Remove hardcoded conformance badge, report, and CI artifact (#39)#44
Open
davidcrowe wants to merge 1 commit into
Open
Remove hardcoded conformance badge, report, and CI artifact (#39)#44davidcrowe wants to merge 1 commit into
davidcrowe wants to merge 1 commit into
Conversation
saveReport.ts wrote all five conformance categories (pkce, jwt_verify, scope_enforcement, allowlist, expiry) as "pass" with a fresh timestamp, consulting no test — and npm test ran it after every suite. The committed docs/conformance.json reflected that, and the README badge read its version. For a repo-visibility push this is the single highest-risk artifact: one file-read of saveReport.ts discredits every other claim. Rather than fake a conformance suite, remove it. PKCE is not implemented in this repo (the OAuth/PKCE flow is delegated to Auth0; the only "pkce" reference is a ChatGPT-DCR detection heuristic), so that category cannot be honestly asserted at all. The other four map to real unit-tested code, but badging library unit tests as "OAuth 2.1 + MCP Authorization conformance" overclaims the same way. An absent badge is honest; a hardcoded one is not. A real MCP Authorization conformance suite is a separate, larger effort. Removed: - README "MCP/Auth Conformance" badge - docs/conformance.json - packages/explicabl-core/src/reporting/saveReport.ts (+ compiled .js) - docs/testing/conformance.md (empty) - .github/workflows/conformance.yml (redundant: build.yml already runs tests; its only distinct job was uploading conformance.json) - the conformance:report npm script; stripped it from the test script - conformance mentions in operations/testing/deployment docs + CONTRIBUTING Build green, 159 tests pass, npm test no longer regenerates the file.
This was referenced Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #39.
Recommendation: remove, don't wire
The issue offered two paths — wire
saveReport.tsto real tests, or remove the badge + file + script. I recommend removal, for a concrete reason found while investigating:pkcereference in the codebase is a ChatGPT-DCR detection heuristic (token_endpoint_auth_method === "none"). There is nocode_challenge/S256 verification to assert against. So thepkcecategory can never be honestly backed here.jwt_verify,scope_enforcement,allowlist,expiry) do map to real, unit-tested package code — but badging library unit tests as "OAuth 2.1 + MCP Authorization conformance" overclaims in exactly the way a skeptical evaluator catches. A conformance badge implies a conformance suite against the spec; that suite doesn't exist.0.1.0) anyway — near-zero credibility value, high risk.An absent badge is honest; a hardcoded one is not. A genuine MCP Authorization conformance suite (real spec test vectors) is a worthwhile later effort, not something to fake under the star-push clock.
Removed
MCP/Auth Conformancebadgedocs/conformance.jsonpackages/explicabl-core/src/reporting/saveReport.ts(+ its committed compiled.js)docs/testing/conformance.md(was empty).github/workflows/conformance.yml— redundant:build.ymlalready runsnpm test; this workflow's only distinct job was uploadingconformance.json. No loss of test CI.conformance:reportnpm script, and stripped&& npm run conformance:reportfromtestoperations.md,testing.md,deployment.md,CONTRIBUTING.mdVerification
npm run buildclean ·npm testgreen (17 files / 159 tests) ·npm testno longer regenerates any conformance file · no residualconformance/saveReportreferences outsidenode_modules.Not merged — that's yours.
Note:
packages/explicabl-core/src/reporting/dcrLastSeen.ts(0-byte) + its.jsare dead files left in that dir, unrelated to conformance — flagging for the #42 hygiene sweep rather than expanding this PR's scope.