From 53532e04ff1aec789bbd9fd288498e3f2f016bd5 Mon Sep 17 00:00:00 2001 From: Kyle Isom Date: Sat, 26 Sep 2026 01:09:18 -0700 Subject: [PATCH] M5b spec: the plain-URL fetch was marked, not observed Co-Authored-By: Claude Opus 5.5 (1M context) --- docs/specs/2026-09-26-m5b-hardening.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/specs/2026-09-26-m5b-hardening.md b/docs/specs/2026-09-26-m5b-hardening.md index f5e9435..4b92088 100644 --- a/docs/specs/2026-09-26-m5b-hardening.md +++ b/docs/specs/2026-09-26-m5b-hardening.md @@ -260,7 +260,7 @@ messages and read each post's `metadata` back through the API): | Posted | Link preview (`embeds`) | Image fetched by the server (`images`) | |---|---|---| -| a plain URL | yes: a `link` embed, fetched when a client first shows it | | +| a plain URL | marked for a preview (a `link` embed); no card appeared, because `example.com` has no OpenGraph tags, so the fetch itself was not observed | | | a URL in a code span | none | | | a URL in a fenced block | none | | | a Markdown link, `[text](url)` | none: only plain URLs are previewed | | @@ -269,7 +269,8 @@ messages and read each post's `metadata` back through the API): | a defanged `hxxps://` URL | none | | So a code span stops both automatic fetches, and an image is fetched by the server itself, not only -by each client: escaping images matters in every session. +by each client: escaping images matters in every session. The owner's screenshot of the posts +matched the readings; the test posts were then deleted. `TurnDone` gains `untrusted: bool` (a new field, so its fixture changes). Trusting `loopd`'s own labels here is sound: this is a defence in depth on presentation, not a trust gate.