standup
Weekly — week of 2026-07-27
Four standups, roughly fifty PRs, and a week that expanded the platform on almost every axis simultaneously.
▶ Watch the 1:20 summary — Weekly status — Week of 2026-07-27
Weekly digest for the week of 2026-07-21 → 2026-07-27. What shipped:
Four standups, roughly fifty PRs, and a week that expanded the platform on almost every axis simultaneously.
Platform connectors finished their V1 roster. #487 and #503 shipped BuddyPress_Module and EDD_Module early in the week. #571 added MemberMouse — the first connector implementing both Billing_Module and Engagement_Module in a single class. #670 added PMPro_Module with all four entities and 408 lines of tests. #651 closed the V1 engagement roster with LearnDash, using batched IN() queries throughout. A companion fix in #648 patched a silent cross-platform wipe that would have zeroed BuddyPress keys whenever LearnDash dropped transiently.
SiteStats is now backend-authoritative. #517 recomputes all rollup figures from platform-tagged rows on every sync, retiring the plugin’s /stats payload. Two correctness bugs in rollup.py were fixed in the same commit: EDD expires_at=NULL rows were being treated as lifetime memberships, and churn was dividing churned subscriptions by active members. #525 simultaneously deprecated mrr_cents/churn_rate in get_stats() to null — the plugin was computing MRR as a flat sum with no proration and churn against all-time cancellations with no time window.
The plugin release pipeline closed its loop. The CI workflow (build → KMS-sign → GCS upload → publish) merged in #617 and #620. Reproducible zip builds (#638), MD5 defense-in-depth (#639, #642), WP-native auto-update with KMS signature verification (#655), and a public GET /latest-download endpoint (#654) all followed. New installs no longer pull a stale static zip.
Streaming chat, the wp-admin shell, and the help center shipped as user-facing surfaces. Plugin 1.9.0 (#561) delivers token-by-token chat scoped server-side to the connected site, with the plugin key never reaching the browser. The 3-tab wp-admin shell landed in #546. The public help center went live via #663 and #674, with TechArticle/FAQPage JSON-LD, sitemap, and /llms.txt. Pro pricing dropped to $19.95 in #659, sweeping 13 display locations; KB docs updated in #116, with unit-economics guardrails deliberately held pending re-derivation.
Notable. The security review in #572 found three separate issues before any production code existed: a domain-control echo that would have let any HTTP server bind a victim’s domain to an attacker’s key; a client-controlled version header that made the bearer-only→signed auth transition trivially reversible; and a chat relay leak where a supplied conversation_id for a different site could be continued across the trust boundary. All three were fixed in the spec. Finding auth bypasses at design review rather than in deployed code is the week’s most consequential outcome by a wide margin.
Synthesized from 4 daily standups in [2026-07-21, 2026-07-27].