New Phase 20 is a public demo instance on sm-demo-app with every shared
plugin. Phases 21-29 stay off the roadmap until their goals firm up.
The cutover (closing v1.0) moves to 30; WavePath work starts at 31 with
the former 19.2, Horoskopia follows at 36-40. Seeds, notes and the
30-CONTEXT now point at the new numbers.
An optional dependency is optional at activation, not at compile time:
importing the package that declares a looked-up type keeps the other
plugin in go.mod; only party.Plugin.Requires leaves it out.
- PG_CHATVIDEO_TESTS runs TestUserDeletionReassignsSession (WR-05)
- self-test lists the token and pins it in the PG_CHATVIDEO_TESTS line
- NOT RUN postgres banner names it
The docs stage now refuses secret-shaped content (key names, PEM private
keys, JWTs) in each sibling's testdata/goldens; --self-test plants each
pattern. Closes T-19.1-12.
Copy the phase 19 detector shape onto five sibling plugin roots, named short tests, postgres tracers plus GDPR names, and the three decision-note greps.
Co-authored-by: Cursor <cursoragent@cursor.com>
- modules/breakwater exports Render(markdown) and Purify(html): goldmark GFM
in its default safe mode (raw HTML stripped, unsafe links dropped), then a
named bluemonday policy built from NewPolicy, not the UGC preset
- the policy is the PHP golem15/forum HTMLPurifier config 1:1: the fixed
element list, a[href|rel|target], http/https/mailto only, rel=nofollow on
every link, target=_blank plus noopener on fully-qualified links
- tests cover the PHP ForumMarkdownRenderTest corpus, links per scheme,
blank input, the Purify allow-list and concurrent use; testable examples
feed the docs page snippets
- module README, root module table row, introduction.md Utilities row and
docs/services/markdown.md (which gate serves user content vs admin fields)
- go.mod and go.sum unchanged: bluemonday v1.0.27 and goldmark v1.8.6 were
already pinned
Pin github.com/livekit/server-sdk-go/v2 v2.19.0 (Apache-2.0). Flag
pion/media-sdk/buildkit; production talks to RoomAPI only; tests ship a
fake and must not construct lksdk.Room. Operator HTTP uses fetchguard
TrustedMode. Token golden vs PHP LiveKitService.php 80-99; jwt/v5
MapClaims fallback if ToJWT differs.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Task 1 wrote the forum policy note; forum execution waits on the D-17 module
- Do not create sm-forum-plugin until Render and Purify exist
Co-authored-by: Cursor <cursoragent@cursor.com>
- Pin the named forum policy on bluemonday v1.0.27 already in go.mod
- Separate it from seaglass UGC: PHP allow-list, http/https/mailto, nofollow and target blank
- D-17 owns Render/Purify; forum must not vendor goldmark or bluemonday
Co-authored-by: Cursor <cursoragent@cursor.com>
Advance Phase 19.1 to plan 2 of 6 and tick 19.1-01 on the roadmap now that the sibling plugin is on origin/main.
Co-authored-by: Cursor <cursoragent@cursor.com>
Record the proceed-and-push lock, sibling repo commits, tea remote, and Task 3 deviations so later 19.1 plans can consume the new plugin.
Co-authored-by: Cursor <cursoragent@cursor.com>
The fail-closed postgres list now names the teammate DM write-IDOR case so CR-01 cannot regress silently. TestDeletingCascade stays required.
Co-authored-by: Cursor <cursoragent@cursor.com>
