chore: deslop compiled vocabulary validation

[steipete]

The ingestion allowlist is compiled into the Worker, but its caller still used an asynchronous catalog loader and an unavailable-catalog fallback. Use one module-private set and filter directly, removing the obsolete loader without changing admitted names, canonicalization, sorting, or stored columns. Callers only receive fresh result arrays.

Update comments, package metadata, and vocabulary documentation that still described the retired public dashboard and seven-day stats window. Historical export formats remain supported.

Validation: on a remote Linux runner with Node 24.18.1, npm ci && npm run check && npx wrangler deploy --dry-run passed: vocabulary consistency, TypeScript, all 406 tests in 12 files, and the Worker bundle. Tests retain private-name rejection, canonicalization, caller-result isolation, and workerd HTTP coverage. Independent Codex review found no actionable P0–P2 findings. Production source shrinks; no collection or endpoint behavior changes.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 23, 2026, 3:50 AM ET / 07:50 UTC.

ClawSweeper review

What this changes

The PR simplifies telemetry name validation to use a private compiled set and updates documentation referring to the retired public dashboard.

Merge readiness

⛔ Blocked before merge - 2 items remain

Keep open: this is a focused, useful cleanup that is not implemented on main. No actionable code defect was found, but the supplied validation does not satisfy the contributor real-behavior proof gate.

Priority: P3
Reviewed head: 9da235bfaf318fc0be3424ce5da1930b0d034d57

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The patch is focused and source-consistent, but its evidence remains limited to automated validation and dry-run bundling.
Proof confidence	🦪 silver shellfish (2/6)	Needs real behavior proof before merge: Needs real behavior proof before merge: supplied tests and dry-run compilation do not demonstrate a valid feature-statistics POST reaching the changed filter and producing canonical public names while excluding private names in a real setup. The workerd coverage exercises other paths. No stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: Needs real behavior proof before merge: supplied tests and dry-run compilation do not demonstrate a valid feature-statistics POST reaching the changed filter and producing canonical public names while excluding private names in a real setup. The workerd coverage exercises other paths. No stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	7 items	Pinned introduced change: The seven-file introduced diff removes the asynchronous set loader, retains lowercase filtering, deduplication and sorting, and changes all three ingestion callers. Other changes are documentation, metadata and corresponding tests. Current main still contains the loader: Main constructs a fresh set in loadKnownNames and passes it into keepKnownNames; the proposed simplification remains distinct work. Storage and vocabulary contracts preserved: The introduced diff leaves the generated vocabulary, retained metadata, analytics column builder, lockfile and deployment configuration unchanged. The removed undefined-catalog branch was unreachable from the compiled loader during normal ingestion.
Findings	None	None.
Security	None	None.

How this fits together

The telemetry Worker receives update checks with optional feature statistics, filters reported names against a compiled public vocabulary, and writes validated analytics rows before returning the latest version.

flowchart TD
 A[Update request] --> B[Parse optional feature statistics]
 B --> C[Filter names against compiled vocabulary]
 D[Reviewed public names] --> C
 C --> E[Write analytics row]
 E --> F[Return latest version]

Loading

Before merge

• Add real behavior proof - Needs real behavior proof before merge: Needs real behavior proof before merge: supplied tests and dry-run compilation do not demonstrate a valid feature-statistics POST reaching the changed filter and producing canonical public names while excluding private names in a real setup. The workerd coverage exercises other paths. No stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Complete next step (P2) - Add after-fix real-setup ingestion evidence to the PR body. Terminal output or redacted logs count; screenshots or recordings are welcome when they show the result. Redact IPs, keys, private endpoints and other private details. Updating the body should trigger re-review; otherwise ask a maintainer to comment @clawsweeper re-review.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test LOC	Production source +10/-17 (net -7); tests +17/-31 (net -14)	The cleanup reduces source and test code while retaining privacy and canonicalization assertions.

Technical review

Best possible solution:

Keep one encapsulated compiled vocabulary while preserving accepted names, independent result arrays and the existing analytics format.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR removes obsolete implementation scaffolding rather than reporting broken existing behavior.

Is this the best way to solve the issue?

Yes: direct filtering against an unexposed compiled set is a narrow simplification, and all repository callers are updated without changing the vocabulary or storage contract.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against d57a65267837.

Labels

Label changes:

• add P3: This is bounded internal cleanup and documentation maintenance without an identified user-facing regression.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Needs real behavior proof before merge: supplied tests and dry-run compilation do not demonstrate a valid feature-statistics POST reaching the changed filter and producing canonical public names while excluding private names in a real setup. The workerd coverage exercises other paths. No stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P3: This is bounded internal cleanup and documentation maintenance without an identified user-facing regression.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Needs real behavior proof before merge: supplied tests and dry-run compilation do not demonstrate a valid feature-statistics POST reaching the changed filter and producing canonical public names while excluding private names in a real setup. The workerd coverage exercises other paths. No stored-data contract changes. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Pinned introduced change: The seven-file introduced diff removes the asynchronous set loader, retains lowercase filtering, deduplication and sorting, and changes all three ingestion callers. Other changes are documentation, metadata and corresponding tests. (src/allowlist.ts:17, 9da235bfaf31)
• Current main still contains the loader: Main constructs a fresh set in loadKnownNames and passes it into keepKnownNames; the proposed simplification remains distinct work. (src/allowlist.ts:20, d57a65267837)
• Storage and vocabulary contracts preserved: The introduced diff leaves the generated vocabulary, retained metadata, analytics column builder, lockfile and deployment configuration unchanged. The removed undefined-catalog branch was unreachable from the compiled loader during normal ingestion. (src/analytics.ts:5, 9da235bfaf31)
• Validation evidence and coverage boundary: The complete supplied PR body reports 406 passing tests, typechecking, vocabulary consistency and a Wrangler dry-run on Linux with Node 24.18.1; the live body matches it. Filtering coverage uses mocked analytics writes. The inspected workerd HTTP tests cover geography, retired stats and malformed UTF-8, rather than a valid mixed public/private-name submission through the changed filter. No after-fix real-setup ingestion evidence is supplied. Tests were not executed during this read-only review. (test/latest-version-runtime.test.mjs:14, 9da235bfaf31)
• Related merged vocabulary work: fix(telemetry): retain public name vocabulary #8 is merged and established retained compiled names and canonicalization. It retained fresh-set loading, so it does not supersede this cleanup. Its author is vincentkoc, also the requested reviewer of this PR. (9507ba481c90)
• Area history and inspection limitation: Available main history connects Vincent Koc to vocabulary and ingestion work and Peter Steinberger to dashboard retirement and adjacent cleanup. Deeper follow-history and pickaxe inspection encountered unavailable historical blobs; no feature-introduction attribution is inferred from that incomplete history. (src/allowlist.ts, d57a65267837)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add redacted after-fix runtime output showing public-name canonicalization, private-name rejection and a successful update response through the Worker ingestion path.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.