carlos / platform Public

Reviewed platform f1076f62 and website 59b9cf9. No files edited. All 28 release ranges and own-commit counts match Git. Go tests could not start in the read-only sandbox; full npm run check requires writes. Existing website checks and in-memory rendering passed.

1. P1 — Encoded addresses and private links bypass public-output validation. internal/changelog/build.go:559 CheckPublic scans serialized source text, but Markdown decodes entities afterward. For example, [contact](mailto:ops@example.org) and [source](https://github.com/carlosframework/platform) evade its patterns. In-memory rendering produced the actual email address and private platform URL, and check-docs.mjs still passed. Fix: Validate decoded Markdown text and normalized link destinations, with a corresponding rendered-output privacy check. Add regression cases for entities and percent-encoded URLs.

1. P1 — An invalid notes form silently removes release notes while passing the gates. internal/changelog/committed_test.go:48, src/changelog.njk:160 Changing v0.24.2’s notes.form from "bullets" to "bullet" in memory removed its notes from the rendered page; the website gate passed. The Go checks never validate form, and the bullet-mapping checks still inspect the retained sections, so they cannot detect this loss. Fix: Require exactly "bullets" or "markdown" with the matching payload. Reject unknown forms during website validation, and test this mutation.

1. P2 — Credit assigns every agent to every person on a commit. internal/changelog/credit.go:136 In v0.23.0, landing da866a92 credits Tony Wood “with claude.” Across its 24 own commits, Tony appears only as the human co-author of 9fe9ec28; that commit’s agent identity belongs to Paul. Tally discards those associations and attaches the combined agents to both people. This contradicts the specified per-person attribution. Fix: Preserve each resolved person–agent pair. Attach agent-only trailers to the author’s person, rather than every co-author, and add this historical case as a regression.

Accept with fixes.