Add tools/build_site.py: runs the full pipeline in dependency order
(build_content -> build_listings -> seo_inject --all --sitemap ->
build_botlinks -> build_search_index), each as a subprocess so a failing
step aborts the build before anything downstream runs (no partial
deploy). --check verifies non-destructively; --images also runs
optimize_images. This is what CI will run in U5.
Fix a build_content idempotence bug found via U4: the hero and
article-header regions were emitted with leading indentation while the
regex left the template's pre-tag whitespace in place, so indentation
compounded (+16 spaces) on every rebuild. First line is now unindented;
the full build is verified idempotent (identical git tree across two
runs). Added a fixpoint test (re-rendering a page's own output is
byte-identical) so this can't regress.
docs/local-preview.md: build + serve on :8000 in all three languages.
tools/README.md: document build_site + build_content.
26 tests pass.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the hand-maintained ARTICLE_DATES registry as the source of
truth with dates read from content/ front-matter, so publishing a post
via the CMS needs no manual registry edit (plan R4).
- tools/content_index.py: load_dates() reads content/ front-matter into
{source_folder/slug: {published|modified: iso}}. Standalone (os+yaml),
no import cycle with seo_inject.
- tools/seo_inject.py: ARTICLE_DATES is now {**static_fallback,
**content_dates}; content wins. The static table is kept only as a
fallback for entries not present in content/.
- migration now preserves the published-vs-modified distinction
(date_type), so the switch is byte-identical: content-derived dates
equal the old static table exactly (17/17, incl. the one 'modified').
Verified: full `seo_inject --all --sitemap` + build_listings +
build_botlinks run produces ZERO changes to any site page. build_content
--check still reproduces all 51 pages.
build_botlinks.py needs no change (it scrapes built pages, which are a
pure function of content/). Listings get content-driven dates for free
via seo_inject.ARTICLE_DATES.
tools/tests/test_content_index.py: 5 tests (dates == legacy registry,
merged registry unchanged, published/modified distinction, events key on
projects/<slug>, one ISO date per entry).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add tools/build_content.py: renders every content/ entry into its blog /
news / event detail page by self-templating the page's own chrome and
replacing only content-derived regions (title, article header, hero,
body, and — for new pages only — the scrollspy).
Faithful reproduction, proven against the live site:
- body_format: html fragments injected verbatim, so guide-boxes, inline
figures and event galleries render unchanged.
- scrollspy sidebars are preserved (labels are hand-curated, shorter than
the H2s); only generated when a page has none.
- <title> suffix derived per page, so EN/SI " - MSOS", MK " - МСОС", and
suffix-less event titles all reproduce exactly.
- hero /images/… rewritten to the page's ../../../ depth.
- ASCII-only console output (no cp1252 crash on Windows/CI).
tools/tests/test_build_content.py: 8 characterization tests; the core one
renders all 51 pages and asserts each is semantically equivalent
(whitespace/attr-order-insensitive) to the current page — the R5
no-regression guarantee.
Does NOT overwrite the committed pages; whether generated pages are
committed vs built fresh in CI is decided in U4/U5. Run:
python tools/build_content.py --check # verify equivalence
python tools/build_content.py --write # emit pages (for U4)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Establish content/ as the source of truth for editable content and
back-fill it from the existing detail pages, per U1 of the no-code CMS
plan.
- docs/content-model.md: front-matter schema (EN/MK/SI), body_format
html-vs-markdown, content/events -> projects/ output mapping.
- tools/migrate_pages_to_content.py: bs4/yaml extractor; pulls title,
subtitle, category, ISO date (from ARTICLE_DATES), hero image+caption;
preserves the article body PLUS trailing sibling sections (event
galleries) verbatim as body_format: html. Reports unparseable pages
instead of emitting half-formed files.
- content/**: 51 files (17 entries x EN/MK/SI), 0 skips.
- tools/tests/test_migrate_roundtrip.py: 12 characterization tests
(structured fields, news-has-no-subtitle, event gallery/lightbox
preserved, Cyrillic UTF-8 round-trip, every page parses).
- .gitignore: ignore __pycache__/ and *.pyc.
U1 is unblocked and standalone. U2 (render content -> pages) is next;
U5/U6 remain blocked on Open Question Q1 (Gitea<->GitHub topology).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a "Photos, images & copyright" card to the Official information
(legal) page in all three languages, plus a short rights/removal note
on the Gallery and Events & Projects pages.
- Clarifies most images are MSOS property or used with permission, and
that third-party images (Get to know Macedonia/Slovenia, Student
Welcome Guide) remain their owners' property.
- Requires prior written permission to reuse MSOS's own images.
- Adds a photo-removal / consent-withdrawal path via info@msosorg.com.
- New shared .photo-rights-note style in css/pages/_gallery.css.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Gallery flow:
- Album covers now open the photo lightbox directly (full album set), while
the title/"Read the story" link opens the article. Previously the whole card
linked to the article and photos were only at the bottom of it.
- Each album carries its full photo set in a hidden js-lightbox grid; added
main.js support for [data-lightbox-target] cover triggers.
- Added the missing main.js include on the gallery page (its lightbox, mobile
menu and language switcher never ran before).
- Lightbox gained an optional "Read the story ->" button (data-project-url /
data-project-label) shown only for gallery albums.
Watermark:
- Baked a subtle "(c) msosorg.com" watermark (bottom-right, sized per image)
into 114 of our own event/community photos. Stock/partner/logo/icon images
excluded. Clean originals backed up to images/_originals/ (git-ignored); the
script always re-derives from them so re-runs never stack.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Renamed the section from "Our members & friends" to "Through the years"
(Низ годините / Skozi leta) — a retrospective framing that honours everyone
who has been part of MSOS without labelling anyone a current member or friend.
Updated title, marquee aria-label, image alt text and the dev comment.
- Removed dashes from the hero intro, section intro and closing note.
- Replaced the placeholder names with the full list of 74 contributors, kept
the original five, sorted alphabetically per language (Latin for EN/SI,
Macedonian Cyrillic with native collation for MK).
- New design for the names: a clean multi-column credits wall (accent dot,
hairline rows, hover) instead of pill chips (css/pages/_about.css).
- Added a thank-you note to members past, present and future, and to everyone
who has volunteered, contributed or supported MSOS. EN/MK/SI.
MK/SI copy is AI-drafted and pending a native proofread.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- "Our members & friends" carousel now uses 22 curated, web-optimised photos
(members-01..22.webp) from the members & friends library, chosen for warmth,
smiles, hugs, events, team and community; applied to EN/MK/SI, with the
seamless-loop duplicate set and per-language alt text. Old placeholder
event photos removed.
- Hero slideshow enriched with 6 new candid 1920px slides (group hug, pizza,
picnic, coffee, night group, arms-up cheer) interleaved among the existing
crowd shots; the JS picks up all slides automatically (now 17).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- New Press & media page in all three languages: press-enquiries contact,
a 6-way logo download grid (EN/SI/MK x colour/white), an "MSOS at a glance"
fact sheet (full legal name + preferred name), and a grouped coverage list
(media, universities & institutions, official records, reference, government)
with 29 verified third-party links, each described in EN/MK/SL.
- Styling in css/pages/_press.css (imported by main.css), on the site's tokens.
- Footer: added a "Press & media" link to the Organisation column on every page
(all languages, relative paths correct for each page depth).
- SEO/sitemap refreshed so the new pages carry NGO schema + hreflang.
MK/SI copy is AI-drafted and pending a native proofread.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Generative Engine Optimization pass so AI answer engines (ChatGPT, Gemini,
Perplexity, AI Overviews) can confidently identify and cite MSOS.
Schema (tools/seo_inject.py, propagated to all 231 pages):
- FAQPage JSON-LD parsed from the /faq/ Q&A blocks (33 Q&A x EN/MK/SI)
- Organization upgraded to NGO with entity-disambiguation fields:
alternateName (all spellings), description, areaServed Slovenia,
knowsLanguage, and foundingDate 2023-03-05
- Event JSON-LD on all 9 /projects/ recap pages (date + real location)
Autonomous for future content (no code edits to add a project):
- Event/Article dates auto-read from the English page's publish date;
event city auto-detected from the body (Slovenian-city whitelist).
ARTICLE_DATES/PROJECT_LOCATIONS are now optional overrides only.
(Auto-detect corrected Paint & Wine to Nova Gorica.)
- build_listings.py: auto-date fallback so undated new content still lists
- pre-commit hook now runs seo_inject.py --all --sitemap first, then
listings/botlinks, and re-stages changed pages (idempotent)
Docs: docs/geo-offsite-worklist.md - copy-paste-ready off-site plan
(Wikidata, Wikipedia fixes, directories, Google Business, AI-visibility tests).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Layout / CSS (css/pages/_guide.css):
- Left-align .guide-checklist and .guide-steps (margin 16px 0) so bullet
lists no longer drift right inside the flex article-body.
- Make .guide-table-wrap shrink to the viewport (width:100%; min-width:0)
so wide tables scroll horizontally on mobile instead of overflowing.
- Add a reusable .guide-cta pill button for inline calls to action.
Content, applied across all three languages:
- Replace the info-pill row (guide-meta) on every guide page with a
"Last checked" eyebrow above the title.
- application-deadlines: correct "North Macedonian citizen" to
"Citizen of North Macedonia".
- study-cities: reword the "X map:" run-on paragraphs, give Nova Gorica
and Celje proper strengths/challenges bullet lists.
- tuition-and-scholarships: fix the leftover "Link the exact call" note
and add a prominent SRIPS 380th-call button.
- student-accommodation: retitle to "full-time student", delete the SRCe
brokerage paragraph, add an ownership-check (land register / GURS)
paragraph.
- prepare-to-move: add bus, flight, airport-transfer and car-sharing
providers with links.
- administrative-basics: link the DR-02 form and FURS tax-number page and
the bank-account blog; remove the "A common sequence" section.
- official-sources-and-checklists: remove the "Checklists to build"
section and the pre-publication reminder sentence, and tidy the meta
description that referenced the removed section.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Remove the coloured placeholder cards behind the "ways to be part of
MSOS" carousel (override the _hub.css gradients on .mm-use) and load the
photos eagerly with fetchpriority so they appear immediately.
- Remove the "Figures to confirm before launch." note (and the SI
equivalent) from the MSOS-in-numbers section.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
About Us:
- Replace the appreciation photo with an Apple-style scrolling marquee that
focal-zooms the centred photo (main.js + _about.css); heading now sits above
the carousel; remove the "Have any questions?" FAQ CTA (EN/MK/SI).
Landing hero:
- Turn the flat blue overlay into a Proxify-style radial vignette (light centre
over the CTA, dark edges) and raise the "Become a member" button.
Filter bar (Events & Projects / Blog / News, EN/MK/SI):
- Add a shared Proxify-style rounded pill bar with a trailing search icon that
swaps to a search field and opens a results dropdown (thumbnail + category +
title). New css/pages/_filterbar.css + filter-search.js, layered on top of the
existing filter/pagination JS. Blog category icons preserved.
- Balance the News filter bar spacing between the header and the cards.
Student Welcome Guide:
- Widen the intro paragraphs, constrain the full-bleed disclaimer to a normal
centred width, and add space before the route configurator.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Override the inherited cream .page-header-section background to transparent so
the "Mission and Vision" title sits directly on the section's blue gradient
(no white rectangle behind it).
- On mobile, hide the mission/vision box icons (crosshair/eye) — text only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Switch the hero content from vertical-centre to top-aligned so the title/text sit
in the upper background area of the rotating group photos instead of over faces.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Rework the About Us hero so the eyebrow, title and description are overlaid on
the auto-rotating team images (centred, white, text-shadowed) exactly like the
landing hero, instead of sitting in a separate white band above them. Remove the
old page-header band and move its text into the hero. All three languages.
- Rename the "Who We Are" menu item from "Our team" to "About Us"
(MK "За нас", SI "O nas") across all pages; footer "About us" link unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Record in PRE-LAUNCH-TODO.md that new pages still need ARTICLE_DATES + a
seo_inject.py --all --sitemap run (the commit hook covers News/homepage/bot
sync but not SEO), so it isn't forgotten.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Versioned hook at tools/git-hooks/pre-commit runs build_listings.py and
build_botlinks.py on every commit and stages their output, so the News hub,
homepage "Latest news", /llms.txt and /links-for-bots/ always reflect the actual
Blog/Projects/News content — no manual step. Non-blocking: warns and proceeds if
Python or a generator fails. Activated with `git config core.hooksPath tools/git-hooks`.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rewrite tools/build_listings.py to treat the Blog, Projects and News detail
pages as the single source of truth. It now regenerates:
- the News hub grid (all items, newest first, correct dates from ARTICLE_DATES)
- the homepage "Latest news" block (top 3)
both marker-wrapped. Previously the News hub was hand-maintained with drifted,
hardcoded dates and only some blog posts; now adding a blog/event and running
the script flows through to News and the homepage automatically.
Card links/images are root-relative so they work on any host.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The generated /links-for-bots/ pages linked to absolute https://msosorg.com/...
URLs, which 404 when the site is served from another host (e.g. local dev, or
before this branch is deployed). Switch the pages' navigation links to
root-relative (/llms.txt, /en/..., /links-for-bots/...). Canonical tags stay
absolute (SEO) and llms.txt keeps absolute URLs (llmstxt.org convention).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Previously /llms.txt and /links-for-bots/ existed but were not linked anywhere,
so users/bots couldn't find them. Following Proxify's pattern, add a "For bots"
footer column (all 225 pages, EN/MK/SI) linking to category link lists and an
AI summary page.
build_botlinks.py now also generates:
/links-for-bots/blog|guide|projects/ per-section link lists (EN/MK/SI)
/links-for-bots/about-msos/ "Hey AI, learn about us" summary
/links-for-bots/ hub + /llms.txt
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Give the 23 project pages that used a single-column layout the same scrollspy
table-of-contents sidebar as the others (built from their <h2> sections, with
language-agnostic section-N ids so it works for Cyrillic too), plus the mobile
ToC header. The "Like what we do?" sidebar CTA now sits under the ToC on every
non-memorial project page; the two memorial stories get the ToC but no CTA.
The full-width bottom CTA remains the mobile fallback.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a compact "Like what we do?" CTA box directly below the table of contents
in the left sidebar. The ToC already scrolls internally when long, so the box
stays pinned in the same visual field. The full-width bottom CTA is hidden on
desktop where a sidebar CTA exists (via :has()) and remains the mobile fallback.
Applied to the 4 project pages that have a ToC sidebar; the others (all MK/SI +
3 EN) have no sidebar and keep the bottom CTA.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Publish Vasil Handziski's personal essay in MK (original) with EN/SI AI-drafted
translations. Adds a prose article variant (no scrollspy sidebar, centred column,
custom byline) via .article-page--prose, plus blog index cards in all languages.
Converter now omits the "last checked" line when empty.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Build the Welcome Days article in all three languages from the multilingual
source (# English / # Slovenščina / # Македонски sections + shared sources),
no machine translation. Date registered, SEO injected. Cards already existed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add Macedonian and Slovenian versions of the accommodation post (AI-drafted,
flagged for native review), rebuild EN with a proper Student Welcome Guide link
and a real Sources section, and add MK/SI blog index cards. Converter now treats
a secondary "# Sources" heading as a section.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Build full articles for "Learning Slovene", "Study in North Macedonia
(government scholarship)" and "Ad futura scholarship" in all three languages,
split from the trilingual Markdown sources (no machine translation). Dates
registered in ARTICLE_DATES and SEO re-injected per page. Blog index cards for
these already existed and now point to real content instead of stubs.
Hero images are placeholders pending topical photos.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
tools/build_blog.py converts a Markdown source into the site's scrollspy blog
article (title, header, hero, sidebar nav from ## headings, body). First output:
the new EN post "Where to search for student accommodation in Slovenia", added at
the top of the blog index (newest first), dated 2026-08-03, SEO injected.
MK/SI of this post and the rest of the blog batch (refresh 1-5, split trilingual
posts 2-4, personal essay post 7) still to come.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
#9.2 Full-width auto-rotating team hero (crossfade every 4.5s, transparent blue
overlay) directly under the About Us title — 11 landscape photos supplied by MSOS.
#9.4 "Our members & friends" appreciation section after Mission & Vision: a
contained photo carousel + name chips. Photos and names are PLACEHOLDERS
(names in "First L." format) pending the full members list.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add tools/build_listings.py: copies the top 3 cards from each language's News
hub into the homepage "Latest news" block (marker-wrapped), so editing the News
page now updates the homepage. The News hub stays the hand-edited source of truth
(it may hold curated teaser cards without a detail page).
Also: fix the Gallery meta description (was a copy of the FAQ text) and add a
durable gallery override to seo_inject.py; refresh llms.txt / links-for-bots.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add tools/build_botlinks.py which regenerates, from the pages already on disk:
- /llms.txt llmstxt.org-style Markdown index (English, with descriptions)
- /links-for-bots/ a lightweight fully-linked crawl hub covering EN/MK/SI
Re-run `python tools/build_botlinks.py` after adding or removing pages; it only
reads each page's <title> and meta description, so it stays current automatically.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Footer disclaimer on every page (informative-only, verify with official sources)
- "Good to know" callout across all Student Welcome Guide pages, pointing to
the "Was this page helpful?" box for reporting errors
- "Website content & liability" disclaimer card on the Official information page
All three languages (EN/MK/SI).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- #9.1 Reorder "Who We Are" nav to Our team, Timeline, MSOS Hub (all 225 pages)
- #4 Fix MK "Ask MSOS" label to "Прашај го МСОС"
- #11 Landing hero overlay -> radial blue vignette (lighter centre)
- #3 Gallery cards show the event date under the title (DD.MM.YYYY)
- #1 Membership/support CTA at the end of project pages (memorials excluded)
- #8 "Illustrative image" tag on blog/news photo captions
- #9.3 Mission & Vision: full-width gradient band + more space above title
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
New posts (Ad futura scholarship, learning Slovene, welcome days,
study in North Macedonia) across EN/MK/SI, plus blog index and _blog.css
updates. (Also carries the site-wide nav reorder and the illustrative-image
caption tag on the bank-account post.)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Convert the Hub / Become-a-member carousels from a pure-CSS marquee to a
JS-driven scroller with click-and-drag, touch swipe, and progress dots
(setupHubCarousel). Turn the "ways to be part of MSOS" cards into hub-style
photo cards and add the final Become-a-member photos (WebP).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Convert the fixed 6-card grid in the "There is more than one way to be
part of MSOS" section into the Hub's auto-scrolling marquee, reusing the
existing .hub-carousel mechanics with icon-based gradient cards. Applied
across EN/MK/SI.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the temporary placeholder images in the "What you can do here"
and "A glimpse of the space" sections with the final Hub photos
(converted to WebP) across EN/MK/SI, and drop the placeholder notes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Applies the corrections from "msos web corrections.docx" across 6 Macedonian
pages, plus two global fixes, plus matching English tweaks.
Per-page (MK):
- Landing: hero eyebrow/subtitle, story section, testimonials, FAQ block
- About us / Our team: "Раководен тим" -> "Управен одбор", team names to
Cyrillic, Marko's title, removed duplicate top gradient + added spacing,
fixed the broken "Still have questions" footer to match the landing page
- MSOS Hub: title widow (nbsp), hub descriptions
- FAQ: intro + 9 answer corrections (also fixed leftover English fragments)
- Become a Member: card label, removed stats note, consistent "ти" voice,
Cyrillic names, form step + success text
- Support: title, subtitle, community section, support options
Global (all MK pages): header menu "Нашиот тим, мисија, визија и вредности"
-> "Нашиот тим"; напатница -> напотница. Visible punctuation dashes changed
to commas per owner preference.
English: testimonials section (en/index.html) and two document answers
(en/faq) updated to match.
Adds docs/MK-PROOFREADING.md (6 proofread, 63 remaining of 69 MK pages).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the "Image placeholder" boxes on all 30 guide subpages + the guide
landing hero with real, optimized photos and captions, EN/MK/SI (93 figures).
- 31 source photos (up to 18 MB) optimized to WebP (<=1400px, all <500 KB)
as images/guide-<slug>.webp.
- Captions follow the Get-to-Know style: description + "Photo:/Фото:/Foto:"
+ linked source (or MSOS for own event photos). Photographer credits kept.
MK/SI descriptions are translated (proofread welcome).
- CSS: move the banner crop from the figure onto the <img> so the caption
shows below it (was clipped by the figure's fixed height + overflow).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Consolidates outstanding items so nothing is lost during the pause: domain
decision, content placeholders, MK/SI proofread, GA4 setup, plus a record of
what's already hardened. Dev-only doc (docs/ excluded from deploy).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Switch CSP from Report-Only to enforcing, with an allowlist verified in a
browser against a server sending this exact header (0 violations across the
homepage, a YouTube project page, the assistant, MailerLite JSONP, GA/gtag,
and the Google Forms endpoint).
Adds the sources the old report-only policy was missing (and would have
broken if enforced blindly): Google Fonts (style/font), Font Awesome cdnjs
(style/font), MailerLite newsletter (script/connect), the Google Forms
endpoint in connect-src, plus object-src 'none'. Keeps 'unsafe-inline' for
the in-<head> consent bootstrap; the host allowlists + form-action/base-uri
are the real hardening on top of existing output escaping.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
mark
popovskik
popovskik