standup
Standup — 2026-07-22
Massive day.
▶ Watch the 57s summary — Daily standup — Standup 2026-07-22
Daily standup for 2026-07-22. What shipped:
Massive day. Plugin telemetry substrate, in-plugin streaming chat, sandbox infrastructure, and a security review that caught two auth bypasses — all landed.
WP plugin dashboard build (#546–#561) is now largely complete across all three sub-projects. The 3-tab wp-admin shell (Reports · Chat · Connection) shipped in #546. Streaming chat — token-by-token, scoped server-side to the connected site, plugin key never reaching the browser — shipped in #561 as plugin 1.9.0. Two connect-side bugs fixed en route: a spurious post-stream error frame (1.9.1, #570) and a REST nonce stripped by hardened hosts (1.8.1, #555).
Plugin release / auto-update / anti-abuse system got its design spec (#560) and security review (#572) — verdict APPROVED-WITH-CONDITIONS (10 conditions, no redesign needed). Telemetry substrate (Pillar 2: install_uuid, version columns, fleet admin view, header contract) landed in #577. Four platforms added to taxonomy vocab for upcoming connectors (#578).
Escalations saw a cluster of fixes from Omar: email notifications on creation (#541), live sidebar badge wired to real open count (#543), uniform row truncation (#554), and LLM reason capped at 140 chars at write time (#563).
Infrastructure: sandbox frontends provisioned (#564), env-sync tooling for staging→sandbox refresh (#575), staging frontends now auto-deploy alongside production on every merge (#556). Production cutover plan with data migration documented in #547 — includes reencrypt-mp-api-keys.py, already run against prod to fix a real post-cutover sync outage.
Notable. The security review (#572) caught two latent auth bypasses in the plugin signing design before any code was written: a domain-control echo that any HTTP server could satisfy (an attacker could bind a victim’s domain to their own key), and a client-controlled version header that made the bearer-only→signed transition trivially down-switchable. Both are now fixed in the spec. The security review also flagged a cross-site data exposure in the chat relay — a supplied conversation_id for a different site could be continued — caught and fixed before merge.
Window: 2026-07-21T13:00
→ 2026-07-22T13:36.559Z · Sources: memberintel @ aaa31e1, memberpress-intel @ b7c8f4a