mal/plans

Advisory Plans

Plans written against commit 0d31d46.

Status

#	Plan	Catalog	Status	Dependency
001	Fix broken Go lint baseline	DX / Tooling	TODO	None
002	Stop marking JSON attributes as trusted HTML	Security	TODO	None
003	Gate or remove unauthenticated pprof routes	Security	TODO	None
004	Validate playback proxy targets before signing/fetching	Security	TODO	None
005	Limit home continue-watching carousel query	Performance	TODO	None
006	Move top-picks recommendation expansion off request path	Performance	TODO	None
007	Characterize the browser player flow	Tests	TODO	Before major player refactors
008	Add data-fix runner characterization tests	Tests	TODO	None
009	Add CI for the existing verification command	DX / Tooling	TODO	001
010	Add watchlist import / restore	Direction	TODO	None
011	Surface recommendation rationale	Direction	TODO	None
012	Expose episode availability freshness / retry state	Direction	TODO	None

Recommended Order

1. 001-fix-broken-go-lint-baseline.md
2. 009-add-ci-for-existing-verification-command.md
3. 002-stop-marking-json-attributes-trusted-html.md
4. 003-gate-or-remove-unauthenticated-pprof-routes.md
5. 005-limit-home-continue-watching-carousel-query.md
6. 008-add-data-fix-runner-characterization-tests.md
7. 004-validate-playback-proxy-targets.md
8. 007-characterize-browser-player-flow.md
9. 006-move-top-picks-recommendation-expansion-off-request-path.md
10. Direction plans as product priorities: 010, 011, 012.

Verification Baseline

Known passing during audit:

• go test ./...
• bun test
• bunx tsc -p tsconfig.json --noEmit
• bun run lint:ts
• bun audit

Known failing during audit:

• bun run lint:go fails on internal/observability/fx.go:22 for cyclop complexity.

Unavailable during audit:

• govulncheck ./... because govulncheck was not installed.