Paul HittandClaude Fable 5.1
2585c4e9f9
The skill's detector scored the README, DESIGN.md and the extracted
comment prose. Fixed what it flagged: hollow intensifiers, "in order
to", "additionally", "the whole point", bold sentences in docs, and
bold that had wrapped across comment lines. Comment prose scores a
maximum of 3 out of 100 across the repo.
One sweep rule mangled two comments ("which is the entire point of X"
lost its clause); repaired, and the rule now keeps the clause.
Comments and strings only. 764 XCTest and 55 Swift Testing pass.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
3.4 KiB
Contributing
The iOS client for Flamenet Messenger, in Swift and SwiftUI. This repository is
the source of truth for the app and for the encryption engine, the
JavaScript reference implementation published as flamenet-e2e is mirrored out
of this tree, not the other way round.
Security bugs do not go in an issue
Email security@flamenetmessenger.com. See SECURITY.md.
Building
Xcode with an iOS 17+ SDK, and:
xcodegen generate
FlamenetMessenger.xcodeproj/project.pbxproj is gitignored and generated.
Do not hand-edit it and do not commit it. Files and build settings are declared
in project.yml; adding a source file means adding it there (or dropping it
into an existing group's directory) and re-running xcodegen generate. Editing
the pbxproj directly produces a project that works on your machine and on
nobody else's, and a truncated one, which is a fun afternoon.
Testing
xcodebuild -project FlamenetMessenger.xcodeproj -scheme FlamenetMessenger \
-sdk iphonesimulator -destination "platform=iOS Simulator,name=iPhone 17" \
test -only-testing:FlamenetMessengerTests
That unit suite is the merge gate and runs on the project's own macOS runner.
UI tests are not in the gate, on purpose: FlamenetMessengerUITests needs a
local relay listening on port 18810 and, for the conversation tests, two booted
simulators. Without the relay the suite skips rather than fails: a green
run that tested nothing looks identical to a green run that tested everything,
so check the executed count, not the tick.
Two traps that will cost you an hour each:
- The suite occasionally reports
TEST FAILEDwith no failing test. A clean rerun passes. Rerun before believing it. - Two test runners against one simulator produce what looks like an app crash and is not. One runner per device.
What a change needs
- Touching
Sources/E2E/? You are editing the reference implementation. ReadCONTRIBUTING.mdinflamenet-e2eas well, spec first, vectors second, code third, and keep the JS mirror in agreement. Cross-platform interop is a claim this project makes, so it has to actually be run. - Touching the wire? Android and the relay have to move with you. A field the client requires and the relay never sends breaks a feature 100% of the time while every unit test stays green, that has happened here, to groups. Diff the wire types first.
- Touching state that arrives incrementally: avatars, rosters, device lists, merge, never replace. Absent from a fetch means "not loaded yet", not "deleted". Both platforms have shipped this bug.
- Adding a user-visible security claim? It must be true of this client
specifically. See
SECURITY.md; several true-of-the-app statements are false of the web client, and the distinction is not optional.
House rules
- Fail closed. An unverifiable signature, an unknown version, an unpinned identity are refusals, and the user is told which.
- Never log message contents, keys, or tokens.
- No secrets, keystores or passphrases in the repository. It is public.
- Match the surrounding style. Comments explain why a line exists, most often, which attack it prevents.
Comments and prose
Plain text. No emoji or symbol markers, no markdown bold inside code comments, no em-dashes. Say what the code does and why, briefly; the history of how it got that way belongs in the commit message, not in the file.