1.2.0-beta1: API freeze for the 1.2.x ESI track
Cut after alpha3 came back from a clean re-test on portal-dev with
the alpha2 ESI bug verified fixed:
- Token-tampering rejection clean across four variants (mutated
args, mutated signature, swapped callback, garbage token).
- Cache-tag invalidation refreshes ESI fragments correctly.
- No regressions on inherited 1.1 admin-route + cache-poisoning
checks.
Same code as 1.2.0-alpha3 plus a ROADMAP docs bump. The version
bump signals API freeze for the 1.2.x track and asks operators to
soak the module on production-shape sites ahead of rc1.
What 1.2 ships: an ESI render element ('lscache_esi') that emits
<esi:include> tags for per-user fragments, plus the fragment route,
HMAC-SHA256 token signer, and lscache_esi cache tag for site-wide
invalidation. Builds on 1.1's private-cache machinery.
Stability commitment: the 'lscache_esi' element shape, the
fragment-route URL pattern, the token format, and the LscacheTokenSigner
service are stable from this release. Path to 1.2.0 stable is bug-fix
only.