20260902 完成公开树清理与热点拆分

scripts/ci/check_public_tree.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$REPO_ROOT"
+
+readonly PATTERN='git\.nasp\.fit|specs/develop|dev_1\.0\.0_yuyr|private[[:space:]]+(staging|repository)|remote[- ]?(231|211)|Feature #[0-9]{3}|#[0-9]{3}[[:space:]]+M[0-9]+'
+
+readonly -a PUBLIC_TEXT_PATHS=(
+  README.md
+  CONTRIBUTING.md
+  SECURITY.md
+  docs
+  docker
+  deploy
+  scripts
+  tests/compat
+  fixtures
+  crates/panda-rpki-validator/src
+  crates/panda-rpki-validator/tests/fixtures/ta_constraints
+)
+
+if matches="$(rg -n -I -g '!scripts/ci/check_public_tree.sh' -e "$PATTERN" "${PUBLIC_TEXT_PATHS[@]}")"; then
+  echo "public-tree check found internal-history wording:" >&2
+  echo "$matches" >&2
+  exit 1
+fi
+
+echo "public-tree check passed"

scripts/docker/build_image.sh

@@ -24,9 +24,9 @@ Options:
   --image <tag>          Image tag (default: panda-rpki-validator:<version>-<arch>)
   --out-dir <path>       Image archive/metadata directory (default: docker-out)
   --dockerfile <path>    Dockerfile path
-  --builder-image <tag>  Builder base image (M4 staging tag; pin before release)
-  --runtime-image <tag>  Runtime base image (M4 staging tag; pin before release)
-  --allow-dirty          Permit staging build and mark tag/metadata dirty
+  --builder-image <tag>  Builder base image (pin for a supported release)
+  --runtime-image <tag>  Runtime base image (pin for a supported release)
+  --allow-dirty          Permit a local build and mark tag/metadata dirty
   --no-binfmt            Do not install binfmt/qemu for a cross-architecture build
   --no-save              Do not write docker save archive
   --no-load              Build without loading the image into the local daemon
@@ -119,7 +119,7 @@ if [[ -n "$(git -C "$REPO_ROOT" status --short 2>/dev/null)" || "$SOURCE_COMMIT_
   SOURCE_DIRTY=true
 fi
 if [[ "$SOURCE_DIRTY" == true && "$ALLOW_DIRTY" != 1 ]]; then
-  echo "refusing dirty staging tree; pass --allow-dirty for M4 development" >&2
+  echo "refusing dirty tree; pass --allow-dirty for a local development build" >&2
   exit 2
 fi
 

scripts/runtime/run_validator.sh

@@ -69,7 +69,8 @@ usage() {
 Usage:
   ./run_validator.sh
 
-配置来自 package 根目录下的 .env；也可以用 ENV_FILE=/path/to/.env 覆盖。
+Configuration is read from .env at the package root. Set
+ENV_FILE=/path/to/.env to use a different file.
 USAGE
 }
 
@@ -1381,7 +1382,7 @@ run_one_round() {
       daemon_args+=(--db-stats-exact-every "$DB_STATS_EXACT_EVERY")
     fi
   fi
-  # Dead-repo transport blacklist (#141): opt-in via env; the daemon forwards
+  # Dead-repository transport blacklist: opt in through the environment; the daemon forwards
   # the enable flag and threshold to the child unless already present there.
   if [[ -n "${DEAD_REPO_BLACKLIST_PATH:-}" ]]; then
     daemon_args+=(--dead-repo-blacklist "$DEAD_REPO_BLACKLIST_PATH")