Copy the phase 19 detector shape onto five sibling plugin roots, named short tests, postgres tracers plus GDPR names, and the three decision-note greps.
Co-authored-by: Cursor <cursoragent@cursor.com>
- modules/breakwater exports Render(markdown) and Purify(html): goldmark GFM
in its default safe mode (raw HTML stripped, unsafe links dropped), then a
named bluemonday policy built from NewPolicy, not the UGC preset
- the policy is the PHP golem15/forum HTMLPurifier config 1:1: the fixed
element list, a[href|rel|target], http/https/mailto only, rel=nofollow on
every link, target=_blank plus noopener on fully-qualified links
- tests cover the PHP ForumMarkdownRenderTest corpus, links per scheme,
blank input, the Purify allow-list and concurrent use; testable examples
feed the docs page snippets
- module README, root module table row, introduction.md Utilities row and
docs/services/markdown.md (which gate serves user content vs admin fields)
- go.mod and go.sum unchanged: bluemonday v1.0.27 and goldmark v1.8.6 were
already pinned
Pin github.com/livekit/server-sdk-go/v2 v2.19.0 (Apache-2.0). Flag
pion/media-sdk/buildkit; production talks to RoomAPI only; tests ship a
fake and must not construct lksdk.Room. Operator HTTP uses fetchguard
TrustedMode. Token golden vs PHP LiveKitService.php 80-99; jwt/v5
MapClaims fallback if ToJWT differs.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Task 1 wrote the forum policy note; forum execution waits on the D-17 module
- Do not create sm-forum-plugin until Render and Purify exist
Co-authored-by: Cursor <cursoragent@cursor.com>
- Pin the named forum policy on bluemonday v1.0.27 already in go.mod
- Separate it from seaglass UGC: PHP allow-list, http/https/mailto, nofollow and target blank
- D-17 owns Render/Purify; forum must not vendor goldmark or bluemonday
Co-authored-by: Cursor <cursoragent@cursor.com>
Advance Phase 19.1 to plan 2 of 6 and tick 19.1-01 on the roadmap now that the sibling plugin is on origin/main.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the proceed-and-push lock, sibling repo commits, tea remote, and Task 3 deviations so later 19.1 plans can consume the new plugin.
Co-authored-by: Cursor <cursoragent@cursor.com>
The fail-closed postgres list now names the teammate DM write-IDOR case so CR-01 cannot regress silently. TestDeletingCascade stays required.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record CR-01/CR-02 gap closure and mark the 19-06 ROADMAP checkbox. Plugin repos were committed separately and not pushed.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Named short tests must pass; a skip, miss or red required test fails.
- No admin or layers stage; postgres is Docker-host only.
Co-authored-by: Cursor <cursoragent@cursor.com>
Duplicate T-19-04/T-19-06 across plans blocked execute-phase; keep the
originals on 19-01 and 19-03 and give the later plans new registers.
Co-authored-by: Cursor <cursoragent@cursor.com>
