diff --git a/tasks/bundle1-checkpoint-c-review.md b/tasks/bundle1-checkpoint-c-review.md new file mode 100644 index 0000000..d8abdd1 --- /dev/null +++ b/tasks/bundle1-checkpoint-c-review.md @@ -0,0 +1,26 @@ +# Bundle 1 — Checkpoint C review + +Prepared 2026-09-27. **Awaiting owner review.** This covers T06–T07 only; draft/publish permissions, admin editing, public and preview APIs, seed, and frontend adapter have not started. + +## Implemented + +- Additive `content.0001_initial` migration creates a single site identity, site/page revisions, fixed page slugs, ordered typed page sections, managed media, and a publication audit record. Published revision pointers are nullable so migration adds no public content. +- Model validation restricts Home/About section keys, fixed Home order, page kinds, text lengths, plain text, action route IDs, navigation/contact shape and URLs, image alt text, image signatures, dimensions, and upload size. The revision and section uniqueness rules have database constraints. +- Draft and publication columns are present for T08; no permission or publishing path is active. The required section set and About contact-last rule will be checked by the T08 publish service across the whole revision. + +## Review choices + +- CMS uploads accept PNG, JPEG, and WebP, up to **5 MiB** and **4096 × 4096 px**. The source/rights and alt fields are required. An `approved` flag exists for the later asset review gate. +- Text rejects HTML tags and character entities. Contact web links require HTTPS; email and phone contacts require `mailto:` and `tel:` respectively. +- A missing optional image is represented by a nullable media relation; text remains present. Publication must check asset approval before exposing media. + +## Evidence + +- Focused CMS integration tests: **6 passed**. +- Backend unit suite: **79 passed**. +- Backend integration suite: **164 passed** (includes the 6 new tests). +- `python manage.py migrate --noinput --settings=config.settings.test`: `content.0001_initial` applied successfully on the test database. +- `python manage.py check --settings=config.settings.test`: no issues. +- `python manage.py makemigrations --check --dry-run --settings=config.settings.test`: no changes detected. + +No production database, media, or public route was changed. This review closes Checkpoint C only if the owner accepts the schema and validation choices above. diff --git a/tasks/todo.md b/tasks/todo.md index ccc8450..9460b62 100644 --- a/tasks/todo.md +++ b/tasks/todo.md @@ -2,7 +2,7 @@ This is an **implementation backlog**, with work-in-progress noted below and checkboxes reserved for accepted work. See [plan.md](plan.md) for scope, estimates, migration sequence, and release gates. `F`, `B`, and `D` mean frontend, backend, and deployment repository. Each item is intended to fit one focused session (S = 1–2 files; M = 3–5 files); split any item that grows larger. In addition to each item’s check, apply the definition of done: focused and regression tests, lint/build, runtime/browser check, security/rollback where relevant, and human review. -Bundle 0 started 2026-09-24 and was approved by the owner on 2026-09-26. Deliverables: [content inventory](content-inventory.md), [baseline](baseline-2026-09-24.md), [local journey replay](evidence/2026-09-24/local-replay.md), [product/asset review](product-review.md), [CMS/API contract](cms-api-contract-draft.md), backend [API schema](../../guilan-ace-backend/docs/content-api-schema-draft.md), and the approved Home/About visual direction linked from frontend `DESIGN.md`. The owner approved the [Home](concepts/d-logo-led-home.html) and [About](concepts/d-logo-led-about.html) direction on 2026-09-25, then approved the [Bundle 0 review](bundle0-review.md) on 2026-09-26, accepting the content boundary, recorded baseline, and CMS/API contract. T01–T05 and Checkpoints A/B are closed at discovery and contract scope. The current pytest suites pass all 237 tests; the earlier 89-error run is preserved as historical evidence. External SMS/OAuth/live-gateway checks, disputed seed claims, and production media/account assignments remain follow-up work in later gates. Bundle 1 has not started. +Bundle 0 started 2026-09-24 and was approved by the owner on 2026-09-26. Deliverables: [content inventory](content-inventory.md), [baseline](baseline-2026-09-24.md), [local journey replay](evidence/2026-09-24/local-replay.md), [product/asset review](product-review.md), [CMS/API contract](cms-api-contract-draft.md), backend [API schema](../../guilan-ace-backend/docs/content-api-schema-draft.md), and the approved Home/About visual direction linked from frontend `DESIGN.md`. The owner approved the [Home](concepts/d-logo-led-home.html) and [About](concepts/d-logo-led-about.html) direction on 2026-09-25, then approved the [Bundle 0 review](bundle0-review.md) on 2026-09-26, accepting the content boundary, recorded baseline, and CMS/API contract. T01–T05 and Checkpoints A/B are closed at discovery and contract scope. The current pytest suites pass all 237 tests; the earlier 89-error run is preserved as historical evidence. External SMS/OAuth/live-gateway checks, disputed seed claims, and production media/account assignments remain follow-up work in later gates. Bundle 1 started 2026-09-27; T06–T07 await Checkpoint C review. ## 0. Discovery and design contract (4–5 person-days) @@ -16,6 +16,8 @@ Bundle 0 started 2026-09-24 and was approved by the owner on 2026-09-26. Deliver ## 1. CMS foundation and migration (9–12 person-days) +Work in progress: T06–T07 implementation and verification began 2026-09-27. See [Checkpoint C review](bundle1-checkpoint-c-review.md). Acceptance checkboxes remain open pending owner review; T08 onward has not started. + - [ ] **T06 — Add site identity and page schema (M; deps: T05).** Files: B new content app models/migration/tests. Acceptance: one site identity, stable page slugs, ordered typed sections, image/alt and SEO fields exist with uniqueness/validation; migrations are additive. Verify: migration test and `python manage.py check` on a test database. - [ ] **T07 — Validate fields and media handling (M; deps: T06).** Files: B content validators/tests. Acceptance: URLs, section payloads, image type/size, alt text, and unsafe markup are constrained; absent optional media renders safely. Verify: invalid/oversize/malicious inputs rejected in focused tests. - [ ] **Checkpoint C (deps: T06–T07).** Schema and validation reviewed before permissions/API work.