docs(planning): record v1.5.0 as shipped - #130
Merged
Merged
Conversation
Tag v1.5.0 on 694b1bf; GitHub Release published; SVN deploy dispatched manually and verified FROM SVN — trunk Stable tag 1.5.0, tags/1.5.0/ present and carrying the per-user code (not merely the right version string), assets intact. Marks REL-11 and Phase 26 complete, flips the milestone to shipped, and adds the v1.5 entry to MILESTONES.md. The milestone entry records what this release should actually be remembered for: NINE defects found by verification and review, almost none by the test suite as first written. Most instructive is the run of FOUR consecutive holes in Config::sanitize()'s per-user authorization path — client-only gate, then payload-scoped preserve, then raw-key matching, then item-cap starvation, plus a DELETE endpoint that bypassed all of them. Each fix was correct about the case in front of it and blind to the next, and after each one the path looked settled. It only resolved by COLLAPSING three mechanisms into one, not by adding a fifth guard. The transferable lesson: when a fix keeps needing another fix, the shape is wrong, not the coverage. Also corrects ROLE-02's known-limitation text, which still claimed the multisite exempt branch was untested — the dedicated multisite CI lane closed that. Caveats carried forward rather than dropped at the finish line: the #128 fixes shipped unreviewed, there was no human screen-reader pass, and 21-05's browser verification never happened. A milestone record that quietly drops its caveats is how the next cycle inherits a false premise — which this project has already had to correct once. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes out Phase 26 (26-04 Task 4). Planning docs only.
v1.5.0 is live on WordPress.org — tag
v1.5.0on694b1bf, GitHub Release published, SVN deploy dispatched manually and verified from SVN rather than the API:trunkStable tag reads 1.5.0,tags/1.5.0/exists and carries the per-user code (not merely the right version string),assets/intact.Marks REL-11 and Phase 26 complete, flips the milestone to shipped, adds the v1.5 entry to MILESTONES.md.
What the milestone entry records
Not just what shipped, but what this release should be remembered for: nine defects found by verification and review, almost none by the test suite as first written.
The instructive one is the run of four consecutive holes in
Config::sanitize()'s per-user authorization path — client-only gate → payload-scoped preserve → raw-key matching → item-cap starvation, plus a DELETE endpoint that bypassed all of them. Each fix was correct about the case in front of it and blind to the next, and after each one the path looked settled. It only resolved by collapsing three mechanisms into one, not by adding a fifth guard.The transferable lesson, written into the record: when a fix keeps needing another fix, the shape is wrong, not the coverage.
Also corrected
ROLE-02's known-limitation text still claimed the multisite exempt branch was untested. The dedicated multisite CI lane closed that; the text now says so.
Caveats carried forward
A milestone record that quietly drops its caveats is how the next cycle inherits a false premise, which this project has already had to correct once.
🤖 Generated with Claude Code