From 634e5d49229c888cacdb7784c8a577bdefa553d6 Mon Sep 17 00:00:00 2001 From: n30nex Date: Wed, 2 Sep 2026 11:57:57 -0400 Subject: [PATCH] Restore MQTT access inventory and stabilize Lighthouse --- docs/analyzer/data-collection-access.fr.md | 19 +++++++++++++++++-- docs/analyzer/data-collection-access.md | 15 +++++++++++++-- scripts/run-lighthouse.mjs | 11 +++++++++++ tests/content/analyzer-journey.test.mjs | 10 +++++++++- 4 files changed, 50 insertions(+), 5 deletions(-) diff --git a/docs/analyzer/data-collection-access.fr.md b/docs/analyzer/data-collection-access.fr.md index 1bdf7153..427b0eea 100644 --- a/docs/analyzer/data-collection-access.fr.md +++ b/docs/analyzer/data-collection-access.fr.md @@ -8,8 +8,8 @@ task: understand-observer-data scope: canada-baseline status: draft owner: meshcore-canada -last_reviewed: 2026-07-22 -review_by: 2026-10-19 +last_reviewed: 2026-09-02 +review_by: 2026-12-01 difficulty: beginner estimated_time: 6 minutes destructive: false @@ -70,6 +70,21 @@ MeshCore Canada n’offre pas d’abonnement direct général au courtier. L’a direct est limité à CoreScope, aux administrateurs des réseaux maillés locaux et aux personnes autorisées par les administrateurs de l’infrastructure. +## Comptes MQTT en lecture seule + +Cet inventaire public répertorie les services qui utilisent un compte en lecture +seule sur les courtiers MQTT de MeshCore Canada. Il indique le service et +l’exploitant, mais jamais le nom d’utilisateur MQTT, le mot de passe ni le jeton. + +| Service | Exploitant | Utilisation | +|---|---|---| +| Beacon (`dev.meshcore.ca`) | Exploitants de MeshCore Canada | Visualisation publique des paquets et vérification des identifiants de répéteur | +| CoreScope (`live.meshcore.ca`) | Exploitants de MeshCore Canada | Outils publics pour les observateurs, les paquets, les nœuds et la carte | + +Les administrateurs de l’infrastructure doivent mettre ce tableau à jour chaque +fois qu’ils créent ou retirent un compte en lecture seule. [Signalez une entrée +manquante ou périmée](https://github.com/MeshCore-ca/MeshCore-Canada/issues/new/choose). + ## Où les données apparaissent [CoreScope](https://live.meshcore.ca/) affiche des renseignements sur les diff --git a/docs/analyzer/data-collection-access.md b/docs/analyzer/data-collection-access.md index fac423e3..445b5146 100644 --- a/docs/analyzer/data-collection-access.md +++ b/docs/analyzer/data-collection-access.md @@ -8,8 +8,8 @@ task: understand-observer-data scope: canada-baseline status: draft owner: meshcore-canada -last_reviewed: 2026-07-22 -review_by: 2026-10-19 +last_reviewed: 2026-09-02 +review_by: 2026-12-01 difficulty: beginner estimated_time: 6 minutes destructive: false @@ -60,6 +60,17 @@ Changing the radio preset changes what the observer can hear. Public and private MeshCore Canada does not offer general direct broker subscriptions. Direct access is limited to CoreScope, local mesh administrators, and people approved by the infrastructure administrators. +## Read-only MQTT accounts + +This public inventory lists services with a read-only account on the MeshCore Canada brokers. It identifies the service and operator, but never publishes broker usernames, passwords, or tokens. + +| Service | Operator | Purpose | +|---|---|---| +| Beacon (`dev.meshcore.ca`) | MeshCore Canada operators | Public packet viewer and repeater ID checks | +| CoreScope (`live.meshcore.ca`) | MeshCore Canada operators | Public observer, packet, node, and map tools | + +Infrastructure administrators must update this table whenever they create or remove a read-only account. [Report a missing or outdated entry](https://github.com/MeshCore-ca/MeshCore-Canada/issues/new/choose). + ## Where it appears [CoreScope](https://live.meshcore.ca/) shows observer, packet, and map information. Other approved MeshCore Canada services may use the same feed. diff --git a/scripts/run-lighthouse.mjs b/scripts/run-lighthouse.mjs index 6498cfb2..21e3ed02 100644 --- a/scripts/run-lighthouse.mjs +++ b/scripts/run-lighthouse.mjs @@ -69,6 +69,17 @@ async function run() { chromeFlags: ["--headless=new", "--no-sandbox", "--disable-dev-shm-usage"] }); + // A fresh Chrome process can make the first CI audit a cold-start outlier. + // Warm it once, then enforce the unchanged budgets on every measured route. + const warmupUrl = resolveSiteRoute(baseUrl, routes[0][1]); + const warmup = await lighthouse(warmupUrl, { + port: chrome.port, + output: "json", + logLevel: "error", + onlyCategories: ["performance"] + }, desktopConfig); + if (!warmup) throw new Error(`Lighthouse warm-up returned no result for ${warmupUrl}`); + const failures = []; for (const [name, route] of routes) { const url = resolveSiteRoute(baseUrl, route); diff --git a/tests/content/analyzer-journey.test.mjs b/tests/content/analyzer-journey.test.mjs index 40f4ca6f..27505389 100644 --- a/tests/content/analyzer-journey.test.mjs +++ b/tests/content/analyzer-journey.test.mjs @@ -113,17 +113,25 @@ test("all observer method guides follow one lifecycle and end in live verificati } }); -test("privacy page states ownership, access, and the unknown retention boundary", () => { +test("privacy pages state ownership, access, the account inventory, and the unknown retention boundary", () => { const source = read("docs/analyzer/data-collection-access.md"); + const french = read("docs/analyzer/data-collection-access.fr.md"); for (const phrase of [ "Policy summary", "MeshCore Canada infrastructure administrators", "Collection, access, and retention", + "Read-only MQTT accounts", "public retention period has not yet been published", "Never include in public diagnostics", ]) { assert.match(source, new RegExp(phrase, "i")); } + for (const service of ["Beacon (`dev.meshcore.ca`)", "CoreScope (`live.meshcore.ca`)"]) { + assert.ok(source.includes(service), `English inventory missing ${service}`); + assert.ok(french.includes(service), `French inventory missing ${service}`); + } + assert.match(source, /update this table whenever they create or remove a read-only account/i); + assert.match(french, /mettre ce tableau à jour chaque\s+fois qu’ils créent ou retirent un compte en lecture seule/i); }); test("verification distinguishes connectivity from an observed packet", () => {