diff --git a/.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-UAT.md b/.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-UAT.md new file mode 100644 index 0000000..fe09693 --- /dev/null +++ b/.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-UAT.md @@ -0,0 +1,52 @@ +--- +status: testing +phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new +source: [14.3-VERIFICATION.md] +started: 2026-10-08T10:50:06Z +updated: 2026-10-08T10:50:06Z +--- + +## Current Test + +number: 1 +name: Decide CR-01 and WR-02 before tagging +expected: | + Each of CR-01 (whitespace in the framework directory name breaks the go.mod replace) and WR-02 (new.sh does not reject Go keywords, main or internal before cloning) is either fixed or explicitly deferred in 14.3-REVIEW-DISPOSITION.md, and installation.md no longer claims the script stops before cloning on any invalid name unless that is true. +awaiting: user response + +## Tests + +### 1. Decide CR-01 and WR-02 before tagging +expected: CR-01 and WR-02 are fixed or explicitly deferred in 14.3-REVIEW-DISPOSITION.md; the installation.md sentence about stopping before the clone is accurate. +result: [pending] + +### 2. Review the generated CLAUDE.md and the rewritten docs pages +expected: The generated app's CLAUDE.md and docs/setup/installation.md, go-modules-and-workspaces.md and the console pages read correctly. +result: [pending] + +### 3. Confirm the judgment-tier prohibition verdicts +expected: The 17 judgment-tier prohibition verdicts in 14.3-VERIFICATION.md hold, including how WR-04 relates to "no machine-specific paths". +result: [pending] + +### 4. Tag and push framework v0.1.13 +expected: git tag v0.1.13 exists locally and on origin, and summercms.go master is pushed. +result: [pending] + +### 5. Bump the site's framework require to v0.1.13 and redeploy +expected: sm-summercmsio-app and its plugin require v0.1.13. After the deploy, curl -fsSI https://summercms.io/new returns 200 with text/plain; charset=utf-8. +result: [pending] + +### 6. Run the production acceptance +expected: bash scripts/check-phase14.3.sh --acceptance-production passes, and SUMMERCMS_TERMINAL_CHECK=1 go test -run TestTerminalCommands passes in sm-summercmsio-app with no overrides. +result: [pending] + +## Summary + +total: 6 +passed: 0 +issues: 0 +pending: 6 +skipped: 0 +blocked: 0 + +## Gaps diff --git a/.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-VERIFICATION.md b/.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-VERIFICATION.md new file mode 100644 index 0000000..42634ed --- /dev/null +++ b/.planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-VERIFICATION.md @@ -0,0 +1,219 @@ +--- +phase: 14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new +verified: 2026-10-08T12:10:00Z +status: human_needed +score: 6/6 roadmap success criteria verified in code (release, deploy and production run pending as user actions) +covered_files: + - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-01-PLAN.md + - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-01-SUMMARY.md + - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-02-PLAN.md + - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-02-SUMMARY.md + - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-03-PLAN.md + - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-03-SUMMARY.md + - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-04-PLAN.md + - .planning/phases/14.3-one-command-app-scaffolding-summer-new-and-summercms-io-new/14.3-04-SUMMARY.md + - README.md + - cmd/summer/main.go + - docs/architecture/go-modules-and-workspaces.md + - docs/console/introduction.md + - docs/console/scaffolding.md + - docs/setup/installation.md + - docs/site.yaml + - examples/hello/config/http.yaml + - internal/build/new.go + - internal/build/scaffold.go + - internal/build/stubs/new.tmpl + - internal/build/stubs/plugin.tmpl + - modules/bonfire/command.go + - modules/lagoon/keygen.go + - modules/sunrise/new.sh + - modules/sunrise/sunrise.go + - scripts/check-phase14.3.sh +covered_digest: "v2:sha256:e3a4adbf699b33af4ead50e3c65667d4d83f0f798492ef21f6b531e5276529fd" +behavior_unverified: 0 +overrides_applied: 0 +human_verification: + - test: "Tag framework v0.1.13 (all framework work is on master, 40 commits after v0.1.12) and push the tag" + expected: "git ls-remote --tags https://git.golem15.com/golem15/summercms lists v0.1.13; the bootstrap script's newest-tag selection then picks a release that has `summer new`" + why_human: "D-28 makes tagging a user action. Until v0.1.13 exists, the one-liner checks out v0.1.12, which has no `summer new` command, so the production path cannot work yet" + - test: "Bump sm-summercmsio-plugin (and app) `require git.golem15.com/golem15/summercms` from v0.1.12 to v0.1.13, then redeploy summercms.io per sm-summercmsio-app/DEPLOY.md" + expected: "curl -sI https://summercms.io/new answers 200 with Content-Type text/plain; charset=utf-8 and the body equals modules/sunrise/new.sh at v0.1.13" + why_human: "Deploy is a user action (D-19, D-28). Checked on 2026-10-08: https://summercms.io/new currently answers 404 text/html" + - test: "After the deploy, run `bash scripts/check-phase14.3.sh --acceptance-production`" + expected: "Ends with `Phase 14.3 production acceptance passed` (the real `curl -fsSL https://summercms.io/new | bash -s -- demo` in node:24-bookworm, then compose/build/migrate/serve answering \"plugin\":\"golem15.demo\")" + why_human: "Needs the tag and the deploy above; the pre-release local acceptance (script from the repo, SUMMERCMS_REF=HEAD) passed in this verification" + - test: "Decide on code-review finding CR-01 (and WR-02) before tagging v0.1.13" + expected: "Either fix (quote whitespace paths in go.mod/plugin go.mod replace, mirror the keyword/main/internal rule in new.sh) or record them as deferred in 14.3-REVIEW-DISPOSITION.md" + why_human: "The tag freezes the generator and the script served at /new. CR-01 is reproduced (see Anti-Patterns) but only hits a framework directory whose name contains whitespace; whether it must block the release is a product call" + - test: "Read the generated CLAUDE.md and the four rewritten docs pages" + expected: "Agent instructions and docs are accurate, readable and name no consuming application" + why_human: "Carried from plan summaries (human_judgment: true). Greps prove required names/links and the forbidden-name rule only. Note docs/setup/installation.md says the script stops before cloning on an invalid name, which is false for Go keywords, `main` and `internal` (WR-02)" + - test: "Review the judgment-tier prohibitions listed under Prohibitions below (non-authoritative verifier verdicts)" + expected: "Human confirms or rejects each flagged verdict" + why_human: "All 17 prohibitions are verification: judgment; per ADR-550 an autonomous verdict is advisory only" +--- + +# Phase 14.3: One-command app scaffolding Verification Report + +**Phase Goal:** Starting a SummerCMS app takes one command. `summer new ` writes a ready-to-run `sm--app` next to the framework checkout, and `curl -fsSL https://summercms.io/new | bash -s -- ` checks the prerequisites, fetches the framework, installs the `summer` CLI and runs it. Ships as framework tag `v0.1.13`. +**Verified:** 2026-10-08T12:10:00Z +**Status:** human_needed +**Re-verification:** No (initial verification) + +## Goal Achievement + +All code for the goal exists, is wired and was exercised end to end by this verifier in its own process (not taken from SUMMARY claims): the full unit gate, the D-12 generator run on real PostgreSQL 16, the gated bootstrap end-to-end test and the D-20 node:24-bookworm container acceptance all passed. What remains is the release leg of the goal ("ships as v0.1.13", summercms.io actually serving `/new`), which D-28 assigns to the user. + +### Observable Truths (roadmap contract) + +| # | Truth | Status | Evidence | +|---|-------|--------|----------| +| 1 | `summer new ` validates the name, refuses an existing dir, writes go.mod (module path, go 1.27.0, relative replace via --framework > sibling-by-module-path > clear error), summer.yaml, starter plugin via make:plugin/plugin:add + go.work, `--no-plugin`, complete config/ (http.yaml body_limits, app key, uploads bucket), .env.example + .env with fresh key, .gitignore, compose.yaml (PG16 matching .env), CLAUDE.md/AGENTS.md, first commit (`--no-git`) | ✓ VERIFIED | `internal/build/new.go` (ValidateAppName: regex + `token.IsKeyword` + main/internal; `os.Lstat` refusal; `resolveFramework` with `checkFramework` module-path match, binary-source last, error names `--framework`; `addStarterPlugin` -> `makePlugin(StarterRoute)` + `AddPlugin`); `stubs/new.tmpl` (all files); `cmd/summer/main.go:303` `newCommand` wires `lagoon.GenerateAppKey()` and the three flags. Goldens in `internal/build/testdata/new{,-no-plugin}` show `replace ... => ../summercms`, relative `./plugins/demo` go.work, empty plugin list. Unit gate: TestNewGolden, TestNewGoldenNoPlugin, TestNewValidateAppName, TestNewRefusesExistingTarget, TestNewFrameworkResolution, TestNewEnvFileMode, TestNewAgentsSymlink, TestNewGitFirstCommit, TestNewNoGit all named-PASS. Binary-source fallback added on top of the roadmap order (permitted by D-04). | +| 2 | Generated app works with no edits: `summer build`, `summer migrate`, `summer serve`, starter route answers over HTTP | ✓ VERIFIED | Ran `bash scripts/check-phase14.3.sh --generator` myself: sibling detection, no git identity, `docker compose up -d --wait`, `built demo in 5.044s`, `✓ migrations applied`, `GET / -> {"message":"Hello from SummerCMS","plugin":"golem15.demo"}`, `Phase 14.3 generator check passed`. TestNewAppSmoke (real build + route:list) and TestNewNoPluginBuilds also passed in the unit gate. | +| 3 | Bootstrap script wrapped in `main()`; checks Go 1.27+ and Docker; clones or fast-forwards the framework; `go install ./cmd/summer` with PATH hint; runs `summer new`; prints next steps; summercms.io serves it at `/new` as text/plain | ✓ VERIFIED (code); production serving pending (human item) | `modules/sunrise/new.sh` (functions only, last line `main "$@"`; `check_go` with go.dev/dl hint; `check_docker` warn-only; `checkout_framework` clone at newest vX.Y.Z or ff-only via `merge-base --is-ancestor`; `GOWORK=off go -C "$dir" install ./cmd/summer`; PATH hint; `summer new "$name" --framework "$dir"`); `sunrise.Script()` embeds it; site `plugins/golem15/summercms/plugin.go:62` `g.Get("/new", scriptHandler(sunrise.Script()))`, `script.go` sets text/plain, nosniff, no-cache, ETag. TestScriptTruncationRunsNothing, TestScriptBehavior, TestScriptShellcheck, TestNewScriptRoute, TestRoutesAssemble named-PASS; `--bootstrap` stage (TestBootstrapEndToEnd) passed in my run. https://summercms.io/new currently answers 404 (not deployed, D-28). | +| 4 | In a clean node:24-bookworm container with Go 1.27, Docker, git, jq: one-liner -> `cd sm-demo-app && docker compose up -d && summer build && summer migrate && summer serve` ends with the starter route answering | ✓ VERIFIED (pre-release form); production form pending (human item) | Ran `bash scripts/check-phase14.3.sh --acceptance` myself: bare node:24-bookworm, Go 1.27.0 from go.dev (sha256 checked), `curl -fsSL file:///fw/modules/sunrise/new.sh \| SUMMERCMS_REPO=/fw SUMMERCMS_REF= bash -s -- demo`, compose up, build, migrate, serve -> `{"message":"Hello from SummerCMS","plugin":"golem15.demo"}`, `Phase 14.3 acceptance passed`. No containers, volumes or ports left behind. The literal `https://summercms.io/new` run needs the tag + deploy. | +| 5 | installation.md leads with the one-liner; go-modules-and-workspaces.md and console docs cover `summer new`; llms.txt/llms-full.txt include the changes; docs checks pass | ✓ VERIFIED | `docs/setup/installation.md` first section "Create an application with one command" with the exact one-liner; `go-modules-and-workspaces.md` section "Applications created by summer new"; `docs/console/scaffolding.md` "Creating an application" with `--framework`, `--no-plugin`, `--no-git`. Fresh `summer docs:build --out `: llms.txt has the one-liner (1), llms-full.txt has it (6) and `summer new` (20). `docs:build --check`, TestDocsTree, TestDocsAIOutputsInSync passed in the unit gate. | +| 6 | Generator Go tests (golden output plus a real build of the scaffold in a temp dir) are the last plan | ✓ VERIFIED | Plan 04 (wave 4, last) delivered `new_golden_test.go` (TestNewGolden/NoPlugin, `-update` flag), 23 goldens, TestNewAppSmoke/TestNewNoPluginBuilds (real `App()` build, skipped only under `-short`). Gate asserts goldens unchanged after the run. | +| G | Ships as framework tag `v0.1.13` | ? HUMAN | Not tagged locally or on the remote (latest remote tag v0.1.12). D-28 makes tagging a user action. | + +**Score:** 6/6 roadmap success criteria verified in code (0 present-but-behavior-unverified). The release clause (tag, site bump, deploy, production acceptance) is routed to human verification. + +### Locked decisions (D-01..D-28) coverage + +| Decision | Status | Evidence | +|----------|--------|----------| +| D-01 naming convention | ✓ | CLAUDE.md template "Naming convention"; docs/console/scaffolding.md | +| D-02 name rule, no overwrite | ✓ | `appNameRe`, `os.Lstat` refusal; TestNewValidateAppName, TestNewRefusesExistingTarget | +| D-03 go.mod shape, relative replace | ✓ (CR-01 edge case) | go.mod.golden; relative only, but unquoted when the path contains whitespace | +| D-04 framework resolution order | ✓ | `resolveFramework`; TestNewFrameworkResolution | +| D-05 starter plugin via shared code paths | ✓ | `makePlugin(..., pluginOptions{StarterRoute: true})` + `AddPlugin`; single `routes.go` template; TestMakePluginRoutesUnchanged | +| D-06 `--no-plugin` | ✓ | TestNewNoPluginBuilds (real build) | +| D-07 config/ complete, examples/hello http.yaml | ✓ | four config templates; `examples/hello/config/http.yaml`; serve proven by `--generator` | +| D-08 .env/.env.example/.gitignore, GenerateAppKey reused | ✓ | `lagoon.GenerateAppKey` used by `key:generate` and `newCommand`; TestGenerateAppKey, TestNewEnvFileMode | +| D-09 compose PG16 matching .env | ✓ | compose template + `devDSN`; `--generator` migrate succeeded | +| D-10 CLAUDE.md/AGENTS.md | ✓ | template; AGENTS.md relative symlink; TestNewAgentsSymlink | +| D-11 git init + first commit, fallback identity | ✓ | `initGit`; `--generator` checked one commit on main by `SummerCMS `, .env untracked | +| D-12 works with no edits | ✓ | `--generator` run (this verification) | +| D-13 script embedded, served at GET /new | ✓ code / human deploy | `modules/sunrise`, site `script.go`; TestNewScriptRoute | +| D-14 `main()` wrapper | ✓ | last line `main "$@"`; TestScriptTruncationRunsNothing | +| D-15 script steps | ✓ | new.sh; TestScriptBehavior; TestBootstrapEndToEnd | +| D-16 latest release tag, ff-only, refuse dirty/branch | ✓ | `latest_tag`, `check_checkout`, `merge-base --is-ancestor`; TestScriptBehavior | +| D-17 clone location / overrides | ✓ | `SUMMERCMS_REPO/DIR/REF` | +| D-18 docs | ✓ | see truth 5 | +| D-19 landing page + TestTerminalCommands | ✓ code / human deploy | `terminal.json` three groups, six commands; pnpm test 32/32; TestLoadTerminal, TestTerminalScript, TestTerminalEnv, TestTerminalRunScript PASS (gated TestTerminalCommands not re-run here; summary reports pass) | +| D-20 container acceptance | ✓ pre-release / human production | see truth 4 | +| D-21 test conventions, last plan | ✓ | see truth 6 | +| D-22 keyword/main/internal refusal | ✓ in `summer new`; ✗ not mirrored in new.sh (WR-02) | TestNewValidateAppName | +| D-23 fixed non-5432 port on 127.0.0.1 | ✓ | `127.0.0.1:54320:5432` | +| D-24 `summer new` prints next steps; script prints cd + PATH hint | ✓ | `new/next-steps` template; new.sh tail | +| D-25 no root go.sum; go.work.sum ignored | ✓ | gitignore template; `--generator` checks no go.sum | +| D-26 package under modules/, SUMMERCMS_* only | ✓ | `modules/sunrise`, README + root table row; forbidden scan passed | +| D-27 relative plugin:add go.work, opt-in starter route, GenerateAppKey, hello http.yaml | ✓ | `runGoWorkUse` via `relModulePath`; TestMakeAndAddPluginOnHelloCopy | +| D-28 release ordering, user actions | ? human | site require still v0.1.12 with local replace; no v0.1.13 tag; nothing deployed | + +### Required Artifacts + +| Artifact | Expected | Status | Details | +|----------|----------|--------|---------| +| `internal/build/new.go` | NewApp, ValidateAppName, planNewApp, resolution | ✓ VERIFIED | 419 lines, substantive, called from `cmd/summer/main.go` | +| `internal/build/stubs/new.tmpl` | go.mod, config, .env, compose, gitignore, CLAUDE.md, next steps | ✓ VERIFIED | rendered by `planNewApp` | +| `internal/build/stubs/plugin.tmpl` | opt-in starter route | ✓ VERIFIED | `{{if .StarterRoute}}` GET `/{$}` | +| `cmd/summer/main.go` | `new` command with three flags | ✓ VERIFIED | `newCommand()` registered in `toolCommands()` | +| `modules/lagoon/keygen.go` | `GenerateAppKey` | ✓ VERIFIED | reused by key:generate and summer new | +| `examples/hello/config/http.yaml` | body_limits | ✓ VERIFIED | `go -C examples/hello test ./...` passed | +| `modules/sunrise/new.sh`, `sunrise.go`, `README.md` | script, embed, README | ✓ VERIFIED | `//go:embed new.sh`, `Script()` clones bytes | +| `sm-summercmsio-app/plugins/golem15/summercms/script.go` + `plugin.go` | GET /new | ✓ VERIFIED | committed in plugin `2157bb9`, gitlink in app `fd721cf` | +| `vue-summercmsio-app/app/data/terminal.json` | one-liner Get started | ✓ VERIFIED | committed `6140750` | +| `sm-summercmsio-app/terminal_check_test.go` | SUMMERCMS_NEW_URL, backgrounded serve | ✓ VERIFIED | unit tests PASS | +| `internal/build/new_golden_test.go`, `testdata/new*/` | goldens | ✓ VERIFIED | 17 + 6 goldens, unchanged after the gate run | +| `modules/sunrise/script_behavior_test.go` | behaviour matrix | ✓ VERIFIED | TestScriptBehavior PASS | +| `scripts/check-phase14.3.sh` | fail-closed gate | ✓ VERIFIED | stages run here: --unit, --generator, --bootstrap, --acceptance | + +### Key Link Verification + +| From | To | Via | Status | +|------|----|-----|--------| +| `cmd/summer/main.go` | `modules/lagoon/keygen.go` | `lagoon.GenerateAppKey()` -> `NewOptions.AppKey` | ✓ WIRED | +| `internal/build/new.go` | `internal/build/scaffold.go` | `makePlugin(StarterRoute)`, `AddPlugin`, `generate()` | ✓ WIRED | +| `scaffold.go` | `go.work` | `runGoWorkUse` passes `relModulePath` result | ✓ WIRED | +| site `plugin.go` | `modules/sunrise` | `g.Get("/new", scriptHandler(sunrise.Script()))` via local replace | ✓ WIRED | +| `new.sh` | `cmd/summer` | `go install ./cmd/summer`; `summer new "$name" --framework "$dir"` | ✓ WIRED | +| `terminal.json` | `terminal_check_test.go` | `loadTerminal` | ✓ WIRED | +| `check-phase14.3.sh` | `14.3-SECURITY-REVIEW.md` | `--security` threat-ID scan | ✓ WIRED (not re-run; unit gate's forbidden scan passed) | + +### Behavioral Spot-Checks (run by this verifier) + +| Behavior | Command | Result | Status | +|----------|---------|--------|--------| +| vet, full tests, named PASS for 28 framework + 6 site tests, hello, docs check, site plugin/app, pnpm generate/test, forbidden scan | `bash scripts/check-phase14.3.sh --unit` | `Phase 14.3 unit stage passed`, exit 0 | ✓ PASS | +| D-12 generated app builds, migrates, serves | `bash scripts/check-phase14.3.sh --generator` | `GET / -> {"message":"Hello from SummerCMS","plugin":"golem15.demo"}` | ✓ PASS | +| Bootstrap end to end on the host | `bash scripts/check-phase14.3.sh --bootstrap` | `PASS TestBootstrapEndToEnd` | ✓ PASS | +| D-20 in node:24-bookworm | `bash scripts/check-phase14.3.sh --acceptance` | `Phase 14.3 acceptance passed` | ✓ PASS | +| llms outputs carry the change | `summer docs:build --out `; grep | one-liner in llms.txt and llms-full.txt; `summer new` x20 | ✓ PASS | +| Production `/new` | `curl -sS -o /dev/null -w '%{http_code}' https://summercms.io/new` | `404 text/html` | ? HUMAN (not deployed, D-28) | +| CR-01 reproduction | `summer new demo --framework "my fw" --no-git --no-plugin` | prints `created ...`, go.mod `replace ... => ../my fw`, `go list -m` fails `malformed module path "../my"` | ✗ confirmed (edge case) | +| Parent path with spaces, default sibling | `summer new demo --no-git --no-plugin` in `has space/` | `replace ... => ../summercms`, module loads | ✓ PASS | + +All Docker resources and ports 8080/54320 were confirmed free after the runs; scratch files were removed. + +### Probe Execution + +Step 7c: no `scripts/*/tests/probe-*.sh` declared or present for this phase; the phase gate stages above serve that role and were run directly. + +### Requirements Coverage + +REQUIREMENTS.md maps no IDs to Phase 14.3 (roadmap says "Requirements: TBD"). Coverage is accounted per locked decision in the D-01..D-28 table above. No orphaned requirements. + +### Prohibitions (judgment tier; non-authoritative verifier verdicts, human review recommended) + +| Prohibition | Verdict | Flag | +|-------------|---------|------| +| summer new never commits .env or a key; .env.example has no real key | holds (`--generator` checked `git ls-files .env` empty; template `SUMMER_APP__KEY=`) | unverified-prohibition, human review recommended | +| Committed go.mod/go.work never contain absolute, machine-specific paths | holds on default paths; WR-04: binary-source fallback can write a relative path into GOMODCACHE (machine-specific) | unverified-prohibition, human review recommended | +| compose.yaml never publishes PG on other than 127.0.0.1 | holds (`"127.0.0.1:54320:5432"`) | unverified-prohibition | +| Template text never names a consuming application | holds (grep clean; docs forbidden-name rule passed) | unverified-prohibition | +| No new Go dependency / no runtime plugin loading (x2) | holds (`git diff v0.1.12 -- go.mod` empty; forbidden scan passed) | unverified-prohibition | +| Script never reads/sets SUMMER_* | holds (only SUMMERCMS_*; forbidden scan) | unverified-prohibition | +| Script never discards local work in an existing checkout | holds (refusals; TestScriptBehavior) | unverified-prohibition | +| Script never escalates or writes outside its dirs | holds on reading new.sh (no sudo; writes clone dir, GOBIN, app dir) | unverified-prohibition | +| No task pushes/tags/bumps require/deploys (x3) | holds (no v0.1.13 tag; site require v0.1.12; prod /new 404) | unverified-prohibition | +| One-liner never shown over HTTP or without -f | holds (terminal.json, docs) | unverified-prohibition | +| Framework docs never name a consuming application | holds (docs check) | unverified-prohibition | +| Gate never passes on skipped/filtered/-update run | holds (`require_named_pass` rejects skip, "no tests to run", golden diffs) | unverified-prohibition | + +### Anti-Patterns Found + +No TBD/FIXME/XXX/TODO/placeholder markers in the phase's files. + +Open code-review findings (14.3-REVIEW.md, all `open` in 14.3-REVIEW-DISPOSITION.md), classified against the success criteria: + +| Finding | File | Severity here | Defeats a success criterion? | +|---------|------|---------------|------------------------------| +| CR-01 whitespace in framework path -> unparseable go.mod, `--no-plugin` reports success | `internal/build/stubs/new.tmpl:9`, `scaffold.go` `frameworkReplaceFor` | ⚠️ Warning (reproduced) | No for the documented flows: the bootstrap always puts the app next to the checkout, so only a checkout basename with whitespace (custom `SUMMERCMS_DIR` or `--framework`) triggers it; a parent path with spaces is fine (verified). It is a real correctness bug in the `--framework` path of SC1/SC2 and should be fixed or explicitly deferred before the v0.1.13 tag freezes it | +| WR-01 Ctrl+C leaves a partial app; re-runs refused | `cmd/summer/main.go`, `new.go` | ⚠️ Warning | No; docs sentence about cleanup is over-broad | +| WR-02 script accepts Go keywords/main/internal, clones and installs before summer new refuses | `new.sh:215` | ⚠️ Warning | No (summer new still refuses, nothing broken is written), but makes a docs claim in installation.md false | +| WR-03 bad SUMMERCMS_REF on fresh clone leaves a branch checkout the next run refuses | `new.sh:163-169` | ⚠️ Warning | No (override-only path) | +| WR-04 binary-source fallback can point into GOMODCACHE | `new.go:286-297` | ⚠️ Warning | No for the bootstrap path (always passes --framework); touches the "no machine-specific paths" prohibition | +| WR-05 every app uses host port 54320 | `new.tmpl:67` | ⚠️ Warning | No (single-app criteria), second concurrent app's `docker compose up` fails | +| WR-06 go.work.sum ignored; --no-plugin app commits no checksums | `new.tmpl:84` | ⚠️ Warning | No; D-25 locked this choice; supply-chain risk should be recorded | +| WR-07 TestTerminalCommands passes SUMMERCMS_DIR through | `terminal_check_test.go:74` | ℹ️ Info (test hygiene) | No | +| WR-08 `--generator` stage orphans the app binary | `check-phase14.3.sh:154` | ℹ️ Info (test hygiene) | No; in this run port 8080 was free afterwards | +| IN-01..IN-10 | various | ℹ️ Info | No | + +### Human Verification Required + +1. **Tag v0.1.13.** Test: tag and push. Expected: the remote lists v0.1.13. Why: D-28 user action; until then the one-liner installs v0.1.12, which has no `summer new`. +2. **Bump the site require and redeploy.** Test: bump `sm-summercmsio-plugin`/app to v0.1.13, deploy per DEPLOY.md, then `curl -sI https://summercms.io/new`. Expected: 200 `text/plain; charset=utf-8`. Why: currently 404. +3. **Production acceptance.** Test: `bash scripts/check-phase14.3.sh --acceptance-production`. Expected: `Phase 14.3 production acceptance passed`. +4. **Decide CR-01 / WR-02 before tagging.** Fix or mark deferred in 14.3-REVIEW-DISPOSITION.md. +5. **Read generated CLAUDE.md and the docs pages** for accuracy and tone (WR-02 makes one installation.md sentence false). +6. **Confirm the judgment-tier prohibition verdicts** in the table above. + +### Gaps Summary + +No goal gap blocks the phase: every success criterion is implemented, wired and was exercised by this verifier (unit gate, real PostgreSQL generator run, bootstrap end-to-end, node:24-bookworm container acceptance). The goal is not fully delivered until the user actions run: the v0.1.13 tag does not exist, summercms.io/new answers 404, and the production acceptance has not run. The open review findings are quality defects outside the documented happy path; CR-01 is the one worth fixing before the tag, because the tag freezes the generator and the script. + +--- + +_Verified: 2026-10-08T12:10:00Z_ +_Verifier: Claude (gsd-verifier)_