mixandClaude Opus 5
1e4746e52f
test / test (push) Has been cancelled
Nothing from the 2026-08-19 code review now lives only in its plan file. Four new roadmap items, all `candidate`: - csrf-tokens — §4.4. The review recorded a decision to add per-session tokens but never turned it into a task, and security.md still argues the header checks suffice. The item says to settle which of the two stands first. - template-data-typing — §7.1, map[string]any template payloads. - structured-logging — §7.2 and §5.5, log/slog plus the per-package logf aliases. - review-2026-08-followups — the small remainder: backup re-auth, the missing DMARC-service / handler / error-page / corrupted-backup tests, and the nine minor findings (§6.1, §6.2, §6.4, §7.4, §8.6, §9.3, §10.3-10.5) that were never carried into the phase tables. §7.3 (build tags for the /proc reader) is deliberately not carried over: it was declined during the pass, and both documents now say so, so it does not get re-raised at the next review. The plan's status table links each open row to its roadmap item, and the roadmap's recommended-order note points back at the plan. Also unlinked two CHANGELOG references to plan files deleted after those releases shipped; the text stays, the dead links do not. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>