golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(19.3-02): record plan 02 state and roadmap progress

Browse Source
This commit is contained in:
Jakub Zych
2026-10-15 18:02:28 +02:00
parent e3ba89a411
commit b1fab9930b
2 changed files with 16 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
.planning/ROADMAP.md
View File

@@ -1255,14 +1255,14 @@ Plans:
3. An S3 blob driver can be selected through framework config, so the application does not import it. `/api-docs` and `/api-docs.json` can be served. Turnstile verification middleware is available.
4. The touched modules' READMEs and `docs/` pages are updated. The new code has unit tests, delivered in the phase's last plan.
**Plans:** 1/5 plans executed
**Plans:** 2/5 plans executed
Plans:
**Wave 1**
- [x] 19.3-01-PLAN.md — Decision note, then the `cooler` module: Redis-backed rate-limit store wired by serve, memory (otter) and Redis cache drivers (wave 1)
**Wave 2** *(blocked on Wave 1 completion)*
- [ ] 19.3-02-PLAN.md — bouncer cookie transport and Turnstile, surf CORS hardening and `cors:<profile>`, opt-in /api-docs (wave 2)
- [x] 19.3-02-PLAN.md — bouncer cookie transport and Turnstile, surf CORS hardening and `cors:<profile>`, opt-in /api-docs (wave 2)
- [ ] 19.3-03-PLAN.md — summer.yaml `build.tags` and the `summercms_s3` S3 driver, disk-name extension fix, `storage.uploads.public_url` (wave 2)
- [ ] 19.3-04-PLAN.md — Site-cache purge in cooler, `pact.ReorderAfterSave`, Journal/menu/FAQ adoption, shared Nuxt purge route in three layers, push checkpoint, app pointer bumps (wave 2)
@@ -1386,7 +1386,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
| 19. Chat and ChatChannels | 0/TBD | Not started | - |
| 19.1. Chat satellites | 0/TBD | Not started | - |
| 19.2. Chat polish against WavePath clients | 0/TBD | Not started | - |
| 19.3. Framework transport and infrastructure for WavePath | 1/5 | In Progress| |
| 19.3. Framework transport and infrastructure for WavePath | 2/5 | In Progress| |
| 19.4. OIDC provider on wristband | 0/TBD | Not started | - |
| 19.5. Social login in sm-user-plugin | 0/TBD | Not started | - |
| 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - |

20
.planning/STATE.md
View File

@@ -4,16 +4,16 @@ milestone: v1.0
current_phase: "19.3"
current_phase_name: Framework transport and infrastructure for WavePath (INSERTED)
status: executing
stopped_at: Completed 19.3-01-PLAN.md
last_updated: "2026-10-15T15:42:23.602Z"
stopped_at: Completed 19.3-02-PLAN.md
last_updated: "2026-10-15T16:02:18.570Z"
last_activity: 2026-10-15
last_activity_desc: Phase 19.3 execution started
state_head: d86f27cc9cb98c361d1d67ab9fb43f1be628cdd2
state_head: e3ba89a411b85ee79e8afce8bf08739f78c99ecf
progress:
total_phases: 40
completed_phases: 31
total_plans: 190
completed_plans: 183
completed_plans: 184
gsd_state_version: "1.0"
milestone_name: milestone
---
@@ -30,7 +30,7 @@ See: .planning/PROJECT.md (updated 2026-10-12)
## Current Position
Phase: 19.3 (Framework transport and infrastructure for WavePath (INSERTED)) — EXECUTING
Plan: 2 of 5
Plan: 3 of 5
Status: Ready to execute
Last activity: 2026-10-15 — Phase 19.3 execution started
@@ -240,6 +240,7 @@ Progress: [████░░░░░░] 44%
| Phase 18.1 P05 | 20 min | 3 tasks | 20 files |
| Phase 18.1 P06 | 50min | 5 tasks | 39 files |
| Phase 19.3 P01 | 14 min | 2 tasks | 20 files |
| Phase 19.3 P02 | 15min | 4 tasks | 11 files |
## Accumulated Context
@@ -808,6 +809,11 @@ Recent decisions affecting current work:
- [Phase 19.3]: 19.3-01: unreachable Redis at start-up is a warning; missing/malformed redis.url with a Redis driver is a boot error naming the key
- [Phase 19.3]: 19.3-01: cooler key prefix = cache.prefix or slug(app.name)+':' (default summer:); cache keys <prefix>cache:, limiter keys <prefix>rl:
- [Phase 19.3]: 19.3-01: Remember degrades on cache errors; Redis Flush is SCAN MATCH <prefix>cache:* + UNLINK, never FLUSHDB
- [Phase 19.3]: 19.3-02: bouncer cookie transport reads auth.cookie.* through CookieConfigSource (compass satisfies it, bouncer imports no framework module); TokenCookie Max-Age is the guard's refresh window
- [Phase 19.3]: 19.3-02: credentialed CORS with a * origin, uncompilable or PHP-delimited origin patterns fail boot; dynamic CORS answers echo the exact origin with Vary: Origin; the non-credentialed * answer is unchanged
- [Phase 19.3]: 19.3-02: route-group CORS uses cors:<profile> from http.cors_profiles.<name>; the router registers OPTIONS preflight routes (owner surf) and refuses overlap with http.cors.paths
- [Phase 19.3]: 19.3-02: Turnstile open/closed follows PHP; with a secret, a transport error or timeout is 422 in both modes and a missing token fails without a siteverify call; a published *bouncer.Turnstile or bouncer.TurnstileWriter overrides the defaults
- [Phase 19.3]: 19.3-02: /api-docs is opt-in (http.api_docs.enabled), spec from exactly one surf.APIDocsProvider converted at boot, swagger-ui-dist pinned to 5.33.1 with sha384 SRI and a nonce CSP
### Pending Todos
@@ -886,6 +892,6 @@ Items acknowledged and carried forward from previous milestone close:
## Session Continuity
Last session: 2026-10-15T15:42:22.846Z
Stopped at: Completed 19.3-01-PLAN.md
Last session: 2026-10-15T16:02:17.838Z
Stopped at: Completed 19.3-02-PLAN.md
Resume file: None