golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(14.3): persist human verification items as UAT

Browse Source
This commit is contained in:
Jakub Zych
2026-10-08 12:50:07 +02:00
parent 3caaf5f894
commit b1f54976aa
2 changed files with 271 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-UAT.md Normal file
View File

@@ -0,0 +1,52 @@
---
status: testing
phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new
source: [14.3-VERIFICATION.md]
started: 2026-10-08T10:50:06Z
updated: 2026-10-08T10:50:06Z
---
## Current Test
number: 1
name: Decide CR-01 and WR-02 before tagging
expected: |
Each of CR-01 (whitespace in the framework directory name breaks the go.mod replace) and WR-02 (new.sh does not reject Go keywords, main or internal before cloning) is either fixed or explicitly deferred in 14.3-REVIEW-DISPOSITION.md, and installation.md no longer claims the script stops before cloning on any invalid name unless that is true.
awaiting: user response
## Tests
### 1. Decide CR-01 and WR-02 before tagging
expected: CR-01 and WR-02 are fixed or explicitly deferred in 14.3-REVIEW-DISPOSITION.md; the installation.md sentence about stopping before the clone is accurate.
result: [pending]
### 2. Review the generated CLAUDE.md and the rewritten docs pages
expected: The generated app's CLAUDE.md and docs/setup/installation.md, go-modules-and-workspaces.md and the console pages read correctly.
result: [pending]
### 3. Confirm the judgment-tier prohibition verdicts
expected: The 17 judgment-tier prohibition verdicts in 14.3-VERIFICATION.md hold, including how WR-04 relates to "no machine-specific paths".
result: [pending]
### 4. Tag and push framework v0.1.13
expected: git tag v0.1.13 exists locally and on origin, and summercms.go master is pushed.
result: [pending]
### 5. Bump the site's framework require to v0.1.13 and redeploy
expected: sm-summercmsio-app and its plugin require v0.1.13. After the deploy, curl -fsSI https://summercms.io/new returns 200 with text/plain; charset=utf-8.
result: [pending]
### 6. Run the production acceptance
expected: bash scripts/check-phase14.3.sh --acceptance-production passes, and SUMMERCMS_TERMINAL_CHECK=1 go test -run TestTerminalCommands passes in sm-summercmsio-app with no overrides.
result: [pending]
## Summary
total: 6
passed: 0
issues: 0
pending: 6
skipped: 0
blocked: 0
## Gaps

219
.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-VERIFICATION.md Normal file
View File

@@ -0,0 +1,219 @@
---
phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new
verified: 2026-10-08T12:10:00Z
status: human_needed
score: 6/6 roadmap success criteria verified in code (release, deploy and production run pending as user actions)
covered_files:
- .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-01-PLAN.md
- .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-01-SUMMARY.md
- .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-02-PLAN.md
- .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-02-SUMMARY.md
- .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-03-PLAN.md
- .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-03-SUMMARY.md
- .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-04-PLAN.md
- .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-04-SUMMARY.md
- README.md
- cmd/summer/main.go
- docs/architecture/go-modules-and-workspaces.md
- docs/console/introduction.md
- docs/console/scaffolding.md
- docs/setup/installation.md
- docs/site.yaml
- examples/hello/config/http.yaml
- internal/build/new.go
- internal/build/scaffold.go
- internal/build/stubs/new.tmpl
- internal/build/stubs/plugin.tmpl
- modules/bonfire/command.go
- modules/lagoon/keygen.go
- modules/sunrise/new.sh
- modules/sunrise/sunrise.go
- scripts/check-phase14.3.sh
covered_digest: "v2:sha256:e3a4adbf699b33af4ead50e3c65667d4d83f0f798492ef21f6b531e5276529fd"
behavior_unverified: 0
overrides_applied: 0
human_verification:
- test: "Tag framework v0.1.13 (all framework work is on master, 40 commits after v0.1.12) and push the tag"
expected: "git ls-remote --tags https://git.golem15.com/golem15/summercms lists v0.1.13; the bootstrap script's newest-tag selection then picks a release that has `summer new`"
why_human: "D-28 makes tagging a user action. Until v0.1.13 exists, the one-liner checks out v0.1.12, which has no `summer new` command, so the production path cannot work yet"
- test: "Bump sm-summercmsio-plugin (and app) `require git.golem15.com/golem15/summercms` from v0.1.12 to v0.1.13, then redeploy summercms.io per sm-summercmsio-app/DEPLOY.md"
expected: "curl -sI https://summercms.io/new answers 200 with Content-Type text/plain; charset=utf-8 and the body equals modules/sunrise/new.sh at v0.1.13"
why_human: "Deploy is a user action (D-19, D-28). Checked on 2026-10-08: https://summercms.io/new currently answers 404 text/html"
- test: "After the deploy, run `bash scripts/check-phase14.3.sh --acceptance-production`"
expected: "Ends with `Phase 14.3 production acceptance passed` (the real `curl -fsSL https://summercms.io/new | bash -s -- demo` in node:24-bookworm, then compose/build/migrate/serve answering \"plugin\":\"golem15.demo\")"
why_human: "Needs the tag and the deploy above; the pre-release local acceptance (script from the repo, SUMMERCMS_REF=HEAD) passed in this verification"
- test: "Decide on code-review finding CR-01 (and WR-02) before tagging v0.1.13"
expected: "Either fix (quote whitespace paths in go.mod/plugin go.mod replace, mirror the keyword/main/internal rule in new.sh) or record them as deferred in 14.3-REVIEW-DISPOSITION.md"
why_human: "The tag freezes the generator and the script served at /new. CR-01 is reproduced (see Anti-Patterns) but only hits a framework directory whose name contains whitespace; whether it must block the release is a product call"
- test: "Read the generated CLAUDE.md and the four rewritten docs pages"
expected: "Agent instructions and docs are accurate, readable and name no consuming application"
why_human: "Carried from plan summaries (human_judgment: true). Greps prove required names/links and the forbidden-name rule only. Note docs/setup/installation.md says the script stops before cloning on an invalid name, which is false for Go keywords, `main` and `internal` (WR-02)"
- test: "Review the judgment-tier prohibitions listed under Prohibitions below (non-authoritative verifier verdicts)"
expected: "Human confirms or rejects each flagged verdict"
why_human: "All 17 prohibitions are verification: judgment; per ADR-550 an autonomous verdict is advisory only"
---
# Phase 14.3: One-command app scaffolding Verification Report
**Phase Goal:** Starting a SummerCMS app takes one command. `summer new <name>` writes a ready-to-run `sm-<name>-app` next to the framework checkout, and `curl -fsSL https://summercms.io/new | bash -s -- <name>` checks the prerequisites, fetches the framework, installs the `summer` CLI and runs it. Ships as framework tag `v0.1.13`.
**Verified:** 2026-10-08T12:10:00Z
**Status:** human_needed
**Re-verification:** No (initial verification)
## Goal Achievement
All code for the goal exists, is wired and was exercised end to end by this verifier in its own process (not taken from SUMMARY claims): the full unit gate, the D-12 generator run on real PostgreSQL 16, the gated bootstrap end-to-end test and the D-20 node:24-bookworm container acceptance all passed. What remains is the release leg of the goal ("ships as v0.1.13", summercms.io actually serving `/new`), which D-28 assigns to the user.
### Observable Truths (roadmap contract)
| # | Truth | Status | Evidence |
|---|-------|--------|----------|
| 1 | `summer new <name>` validates the name, refuses an existing dir, writes go.mod (module path, go 1.27.0, relative replace via --framework > sibling-by-module-path > clear error), summer.yaml, starter plugin via make:plugin/plugin:add + go.work, `--no-plugin`, complete config/ (http.yaml body_limits, app key, uploads bucket), .env.example + .env with fresh key, .gitignore, compose.yaml (PG16 matching .env), CLAUDE.md/AGENTS.md, first commit (`--no-git`) | ✓ VERIFIED | `internal/build/new.go` (ValidateAppName: regex + `token.IsKeyword` + main/internal; `os.Lstat` refusal; `resolveFramework` with `checkFramework` module-path match, binary-source last, error names `--framework`; `addStarterPlugin` -> `makePlugin(StarterRoute)` + `AddPlugin`); `stubs/new.tmpl` (all files); `cmd/summer/main.go:303` `newCommand` wires `lagoon.GenerateAppKey()` and the three flags. Goldens in `internal/build/testdata/new{,-no-plugin}` show `replace ... => ../summercms`, relative `./plugins/demo` go.work, empty plugin list. Unit gate: TestNewGolden, TestNewGoldenNoPlugin, TestNewValidateAppName, TestNewRefusesExistingTarget, TestNewFrameworkResolution, TestNewEnvFileMode, TestNewAgentsSymlink, TestNewGitFirstCommit, TestNewNoGit all named-PASS. Binary-source fallback added on top of the roadmap order (permitted by D-04). |
| 2 | Generated app works with no edits: `summer build`, `summer migrate`, `summer serve`, starter route answers over HTTP | ✓ VERIFIED | Ran `bash scripts/check-phase14.3.sh --generator` myself: sibling detection, no git identity, `docker compose up -d --wait`, `built demo in 5.044s`, `✓ migrations applied`, `GET / -> {"message":"Hello from SummerCMS","plugin":"golem15.demo"}`, `Phase 14.3 generator check passed`. TestNewAppSmoke (real build + route:list) and TestNewNoPluginBuilds also passed in the unit gate. |
| 3 | Bootstrap script wrapped in `main()`; checks Go 1.27+ and Docker; clones or fast-forwards the framework; `go install ./cmd/summer` with PATH hint; runs `summer new`; prints next steps; summercms.io serves it at `/new` as text/plain | ✓ VERIFIED (code); production serving pending (human item) | `modules/sunrise/new.sh` (functions only, last line `main "$@"`; `check_go` with go.dev/dl hint; `check_docker` warn-only; `checkout_framework` clone at newest vX.Y.Z or ff-only via `merge-base --is-ancestor`; `GOWORK=off go -C "$dir" install ./cmd/summer`; PATH hint; `summer new "$name" --framework "$dir"`); `sunrise.Script()` embeds it; site `plugins/golem15/summercms/plugin.go:62` `g.Get("/new", scriptHandler(sunrise.Script()))`, `script.go` sets text/plain, nosniff, no-cache, ETag. TestScriptTruncationRunsNothing, TestScriptBehavior, TestScriptShellcheck, TestNewScriptRoute, TestRoutesAssemble named-PASS; `--bootstrap` stage (TestBootstrapEndToEnd) passed in my run. https://summercms.io/new currently answers 404 (not deployed, D-28). |
| 4 | In a clean node:24-bookworm container with Go 1.27, Docker, git, jq: one-liner -> `cd sm-demo-app && docker compose up -d && summer build && summer migrate && summer serve` ends with the starter route answering | ✓ VERIFIED (pre-release form); production form pending (human item) | Ran `bash scripts/check-phase14.3.sh --acceptance` myself: bare node:24-bookworm, Go 1.27.0 from go.dev (sha256 checked), `curl -fsSL file:///fw/modules/sunrise/new.sh \| SUMMERCMS_REPO=/fw SUMMERCMS_REF=<HEAD> bash -s -- demo`, compose up, build, migrate, serve -> `{"message":"Hello from SummerCMS","plugin":"golem15.demo"}`, `Phase 14.3 acceptance passed`. No containers, volumes or ports left behind. The literal `https://summercms.io/new` run needs the tag + deploy. |
| 5 | installation.md leads with the one-liner; go-modules-and-workspaces.md and console docs cover `summer new`; llms.txt/llms-full.txt include the changes; docs checks pass | ✓ VERIFIED | `docs/setup/installation.md` first section "Create an application with one command" with the exact one-liner; `go-modules-and-workspaces.md` section "Applications created by summer new"; `docs/console/scaffolding.md` "Creating an application" with `--framework`, `--no-plugin`, `--no-git`. Fresh `summer docs:build --out <tmp>`: llms.txt has the one-liner (1), llms-full.txt has it (6) and `summer new` (20). `docs:build --check`, TestDocsTree, TestDocsAIOutputsInSync passed in the unit gate. |
| 6 | Generator Go tests (golden output plus a real build of the scaffold in a temp dir) are the last plan | ✓ VERIFIED | Plan 04 (wave 4, last) delivered `new_golden_test.go` (TestNewGolden/NoPlugin, `-update` flag), 23 goldens, TestNewAppSmoke/TestNewNoPluginBuilds (real `App()` build, skipped only under `-short`). Gate asserts goldens unchanged after the run. |
| G | Ships as framework tag `v0.1.13` | ? HUMAN | Not tagged locally or on the remote (latest remote tag v0.1.12). D-28 makes tagging a user action. |
**Score:** 6/6 roadmap success criteria verified in code (0 present-but-behavior-unverified). The release clause (tag, site bump, deploy, production acceptance) is routed to human verification.
### Locked decisions (D-01..D-28) coverage
| Decision | Status | Evidence |
|----------|--------|----------|
| D-01 naming convention | ✓ | CLAUDE.md template "Naming convention"; docs/console/scaffolding.md |
| D-02 name rule, no overwrite | ✓ | `appNameRe`, `os.Lstat` refusal; TestNewValidateAppName, TestNewRefusesExistingTarget |
| D-03 go.mod shape, relative replace | ✓ (CR-01 edge case) | go.mod.golden; relative only, but unquoted when the path contains whitespace |
| D-04 framework resolution order | ✓ | `resolveFramework`; TestNewFrameworkResolution |
| D-05 starter plugin via shared code paths | ✓ | `makePlugin(..., pluginOptions{StarterRoute: true})` + `AddPlugin`; single `routes.go` template; TestMakePluginRoutesUnchanged |
| D-06 `--no-plugin` | ✓ | TestNewNoPluginBuilds (real build) |
| D-07 config/ complete, examples/hello http.yaml | ✓ | four config templates; `examples/hello/config/http.yaml`; serve proven by `--generator` |
| D-08 .env/.env.example/.gitignore, GenerateAppKey reused | ✓ | `lagoon.GenerateAppKey` used by `key:generate` and `newCommand`; TestGenerateAppKey, TestNewEnvFileMode |
| D-09 compose PG16 matching .env | ✓ | compose template + `devDSN`; `--generator` migrate succeeded |
| D-10 CLAUDE.md/AGENTS.md | ✓ | template; AGENTS.md relative symlink; TestNewAgentsSymlink |
| D-11 git init + first commit, fallback identity | ✓ | `initGit`; `--generator` checked one commit on main by `SummerCMS <summer@localhost>`, .env untracked |
| D-12 works with no edits | ✓ | `--generator` run (this verification) |
| D-13 script embedded, served at GET /new | ✓ code / human deploy | `modules/sunrise`, site `script.go`; TestNewScriptRoute |
| D-14 `main()` wrapper | ✓ | last line `main "$@"`; TestScriptTruncationRunsNothing |
| D-15 script steps | ✓ | new.sh; TestScriptBehavior; TestBootstrapEndToEnd |
| D-16 latest release tag, ff-only, refuse dirty/branch | ✓ | `latest_tag`, `check_checkout`, `merge-base --is-ancestor`; TestScriptBehavior |
| D-17 clone location / overrides | ✓ | `SUMMERCMS_REPO/DIR/REF` |
| D-18 docs | ✓ | see truth 5 |
| D-19 landing page + TestTerminalCommands | ✓ code / human deploy | `terminal.json` three groups, six commands; pnpm test 32/32; TestLoadTerminal, TestTerminalScript, TestTerminalEnv, TestTerminalRunScript PASS (gated TestTerminalCommands not re-run here; summary reports pass) |
| D-20 container acceptance | ✓ pre-release / human production | see truth 4 |
| D-21 test conventions, last plan | ✓ | see truth 6 |
| D-22 keyword/main/internal refusal | ✓ in `summer new`; ✗ not mirrored in new.sh (WR-02) | TestNewValidateAppName |
| D-23 fixed non-5432 port on 127.0.0.1 | ✓ | `127.0.0.1:54320:5432` |
| D-24 `summer new` prints next steps; script prints cd + PATH hint | ✓ | `new/next-steps` template; new.sh tail |
| D-25 no root go.sum; go.work.sum ignored | ✓ | gitignore template; `--generator` checks no go.sum |
| D-26 package under modules/, SUMMERCMS_* only | ✓ | `modules/sunrise`, README + root table row; forbidden scan passed |
| D-27 relative plugin:add go.work, opt-in starter route, GenerateAppKey, hello http.yaml | ✓ | `runGoWorkUse` via `relModulePath`; TestMakeAndAddPluginOnHelloCopy |
| D-28 release ordering, user actions | ? human | site require still v0.1.12 with local replace; no v0.1.13 tag; nothing deployed |
### Required Artifacts
| Artifact | Expected | Status | Details |
|----------|----------|--------|---------|
| `internal/build/new.go` | NewApp, ValidateAppName, planNewApp, resolution | ✓ VERIFIED | 419 lines, substantive, called from `cmd/summer/main.go` |
| `internal/build/stubs/new.tmpl` | go.mod, config, .env, compose, gitignore, CLAUDE.md, next steps | ✓ VERIFIED | rendered by `planNewApp` |
| `internal/build/stubs/plugin.tmpl` | opt-in starter route | ✓ VERIFIED | `{{if .StarterRoute}}` GET `/{$}` |
| `cmd/summer/main.go` | `new` command with three flags | ✓ VERIFIED | `newCommand()` registered in `toolCommands()` |
| `modules/lagoon/keygen.go` | `GenerateAppKey` | ✓ VERIFIED | reused by key:generate and summer new |
| `examples/hello/config/http.yaml` | body_limits | ✓ VERIFIED | `go -C examples/hello test ./...` passed |
| `modules/sunrise/new.sh`, `sunrise.go`, `README.md` | script, embed, README | ✓ VERIFIED | `//go:embed new.sh`, `Script()` clones bytes |
| `sm-summercmsio-app/plugins/golem15/summercms/script.go` + `plugin.go` | GET /new | ✓ VERIFIED | committed in plugin `2157bb9`, gitlink in app `fd721cf` |
| `vue-summercmsio-app/app/data/terminal.json` | one-liner Get started | ✓ VERIFIED | committed `6140750` |
| `sm-summercmsio-app/terminal_check_test.go` | SUMMERCMS_NEW_URL, backgrounded serve | ✓ VERIFIED | unit tests PASS |
| `internal/build/new_golden_test.go`, `testdata/new*/` | goldens | ✓ VERIFIED | 17 + 6 goldens, unchanged after the gate run |
| `modules/sunrise/script_behavior_test.go` | behaviour matrix | ✓ VERIFIED | TestScriptBehavior PASS |
| `scripts/check-phase14.3.sh` | fail-closed gate | ✓ VERIFIED | stages run here: --unit, --generator, --bootstrap, --acceptance |
### Key Link Verification
| From | To | Via | Status |
|------|----|-----|--------|
| `cmd/summer/main.go` | `modules/lagoon/keygen.go` | `lagoon.GenerateAppKey()` -> `NewOptions.AppKey` | ✓ WIRED |
| `internal/build/new.go` | `internal/build/scaffold.go` | `makePlugin(StarterRoute)`, `AddPlugin`, `generate()` | ✓ WIRED |
| `scaffold.go` | `go.work` | `runGoWorkUse` passes `relModulePath` result | ✓ WIRED |
| site `plugin.go` | `modules/sunrise` | `g.Get("/new", scriptHandler(sunrise.Script()))` via local replace | ✓ WIRED |
| `new.sh` | `cmd/summer` | `go install ./cmd/summer`; `summer new "$name" --framework "$dir"` | ✓ WIRED |
| `terminal.json` | `terminal_check_test.go` | `loadTerminal` | ✓ WIRED |
| `check-phase14.3.sh` | `14.3-SECURITY-REVIEW.md` | `--security` threat-ID scan | ✓ WIRED (not re-run; unit gate's forbidden scan passed) |
### Behavioral Spot-Checks (run by this verifier)
| Behavior | Command | Result | Status |
|----------|---------|--------|--------|
| vet, full tests, named PASS for 28 framework + 6 site tests, hello, docs check, site plugin/app, pnpm generate/test, forbidden scan | `bash scripts/check-phase14.3.sh --unit` | `Phase 14.3 unit stage passed`, exit 0 | ✓ PASS |
| D-12 generated app builds, migrates, serves | `bash scripts/check-phase14.3.sh --generator` | `GET / -> {"message":"Hello from SummerCMS","plugin":"golem15.demo"}` | ✓ PASS |
| Bootstrap end to end on the host | `bash scripts/check-phase14.3.sh --bootstrap` | `PASS TestBootstrapEndToEnd` | ✓ PASS |
| D-20 in node:24-bookworm | `bash scripts/check-phase14.3.sh --acceptance` | `Phase 14.3 acceptance passed` | ✓ PASS |
| llms outputs carry the change | `summer docs:build --out <tmp>`; grep | one-liner in llms.txt and llms-full.txt; `summer new` x20 | ✓ PASS |
| Production `/new` | `curl -sS -o /dev/null -w '%{http_code}' https://summercms.io/new` | `404 text/html` | ? HUMAN (not deployed, D-28) |
| CR-01 reproduction | `summer new demo --framework "my fw" --no-git --no-plugin` | prints `created ...`, go.mod `replace ... => ../my fw`, `go list -m` fails `malformed module path "../my"` | ✗ confirmed (edge case) |
| Parent path with spaces, default sibling | `summer new demo --no-git --no-plugin` in `has space/` | `replace ... => ../summercms`, module loads | ✓ PASS |
All Docker resources and ports 8080/54320 were confirmed free after the runs; scratch files were removed.
### Probe Execution
Step 7c: no `scripts/*/tests/probe-*.sh` declared or present for this phase; the phase gate stages above serve that role and were run directly.
### Requirements Coverage
REQUIREMENTS.md maps no IDs to Phase 14.3 (roadmap says "Requirements: TBD"). Coverage is accounted per locked decision in the D-01..D-28 table above. No orphaned requirements.
### Prohibitions (judgment tier; non-authoritative verifier verdicts, human review recommended)
| Prohibition | Verdict | Flag |
|-------------|---------|------|
| summer new never commits .env or a key; .env.example has no real key | holds (`--generator` checked `git ls-files .env` empty; template `SUMMER_APP__KEY=`) | unverified-prohibition, human review recommended |
| Committed go.mod/go.work never contain absolute, machine-specific paths | holds on default paths; WR-04: binary-source fallback can write a relative path into GOMODCACHE (machine-specific) | unverified-prohibition, human review recommended |
| compose.yaml never publishes PG on other than 127.0.0.1 | holds (`"127.0.0.1:54320:5432"`) | unverified-prohibition |
| Template text never names a consuming application | holds (grep clean; docs forbidden-name rule passed) | unverified-prohibition |
| No new Go dependency / no runtime plugin loading (x2) | holds (`git diff v0.1.12 -- go.mod` empty; forbidden scan passed) | unverified-prohibition |
| Script never reads/sets SUMMER_* | holds (only SUMMERCMS_*; forbidden scan) | unverified-prohibition |
| Script never discards local work in an existing checkout | holds (refusals; TestScriptBehavior) | unverified-prohibition |
| Script never escalates or writes outside its dirs | holds on reading new.sh (no sudo; writes clone dir, GOBIN, app dir) | unverified-prohibition |
| No task pushes/tags/bumps require/deploys (x3) | holds (no v0.1.13 tag; site require v0.1.12; prod /new 404) | unverified-prohibition |
| One-liner never shown over HTTP or without -f | holds (terminal.json, docs) | unverified-prohibition |
| Framework docs never name a consuming application | holds (docs check) | unverified-prohibition |
| Gate never passes on skipped/filtered/-update run | holds (`require_named_pass` rejects skip, "no tests to run", golden diffs) | unverified-prohibition |
### Anti-Patterns Found
No TBD/FIXME/XXX/TODO/placeholder markers in the phase's files.
Open code-review findings (14.3-REVIEW.md, all `open` in 14.3-REVIEW-DISPOSITION.md), classified against the success criteria:
| Finding | File | Severity here | Defeats a success criterion? |
|---------|------|---------------|------------------------------|
| CR-01 whitespace in framework path -> unparseable go.mod, `--no-plugin` reports success | `internal/build/stubs/new.tmpl:9`, `scaffold.go` `frameworkReplaceFor` | ⚠️ Warning (reproduced) | No for the documented flows: the bootstrap always puts the app next to the checkout, so only a checkout basename with whitespace (custom `SUMMERCMS_DIR` or `--framework`) triggers it; a parent path with spaces is fine (verified). It is a real correctness bug in the `--framework` path of SC1/SC2 and should be fixed or explicitly deferred before the v0.1.13 tag freezes it |
| WR-01 Ctrl+C leaves a partial app; re-runs refused | `cmd/summer/main.go`, `new.go` | ⚠️ Warning | No; docs sentence about cleanup is over-broad |
| WR-02 script accepts Go keywords/main/internal, clones and installs before summer new refuses | `new.sh:215` | ⚠️ Warning | No (summer new still refuses, nothing broken is written), but makes a docs claim in installation.md false |
| WR-03 bad SUMMERCMS_REF on fresh clone leaves a branch checkout the next run refuses | `new.sh:163-169` | ⚠️ Warning | No (override-only path) |
| WR-04 binary-source fallback can point into GOMODCACHE | `new.go:286-297` | ⚠️ Warning | No for the bootstrap path (always passes --framework); touches the "no machine-specific paths" prohibition |
| WR-05 every app uses host port 54320 | `new.tmpl:67` | ⚠️ Warning | No (single-app criteria), second concurrent app's `docker compose up` fails |
| WR-06 go.work.sum ignored; --no-plugin app commits no checksums | `new.tmpl:84` | ⚠️ Warning | No; D-25 locked this choice; supply-chain risk should be recorded |
| WR-07 TestTerminalCommands passes SUMMERCMS_DIR through | `terminal_check_test.go:74` | ℹ️ Info (test hygiene) | No |
| WR-08 `--generator` stage orphans the app binary | `check-phase14.3.sh:154` | ℹ️ Info (test hygiene) | No; in this run port 8080 was free afterwards |
| IN-01..IN-10 | various | ℹ️ Info | No |
### Human Verification Required
1. **Tag v0.1.13.** Test: tag and push. Expected: the remote lists v0.1.13. Why: D-28 user action; until then the one-liner installs v0.1.12, which has no `summer new`.
2. **Bump the site require and redeploy.** Test: bump `sm-summercmsio-plugin`/app to v0.1.13, deploy per DEPLOY.md, then `curl -sI https://summercms.io/new`. Expected: 200 `text/plain; charset=utf-8`. Why: currently 404.
3. **Production acceptance.** Test: `bash scripts/check-phase14.3.sh --acceptance-production`. Expected: `Phase 14.3 production acceptance passed`.
4. **Decide CR-01 / WR-02 before tagging.** Fix or mark deferred in 14.3-REVIEW-DISPOSITION.md.
5. **Read generated CLAUDE.md and the docs pages** for accuracy and tone (WR-02 makes one installation.md sentence false).
6. **Confirm the judgment-tier prohibition verdicts** in the table above.
### Gaps Summary
No goal gap blocks the phase: every success criterion is implemented, wired and was exercised by this verifier (unit gate, real PostgreSQL generator run, bootstrap end-to-end, node:24-bookworm container acceptance). The goal is not fully delivered until the user actions run: the v0.1.13 tag does not exist, summercms.io/new answers 404, and the production acceptance has not run. The open review findings are quality defects outside the documented happy path; CR-01 is the one worth fixing before the tag, because the tag freezes the generator and the script.
---
_Verified: 2026-10-08T12:10:00Z_
_Verifier: Claude (gsd-verifier)_