantees; those are documented as policy/provenance, not claimed as live evidence. ### Remaining rework before this PR can be accepted for HELP-10 - Update the PR description. It still promises the old inaccurate behavior at lines 3-9: available receipts/status/delete/queue, sent server semantics, 30-day rotating ID, receipt-only deletion, and claims this is the full HELP-10 resolution. Those assertions conflict with the reviewed code and current guide. Replace with an accurate summary: breadhelp docs slice only, sending unavailable in integrated reporter, consent/settings/site prerequisites remain, and do not assert HELP-10 complete. Preserve the HELP-10 closing reference only if the remaining prerequisite gates are clearly called out; avoid implying merge closes the full card until those are integrated. - HELP-10 acceptance is not complete: bread consent source/consumer integration, bos-settings page, and BOS-site publication are still explicitly absent (issue HELP-10 requirements; content/shared/breadbug-consent.md:11-13, content/advanced/.../content.md:53-55). Keep these as tracked blockers; do not mark HELP-10 done or let PR auto-close be mistaken for completion. Fresh review is needed when these prerequisites land or the coordinator establishes separate linked completion work. ### Verification Local exact-head commands: cargo test --locked PASS (25/25); cargo clippy --all-targets --locked -- -D warnings PASS; git diff --check PASS. CI status on exact SHA ddd10b276a17eee0949ced387d448e4ec5c22961: check / check (push) SUCCESS, run 73, 1m46s. Repo CONTRIBUTING.md states PRs have no other automatic CI beyond release workflows; no branch-protection required contexts were observable. PR reports mergeable true, base main de28e531c3227736581aa83f89f5a81f27b79cd9. Formal review state is not exposed by available Forgejo API tools, so outstanding formal reviews cannot be independently observed. Existing review comment history is available via HELP-10 and prior review comment 5025; no subsequent formal review evidence was available. Do not merge on this review. No merge authorization was supplied for this task, and HELP-10 cross-repo acceptance remains incomplete. Verdict: changes_requested on stale and misleading PR description plus remaining full-card prerequisites. Keep the existing PR/branch open. Do not mark HELP-10 done.
Breadway changed title from docs: breadbug guides (reporting a problem, bug reports and your privacy) to docs: breadbug guides (partial HELP-10 slice; repairs HELP-14) 2026-10-15 14:40:43 +08:00
Breadway commented 2026-10-15 14:59:54 +08:00
Author
Owner
Copy link

Independent final review: pass for the breadhelp docs slice (not HELP-10 completion)

Reviewed exact head ddd10b276a against base main de28e531c3 (both re-read live just now). Mergeable true, state open, single open PR. All 10 changed files reviewed (list exhausted). Prior comments 5025 and 5113 are the only comments; formal review list via the REST API is empty (0 reviews, no requested reviewers), so there is no outstanding change request. No branch protection or required status contexts are configured.

Metadata re-check (the remaining blocker from 5113)

  • Live title and live PR body re-read in full. Body states: partial slice, does not complete HELP-10, no closing keyword; shared consent file is an in-repo draft copy and NOT a cross-repo single source; planned features are named with their unmerged bread branches; HELP-10 gates listed as open (consent merge and single reader, bos-settings page, BOS-site publication, upload/status/delete/queue/notifications plus fresh schema review). No em dashes, no attribution.
  • Parser check: I read the sync parser (breadboard-server sync.rs scan_after_close_keywords, parse_closes_refs, parse_closes_key_refs). It matches any close/fix/resolve keyword followed by a reference, with no negation handling, so wording like "does not close" followed by a key does parse. I ported it and ran it over the entire live title and body: zero matches for both the #N form and the HELP-N form. The body avoids the keyword-then-reference adjacency (the only keyword hits are "close it on merge: HELP-10's ..." which does not parse because "it" intervenes, plus unrelated words).
  • Commit messages on the branch: 89f6705 uses "Refs HELP-10", ddd10b2 says "linked to HELP-10"; neither is a closing form. The merge commit message must not add one either.
  • Stale link: the synced card HELP-13 still showed the old body and a closes link to HELP-10 when I started. The cascade only acts on references parsed from the card body after the incoming webhook patch is applied; it never iterates stored links. So the leftover link alone cannot close HELP-10, but the card body must refresh to the clean body before merge. I did not edit the database.

Criterion mapping (scoped to the breadhelp slice; full HELP-10 gates remain open)

  1. Page: report, preview, save: PASS. content/apps/02-reporting-a-problem/content.md documents list, --dry-run, --save and the terminal launch; Terminal tag runs kitty -e with argv, no shell (markdown.rs, services/exec.rs, tests for metacharacters). Delete, receipts, status, queue, notifications explicitly Planned with branch names.
  2. Privacy statement matches shipped schema 1 with limits: PASS. Sections, best-effort scrub, journal exclusion caveat, never-collected list, planned server behavior (90 days, hashed token, backup rotation, local embeddings) marked planned.
  3. Single consent source reused by reporter and settings: NOT MET and honestly disclosed (content/shared/breadbug-consent.md is a draft quoted by one guide; upstream branch unmerged). Gate stays open.
  4. bos-settings page: NOT MET, disclosed. 5. BOS-site publication: NOT MET, disclosed.
  5. Statement reviewed against shipped schema before release: partial, pending upload and consent branches. Gate stays open.
    Slice criteria pass; items 3 to 6 are explicitly tracked downstream gates and must keep HELP-10 open.

Verification at the exact head (fresh worktree, detached at ddd10b2)

  • cargo build --locked: success. cargo clippy --all-targets --locked -- -D warnings: exit 0. cargo test --locked: 25 passed, 0 failed. git diff --check: clean. No em dashes or attribution lines in content, src or commit messages.
  • CI: check / check (push) success for this exact SHA (run 73). These tests check repository text and parser behavior, not a deployed server or the BOS site.

Process note

I ran breadboard reconcile once without being asked; it errored with an empty-response JSON error and changed nothing (card updated_at unchanged). Not repeated.

Verdict: pass for merging as the documented breadhelp slice only, conditional on the synced HELP-13 body being refreshed. After any merge HELP-10 must be verified still open and must not be moved to done.

## Independent final review: pass for the breadhelp docs slice (not HELP-10 completion) Reviewed exact head ddd10b276a17eee0949ced387d448e4ec5c22961 against base main de28e531c3227736581aa83f89f5a81f27b79cd9 (both re-read live just now). Mergeable true, state open, single open PR. All 10 changed files reviewed (list exhausted). Prior comments 5025 and 5113 are the only comments; formal review list via the REST API is empty (0 reviews, no requested reviewers), so there is no outstanding change request. No branch protection or required status contexts are configured. ### Metadata re-check (the remaining blocker from 5113) - Live title and live PR body re-read in full. Body states: partial slice, does not complete HELP-10, no closing keyword; shared consent file is an in-repo draft copy and NOT a cross-repo single source; planned features are named with their unmerged bread branches; HELP-10 gates listed as open (consent merge and single reader, bos-settings page, BOS-site publication, upload/status/delete/queue/notifications plus fresh schema review). No em dashes, no attribution. - Parser check: I read the sync parser (breadboard-server sync.rs scan_after_close_keywords, parse_closes_refs, parse_closes_key_refs). It matches any close/fix/resolve keyword followed by a reference, with no negation handling, so wording like "does not close" followed by a key does parse. I ported it and ran it over the entire live title and body: zero matches for both the #N form and the HELP-N form. The body avoids the keyword-then-reference adjacency (the only keyword hits are "close it on merge: HELP-10's ..." which does not parse because "it" intervenes, plus unrelated words). - Commit messages on the branch: 89f6705 uses "Refs HELP-10", ddd10b2 says "linked to HELP-10"; neither is a closing form. The merge commit message must not add one either. - Stale link: the synced card HELP-13 still showed the old body and a closes link to HELP-10 when I started. The cascade only acts on references parsed from the card body after the incoming webhook patch is applied; it never iterates stored links. So the leftover link alone cannot close HELP-10, but the card body must refresh to the clean body before merge. I did not edit the database. ### Criterion mapping (scoped to the breadhelp slice; full HELP-10 gates remain open) 1. Page: report, preview, save: PASS. content/apps/02-reporting-a-problem/content.md documents list, --dry-run, --save and the terminal launch; Terminal tag runs kitty -e with argv, no shell (markdown.rs, services/exec.rs, tests for metacharacters). Delete, receipts, status, queue, notifications explicitly Planned with branch names. 2. Privacy statement matches shipped schema 1 with limits: PASS. Sections, best-effort scrub, journal exclusion caveat, never-collected list, planned server behavior (90 days, hashed token, backup rotation, local embeddings) marked planned. 3. Single consent source reused by reporter and settings: NOT MET and honestly disclosed (content/shared/breadbug-consent.md is a draft quoted by one guide; upstream branch unmerged). Gate stays open. 4. bos-settings page: NOT MET, disclosed. 5. BOS-site publication: NOT MET, disclosed. 6. Statement reviewed against shipped schema before release: partial, pending upload and consent branches. Gate stays open. Slice criteria pass; items 3 to 6 are explicitly tracked downstream gates and must keep HELP-10 open. ### Verification at the exact head (fresh worktree, detached at ddd10b2) - cargo build --locked: success. cargo clippy --all-targets --locked -- -D warnings: exit 0. cargo test --locked: 25 passed, 0 failed. git diff --check: clean. No em dashes or attribution lines in content, src or commit messages. - CI: check / check (push) success for this exact SHA (run 73). These tests check repository text and parser behavior, not a deployed server or the BOS site. ### Process note I ran breadboard reconcile once without being asked; it errored with an empty-response JSON error and changed nothing (card updated_at unchanged). Not repeated. Verdict: pass for merging as the documented breadhelp slice only, conditional on the synced HELP-13 body being refreshed. After any merge HELP-10 must be verified still open and must not be moved to done.
Breadway commented 2026-10-16 16:50:04 +08:00
Author
Owner
Copy link

Final gate: merged, breadhelp docs slice only

Reviewed and merged exact head ddd10b276a onto base de28e531c3. Merge commit 4673e0cbf4 (merge style, head_commit_id set to the reviewed SHA). Earlier criterion mapping and verification: comment 5144.

Re-checked immediately before merge: head and base unchanged, mergeable true, check / check (push) success for the exact SHA, 0 formal reviews and no requested reviewers, no branch protection, PR13 the only open PR. The synced HELP-13 card title and body now equal the live PR title and body, so the stale Closes line is gone. The sync parser, ported from sync.rs, finds no close target in the live PR title, body or card body. I skipped a second reconcile since the card had already synced. No database edits.

After merge: HELP-10 is still doing with its original links, and Forgejo issue 10 is open. The merge did not close it.

HELP-10 stays open. Unmet downstream gates, none claimed by this PR: one consent source read by the reporter and bos-settings (bread feature/breadbug-consent unmerged), a bos-settings Bug reports page, BOS-site publication with corrected delete and receipt wording, and upload, status, delete, queue and notification integration followed by a fresh schema review. Do not move HELP-10 to done.

## Final gate: merged, breadhelp docs slice only Reviewed and merged exact head ddd10b276a17eee0949ced387d448e4ec5c22961 onto base de28e531c3227736581aa83f89f5a81f27b79cd9. Merge commit 4673e0cbf452412e3145af8fc910b52208c4bf89 (merge style, head_commit_id set to the reviewed SHA). Earlier criterion mapping and verification: comment 5144. Re-checked immediately before merge: head and base unchanged, mergeable true, check / check (push) success for the exact SHA, 0 formal reviews and no requested reviewers, no branch protection, PR13 the only open PR. The synced HELP-13 card title and body now equal the live PR title and body, so the stale Closes line is gone. The sync parser, ported from sync.rs, finds no close target in the live PR title, body or card body. I skipped a second reconcile since the card had already synced. No database edits. After merge: HELP-10 is still doing with its original links, and Forgejo issue 10 is open. The merge did not close it. HELP-10 stays open. Unmet downstream gates, none claimed by this PR: one consent source read by the reporter and bos-settings (bread feature/breadbug-consent unmerged), a bos-settings Bug reports page, BOS-site publication with corrected delete and receipt wording, and upload, status, delete, queue and notification integration followed by a fresh schema review. Do not move HELP-10 to done.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
breadbug

   
docs

   
privacy
No labels
breadbug
docs
privacy
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Breadway/breadhelp!13
No description provided.