diff options
Diffstat (limited to 'CLAUDE.md')
| -rw-r--r-- | CLAUDE.md | 18 |
1 files changed, 18 insertions, 0 deletions
@@ -338,6 +338,24 @@ anything that assumes one key per person. key from the per-node identities. What it does cost is metadata: the hub now knows how many devices an account has and when each last signed in +- **The desktop client exists as source and has never been run.** There is no + npm on the development machine, so Electron was never installed and + `packages/meshbay-client/` has not been launched once. `test_desktop_shell.py` + pins its security contract by reading the source — sandbox, contextIsolation, + the privileged `app://` scheme, the CSP keeping `wasm-unsafe-eval`, the + traversal check, the bridge exposing no path. That is the same weak evidence + `test_downloads.py` gives the browser save paths, and for the same reason: it + catches a property being *removed*, and proves nothing about the thing running + +- **A user unit cannot carry `User=`.** `meshbay-node.spec` installed the system + template into `%{_userunitdir}`, where systemd refuses the file outright — the + packaged unit could never have started, and nothing noticed because nobody had + built and installed the RPM. Two units now, `test_packaging_units.py` holds + each in its own directory. Note the test's own first version searched the + whole file and matched the *comment* explaining why `User=` is absent; parse + directives, not text — the same mistake as reading a CSP out of the comment + above the meta tag + ## Two lessons that cost four rounds of live testing - **`QE/deploy/e2e.py` cannot test `app.js`.** It is a second implementation of the |