fix(db): default new-device trust_weight to 0.50 (#15) - #23
Merged
Conversation
Align the devices.trust_weight column default with trust.TrustBase so enrolment no longer shows 1.00 until the first recompute. Fixes Hushield#15
Omit reliance on the column default alone: upsertDevice now writes trust.TrustBase explicitly, and tests cover both the insert path and the schema default after migration 0006.
This was referenced Sep 12, 2026
jbrahy
added a commit
that referenced
this pull request
Sep 12, 2026
CI's govulncheck step fails on five Go standard library vulnerabilities present in 1.26.5 and fixed in 1.26.6: GO-2026-6089, GO-2026-5972, GO-2026-5026 and two others reached through net/http, encoding/asn1 and crypto/tls from cmd/server, internal/push, internal/attest and internal/api. This is what has actually been failing CI, and it matters more than a red badge: govulncheck runs BEFORE "go test (race + cover)", and its failure SKIPS the test step entirely. Every run since these advisories landed reported a failure without ever executing a single Go test. That is how the stale e2e expectation in 52184d5 (#23) reached main claiming "CI covers those" -- CI had stopped running the tests it was said to cover. Worth considering separately: a security scanner that silently disables the test suite when it trips is the wrong ordering. Running go test before govulncheck, or continue-on-error on the scan, would keep test results visible while a stdlib advisory is outstanding. go.mod pins the version and CI reads it via go-version-file, so this one line moves both. Verified under 1.26.6: govulncheck reports no vulnerabilities, gofmt and go vet are clean, and go test ./... -race -cover passes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PBmEXErCWYt3WZCZKaS7m9
jbrahy
added a commit
that referenced
this pull request
Sep 12, 2026
…expectations (#25) CI was failing at govulncheck on five Go stdlib vulnerabilities in 1.26.5, fixed in 1.26.6. govulncheck runs BEFORE "go test", and its failure SKIPS the test step, so every run since those advisories reported a failure without executing a single Go test. - build: bump the Go toolchain to 1.26.6. go.mod pins it and CI reads it via go-version-file, so one line moves both. - fix(api): restore the e2e block path. 52184d5 (#23) changed new-device trust_weight from 1.00 to TrustBase (0.50) and left TestEndToEnd_FullLifecycle asserting the old arithmetic. numberA now uses six reporters so it genuinely blocks (six score 6.0 against a threshold of 5.0; five would hit it exactly, which decay makes unsafe), numberB uses three to clear the same margin problem, and a guard fails loudly naming any scoring constant that moves again. Note for follow-up: ordering a security scanner ahead of the test suite means a stdlib advisory silently disables all test feedback. Running go test first, or continue-on-error on the scan, would avoid a repeat. Consequence of #23 that the stale assertion was hiding: a number now needs FIVE fresh-device scam reports to auto-block, up from three.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
New devices omitted
trust_weighton insert and inheritedDEFAULT 1.00, then dropped to0.50on first recompute (trust.TrustBase).0006sets the column default to0.50(does not rewrite0001)api.upsertDevicenow writestrust.TrustBaseexplicitly on enrolmentFixes #15
Test plan
COLUMN_DEFAULTassertions updatedTestUpsertDevice_EnrolmentTrustMatchesTrustBase+ happy-path trust checkgo test ./internal/trust/ ./internal/api/ ./internal/db/(DB tests skip without MySQL locally)