Standup — 2026-07-30

▶ Watch the 1:03 summary — Daily standup — Standup 2026-07-30

Daily standup for 2026-07-30. What shipped:

Plugin 1.14.0 shipped. #864 bumps the connect plugin to 1.14.0, carrying the Ultimate Member billing connector (#836) and WishList batching (#838). Merging is not shipping — the plugin reaches no site until plugin-release.yml is dispatched.

Ultimate Member connector is the headline feature in this release. #836 adds a full Billing_Module reading wp_users/wp_usermeta/wp_options in-process: site-scoped member set, UM role catalogue as memberships, transactions/subscriptions unconditionally empty (no payment ledger in UM core). To support it, innovations#384 also landed — nine Integer columns across the four billing tables are now String(255), and _parse_platform_ref returns str while keeping int() as the malformed-payload guard for every numeric platform. ADR-0036 was amended to record ultimate_member as a billing platform with the “billing = emits member/membership entities, not money available” note placed directly in the §2 enum entry.

WishList batching (#838) cuts per-member level resolution from 201 queries/page to 1 + levels using WLM’s own member_ids_by_status(). ADR-0041 (#834) records the direct consequence: the Free-tier connector allow-list was designed around WishList’s query cost, which evaporated the same day the implementation shipped. The decision is that connector platform identity is not a tier-gating axis; member count is.

Auth hardening. Two PRs closed a gap in password reset: #841 adds an authenticated POST /auth/me/request-password-reset that drops Turnstile (the session is the anti-abuse gate), and #842 fast-follows with a per-inbox dispatch cap, background send for constant-time response, and prior-token invalidation.

Infrastructure. Cloud SQL moved from db-f1-micro to db-g1-small per ADR-0040 (#825), lifting SYNC_ADMISSION_SLOTS 1→3. The plugin-release bucket got a ~10-year unlocked retention policy (#856) — unlocked deliberately, because a locked policy would block yanking a compromised release. ADR-0027 was updated (#861) to fold per-workflow WIF scoping for release signing in as §2c, to ship as part of the one consolidated WIF-into-Terraform effort rather than as another out-of-band resource.

Two more fixes:

• add8fa5b — a PHP notice before the JSON body no longer kills an entire sync; the site (sinisa.apps.cspf.co) had never synced since connecting because /stats was dying on a prefixed-but-intact response before reaching /members.
• 7f10f857 — advisor prose now renders “Easy Digital Downloads” instead of “edd”; seven render points fixed, with a parity test that parses the TypeScript label map and asserts the Python and TS maps stay identical.

GCP infra cost tracking (#854) landed: BQ billing export → daily scheduler → idempotent Postgres rollup → admin observability page with a combined total-cost-of-ownership headline. A final whole-branch review caught a seam bug where the headline was summing infra calendar-MTD against AI 7-day data; both halves are now true MTD.

Notable. The admin/ vitest suite (237 tests, 36 files) had never run in CI. #845 gates it — same gap that let app/’s Turnstile logic ship broken three times. The new admin-check job validated itself on its own PR.

---

Window: 2026-07-29T13:00

→ 2026-07-30T13:38

.126Z · Sources: memberintel @ 31266ba, memberpress-intel @ ebaca48