The round-2 review email raises two findings. Both were worked on 2026-08-25, but neither loop was closed: the reply was drafted and never sent, and dist/saddle-1.0.0.zip is now stale (built before #158, so it carries neither the current accent CSS nor the current changelog).
1. saddle/get-media permission_callback
Quoted at includes/abilities/core-content.php:355, with the note that the callback "only checks the generic read capability" while get_media returns any attachment's metadata without a per-attachment read_post check.
The finding is already fixed, and went wider than the cited line — #149 routes every id-taking read through Saddle_Abilities::require_readable_post(). But the fix is on the execute path, not at the permission_callback line the reviewer quoted, so any automated re-scan will quote the same line again.
Decision (Fahim): answer it with a code comment plus the reply, not by moving the check into the gate. Core does pass $input to check_permissions() and accepts a WP_Error back, but the named refusal an agent needs is produced on the execute path, and denial_reason() / is_callable_now() read the input-free gate registry.
Work: a block comment above the read-ability registration group stating the two-layer model explicitly, and a one-line pointer on each id-taking read registration (get-media, get-post, get-page, get-blocks, list-post-revisions, lint-page, render-node, verify-page, get-preview-url).
2. Terms/Privacy URL 401
https://unsplash.com/api-terms in readme.txt answers 401 to their checker.
It is a false positive, reproduced again on 2026-08-27. unsplash.com is behind Anubis — 307 → /.within.website?redir=… then 401 to any user-agent containing Mozilla, 200 to curl. It is not limited to the flagged path: /api-terms, /privacy, /terms, /documents/* and /license all behave identically, so there is no reachable canonical Unsplash terms or privacy URL to swap to, and swapping only the flagged one would leave the same landmine. Only help.unsplash.com answers 200 to a browser UA, and it is already listed first.
Decision (Fahim): keep both canonical links and explain the 401.
Work: a Round 2 section in WPORG-SUBMISSION.md carrying both answers in the §1–§12 style so a round 3 is answered by copy-paste, and a drafted reply email.
Acceptance
The round-2 review email raises two findings. Both were worked on 2026-08-25, but neither loop was closed: the reply was drafted and never sent, and
dist/saddle-1.0.0.zipis now stale (built before #158, so it carries neither the current accent CSS nor the current changelog).1.
saddle/get-mediapermission_callbackQuoted at
includes/abilities/core-content.php:355, with the note that the callback "only checks the generic read capability" whileget_mediareturns any attachment's metadata without a per-attachmentread_postcheck.The finding is already fixed, and went wider than the cited line — #149 routes every id-taking read through
Saddle_Abilities::require_readable_post(). But the fix is on the execute path, not at thepermission_callbackline the reviewer quoted, so any automated re-scan will quote the same line again.Decision (Fahim): answer it with a code comment plus the reply, not by moving the check into the gate. Core does pass
$inputtocheck_permissions()and accepts aWP_Errorback, but the named refusal an agent needs is produced on the execute path, anddenial_reason()/is_callable_now()read the input-free gate registry.Work: a block comment above the read-ability registration group stating the two-layer model explicitly, and a one-line pointer on each id-taking read registration (
get-media,get-post,get-page,get-blocks,list-post-revisions,lint-page,render-node,verify-page,get-preview-url).2. Terms/Privacy URL 401
https://unsplash.com/api-termsinreadme.txtanswers 401 to their checker.It is a false positive, reproduced again on 2026-08-27.
unsplash.comis behind Anubis —307 → /.within.website?redir=…then401to any user-agent containingMozilla,200tocurl. It is not limited to the flagged path:/api-terms,/privacy,/terms,/documents/*and/licenseall behave identically, so there is no reachable canonical Unsplash terms or privacy URL to swap to, and swapping only the flagged one would leave the same landmine. Onlyhelp.unsplash.comanswers 200 to a browser UA, and it is already listed first.Decision (Fahim): keep both canonical links and explain the 401.
Work: a Round 2 section in
WPORG-SUBMISSION.mdcarrying both answers in the §1–§12 style so a round 3 is answered by copy-paste, and a drafted reply email.Acceptance
WPORG-SUBMISSION.md§13 and §14 written.orgzip rebuilt from currentmainand re-verified in the artifact