carlos / platform Public

| Previous finding | Disposition | Evidence | |---|---|---| | 1. P1 — Encoded addresses and private links bypass validation | Not fully fixed | Original entity and percent-encoding examples now fail validation. However, [source](https://github.com/carlosframework/./platform) still passes the rendered-page gate; the browser resolves it to the private platform repository. Neither Go decoding nor the website check normalizes URL paths. Likewise, ops**@**example.org renders a visible address and passes. Remaining fix: validate rendered text and parsed, normalized link destinations. | | 2. P1 — Invalid notes form silently removes notes | Fixed | Go validation requires a recognized form and matching payload. The website gate now rejects the original v0.24.2 "bullet" mutation; confirmed with in-memory rendering. | | 3. P2 — Every agent assigned to every person | Fixed | Tally preserves identity pairings. Landing da866a92 still counts 24 own commits, but its generated credit now correctly lists Paul with Claude and Tony alone, consistent with 9fe9ec28. |

No new P1 or P2 findings. The remaining privacy failures belong to finding 1.

Reviewed platform d10798d0 and website 973f407. All 28 release ranges and 363 unique changes’ own-commit counts match Git. Existing website checks, vendored-data comparison, and in-memory rendering checks ran. Go tests could not start because the sandbox blocks their work directory; full npm run check requires writes. No files edited.

accept with fixes