Claude Opus 5andbdeshi
1f168d973b
Dropping raw HTML was silently destructive. H<sub>2</sub>O rendered as "H2O",
10<sup>6</sup> as "106", <kbd>Ctrl</kbd> as "Ctrl", and khosra check reported
nothing — an author lost meaning with no signal anywhere. Measured on the real
binary before and after.
Invariant 2 already says content from the site root is trusted, so the old gate
was defending the half of the boundary that was never in question while the
untrusted half has no code to defend yet. Chemistry, units, exponents and
keystrokes are what a hard-science site needs and what no Markdown dialect
expresses, so html.WithUnsafe() goes on in internal/render/render.go.
The gate does not disappear; it narrows. verify.sh used to fail on WithUnsafe
appearing anywhere and now fails unless it appears in exactly that one file —
watched doing both, accepting one call site and naming both files when a second
appears. A second pipeline trusting its input is the failure ADR-0003 exists to
prevent, and when comments arrive they get their own goldmark without it. The
gate is the reminder that the split has to be built rather than assumed.
The security test that asserted "raw HTML must still be dropped" now asserts the
property that actually holds and matters more: a shortcode argument stays data
whatever the page around it is allowed to do. ::figure{alt=<b>bold</b>} still
arrives as <b> while the <span> beside it renders.
core 2793/2800, ext 1077/2000, 34 gates green, 0 warnings.
khosra
A flat-file personal publishing engine in Go. Point the binary at a directory of Markdown and it becomes an owned, networked home for fiction, webcomics, art, and essays, in English and Bengali. The site's content lives in its own repository, not this one (ADR-0011).
Build and run
Needs Go 1.26+ and git; nothing else.
make build # or: go build -o khosra ./cmd/khosra
make run SITE=/path/to/site # or: ./khosra -site /path/to/site
make test
make verify # everything the project enforces — green before every commit
make help lists targets. make is a convenience wrapper; go build, go test and
./scripts/verify.sh work on their own and are what the gate uses.
A site root is a directory holding content/, and optionally static/ and templates/. It lives in its
own repository, not this one — the binary is pointed at it.
If you are a human: start at HARNESS.md — what the scaffolding is, how to use it, and what to decide.
If you are an agent: start at CLAUDE.md — the constitution and the read order. It is loaded for you automatically; this file is not a prerequisite and nothing here is a rule.