guilan-ace-deployment/tasks/bundle1-checkpoint-c-review.md

Bundle 1 — Checkpoint C review

Prepared 2026-09-27. Approved by the owner on 2026-09-27. This covers T06–T07 only; draft/publish permissions, admin editing, public and preview APIs, seed, and frontend adapter had not started at this checkpoint.

Implemented

• Additive content.0001_initial migration creates a single site identity, site/page revisions, fixed page slugs, ordered typed page sections, managed media, and a publication audit record. Published revision pointers are nullable so migration adds no public content.
• Model validation restricts Home/About section keys, fixed Home order, page kinds, text lengths, plain text, action route IDs, navigation/contact shape and URLs, image alt text, image signatures, dimensions, and upload size. The revision and section uniqueness rules have database constraints.
• Draft and publication columns are present for T08; no permission or publishing path is active. The required section set and About contact-last rule will be checked by the T08 publish service across the whole revision.

Review choices

• CMS uploads accept PNG, JPEG, and WebP, up to 5 MiB and 4096 × 4096 px. The source/rights and alt fields are required. An approved flag exists for the later asset review gate.
• Text rejects HTML tags and character entities. Contact web links require HTTPS; email and phone contacts require mailto: and tel: respectively.
• A missing optional image is represented by a nullable media relation; text remains present. Publication must check asset approval before exposing media.

Evidence

• Focused CMS integration tests: 6 passed.
• Backend unit suite: 79 passed.
• Backend integration suite: 164 passed (includes the 6 new tests).
• python manage.py migrate --noinput --settings=config.settings.test: content.0001_initial applied successfully on the test database.
• python manage.py check --settings=config.settings.test: no issues.
• python manage.py makemigrations --check --dry-run --settings=config.settings.test: no changes detected.

No production database, media, or public route was changed. The owner approved Checkpoint C and the schema and validation choices above on 2026-09-27.