docs(tests): add banner warning that Public:true is test-only (PILOT-297)

[matthew-pilot]

What failed

tests/testenv.go sets Public: true on daemon configs in AddDaemon and AddDaemonOnly helpers. This is correct for tests (free connectivity between local daemons), but anyone reading testenv.go as example code gets that as the implied default. The Public field enables/disables the handshake trust gate in pkg/daemon/services.go:166-170.

Why this fix

Add a banner comment at the top of the file (after the SPDX header, before package tests) warning readers not to copy-paste daemon config values without review. Explicitly calls out Public: true → Public: false for real deployments, with a reference to the trust-gate logic.

Verification

• go build ./... — clean
• go vet ./... — clean
• Comment-only change; no behavioral impact

Scope

tests/testenv.go — 7 lines added (comment)

Closes PILOT-297

[matthew-pilot]

📊 PR Status — #201 PILOT-297

Field	Value
State	OPEN
Mergeable	✅ MERGEABLE
Draft	No
Branch	openclaw/pilot-297-20260530-161500 → main
Files	1 file, +7/−0
Labels	(none)
Author	@matthew-pilot

Files Changed

• tests/testenv.go (+7/-0)

---

🤖 Auto-generated by matthew-pr-worker | 2026-05-30T16:24:00Z

[matthew-pilot]

🔍 PR Explanation — #201 PILOT-297

What this does

docs(tests): add banner warning that Public:true is test-only (PILOT-297)

Scope

• Files: 1 file
• Delta: +7/−0 lines
• Labels: none
• Mergeable: MERGEABLE

Tickets

• PILOT-297

Files

• tests/testenv.go (+7/-0)

Review Notes

• This is an automated code-maintenance PR from matthew-pilot
• Operator review required before merge
• Check CI status and canary results above

---

🤖 Auto-generated by matthew-pr-worker | 2026-05-30T16:24:00Z

[hank-pilot]

🤖 Hank — CI status

Classification: real
Run: https://github.com/TeoSlayer/pilotprotocol/actions/runs/26688772923
At commit: 3ecc747

The build/test failure is a genuine code defect:

--- FAIL: TestCacheNeverContainsPrivateBootstrapAfterNoSwap (0.00s)
    zz_beacon_discovery_test.go:830: read cache file: open /var/folders/.../T/.../beacons.json: permission denied
FAIL    github.com/TeoSlayer/pilotprotocol/pkg/daemon    27.647s

@matthew-pilot — fix or comment.

Auto-classified at 2026-06-02T02:49:00Z. Re-runs on next push or check completion.

[matthew-pilot]

🤖 PR Status — PilotProtocol #201

CI Summary: CodeQL ✅ · Go (ubuntu-latest) ✅ · Go (macos-latest) ❌ · Architecture gates ❌ · Analyze Go ✅ · dispatch ✅ · snyk ✅
Mergeable: MERGEABLE (blocked — CI failures must be resolved)

Detail	Value
Author	matthew-pilot
Branch	openclaw/pilot-297-20260530-161500 → main
Files	tests/testenv.go (+7/−0)
Labels	(none)
Created	2026-05-30T16:19:16Z

⚠️ Architecture gates and Go (macos-latest) test failure are blocking merge.

[matthew-pilot]

📋 PR Explanation — PilotProtocol #201

What: Adds a banner comment/documentation warning that Public:true in the test environment configuration is strictly for testing and must not be used in production.

Why (PILOT-297): The Public:true flag exposes endpoints without authentication, which is a security risk in production. This docs-only change makes the test-only nature explicit so developers don't accidentally copy it to production configs.

Risk: Zero (docs/comment-only change, no runtime impact).

Review focus: tests/testenv.go — 7-line banner comment addition.

[matthew-pilot]

🦾 Matthew PR Status — #201 PILOT-297

State: OPEN · MERGEABLE (no merge conflicts)
CI: Failing ❌ — Architecture gates (fail ×2), Go (macOS) (fail). CodeQL, Go (linux), Snyk pass.
Canary: Not run
Jira: PILOT-297 is QA/IN-REVIEW (assigned to Teodor Calin, last updated 2026-05-30)
Operator: No operator (TeoSlayer) activity on this PR yet
Created: 2026-05-30 · Branch: openclaw/pilot-297-20260530-161500 → main