guilan-ace-deployment/tasks/bundle0-review.md

Bundle 0 review for the association owner

Prepared 2026-09-25; revised after the owner rejected three earlier design concepts and gave three visual references plus the Home structure. This page collects the decisions needed to close Checkpoints A and B in plan.md. It does not authorize a production seed or change any event/payment rule.

Owner approval recorded 2026-09-26: the owner read and approved this review, including the content ownership and exclusions, the local baseline with its stated test/external-integration limits, and the CMS/API decisions below. T01, T02, T05, Checkpoints A/B, and Bundle 0 are closed at discovery and contract scope. Bundle 1 has not started. Later seed, staff-account, media, staging, and release gates remain in todo.md.

Already chosen

• Home/About design direction approved 2026-09-25: use the current association logo's teal, pale gold, and charcoal in a modern content-rich interface. View Home, About, the Shadcn/ui and Lucide component map, and the design record. Home follows intro → featured events → featured blog posts → CTA → footer. This approval settles T04's visual direction; production components and content still require implementation review.
• Identity: keep the existing repository logo; use the official full name in About and metadata, with the current short lockup and faculty subline in the header.
• Public contacts: use the About-page email eastguilanceassociation@gmail.com, Telegram t.me/guilancea, and Instagram instagram.com/guilance.ir. The current footer variants are recorded for cutover.

Content ownership for review

The route matrix and 208-line source ledger classify current public copy, images, and metadata. The proposed boundary is:

Owner	Examples
New CMS	Association identity, approved contacts, Home/About editorial sections, navigation labels/order, footer description, page introductions and default SEO.
Existing domain models	Events, capacity/prices, registrations/payments, blog articles/authors/media, user profiles.
Application code	Route destinations, auth/payment state labels, forms and errors, admin controls, responsive behavior, canonical/JSON-LD structure.

The initial seed will exclude disputed statistics and founding-year mappings, affiliation relationships, personal LinkedIn/generic X links, and the trust-seal claim until their source and entity are confirmed. The exact legacy values remain in the inventory; nothing is silently rewritten.

Approved CMS/API decisions

The architecture contract and backend response schema specify:

1. Fixed Home editorial sections: association-first hero, featured_events, featured_posts, then participation. Event and blog cards read existing domain APIs; the CMS owns only headings/intro/actions around them. About uses identity first and contact last, with optional mission, activities, values, committees, affiliations, and FAQ. Route IDs and destinations stay in code. The proposed featured-item selection policy is in the contract.
2. content_editor can draft and preview authorized content; content_publisher can publish and restore; superusers retain full control. is_staff alone cannot publish. Public readers receive published revisions only.
3. Staff preview requires authentication and returns exact draft revisions with no-store and noindex. A publish swaps an immutable revision pointer and records an audit entry; restore creates another revision rather than rewriting history.
4. Public API responses use ETag and a proposed 60-second shared-cache bound. The frontend avoids an additional persistent CMS cache. Missing/unpublished content returns 404 and the frontend stays on legacy rendering until cutover.

Actual staff account assignments, media rights/import, uncertain content claims, and deployment rehearsal happen in later tasks before production release.

Accepted baseline of current state

The dated baseline and local replay cover Home/About captures at 320/390/768/1440px and local auth, event, mocked payment, blog and staff journeys with failure cases. With Redis running, manage.py check and 25 event integration tests passed. The historical combined users/events/payments Django test command ran 148 tests with 89 errors, mostly stale test fixtures and patch targets; its raw output remains in the original test log. On 2026-09-26, the current documented pytest suites passed 79 unit tests and 158 integration tests; see the rerun record. External SMS, Google OAuth, and a live payment gateway remain untested.

The replay also found a countdown hydration mismatch and notification stream-token HTTP 405. These are current-state issues for later implementation planning. SMS delivery, Google OAuth, and a live gateway were not exercised; the OTP and payment callbacks were safely mocked locally.

Approval record

The owner approved this document on 2026-09-26 after separately approving the Home/About design direction on 2026-09-25. Checkpoint A accepts the inventory classification and recorded local baseline, including the historical 89-error run and the unexercised external paths. The current pytest suite rerun subsequently passed, as recorded above. T05 and Checkpoint B accept the section registry, featured-item policy, field bounds, roles, published/preview API behavior, and cache rule for implementation. This approval does not authorize production content publication.