# v1.4 Milestone Audit — Editor Enhancements & Authoring Polish

**Date:** 2026-07-01
**Verdict:** ✅ **PASSED** — all 7 phases complete and independently qa-verified; every v1.4 requirement (ED-01…ED-06) delivered; milestone security review verdict **SHIP**.
**Git range:** `v1.0..HEAD` — 91 commits.
**Final quality state:** backend `go build ./... && go vet ./... && go test ./...` green; frontend (from `web/`) `tsc -b` clean, `vitest` **785 passed / 64 files**, `npm run build` clean with the `assertLazyChunks` bundle guard active.

## Requirement traceability (ED-01…ED-06)

| REQ | Phase | Delivered | Verification |
|-----|-------|-----------|--------------|
| ED-02a — inline `#tag` parser + badge render | 21 | ✅ | qa passed |
| ED-02b/c — Model-B (frontmatter-canonical) materialization + tag UI | 22 | ✅ | qa passed |
| ED-03a — LLM tag suggestions (suggest→approve→apply→reconcile) | 23 | ✅ | qa passed; established the merge-first apply→reconcile pattern |
| ED-01a/b — remove manual Description; on-demand LLM description generator | 24 | ✅ | qa passed (10/10 truths) |
| ED-04a — code syntax highlighting on both CM6 surfaces, code-split | 25 | ✅ | qa passed (9/9); reusable `assertLazyChunks` + async-widget pattern |
| ED-05a — mermaid diagrams (lazy, sandboxed, read+live, raw-code fallback) | 26 | ✅ | qa passed (9/9); bundle-loosening ruled sound |
| ED-06a — page templates (files-as-truth, robust frontmatter merge) | 27 | ✅ | qa passed (7/7); server-side okf merge, dup-key fail-closed |

Every requirement in the REQUIREMENTS.md traceability table maps to exactly one completed, verified phase. No requirement shipped incomplete.

## Quality gates

- **Per-phase execution gates:** each build span ran the engineer's `anvil-code-reviewer` (pre-handoff diff review) + `anvil-adversarial-tester` (hard-bar / security-sensitive surfaces). Notable adversarial results: Phase 25 — invariants held under 40 attacks (2 defects fixed); Phase 26 — 49 tests, 0 defects (no-innerHTML + teardown-safe held); Phase 27 — 39-case table + `FuzzTemplateMerge` ~279k execs, 0 defects.
- **Independent verification:** every phase was verified goal-backward by qa (separate from the engineer) against code reality with the full suites re-run — all `passed`, zero gaps routed up.
- **Milestone security review** (`.planning/v1.4-SECURITY-REVIEW.md`): **SHIP** — no critical/high; the new untrusted-input surfaces (mermaid SVG injection/strict-sandbox, highlighter DOM, template frontmatter merge + path-safety, new endpoints) verified. Two LOW findings, both accept-for-ship (see below).
- **Documentation:** `docs/` (architecture + API) + `.planning/codebase/` maps refreshed to HEAD with a doc-verifier pass (all checkable claims verified).

## Load-bearing invariants established/upheld

- **No-`innerHTML` / `textContent`-only** widget + highlighter output (extended to code + mermaid).
- **Layout-neutral reveal** extended to code blocks; **teardown-safe async-widget** pattern (destroyed flag + `isConnected` + atomic swap) shared by highlight + mermaid.
- **Bundle discipline:** per-language grammars and all of mermaid's dep tree are code-split; the `assertLazyChunks` build assertion (module-id level) fails the build on any leak — reused across Phases 25 & 26.
- **Server-authoritative frontmatter:** the template merge + repair runs in `okf` (yaml.Node); `okf.ValidateFrontmatter` fail-closes on duplicate keys / malformed YAML.
- **Merge-first apply→reconcile** (autosave-safe) shared by tag + description apply.

## Follow-ups carried out of v1.4 (tracked, non-blocking)

1. **F-02 (security, LOW):** unbounded JSON body on `POST/PUT /pages` — add a global `MaxBytesReader` cap. Pre-existing; DoS-hardening. → backlog.
2. **F-01 (security, LOW):** mermaid event-handler-attr XSS defense is delegated to upstream `securityLevel:'strict'` + DOMPurify (verified sound). Keep deps pinned + `npm audit` in CI; re-trace on any mermaid major bump.
3. **Phase-26 manual UAT (×2):** concurrent multi-diagram render (serialization queue) and embedded-`<script>`/`onclick` inertness — not jsdom-reproducible; confirm in a real browser.
4. **SMTC-offline:** the two new `.planning/codebase/` maps are direct-read (Honest tier); re-run `blast_radius` on `livePreview.buildDecorations` + `widgets.ts` when the daemon is back; `govulncheck` (F-03) panics on the Go 1.26 toolchain — re-run when fixed (go.mod unchanged this milestone, so no known-vuln exposure added).
5. **Deferred features (from REQUIREMENTS "Future"):** `#tag` badges in the react-markdown path (agent chat/diff); copy-code button + language-label header; Templater per-folder defaults + insert-at-cursor templates; description surfaced in search cards / graph hover.

## Coordination debt / measurability

- `debt query`: 0 (normalized 0).
- `measure refusal-rate`: ok.
- `verify audit-uat`: passed (12 warnings are pre-existing old-phase-directory bookkeeping — phases 08–18 on disk from prior milestones, not in the v1.4 ROADMAP; not v1.4 issues).
