- surf: APIDocsProvider (one plugin) supplies a YAML or JSON OpenAPI document,
converted once at boot to compact JSON in source key order; zero or several
providers or a spec that does not convert fail boot
- http.api_docs.enabled/path/title mount GET /api-docs and /api-docs.json
(summercms.apidocs, public, refusing to replace a plugin route)
- the page loads swagger-ui-dist 5.33.1 from jsDelivr with sha384 SRI and
crossorigin on all three assets, a per-request CSP nonce for its inline
script, nosniff and no-referrer
- docs: API documentation page section, README rows, ExampleAPIDocsProvider
- bouncer: Turnstile.Verify posts secret/response/remoteip to siteverify with
a 5 s bound and PHP's open and closed modes (503 unconfigured in production,
422 on a missing, rejected or overlong token, an error or a timeout); errors
never carry the secret or the token
- bouncer: Turnstile.Middleware reads the token from the query, a JSON body or
a form body, restores the body and writes refusals through a published
TurnstileWriter or neutral JSON
- surf: factory turnstile:open|closed from turnstile.secret/turnstile.field
(a published *bouncer.Turnstile wins), client IP with trusted proxies; any
other param fails boot
- docs: Turnstile section, middleware table, README rows
- surf: LoadCORSProfiles reads http.cors_profiles.<name> (http.cors keys
without paths, validated the same way); factory cors:<profile> sets the
profile's headers; an unknown profile fails boot naming plugin and route
- BuildRouter registers OPTIONS <path> (owner surf, recovery only) for every
path whose routes name cors:<profile>; two profiles on one path, an existing
OPTIONS route or overlap with http.cors.paths fail boot
- docs: CORS profiles section, middleware table and README rows
- bouncer: CookieConfig from auth.cookie.* (LoadCookieConfig validates domain,
same_site none without Secure, secure false in production), TokenCookie with
Max-Age = refresh window, ForgetTokenCookie, CookieRefreshHandler and
CookieLogoutHandler with an app-supplied writer
- surf: http.cors refuses credentials with a * origin and bad or PHP-delimited
patterns at boot, turns wildcard origins into anchored patterns, echoes the
exact origin and sends Vary: Origin on every dynamic CORS answer; the
non-credentialed * answer is unchanged
- smoke tests for the www -> api refresh and the refused wildcard config
- Cache: Get, Set, Has, Forget, Remember (degrades on cache errors), Increment, Flush
with per-entry TTLs under <prefix>cache:
- memory driver on otter v2.3.0 bounded by cache.memory.max_entries; Redis driver
with SET PX, INCRBY and a Flush limited to SCAN MATCH <prefix>cache:* plus UNLINK
- Install publishes the Cache (sharing one Redis client with the rate limiter);
FromApp serves jobs and commands without a dial
- new docs/services/caching.md, configuration rows, cooler README
- new module cooler: Install, Handle, OpenRedis (no URL in errors), RateLimitStore
(atomic fixed-window Lua script with MemoryStore semantics, per-instance fallback)
- serve installs cooler and publishes the Redis surf.Store before BuildRouter;
BuildRouter looks up a published Store, route:list keeps the memory store
- config keys http.rate_limit.store and redis.url; go-redis v9.23.0
- cooler README, root table row, surf README and rate-limiting, configuration
and scaling docs
- go-redis v9.23.0 as the Redis client, otter v2.3.0 as the memory driver
- miniredis test-only after a human check (plan 05), s3blob behind a build tag (plan 03)
- 18.1-VALIDATION.md: every task of plans 01 to 06 with its command and the
gate result; status validated, nyquist_compliant and wave_0_complete true
- deferred-items.md: reorder.flat and the pnpm store watch resolved; the
layer's check-git-install.sh stays open (no gate or release step runs it)
- plugins stage: pgstripe root and ./subscriptions Docker-free names
- postgres stage: the settings, import, secrets and Phase 18 host suites in
the root, and the subscription host, webhook, job, plan sync, gateway and
PHP map suites in ./subscriptions
- TestTaglistFieldValidate: both modes, trim, dedupe, empty, null, wrong shapes,
customTags false, required; TestTaglistFieldHydrate: stored NULL and bad text as []
- TestReorderFlatNodes: parent 422, duplicate and zero id 422, missing or extra 409,
no depth or cycle check; TestReorderFlatCompile checks the localized list schema
- TestReorderFlatSmoke/partitioned: flat reorder within one partition on Postgres
- vitest: script markup as text, Backspace, blur, paste, datalist, customTags,
string mode; flat ArrowUp/ArrowDown and the before/after drop zones
- export_test.go wrappers for the taglist save check, hydration and node check
- check-phase18.1.sh requires the new names in the go, admin and postgres stages
- ListSchema.Localize copied only the reorder title and partition, so
GET .../schema/list answered a flat reorder without flat: true
- closes the deferred item from plan 18.1-04; the README and the lists docs
already describe the flag on the list schema
- scripts/check-phase18.1.sh: stages go, plugins, admin, layers, docs, postgres; --self-test; --all
- detectors copied from check-phase18.sh; TAP detector gains a minimum count of passing tests by name prefix
- PHASE181_REQUIRE_POSTGRES makes a missing Docker daemon fatal under --all
- the layer stage never installs: a pnpm store-dir abort prints the offline frozen recovery and fails
- ReorderView reads flat from the reorder data; ReorderBranch takes a flat
prop and shows only move up and move down
- ArrowRight and ArrowLeft do nothing, an inside drop lands after the row
(tree.ts flatZone, flatMove) and flatten sends parent_id null
- vitest flat cases; docs describe the flat page; rebuilt dist
- config_reorder.yaml without parentColumn on a record with no parent_id
column compiles as a flat (WinterCMS Sortable) reorder; maxDepth above 0
on it fails boot, an explicit parentColumn still means a tree
- ListReorder.Flat and AdminReorderTree.Flat (flat, omitempty); flat nodes
carry parent_id null, a save writes only the sort column, a parent is a
422 on nodes (reorder.flat_parent); 409 and duplicate rules unchanged
- swag descriptions, OpenAPI and schema.d.ts regenerated
- acme.catalog badges reorder fixture, TestReorderFlatCompile and
TestReorderFlatSmoke; docs Flat reorder section and cabana README
- string mode: split on the separator (comma or whitespace), normalised,
stored joined by a comma or one space; null stores an empty string
- customTags false refuses a tag outside options (taglist.not_allowed)
- taglist checked and hydrated on relation forms and settings forms;
settings bind taglist columns; required checked on the tags
- admin: TaglistField string mode and closed option lists, preview renders
the tags read-only as a comma-separated list; rebuilt dist
- docs: Taglist section covers both modes, separator and customTags
- cabana: core type taglist (mode string|array, separator, customTags,
options as a list of tags), column type gate, save-time normalisation
(trim, drop empties, dedupe) and taglist.invalid 422, record hydration
- FormField gains separator and customTags (omitempty); OpenAPI and
schema.d.ts regenerated
- admin: TaglistField chip input with suggestions, registry entry, vitest
- acme.catalog fixture with TestTaglistFieldCompile and TestTaglistFieldSmoke
- docs: forms.md Taglist section, cabana README; rebuilt dist
Mark RESEARCH open questions and premise shifts resolved by D-15..D-22 and flag the superseded recommendations (S-6, S-7, Pattern 9, five-plan split). Split oversized tasks inside plans 01, 02, 04 and 06 (plan count unchanged per D-22) and record the per-plan trade-off for plans 04 and 06.
