Pin github.com/livekit/server-sdk-go/v2 v2.19.0 (Apache-2.0). Flag
pion/media-sdk/buildkit; production talks to RoomAPI only; tests ship a
fake and must not construct lksdk.Room. Operator HTTP uses fetchguard
TrustedMode. Token golden vs PHP LiveKitService.php 80-99; jwt/v5
MapClaims fallback if ToJWT differs.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Pin the named forum policy on bluemonday v1.0.27 already in go.mod
- Separate it from seaglass UGC: PHP allow-list, http/https/mailto, nofollow and target blank
- D-17 owns Render/Purify; forum must not vendor goldmark or bluemonday
Co-authored-by: Cursor <cursoragent@cursor.com>
- go-redis v9.23.0 as the Redis client, otter v2.3.0 as the memory driver
- miniredis test-only after a human check (plan 05), s3blob behind a build tag (plan 03)
- new note .planning/notes/core-plugins-own-repos.md: shared core plugins live in sm-<name>-plugin repos mounted as submodules
- 01-CONTEXT deferral points to the note; PROJECT constraint and Key Decisions row
- ROADMAP Phase 12 repos and the 12-01 entry, and Phase 12 plans 12-01, 12-02, 12-05 name sm-user-plugin and the submodule commit workflow
- Probe keios.eu user, jz chat, and pxpx checkout for models→sibling uses
- Every live edge is a cast or service-calling hook; no "other" category
- Close folded todo verify-models-leaf-rule; bulk port may proceed
Records the move from Scala to Go, the compiled-plugin decision, the
Płytarium port as the v1 target, and the Go ecosystem research that
backs the choice. No code yet.
