Rally Quest Engine v0.3.0

Rally Quest Engine v0.3.0

• Public results Bib links can open each participant's accepted bonuses with submitted proof photos beside Bonus ID, description and awarded points.
• Enable Publish accepted bonus details and photos in Embed this Event on a Post or Page. This is off by default and requires public results enabled.
• Administrative Results and Reviewed Bib links open the accepted-bonus section of the participant score sheet; full submission history remains available.
• Public requests verify event publication, additional photo/detail consent and participant enrollment. Rejected/pending submissions, contact information, rejection reasons and inbox metadata remain private.
• WordPress site administrators alone can configure inboxes, test connections and manually poll. Changing an IMAP host, port, encryption or username requires a newly entered password, preventing retained credentials from being sent to a changed destination.
• Schema 16 adds the opt-in without changing scores, participant assignments or submission decisions.

Install and privacy

Back up the database and event gallery, then install rally-quest-engine-v0.3.0.zip through WordPress Plugins > Add New > Upload Plugin.

Obtain participant permission before publishing proof photos. Existing images use direct WordPress uploads URLs: disabling public listings cannot revoke already shared URLs, downloaded photos or cached pages. Purge WordPress/CDN caches after changing publication or scores. Missing images are identified explicitly.

Review and release gates

This release passed all 16 PHP regression suites, PHP/JavaScript syntax checks, CodeQL JavaScript security-extended analysis, Semgrep PHP/JavaScript and WordPress exploit rules, Gitleaks history/tree secret scans, Trivy dependency/secret scans, Composer audit and the no-open-Dependabot-alert gate. CodeQL does not analyze PHP; PHP checks use the other scanners and tests.

SOLID/WordPress review retained separate query, publication-policy and rendering responsibilities and shared accepted-bonus rendering between public/admin views. New public strings use the plugin text domain; mutations retain capability and nonce checks. The WordPress Coding Standards scan reports an existing formatting/internationalization/documentation and context-sensitive diagnostic backlog. Full WPCS conformance, WordPress.org approval, formal SOLID certification and absence of all vulnerabilities are not claimed.

Previous releases are deprecated. Use v0.3.0 for new installations and upgrades.