diff --git a/.planning/quick/261015-w7f-update-framework-docs-for-phase-19-3-rel/261015-w7f-PLAN.md b/.planning/quick/261015-w7f-update-framework-docs-for-phase-19-3-rel/261015-w7f-PLAN.md new file mode 100644 index 0000000..e0e8445 --- /dev/null +++ b/.planning/quick/261015-w7f-update-framework-docs-for-phase-19-3-rel/261015-w7f-PLAN.md @@ -0,0 +1,241 @@ +--- +phase: quick-261015-w7f +plan: 01 +type: execute +wave: 1 +depends_on: [] +files_modified: + # framework (summercms.go) + - docs/setup/upgrading.md + - docs/index.md + - docs/setup/introduction.md + - docs/architecture/introduction.md + - docs/setup/coming-from-wintercms.md + - docs/setup/configuration.md + - docs/services/frontend-and-ajax.md + # plugins (sibling repos) + - ../sm-faq-plugin/go.mod + - ../sm-faq-plugin/go.sum + - ../sm-menu-plugin/go.mod + - ../sm-menu-plugin/go.sum + - ../sm-journal-plugin/go.mod + - ../sm-journal-plugin/go.sum + # summercms.io app and its site plugin submodule + - ../sm-summercmsio-app/plugins/golem15/summercms/go.mod + - ../sm-summercmsio-app/plugins/golem15/summercms/go.sum + - ../sm-summercmsio-app/go.mod + - ../sm-summercmsio-app/go.sum + - ../sm-summercmsio-app/CLAUDE.md + - ../sm-summercmsio-app/DEPLOY.md + - ../sm-summercmsio-app/README.md + - ../sm-summercmsio-app/scripts/build.sh + - ../sm-summercmsio-app/main.go + - ../sm-summercmsio-app/plugins.gen.go +autonomous: false +requirements: [quick-261015-w7f, decision-2026-10-15-release-v0-2-0] +user_setup: [] + +estimate: + tokens: 110000 + raw_tokens: 110000 + tasks: 3 + confidence: low + +must_haves: + truths: + - "docs/setup/upgrading.md has an 'Upgrading to 0.2' section that names the two boot refusals (WR-05 inferred-insecure token cookie in production; WR-04 credentialed CORS with wildcard-host or unanchored origin patterns), the config fix for each, and the smaller behaviour changes (WR-01 queued purge, WR-07 protected uploads into a public_url bucket, deprecated Journal purge keys). It is in the Setup sidebar and linked from docs/index.md and docs/setup/introduction.md" + - "Every framework module and admin/service feature shipped between v0.1.14 and v0.2.0 is reachable from a hub page: the architecture module table lists all 28 modules (adds cooler, seaglass, signpost, sunrise); the WinterCMS map no longer says Cache or the Reorder behaviour are not provided; the configuration key table has rows for http.cors_profiles, http.api_docs, auth.cookie and turnstile" + - "summer docs:build --check and TestDocsTree pass; no docs page, module README or the root README names a consuming application" + - "Annotated tag v0.2.0 is on origin at the framework master HEAD and its message summarizes the Upgrading to 0.2 notes; origin/master equals local master" + - "sm-faq-plugin, sm-menu-plugin and sm-journal-plugin require summercms v0.2.0 on origin/main and pass vet and tests with GOWORK=off" + - "vue-faq-layer v0.3.0, vue-menu-layer v0.3.0 and vue-journal-layer v0.5.0 are annotated tags on origin at the pushed main of each layer" + - "sm-summercmsio-app and its site plugin require summercms v0.2.0, a release build of bin/summercms-io reports v0.2.0 and boots in scripts/smoke.sh, both repos are pushed; after the rome deploy https://summercms.io/docs/setup/upgrading.html returns 200 (or the executor returned a checkpoint with the exact remaining server commands)" + artifacts: + - path: "docs/setup/upgrading.md" + provides: "Upgrading to 0.2 notes and a linked list of what 0.2 adds since the 0.1 series" + contains: "Upgrading to 0.2" + - path: "../sm-summercmsio-app/go.mod" + provides: "framework require bumped for the release build" + contains: "git.golem15.com/golem15/summercms v0.2.0" + key_links: + - from: "docs/index.md" + to: "docs/setup/upgrading.md" + via: "Markdown link in Where to start" + pattern: "setup/upgrading.md" + - from: "../sm-summercmsio-app/go.mod require v0.2.0" + to: "summercms.go tag v0.2.0" + via: "scripts/build.sh release mode exports the tag go.mod requires and runs summer docs:build --base-url /docs from it" + pattern: "summercms v0.2.0" +--- + + +Bring the framework docs up to date with everything shipped since the docs summercms.io last embedded (framework v0.1.14), add the "Upgrading to 0.2" notes required by decision note `.planning/notes/2026-10-15-release-v0-2-0.md` (commit 76d7888), release framework **v0.2.0** with the plugin requires and layer tags handed off by 19.3-06, then rebuild summercms.io against v0.2.0 and deploy it so `/docs` shows the new pages. + +Purpose: summercms.io/docs is 13 framework tags behind (it embeds v0.1.14 docs), and 19.3's gap closure changed boot behaviour, which is why the release is v0.2.0 and why upgrade notes ship with it. +Output: updated docs/ (one new page), tag v0.2.0, three plugin require bumps, three layer tags, summercms.io on v0.2.0 built, pushed and deployed (or a checkpoint for the server step). + +Release decision (user, this session): version **v0.2.0**, not v0.1.28. Layer tags stay v0.3.0 / v0.3.0 / v0.5.0. Out of scope: moving sm-grzybyfunkcjonalne-app's layer pins or plugin submodule pointers, moving the summercms.io app's user/translate/journal submodule pointers (planning-time `go build` of the app against current master succeeded with the existing pins), and `/msd-verify-work 19.3`. + +Shape: no tracer task. This is a strictly ordered release pipeline (docs, then tag, then consumers, then deploy) with an immutable tag in the middle, so a thin end-to-end slice adds no information. Task 1's verify does render the docs exactly as summercms.io's build does (`--base-url /docs --site-url / --site-label summercms.io`), which proves the docs end of the path before anything is tagged. + +Repo hygiene for all tasks: stage files by explicit path, never `git add -A`; leave other sessions' uncommitted files alone (`.planning/state.json`, `.msd/`, `.planning/phases/17-blog-companions/17-VERIFICATION.md` in summercms.go); no Co-Authored-By or other co-author trailers in any commit or tag message (user's global instruction overrides the default attribution); never force-push; before every push run `git fetch origin --tags` and confirm the branch is not behind (`git rev-list --count HEAD..origin/` is 0). If a branch is behind, stop and report rather than rebase across other sessions' work. + + + +@~/.claude/msd-core/workflows/execute-plan.md +@~/.claude/msd-core/templates/summary.md + + + +@.planning/STATE.md +@CLAUDE.md +@.planning/notes/2026-10-15-release-v0-2-0.md +@.planning/phases/19.3-framework-transport-and-infrastructure-for-wavepath/19.3-06-SUMMARY.md +@../sm-summercmsio-app/CLAUDE.md +@../sm-summercmsio-app/DEPLOY.md + +Planning-time observations (live, 2026-10-15): +- summercms.go master is 24 commits ahead of origin/master, highest tag v0.1.27, `v0.2.0` free on origin. `go test ./cmd/summer -run TestDocsTree` passes on HEAD. `summer` is not on PATH: use `go run ./cmd/summer ...` from the framework root. +- Phases with framework code since v0.1.14: 14.2 (access log, uploads serving), 16.2 (plugin-provided field types), 16.3 (admin personal API tokens, `admin:token:*`), 17 (signpost menu item types, seaglass sanitizer, richeditor, repeater, reorder, singleton), 18 (money and password fields, settings secrets, record actions), 18.1 (taglist, reorder tree), 19.3 (cooler caches and Redis rate-limit store, site-cache purge, `pact.ReorderAfterSave`, bouncer token cookies and Turnstile, credentialed CORS and `cors:`, `/api-docs`, `summer.yaml` `build.tags` and `summercms_s3`, `storage.uploads.public_url`), quick 261011-joh (sieve). Each of these already updated its own service/backend pages and module README; the API reference section is generated from every `modules/*/README.md`, so new modules appear there automatically; the root README module table already lists all 28 modules. +- Gaps found on the hub pages (Task 1 fixes these, then runs its own pass for anything else): + 1. `docs/architecture/introduction.md` "The framework modules" table lists 24 of 28 modules: missing cooler, seaglass, signpost, sunrise. + 2. `docs/setup/coming-from-wintercms.md` "not provided" table still says the Reorder behaviour (record sorting) and Cache are not provided; both shipped. The concept map has no rows for Cache, menu item types, form widgets / plugin field types, HTML sanitizing, singleton settings models, personal API tokens, captcha, credentialed CORS. + 3. `docs/setup/configuration.md` "Keys an application sets" has no rows for `http.cors_profiles.*`, `http.api_docs.*` (`enabled`, `path`, `title`), `auth.cookie.*` (`name`, `domain`, `path`, `secure`, `same_site`) or `turnstile.secret` / `turnstile.field`; those keys are documented only on routing.md and authentication.md. + 4. `docs/index.md` "Where to start" does not mention caching, field types, API tokens or menu item types; `docs/setup/introduction.md` "How these docs are organised" omits the Backend, Database and Services sections. + 5. `docs/services/frontend-and-ajax.md` "Building the frontend" predates the cookie refresh/logout handlers, `cors:`, Turnstile, the site-cache purge and `/api-docs`. + 6. There is no upgrade page; `docs/setup/installation.md#updating-an-application` covers the update script only. +- Setup page orders: introduction 10, installation 20, configuration 30, coming-from-wintercms 40, porting-a-plugin 50. Sidebar order comes from frontmatter `order`; `docs/site.yaml` lists sections only. +- Anchors that exist for linking: `services/routing.md#cors`, `#cors-profiles`, `#api-documentation-page`; `services/authentication.md#cookie-transport`, `#turnstile`; `setup/installation.md#updating-an-application`. +- The Journal plugin's deprecated keys are `golem15.journal.site_cache.purge_url` and `golem15.journal.site_cache.purge_token` (framework keys `site_cache.purge_url` / `site_cache.purge_token` win; a deprecation warning is logged). +- Plugins: sm-faq-plugin, sm-menu-plugin, sm-journal-plugin each 1 commit ahead of origin/main, require summercms v0.1.27, have a local go.work (hence GOWORK=off). Layers: vue-faq-layer and vue-menu-layer package.json 0.3.0 (origin tags up to v0.2.0), vue-journal-layer 0.5.0 (origin tags up to v0.4.0), each 1 commit ahead of origin/main. Prior tag style: `v0.1.27: (Phase 19.3)`; layer `v0.4.0: `. +- `go env`: GOPROXY=https://proxy.golang.org,direct, GOPRIVATE empty. The framework repo is public, so the proxy fetches a fresh tag on demand; if `go get ...@v0.2.0` reports an unknown revision right after the push, retry once with `GOPROXY=direct`. +- summercms.io app: clean, not ahead; go.mod and the site plugin (`plugins/golem15/summercms`, repo sm-summercmsio-plugin, branch master) require v0.1.14; app go.work replaces the framework with ../summercms.go. The previous bump (app commit 83c005d "chore: build against summercms v0.1.14", plugin commit 3845d8c "chore: require summercms v0.1.14") touched app go.mod, CLAUDE.md, DEPLOY.md, README.md and the plugin gitlink. `scripts/build.sh` header comment still says v0.1.12. App config has no `auth.cookie` block and no CORS config, so the v0.2.0 boot refusals do not apply to it; `scripts/smoke.sh` proves the boot. +- rome: `ssh rome` does not resolve from this machine (no `~/.ssh/config` alias, not in /etc/hosts). https://summercms.io/docs/ answers 200 (live site, so this is a normal redeploy: DEPLOY.md "Build (local)", "Upload", "Release (every deploy)", then the verify list; skip "First release only", "Cutover" and the launch checklist). +- g15office: Phase 19.3 milestone task id `lpybyjdh` (`.planning/G15OFFICE.md`); no g15office CLI on PATH. + + + + + + Task 1: Docs audit and fill since v0.1.14, plus the Upgrading to 0.2 page + docs/setup/upgrading.md, docs/index.md, docs/setup/introduction.md, docs/architecture/introduction.md, docs/setup/coming-from-wintercms.md, docs/setup/configuration.md, docs/services/frontend-and-ajax.md (plus any page the audit pass below finds thin) + +Work in the framework root (/media/nvme/dev/golem15/summercms.io/summercms/summercms.go). Read each page before editing it and match its existing voice: plain declarative sentences, tables with a "Where"/module-link column, links relative within docs/ and to `../../modules//README.md`. Every identifier written into docs must exist in the package (the checker enforces it); config keys are not checked automatically, so copy each key from the page or README that already documents it (routing.md, authentication.md, caching.md, storage.md, the cooler/surf/bouncer/lagoon READMEs). Never name a consuming application anywhere in docs (core plugins such as the Journal, menu and FAQ plugins may be named, as caching.md already does); the verify step greps for the known names. + +1. New page `docs/setup/upgrading.md`, per decision note 2026-10-15-release-v0-2-0. Frontmatter: title "Upgrading", a description under 160 characters, section setup, order 60 (last in Setup, after Porting a plugin). Body: + - A short intro: how to move an application to a newer framework release (link `installation.md#updating-an-application` for the update script; for a module require, `go get git.golem15.com/golem15/summercms@v0.2.0` then `go mod tidy`), and the versioning rule from the decision note: the minor version is bumped when an upgrade can refuse a previously valid config or changes a documented behaviour; patch versions are safe to take without reading. + - `## Upgrading to 0.2` with `### Boot refusals` covering exactly two items, each with the symptom (the start-up error and the key it names), who is affected and the fix: + (a) WR-05: in the production environment, `bouncer.LoadCookieConfig` refuses a token cookie whose Secure resolves to false, whether set to false or inferred from an http or unset `app.url`. Affects applications that load an `auth.cookie` block. Fix: set `app.url` to the https URL, or set `auth.cookie.secure` explicitly. Link `../services/authentication.md#cookie-transport`. + (b) WR-04: with `supports_credentials: true`, globally under `http.cors` or in any `http.cors_profiles.`, wildcard `allowed_origins` entries other than a whole leftmost host label and `allowed_origins_patterns` entries not anchored with `^` and `$` (every alternative) fail the start-up, naming the key and index. Fix: list exact origins, or anchored patterns such as the one routing.md shows. Link `../services/routing.md#cors` and `#cors-profiles`. + - `### Behaviour changes`: WR-01 site-cache purges after an admin save are queued after commit and coalesced (one request in flight per purger); tests that assert a purge call `cooler.SiteCachePurger.Wait` first, and shutdown drains the queue (link caching.md). WR-07 an upload with `is_public` false is refused with `attach.ErrProtectedNeedsPrivateBucket` while `storage.uploads.public_url` is set, and `attach.OpenBucket` warns at boot (link storage.md or database/attachments.md, whichever documents public_url). The Journal plugin's `golem15.journal.site_cache.purge_url` and `golem15.journal.site_cache.purge_token` are deprecated aliases of `site_cache.purge_url` / `site_cache.purge_token`; the framework keys win and a warning is logged. Also one line each for the smaller hardening a reader may notice: the zero `bouncer.CookieConfig` writes SameSite=Lax and Secure (WR-09), `/api-docs` allows only nonce-carrying scripts (WR-06), a boot warning when turnstile routes have no secret (WR-08), `cors:` headers now on every response of the route including refusals and recovered panics (CR-01). + - `## What 0.2 adds since 0.1` (the summercms.io docs last showed the 0.1 series): a bulleted list, one line per feature with a link to its page, covering at least: caching and the Redis rate-limit store, site-cache purge and `pact.ReorderAfterSave` (services/caching.md), token cookies and Turnstile (services/authentication.md), credentialed CORS, CORS profiles and the API documentation page (services/routing.md), `build.tags` and S3 uploads plus `storage.uploads.public_url` (services/storage.md, architecture/go-modules-and-workspaces.md), access log (services/logging.md), plugin-provided field types (backend/field-types.md), richeditor, repeater, money, taglist and dependent fields (backend/forms.md), record reordering and singleton controllers (backend/lists-and-filters.md, backend/settings.md or admin-controllers.md, wherever they are documented), admin personal API tokens and `admin:token:*` (backend/users-and-permissions.md, console/setup-and-maintenance.md), menu item types (plugins/menu-item-types.md), and the new modules cooler, seaglass, sieve, signpost (their README links). +2. `docs/index.md`: in "Where to start", add Upgrading to the Setup bullet (link `setup/upgrading.md`), caching to the Services bullet, field types and API tokens to the Backend bullet, menu item types to the Plugins bullet. Keep each bullet one sentence-ish line. +3. `docs/setup/introduction.md` "How these docs are organised": mention upgrading in the Setup bullet and add the missing Backend, Database and Services bullets so the list matches docs/site.yaml's sections. +4. `docs/architecture/introduction.md` module table: add cooler (Services), seaglass (Admin, the rich text sanitizer), signpost (Plugins and the container, or Services; pick by what its README says it serves) and sunrise (Console and tooling). Afterwards the table links all 28 directories under modules/. +5. `docs/setup/coming-from-wintercms.md`: replace the two stale rows in the "not provided" table (Reorder behaviour, Cache) by moving them into the concept map as provided features; add concept-map rows for Laravel Cache / `Cache::remember` → cooler (caching.md), the Static Pages menu item types → signpost (plugins/menu-item-types.md), `registerFormWidgets` / form widgets → plugin-provided field types (backend/field-types.md), the Reorder behaviour → reorder (lists-and-filters.md), singleton settings models → singleton controllers (settings.md), HTML cleaning of rich text → seaglass, personal access tokens → admin API tokens (users-and-permissions.md), captcha on public forms → Turnstile (authentication.md#turnstile), and the Laravel CORS config → `http.cors` and CORS profiles (routing.md). Use only identifiers that the module READMEs already document. +6. `docs/setup/configuration.md` "Keys an application sets": add rows for `http.cors_profiles.*` (named CORS profiles applied with the `cors:` middleware), `http.api_docs.enabled` / `path` / `title`, `auth.cookie.*`, and `turnstile.secret` / `turnstile.field`, each with its module link; extend the `http.cors.*` row with one clause that credentialed CORS refuses wildcard-host and unanchored patterns at boot; add one sentence after the table pointing to Upgrading for keys whose validation tightened in 0.2. +7. `docs/services/frontend-and-ajax.md` "Building the frontend": extend Signing in with the httpOnly token cookie and its refresh/logout handlers (authentication.md#cookie-transport); extend Cross-origin calls with `cors:` for a credentialed SPA (routing.md#cors-profiles); add bullets for bot protection on public forms (Turnstile), purging the frontend's page cache after admin saves (caching.md) and the browsable API documentation page (routing.md#api-documentation-page). +8. Audit pass (bounded): for each module README changed since v0.1.14 (`git diff --name-only v0.1.14..HEAD -- 'modules/*/README.md'`), skim its Features list and confirm each feature is named on at least one docs/ guide page (grep the docs tree for its key identifier). Fix small gaps in place (a sentence or a table row on the page that owns the topic). List anything larger in the SUMMARY under "Docs gaps left" instead of writing a new guide page. +9. Run `go run ./cmd/summer docs:sync` only if a `src=` snippet source changed (none is expected). Commit the docs in one commit, staging only the docs files you changed by path: `docs(quick-261015-w7f): docs since v0.1.14 and the Upgrading to 0.2 notes`. No .planning files in this commit. + + + cd /media/nvme/dev/golem15/summercms.io/summercms/summercms.go && go test -count=1 ./cmd/summer -run TestDocsTree && go run ./cmd/summer docs:build --check && OUT="$(mktemp -d)/docs" && go run ./cmd/summer docs:build --base-url /docs --site-url / --site-label summercms.io --out "$OUT" && grep -q 'Upgrading to 0.2' "$OUT/setup/upgrading.html" && grep -q 'setup/upgrading' "$OUT/index.html" && for m in cooler seaglass signpost sunrise sieve; do grep -q "modules/$m/README.md" docs/architecture/introduction.md || { echo "MISSING module $m"; exit 1; }; done && test "$(grep -cE '^\| (Cache|Record sorting \(the Reorder behaviour\)) \| Not provided' docs/setup/coming-from-wintercms.md)" = 0 && grep -q 'http\.cors_profiles' docs/setup/configuration.md && grep -q 'http\.api_docs' docs/setup/configuration.md && grep -q 'auth\.cookie' docs/setup/configuration.md && grep -q 'turnstile\.secret' docs/setup/configuration.md && grep -q 'setup/upgrading.md' docs/index.md && grep -q 'upgrading.md' docs/setup/introduction.md && grep -q 'ErrProtectedNeedsPrivateBucket' docs/setup/upgrading.md && grep -q 'golem15.journal.site_cache.purge_url' docs/setup/upgrading.md && test "$(grep -rniE 'wavepath|fonoteka|p[lł]ytarium|grzyby|studia' docs README.md modules/*/README.md | wc -l)" = 0 && bash scripts/check-phase19.3.sh docs && echo TASK1_OK + + The docs checker and TestDocsTree pass; a summercms.io-style render contains setup/upgrading.html with the "Upgrading to 0.2" section and the index links it; the architecture table links all 28 modules; the WinterCMS map no longer lists Cache or the Reorder behaviour as not provided; the configuration table carries the four missing key groups; no consuming application is named; one docs commit is on master. + + + + Task 2: Release framework v0.2.0, bump the three plugins, push and tag the three layers + A pushed Go module version is immutable in module proxies: a defect found after the push ships as v0.2.1, it cannot be retagged. The user chose the version and authorized the full release in this session (decision note 76d7888), so no decision checkpoint is inserted; the pre-tag checks below are the gate. + summercms.go tag v0.2.0 (no file), ../sm-faq-plugin/go.mod, ../sm-faq-plugin/go.sum, ../sm-menu-plugin/go.mod, ../sm-menu-plugin/go.sum, ../sm-journal-plugin/go.mod, ../sm-journal-plugin/go.sum, layer tags (no files) + +Per decision note 2026-10-15-release-v0-2-0 and the 19.3-06 handoff (steps 2-4, with v0.2.0 in place of v0.1.28). + +1. Pre-tag gate in the framework root: `go vet ./...`, `go test -short ./...`, `(cd examples/hello && go test ./...)`, and `bash scripts/check-phase19.3.sh --all`. If the Docker daemon is not reachable from this shell, the gate prints NOT RUN docker; per CLAUDE.md retry the docker stage as `sudo -u golem` only if that works without a password, otherwise accept NOT RUN docker (19.3-06 ran it green and only docs changed since) and note it in the SUMMARY. Any other failure: stop, do not tag. +2. Confirm the tree is ready: `git status --porcelain` shows only the other sessions' files listed in the objective (they are not part of the tag; the tag points at a commit); `git fetch origin --tags`; `git rev-list --count HEAD..origin/master` is 0; `git ls-remote --tags origin v0.2.0` prints nothing. +3. Write the tag message to a file in the scratch directory (not the repo) and create the annotated tag with `git tag -a v0.2.0 -F ` on master HEAD. Message: first line `v0.2.0: ` in the v0.1.27 style; a blank line; an "Upgrading to 0.2" block with the two boot refusals and their fixes (WR-05: production refuses a token cookie whose Secure is inferred false from an http or unset app.url; set app.url to https or auth.cookie.secure explicitly. WR-04: credentialed CORS refuses wildcard-host and unanchored origin patterns, globally and per profile; list exact origins or anchored patterns) and the smaller behaviour changes (queued and coalesced site-cache purge, WR-01; protected uploads refused into a public_url bucket, WR-07; Journal purge keys deprecated in favour of site_cache.*); a closing line pointing to docs/setup/upgrading.md. Never name a consuming application in the message (same rule as docs). No co-author trailer. +4. Push: `git push origin master`, then `git push origin v0.2.0`. Confirm with `git ls-remote --tags origin v0.2.0` (tag and its peeled line) and `git rev-list --left-right --count origin/master...master` = 0 0. +5. For each of ../sm-faq-plugin, ../sm-menu-plugin, ../sm-journal-plugin (branch main): `GOWORK=off go get git.golem15.com/golem15/summercms@v0.2.0` (retry once with GOPROXY=direct if the proxy does not know the tag yet), `GOWORK=off go mod tidy`, `GOWORK=off go vet ./...`, `GOWORK=off go test -count=1 ./...` (Docker-backed tests: same Docker note as step 1; if Docker is unavailable run `GOWORK=off go test -count=1 -short ./...` and record that). Commit only go.mod and go.sum by path as `chore: require summercms v0.2.0`. Fetch, check not behind, `git push origin main`. The plugins' tests call `cooler.SiteCachePurger.Wait`, which is why the pushed main only builds standalone after this bump. +6. Layers ../vue-faq-layer, ../vue-menu-layer, ../vue-journal-layer (branch main): run `bash scripts/check-phase19.3.sh layers` from the framework root once before pushing. For each layer confirm `package.json` version is 0.3.0, 0.3.0, 0.5.0 respectively and `git ls-remote --tags origin v` prints nothing; fetch, check not behind, `git push origin main`, then `git tag -a v -m "v: "` and `git push origin v`. +7. Do not touch sm-grzybyfunkcjonalne-app (layer pins, plugin pointers) or any other app: follow-up, out of scope. + + + cd /media/nvme/dev/golem15/summercms.io/summercms && git -C summercms.go fetch -q origin --tags && test "$(git -C summercms.go cat-file -t v0.2.0)" = tag && git -C summercms.go merge-base --is-ancestor 'v0.2.0^{commit}' origin/master && git -C summercms.go log -1 --format=%s 'v0.2.0^{commit}' >/dev/null && git -C summercms.go ls-remote --tags origin v0.2.0 | grep -q 'refs/tags/v0.2.0' && git -C summercms.go cat-file -p v0.2.0 | grep -q 'Upgrading to 0.2' && for p in sm-faq-plugin sm-menu-plugin sm-journal-plugin; do grep -q 'git.golem15.com/golem15/summercms v0.2.0' $p/go.mod && git -C $p fetch -q origin && test "$(git -C $p rev-list --left-right --count origin/main...main)" = "0 0" || { echo "PLUGIN NOT DONE $p"; exit 1; }; done && for lt in vue-faq-layer:v0.3.0 vue-menu-layer:v0.3.0 vue-journal-layer:v0.5.0; do l=${lt%%:*}; t=${lt#*:}; git -C $l fetch -q origin --tags && git -C $l ls-remote --tags origin $t | grep -q "refs/tags/$t" && test "$(git -C $l rev-list --left-right --count origin/main...main)" = "0 0" || { echo "LAYER NOT DONE $l $t"; exit 1; }; done && echo TASK2_OK + + v0.2.0 is an annotated tag on origin at master's HEAD with the upgrade notes in its message; the three plugins require v0.2.0, pass their suites with GOWORK=off and are pushed; the three layers are pushed and tagged v0.3.0, v0.3.0, v0.5.0 on origin; nothing was force-pushed. + + + + Task 3: summercms.io on v0.2.0: bump, release build, push, deploy to rome (checkpoint if the server is unreachable) + ../sm-summercmsio-app/plugins/golem15/summercms/go.mod, ../sm-summercmsio-app/plugins/golem15/summercms/go.sum, ../sm-summercmsio-app/go.mod, ../sm-summercmsio-app/go.sum, ../sm-summercmsio-app/CLAUDE.md, ../sm-summercmsio-app/DEPLOY.md, ../sm-summercmsio-app/README.md, ../sm-summercmsio-app/scripts/build.sh, ../sm-summercmsio-app/main.go, ../sm-summercmsio-app/plugins.gen.go + +Work in /media/nvme/dev/golem15/summercms.io/summercms/sm-summercmsio-app. Mirror the previous bump (plugin commit 3845d8c, app commit 83c005d). Leave the user, translate and journal submodule pointers where they are (planning-time compile against current master succeeded); change them only if the release build fails on them, and then say why in the SUMMARY. + +1. Site plugin `plugins/golem15/summercms` (repo sm-summercmsio-plugin, branch master): `GOWORK=off go get git.golem15.com/golem15/summercms@v0.2.0`, `GOWORK=off go mod tidy`, `GOWORK=off go vet ./...`, `GOWORK=off go test -count=1 ./...`. Commit go.mod and go.sum by path as `chore: require summercms v0.2.0`. Do not push yet. +2. App: set the `git.golem15.com/golem15/summercms` require in go.mod to v0.2.0, `GOWORK=off go mod tidy`, `go vet ./... && go test ./...`. Replace v0.1.14 with v0.2.0 in CLAUDE.md, DEPLOY.md (every occurrence: launch-checklist tag check, Build (local), the `go version -m` sentence) and README.md; in scripts/build.sh fix the stale header comment version (v0.1.12) to v0.2.0. Stage by path: go.mod, go.sum, CLAUDE.md, DEPLOY.md, README.md, scripts/build.sh and the `plugins/golem15/summercms` gitlink; commit `chore: build against summercms v0.2.0`. +3. Release build: `scripts/build.sh` (release mode; it needs tag v0.2.0 in ../summercms.go, created in Task 2, and refuses dirty trees). If `summer build` regenerates main.go or plugins.gen.go, the script stops: commit them by path as `chore: regenerate main.go for summercms v0.2.0` and rerun. Then `go version -m bin/summercms-io` must show the summercms module at v0.2.0. Run `scripts/smoke.sh` (Docker; same Docker note as Task 2) and `scripts/check-deploy.sh`; with the built trees, `SUMMERCMS_REQUIRE_BUILD=1 go -C plugins/golem15/summercms test -count=1 ./...`. Check the built docs: `plugins/golem15/summercms/public/docs/setup/upgrading.html` and `public/docs/api/cooler.html` exist. +4. Push, submodule first: fetch and not-behind check, `git -C plugins/golem15/summercms push origin master`, then `git push origin master` for the app. vue-summercmsio-app is unchanged; do not push it. +5. Deploy preflight: `ssh -o BatchMode=yes -o ConnectTimeout=8 rome 'sudo -n true'`. At planning time `rome` did not resolve from this machine. Do not guess a hostname or IP. If the preflight fails for any reason (unresolved host, auth, sudo wants a password), STOP here and return `## CHECKPOINT REACHED` (type human-action) containing: the absolute path of the built binary and its `go version -m` summercms line; the commands copied verbatim from DEPLOY.md sections "Upload" and "Release (every deploy)" (normal redeploy: not "First release only", not "Cutover"), including the ownership check `stat -c '%U:%G %a %n' /srv/summercms-io /srv/summercms-io/bin /srv/summercms-io/config` from "One-time server setup"; and the post-deploy checks of step 7. Resume instruction: after the user reports the release done, run step 7. +6. If the preflight succeeds: run the DEPLOY.md "Upload" commands from the app root, then over ssh the ownership check and the "Release (every deploy)" commands in order (migrate with the new binary before the restart, keep `.prev`, restart, local curl). If migrate or the restart fails, roll back per DEPLOY.md "Rollback" (App) and report. +7. Post-deploy verification from this machine: the DEPLOY.md "Verify after cutover" curl list, plus `curl -s -o /dev/null -w '%{http_code}' https://summercms.io/docs/setup/upgrading.html` = 200 (it is 404 before the deploy), `https://summercms.io/docs/services/caching.html` = 200, `https://summercms.io/docs/api/cooler.html` = 200, and `curl -s https://summercms.io/docs/setup/upgrading.html | grep -q 'Upgrading to 0.2'`. Then rerun `SUMMERCMS_CHECK_EXTERNAL=1 go -C plugins/golem15/summercms test -run TestExternalLinks -count=1 -v ./...`. +8. g15office: if the session has a g15office tool, post a short comment on task `lpybyjdh` (Phase 19.3) saying v0.2.0 is released with upgrade notes, the plugins require it, the layers are tagged and summercms.io/docs serves it; otherwise list the comment as pending in the SUMMARY for the orchestrator. + + + cd /media/nvme/dev/golem15/summercms.io/summercms/sm-summercmsio-app && grep -q 'git.golem15.com/golem15/summercms v0.2.0' go.mod && grep -q 'git.golem15.com/golem15/summercms v0.2.0' plugins/golem15/summercms/go.mod && test "$(grep -c 'v0\.1\.14' CLAUDE.md DEPLOY.md README.md | awk -F: '{s+=$2} END {print s}')" = 0 && go version -m bin/summercms-io | grep 'golem15/summercms' | grep -q 'v0.2.0' && test -f plugins/golem15/summercms/public/docs/setup/upgrading.html && git fetch -q origin && test "$(git rev-list --left-right --count origin/master...master)" = "0 0" && git -C plugins/golem15/summercms fetch -q origin && test "$(git -C plugins/golem15/summercms rev-list --left-right --count origin/master...master)" = "0 0" && test -z "$(git status --porcelain --ignore-submodules=none)" && echo TASK3_LOCAL_OK && test "$(curl -s -o /dev/null -w '%{http_code}' https://summercms.io/docs/setup/upgrading.html)" = 200 && curl -s https://summercms.io/docs/setup/upgrading.html | grep -q 'Upgrading to 0.2' && echo TASK3_DEPLOYED_OK + + The site plugin and the app require v0.2.0 and are pushed (submodule first); a release build of bin/summercms-io reports v0.2.0, passes smoke.sh, check-deploy.sh and the plugin's build checks, and embeds docs with setup/upgrading.html; either the deploy ran and https://summercms.io/docs/setup/upgrading.html serves the "Upgrading to 0.2" page with the DEPLOY.md verify list green, or the executor returned a human-action checkpoint with the exact remaining server commands and the post-deploy checks (TASK3_LOCAL_OK printed, TASK3_DEPLOYED_OK pending). + + + + + +## Trust Boundaries + +| Boundary | Description | +|----------|-------------| +| local repos → git.golem15.com | pushes of master, main and tags that other apps and the public module proxy consume | +| framework tag → Go module proxy | a published version is cached and immutable | +| build machine → rome | binary and config upload, migrate and restart of the live site | +| docs → public site | everything in docs/ and the tag message becomes public | + +## STRIDE Threat Register + +| Threat ID | Category | Component | Severity | Disposition | Mitigation Plan | +|-----------|----------|-----------|----------|-------------|-----------------| +| T-w7f-01 | Tampering | pushes to master/main of six repos while other sessions work | high | mitigate | fetch with tags and require `HEAD..origin/` = 0 before each push; never force-push; stage by path; stop instead of rebasing | +| T-w7f-02 | Tampering | tag v0.2.0 on a broken tree | high | mitigate | Task 2 step 1 gate (vet, short tests, examples/hello, check-phase19.3.sh --all) before `git tag`; tag must equal origin/master after push | +| T-w7f-03 | Information disclosure | docs pages and tag annotation | medium | mitigate | Task 1 verify greps docs, root and module READMEs for consuming-application names (must be 0); `check-phase19.3.sh docs` repeats the check; no secrets or hostnames in docs or the tag message | +| T-w7f-04 | Denial of service | summercms.io boot after the upgrade (WR-04/WR-05 boot refusals, new required keys) | high | mitigate | app config has no auth.cookie block and no credentialed CORS (observed); `scripts/smoke.sh` boots the release binary on postgres:15 before any upload; DEPLOY.md keeps `bin/summercms-io.prev` and migrate runs before the restart; Rollback (App) on failure | +| T-w7f-05 | Tampering | deploying a binary not built from pushed commits | medium | mitigate | `scripts/build.sh` release mode refuses dirty trees and compiles against the tag export; `go version -m` must show v0.2.0; push happens before upload | +| T-w7f-06 | Spoofing / Elevation | rome access | medium | mitigate | no hostname guessing; BatchMode preflight with `sudo -n`; otherwise a human-action checkpoint; `.env` is never rsynced (DEPLOY.md); ownership check of /srv/summercms-io before the release steps | +| T-w7f-SC | Tampering | `go get` / `go mod tidy` / `pnpm install --frozen-lockfile` | low | accept | only the first-party framework module changes version; its third-party deps are the decided set in .planning/research/STACK.md; pnpm runs from the committed lockfile; no new third-party package is introduced, so no legitimacy checkpoint is needed | + + + +- Task 1 automated block prints TASK1_OK. +- Task 2 automated block prints TASK2_OK. +- Task 3 automated block prints TASK3_LOCAL_OK, and TASK3_DEPLOYED_OK once the deploy is done (by the executor or after the human-action checkpoint). +- Source coverage: + +| Source | Item | Covered by | +|--------|------|------------| +| GOAL | summercms.io docs explain everything shipped since its last docs update | Task 1 (fill), Task 3 (site embeds v0.2.0 docs) | +| GOAL | full framework release | Task 2 | +| GOAL | rebuild and deploy summercms.io | Task 3 | +| DECISION 2026-10-15-release-v0-2-0 | tag v0.2.0, plugins `go get ...@v0.2.0` | Task 2 | +| DECISION | "Upgrading to 0.2" in docs and release notes, two boot refusals with fixes, smaller behaviour changes | Task 1 step 1, Task 2 step 3 | +| DECISION | minor-bump versioning rule | Task 1 step 1 intro | +| HANDOFF 19.3-06 steps 2-4 | tag, plugin bumps, layer push and tags | Task 2 | +| HANDOFF 19.3-06 step 6 | g15office phase comment | Task 3 step 8 | +| HANDOFF 19.3-06 step 5 | app layer pins and plugin pointer bumps | excluded: not authorized (follow-up) | + + + +- https://summercms.io/docs serves the v0.2.0 framework docs, including setup/upgrading.html and the cooler API page. +- v0.2.0 exists on origin as an annotated tag with upgrade notes; three plugins require it; three layers are tagged. +- No force-push, no co-author trailers, no consuming-application names in framework docs, other sessions' files untouched. + + + +Create `.planning/quick/261015-w7f-update-framework-docs-for-phase-19-3-rel/261015-w7f-SUMMARY.md` when done (include: commits per repo with hashes, tag objects, which gate stages ran or were NOT RUN, docs gaps left, deploy outcome or the checkpoint's remaining commands, g15office comment status). + diff --git a/.planning/quick/261015-w7f-update-framework-docs-for-phase-19-3-rel/261015-w7f-SUMMARY.md b/.planning/quick/261015-w7f-update-framework-docs-for-phase-19-3-rel/261015-w7f-SUMMARY.md new file mode 100644 index 0000000..474c253 --- /dev/null +++ b/.planning/quick/261015-w7f-update-framework-docs-for-phase-19-3-rel/261015-w7f-SUMMARY.md @@ -0,0 +1,159 @@ +--- +phase: quick-261015-w7f +plan: 01 +subsystem: docs, release +tags: [docs, release, v0.2.0, summercms.io, deploy] +status: checkpoint +requires: + - decision 2026-10-15-release-v0-2-0 (commit 76d7888) + - 19.3-06 handoff (tag, plugin bumps, layer tags) +provides: + - docs/setup/upgrading.md ("Upgrading to 0.2", version rule, what 0.2 adds since 0.1) + - framework tag v0.2.0 on origin + - sm-faq/menu/journal plugins on summercms v0.2.0 + - layer tags vue-faq-layer v0.3.0, vue-menu-layer v0.3.0, vue-journal-layer v0.5.0 + - summercms.io app and site plugin on v0.2.0, release binary built and pushed +affects: + - summercms.io/docs (after the pending rome deploy) +tech-stack: + added: [] + patterns: [] +key-files: + created: + - docs/setup/upgrading.md + modified: + - docs/index.md + - docs/setup/introduction.md + - docs/architecture/introduction.md + - docs/setup/coming-from-wintercms.md + - docs/setup/configuration.md + - docs/services/frontend-and-ajax.md +decisions: + - "Internal review IDs (WR-0x, CR-01) stay out of the public upgrading page; they appear only in the v0.2.0 tag message" +metrics: + completed: 2026-10-15 +estimate: + tokens: 110000 + tasks: 3 +actuals: + tokens: 7100 # chars/4 over the added lines of every commit in all six repos (28286 chars) + tasks: 3 # Tasks 1 and 2 complete; Task 3 complete up to the deploy preflight (checkpoint) + commits: 1 # framework repo, measured: git rev-list --count plan_head_before..HEAD +plan_head_before: 76d788821ac1e6aaa3b8fb4bf2c824938cc6920a +plan_head_after: f3e8a984b04c0a6945d2f6f346ffda795f1a3c80 +--- + +# Quick 261015-w7f: framework docs since v0.1.14, release v0.2.0, summercms.io on v0.2.0 Summary + +Docs gained an "Upgrading to 0.2" page plus hub-page fixes (28-module table, WinterCMS map, config keys), v0.2.0 is tagged and pushed with the three plugin bumps and three layer tags, and a v0.2.0 release build of summercms.io is pushed and smoke-tested. **The rome deploy is not done**: `rome` does not resolve from this machine, so the server step is handed back as a human-action checkpoint below. + +## Commits and tags per repo + +| Repo | Commit / tag | What | +|------|--------------|------| +| summercms.go | `f3e8a98` | docs(quick-261015-w7f): docs since v0.1.14 and the Upgrading to 0.2 notes | +| summercms.go | tag `v0.2.0` (tag object `d5f754a`, points at `f3e8a98`) | annotated, upgrade notes in the message; pushed with master (`f80e2e8..f3e8a98`, origin/master == master) | +| sm-faq-plugin | `2efe351` | chore: require summercms v0.2.0 (pushed main, `fa90e83..2efe351`) | +| sm-menu-plugin | `f7eddd5` | chore: require summercms v0.2.0 (pushed main, `fe27b9a..f7eddd5`) | +| sm-journal-plugin | `8de4928` | chore: require summercms v0.2.0 (pushed main, `a99e9a1..8de4928`) | +| vue-faq-layer | tag `v0.3.0` (`225870a`) | main pushed `96b6bc0..a229f6a`, then tagged | +| vue-menu-layer | tag `v0.3.0` (`255c0fd`) | main pushed `dd0ee35..c4639c2`, then tagged | +| vue-journal-layer | tag `v0.5.0` (`4673d8e`) | main pushed `5936f66..f5d7aac`, then tagged | +| sm-summercmsio-plugin (submodule `plugins/golem15/summercms`) | `aac8931` | chore: require summercms v0.2.0 (pushed master, `3845d8c..aac8931`) | +| sm-summercmsio-app | `36c3c50` | chore: build against summercms v0.2.0 (pushed master, `83c005d..36c3c50`) | + +No force-push, no co-author trailers, files staged by path. Plugin bumps changed go.mod only (each plugin's go.mod carries a `replace` to `../summercms.go`, so go.sum has no framework line). Other sessions' files untouched (`.planning/state.json`, `.msd/`, `17-VERIFICATION.md`, `sm-journal-plugin/go.work.sum`). + +## Task 1: docs + +- New `docs/setup/upgrading.md` (Setup, order 60): update paths (script and `go get ...@v0.2.0`), the version rule from the decision note, `## Upgrading to 0.2` with `### Boot refusals` (token cookie not Secure in production; credentialed CORS with wildcard-host / unanchored / over-broad origin rules, global and per profile) and their fixes, `### Behaviour changes` (queued and coalesced purge with `cooler.SiteCachePurger.Wait`, `attach.ErrProtectedNeedsPrivateBucket`, deprecated Journal purge keys, cookie defaults, api-docs nonce, Turnstile warning, CORS profile headers on every answer), and `## What 0.2 adds since 0.1` with links. +- `docs/architecture/introduction.md`: cooler, seaglass, signpost, sunrise added; all 28 modules linked. +- `docs/setup/coming-from-wintercms.md`: "Cache" and "Reorder behaviour" removed from Not provided; nine concept-map rows added (reorder, form widgets / field types, rich text sanitizing, singleton controllers, API tokens, Cache facade, CORS config, captcha / Turnstile, Static Pages menu item events). +- `docs/setup/configuration.md`: rows for `http.cors_profiles.*`, `http.api_docs.*`, `auth.cookie.*`, `turnstile.*`; credentialed-CORS clause on `http.cors.*`; pointer to Upgrading. +- `docs/index.md`, `docs/setup/introduction.md`, `docs/services/frontend-and-ajax.md`: links to upgrading, caching, field types, API tokens, menu item types, cookie refresh/logout handlers, CORS profiles, Turnstile, site-cache purge, `/api-docs`. +- Verify: TASK1_OK (TestDocsTree, `docs:build --check`, summercms.io-style render with `setup/upgrading.html`, name grep 0, `check-phase19.3.sh docs`). + +### Docs gaps left + +Bounded audit (README Features bullets whose backticked identifiers appear nowhere in docs/): only reference-level details remain, all covered by the generated API reference pages: `backpack.NewRegistry`, `bonfire.NewRootIO`, `bouncer.Middleware`, the cabana `Admin*` swag carriers and seaglass element allowlist, `conga.Daily`/`conga.Every` details, `fetchguard.ReasonScheme`/`ReasonPrivate`, `lighthouse.RegisterDriver`, postcard template naming, `seaglass.Removals`, sunrise truncation safety, `surf.LocaleFromPrincipal` (documented as `locale.from-principal`), `surf.Router.GroupRaw` (documented as `pact.Router.GroupRaw`), tide proxy/rules, towel getters. No guide page needed. + +## Task 2: release gate + +All gate stages ran green before tagging: `go vet ./...`, `go test -short ./...`, `examples/hello` tests, and `scripts/check-phase19.3.sh --all` with PASS self-test, go, plugins, layers, docs **and docker** (Docker was reachable; nothing NOT RUN). Plugins: `GOWORK=off go vet` and full `GOWORK=off go test -count=1 ./...` (Docker-backed tests included) green for all three. + +## Task 3: summercms.io + +- Site plugin and app require v0.2.0; v0.1.14 replaced in CLAUDE.md, DEPLOY.md, README.md; build.sh header v0.1.12 -> v0.2.0. User/translate/journal submodule pointers untouched (the build did not need them moved). +- `scripts/build.sh` (release) succeeded: `build: bin/summercms-io (release v0.2.0) ready`; main.go / plugins.gen.go unchanged by regeneration. +- `go version -m bin/summercms-io`: `dep git.golem15.com/golem15/summercms v0.2.0`. sha256 `a1c573f96750b08810a76dc3d822d6946e6d2300c791359d5b61de7a0ef81c85`. +- `scripts/smoke.sh`: `smoke: ok`. `scripts/check-deploy.sh`: ok. `SUMMERCMS_REQUIRE_BUILD=1` plugin tests: ok. Built `public/docs/setup/upgrading.html` and `public/docs/api/cooler.html` exist. +- TASK3_LOCAL_OK printed. TASK3_DEPLOYED_OK pending: `https://summercms.io/docs/setup/upgrading.html` answers 404 (old binary still live). + +## Checkpoint: deploy to rome (human-action, remaining) + +Preflight `ssh -o BatchMode=yes -o ConnectTimeout=8 rome 'sudo -n true'` failed: `ssh: Could not resolve hostname rome: Name or service not known` (no alias in ~/.ssh/config or /etc/hosts). No hostname was guessed. + +Binary: `/media/nvme/dev/golem15/summercms.io/summercms/sm-summercmsio-app/bin/summercms-io` (`git.golem15.com/golem15/summercms v0.2.0`). + +From `/media/nvme/dev/golem15/summercms.io/summercms/sm-summercmsio-app` (DEPLOY.md "Upload"): + +```sh +rsync -av --chmod=F644,D755 --rsync-path="sudo rsync" config/ rome:/srv/summercms-io/config/ +rsync -av --rsync-path="sudo rsync" bin/summercms-io rome:/srv/summercms-io/bin/summercms-io.new +``` + +On rome (ownership check from "One-time server setup", must print `root:root 755` three times; then "Release (every deploy)"): + +```sh +stat -c '%U:%G %a %n' /srv/summercms-io /srv/summercms-io/bin /srv/summercms-io/config +cd /srv/summercms-io +sudo -u summercms ./bin/summercms-io.new migrate # before the restart; the cwd matters +[ -f bin/summercms-io ] && sudo cp -p bin/summercms-io bin/summercms-io.prev +sudo mv bin/summercms-io.new bin/summercms-io +sudo supervisorctl restart summercms-io +curl -sI http://127.0.0.1:8095/ # HTTP/1.1 200, Cache-Control: no-cache +``` + +Rollback if migrate or the restart fails (DEPLOY.md "Rollback", App): `cd /srv/summercms-io && sudo mv bin/summercms-io.prev bin/summercms-io && sudo supervisorctl restart summercms-io`. + +Post-deploy checks (run from the build machine after the release; this is the resume step): + +```sh +curl -sI https://summercms.io/ # 200, cache-control: no-cache, no x-robots-tag +curl -sI https://summercms.io/ | grep -i '^strict-transport-security: max-age=31536000' +curl -sI https://www.summercms.io/ | grep -i '^strict-transport-security' +curl -s https://summercms.io/ | grep -o '/_nuxt/[^"]*\.js' | head -n1 \ + | xargs -I{} curl -sI https://summercms.io{} # cache-control: public, max-age=31536000, immutable +curl -sI https://summercms.io/docs/ # 200 +curl -s https://summercms.io/docs/ | grep -o 'class="site-link" href="/"' +curl -sI https://summercms.io/docs/setup/installation # 301, location: /docs/setup/installation.html +curl -sI https://summercms.io/backend # 404 (nginx) +curl -s -o /dev/null -w '%{http_code}\n' -X POST https://summercms.io/ # 403 (nginx limit_except) +curl -sI http://summercms.io/ # 301, location: https://summercms.io/ +curl -sI https://www.summercms.io/ # 301, location: https://summercms.io/ +curl -s -o /dev/null -w '%{http_code}\n' https://summercms.io/docs/setup/upgrading.html # 200 (404 before) +curl -s -o /dev/null -w '%{http_code}\n' https://summercms.io/docs/services/caching.html # 200 +curl -s -o /dev/null -w '%{http_code}\n' https://summercms.io/docs/api/cooler.html # 200 +curl -s https://summercms.io/docs/setup/upgrading.html | grep -q 'Upgrading to 0.2' && echo TASK3_DEPLOYED_OK +SUMMERCMS_CHECK_EXTERNAL=1 go -C plugins/golem15/summercms test -run TestExternalLinks -count=1 -v ./... +``` + +## g15office + +Posted by the orchestrator on task `lpybyjdh` (comment 293), status moved to Testing. It says the rome deploy is pending; post a follow-up once it is live. + +## Deviations from Plan + +- Public upgrading page omits the internal review IDs (WR-01..WR-09, CR-01); the tag message keeps them. Readers of the docs have no use for them. +- Plugin bumps committed go.mod only (no go.sum change, because of the in-go.mod `replace` to `../summercms.go`); the plan listed go.sum as well. + +Otherwise the plan ran as written, up to the planned deploy checkpoint. + +## Self-Check: PASSED + +- FOUND: docs/setup/upgrading.md +- FOUND: f3e8a98 (summercms.go), tag v0.2.0 on origin +- FOUND: 2efe351, f7eddd5, 8de4928 (plugins, pushed) +- FOUND: aac8931 (site plugin), 36c3c50 (app), both pushed +- FOUND: layer tags v0.3.0, v0.3.0, v0.5.0 on origin +- FOUND: bin/summercms-io reporting v0.2.0