v0.12.0 — Polish & Hardening

Generic next-release bucket. Picks up follow-ups deferred from v0.11.0 (config polish, schema versioning, deprecation timelines) and absorbs whatever incremental work lands between v0.11 and v0.12.

Currently planned:

Open work items Ideal burndown

Progress 1/1 work items

Config polish follow-ups from v0.11.0 review (WORK-176): schema URL versioning, mirroring footgun, three-shapes deprecation timeline, target field review.
Security policy for transform pipeline (WORK-177): opt-in SecurityPolicy so hosted products can render untrusted content with layered defences (sanitisation, iframe sandbox attr, meta-CSP, separate-origin escape hatch). Default stays trusted — no behaviour change for self-hosted users.

Add other items as they emerge.

Work Items

Done 1

WORK-176 main

v0.11.0 config follow-ups

A handful of concerns surfaced during the v0.11.0 design review that we deliberately deferred rather than block the milestone. None are urgent; all are worth addressing before the unified config shape ossifies further.

medium moderate

11/11 criteria