golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(phase-14.2): evolve PROJECT.md after phase completion

Browse Source
This commit is contained in:
Jakub Zych
2026-10-12 13:03:39 +02:00
parent 3d42d35c8a
commit 9016e2a6fd
2 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.planning/PROJECT.md
View File

@@ -163,6 +163,9 @@ Quality
| Framework and application in two repos from day one (`summercms.go`, `fonoteka.go`) | Retrofitting the split later is more disruptive; shared stack plugins can be extracted for keios.eu without touching the framework; the framework never imports an app | ✓ Good (Phase 3: fonoteka.go workspace, user + fonoteka plugins, app.Handler test seam) |
| Shared core plugins live in their own `sm-<name>-plugin` repos, mounted into each application as git submodules (first: sm-user-plugin, module `git.golem15.com/golem15/sm-user-plugin`) | A second application (sm-summercmsio-app) exists and the Journal port is next; one copy per core plugin instead of forks; supersedes the Phase 1 keios.eu trigger (`.planning/notes/core-plugins-own-repos.md`) | ✓ Good (2026-10-02, quick 261002-esz) |
| OAuth identities live in sm-user-plugin; Index/Destroy are host-mounted on the JWT group | Social-login rows are a user-plugin table (D-01); routes stay off `/_user` so the host owns Winter 404 and `throttle:10,1` | ✓ Good (Phase 14.1, 2026-10-05; corpus 175/175/0) |
| The local dev stack is the Nuxt app proxied to the Go binary, guarded fail-closed (`fonoteka.go/scripts/dev-stack.sh`), with dev-only seed and marker route gated on `SUMMER_ENV=local` only | Proves the port in daily use before cutover without touching the production origin; `dev` is refused because shared servers often use that name (review WR-05) | ✓ Good (Phase 14.2, 2026-10-12; gate e2e 17/0/0/0, manual UAT 1-11) |
| Framework serves public uploads itself (`storage.uploads.serve`, opt-in) with nosniff, a sandboxing CSP and attachment disposition for non-images | Local runs need WinterCMS upload URLs without nginx; the hardening keeps uploaded HTML or SVG from running on the app origin (review WR-03) | ✓ Good (Phase 14.2) |
| The opt-in request log (`http.access_log`) records method, matched pattern, status and duration, never the URL path | Share and invitation tokens travel in paths (review WR-01); an unported route shows as a 404 with an empty pattern | ✓ Good (Phase 14.2) |
## Evolution
@@ -182,4 +185,4 @@ This document evolves at phase transitions and milestone boundaries.
4. Update Context with current state
---
*Last updated: 2026-10-05 after Phase 14.1 completion*
*Last updated: 2026-10-12 after Phase 14.2 completion*

8
.planning/STATE.md
View File

@@ -5,10 +5,10 @@ current_phase: 17
current_phase_name: Blog companions
status: executing
stopped_at: Phase 14.2 complete; Phase 17 at plan 3 of 4
last_updated: "2026-10-12T11:02:57.775Z"
last_updated: "2026-10-12T11:03:39.823Z"
last_activity: 2026-10-12
last_activity_desc: Phase 14.2 complete (Phase 17 position kept)
state_head: 55476db582d76972cfcd7d18e1c28b86a73a0f39
state_head: 3d42d35c8a733e5862dcbc52dfc91841582a9922
progress:
total_phases: 40
completed_phases: 14
@@ -23,10 +23,10 @@ milestone_name: milestone
## Project Reference
See: .planning/PROJECT.md (updated 2026-09-16)
See: .planning/PROJECT.md (updated 2026-10-12)
**Core value:** An existing WinterCMS-shaped app can be ported plugin by plugin to a single Go binary without its frontend noticing: the PHP version's API contract is the acceptance test.
**Current focus:** Phase 14.2 — Local Fonoteka frontend on local SummerCMS backend
**Current focus:** Phase 17 — Blog companions
## Current Position