Repository navigation
An app icon, a card that unfurls, and a security policy that says what is not a finding - #9
Merged
Merged
Conversation
The iOS runner had no Assets.xcassets at all, so every screenshot of it showed the default blank silhouette -- an agent app that looks like a prototype in the one image anybody sees of it. Android's adaptive layers landed with the status screen; this is the other half. The icon is rendered from a new full-bleed cut of the mark rather than from mark.svg, because iOS and Android both apply their own corner mask and a source that rounds itself gets rounded twice. The PNG carries no alpha, which iOS rejects outright. Both project specs pick it up: project.llama.yml includes project.yml, so wiring ASSETCATALOG_COMPILER_APPICON_NAME once covers the framework build too. The repository had no social preview, so every share of the link -- portfolio, chat, anywhere with an unfurl -- rendered GitHub's generated text card instead of the banner that already existed. There is no API for uploading one, so the image is committed and the upload is a click in Settings. architecture.svg is the mermaid diagram exported for surfaces that do not render mermaid. It carries its own charcoal ground on purpose: the labels are light, and without one it is invisible on a white page, which is most of the places it would be dropped. Getting a standalone SVG out of a browser also needs XMLSerializer rather than outerHTML -- the HTML serializer leaves the <br> inside every foreignObject label unclosed, and a .svg file is parsed as XML, so the whole thing becomes a parse error rather than a diagram. docs/brand.md records the two colours, which mark cut is for what, how each asset is generated, and the two traps above, so the next asset matches this one without anybody re-deriving it. Verified: BUILD SUCCEEDED for the simulator with the icon compiled in (AppIcon60x60@2x.png, AppIcon76x76@2x~ipad.png and Assets.car in the bundle, CFBundleIconName set), the committed project still carries 0 xcframework references, architecture.svg parses as XML and renders, and mkdocs --strict is clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The community profile was at 42%: no CONTRIBUTING, no SECURITY, no code of conduct, no templates. For most projects that is a formality. For one whose front page says "there is no authentication, by design" it is the specific gap that earns a drive-by "critical vulnerability" issue, and answering that issue costs more than writing the policy did. So SECURITY.md leads with the posture rather than burying it: the network is the access control, FLEET_BIND decides which network, and the dashboard token is a speed bump against a stray browser tab rather than an access control -- all of which the README already said, now said somewhere a reporter looks first. Then it names what a real finding would look like, which is the half that keeps the useful reports coming: the shell workload's allowlist, artifact path handling, the web-* workloads fetching arbitrary URLs by design, credentials reaching a log or an uploaded artifact, and FLEET_BIND not binding where it says. CONTRIBUTING.md is the suites, and the things that have cost an evening each: one xcodebuild per simulator, xcodegen by full path in anything non-interactive, do not commit a project regenerated with the framework present, -Pfleet.skipNative is how you run the Android tests with no NDK, and a metric name outside result.schema.json is stored and unqueryable. It ends on the rule the codebase actually runs on -- say what is not true yet -- because that is the review comment a contributor would otherwise get after the fact. The device report template is the point of the whole exercise. The project exists to produce comparable numbers across hardware nobody has a lab full of, and every phone that is not on this shelf is data this repository does not have, including the ones that refused to work. The code of conduct is Contributor Covenant 2.1 unmodified, with its contact placeholder pointed at the maintainer's GitHub rather than an email address, since publishing one in a public file is a decision the owner should make rather than one I should make for him. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two commits: the assets the project was missing, and the community files it had
none of.
Assets
The iOS runner had no
Assets.xcassetsat all, so every screenshot of itshowed the default blank silhouette — an agent app that looks like a prototype
in the one image anybody sees of it. Android's adaptive layers landed with the
status screen in #5; this is the other half.
The icon renders from a new full-bleed cut of the mark rather than from
mark.svg, because iOS and Android both apply their own corner mask and asource that rounds itself gets rounded twice. The PNG carries no alpha, which
iOS rejects outright.
project.llama.ymlincludesproject.yml, so wiringASSETCATALOG_COMPILER_APPICON_NAMEonce covers the framework build too.There was no social preview, so every share of the link rendered GitHub's
generated text card instead of the banner that already existed. The image is
committed; there is no API for uploading one, so that part is a click (see
below).
architecture.svgis the mermaid diagram exported for surfaces that do notrender mermaid — a portfolio, a post, a slide. It carries its own charcoal
ground on purpose: the labels are light, and without one it is invisible on
white, which is most of where it would be dropped.
!!! note
Getting a standalone SVG out of a browser needs
XMLSerializer, notouterHTML. The HTML serializer leaves the<br>inside everyforeignObjectlabel unclosed, and a.svgfile is parsed as XML — so thefirst export was a parse error rather than a diagram.
docs/brand.mdrecords the two colours, which cut of the mark is for what, howeach asset is generated, and both traps above.
Community
The community profile was 42%. For most projects that is a formality. For
one whose front page says "there is no authentication, by design" it is the
specific gap that earns a drive-by "critical vulnerability" issue.
So
SECURITY.mdleads with the posture and then names what a real findingwould look like, which is the half that keeps the useful reports coming: the
shellworkload's allowlist, artifact path handling, theweb-*workloadsfetching arbitrary URLs by design, credentials reaching a log or an uploaded
artifact, and
FLEET_BINDnot binding where it says.CONTRIBUTING.mdis the suites plus the things that have cost an evening each— one
xcodebuildper simulator,xcodegenby full path in anythingnon-interactive, don't commit a project regenerated with the framework present,
-Pfleet.skipNative, and metric names outside the schema.The device report template is the point of the exercise: every phone that is
not on this shelf is data this repository does not have, including the ones that
refused to work.
Code of conduct is Contributor Covenant 2.1 unmodified, with its contact
placeholder pointed at @addisdev on GitHub rather than an email address —
publishing one in a public file is your call, not mine. Say the word and I will
swap it.
Two things only you can do
docs/img/social-preview.pngunder Settings → Social preview.There is no API for it.
Verified
BUILD SUCCEEDEDwith the icon compiled in —AppIcon60x60@2x.png,AppIcon76x76@2x~ipad.pngandAssets.carin the bundle,CFBundleIconNamesetmkdocs build --strictcleanactionlintclean🤖 Generated with Claude Code