Reviewed platform `f1076f62` and website `59b9cf9`. No files edited. All 28 release ranges and own-commit counts match Git. Go tests could not start in the read-only sandbox; full `npm run check` requires writes. Existing website checks and in-memory rendering passed.
`CheckPublic` scans serialized source text, but Markdown decodes entities afterward. For example, `[contact](mailto:ops@example.org)` and `[source](https://github.com/carlosframework/platform)` evade its patterns. In-memory rendering produced the actual email address and private platform URL, and `check-docs.mjs` still passed.
6
**Fix:** Validate decoded Markdown text and normalized link destinations, with a corresponding rendered-output privacy check. Add regression cases for entities and percent-encoded URLs.
7
8
2. **P1 — An invalid notes form silently removes release notes while passing the gates.**
Changing v0.24.2’s `notes.form` from `"bullets"` to `"bullet"` in memory removed its notes from the rendered page; the website gate passed. The Go checks never validate `form`, and the bullet-mapping checks still inspect the retained sections, so they cannot detect this loss.
11
**Fix:** Require exactly `"bullets"` or `"markdown"` with the matching payload. Reject unknown forms during website validation, and test this mutation.
12
13
3. **P2 — Credit assigns every agent to every person on a commit.**
In v0.23.0, landing `da866a92` credits Tony Wood “with claude.” Across its 24 own commits, Tony appears only as the human co-author of `9fe9ec28`; that commit’s agent identity belongs to Paul. `Tally` discards those associations and attaches the combined agents to both people. This contradicts the specified per-person attribution.
16
**Fix:** Preserve each resolved person–agent pair. Attach agent-only trailers to the author’s person, rather than every co-author, and add this historical case as a regression.
amadan