U7 — tells a website builder what they need to know

WEBSITE_WORKSPACE.md, plus the parts of the README that were still describing the old layout or a manual step the code doesn't need anymore (the key-ring paragraph, mainly - that one was actively wrong now, not just stale).
2026-07-28 16:30:19 +02:00
parent 9f4ae475e7
commit 88770c5bd0
6 changed files with 258 additions and 6 deletions
@@ -0,0 +1,45 @@
+# Code Generation Summary — U7 Repository Documentation
+
+**Date**: 2026-07-28
+
+## Files Created
+
+- `WEBSITE_WORKSPACE.md` — the website workspace contract (FR-09): target path, required structure,
+  forbidden/reserved paths, SPA-fallback behaviour, same-origin `/api/v1` calls, applicable CSP
+  policy, Umami inclusion, and why the atomic release switch can't touch it
+
+## Files Modified
+
+- `README.md` — "Productie Setup" section rewritten:
+  - `/` now documented as `wwwroot/web/`, linking to `WEBSITE_WORKSPACE.md`; noted that a missing
+    `wwwroot/web/` at startup serves a built-in placeholder rather than failing
+  - New `/health` row and a dedicated "Health-check endpoint" subsection distinguishing liveness
+    from `Availability/status` / `System/capabilities`
+  - "Build & Publish" rewritten around the actual Gitea Actions pipeline (push → automatic test
+    deploy, `workflow_dispatch` + flag → production) instead of a bare manual `dotnet publish`
+  - New runtime configuration entries: `Observability__SentryDsn`,
+    `SecurityHeaders__AllowedScriptOrigins__0` / `AllowedConnectOrigins__0`
+  - **§2a rewritten**: removed the outdated instruction to manually configure a persistent Data
+    Protection key ring — U2 already made this automatic (`PersistKeysToDbContext` with an explicit
+    discriminator), so the README no longer tells the reader to do work that's already done
+  - **§3 rewritten**: documented the automatic, fail-fast `ApplicationDbContext` migration at
+    startup and the pre-production backup, replacing the old "can be handled via a CI/CD pipeline"
+    hand-wave with what's actually built
+- `frontend/.env.example` — documented the same-origin default for `VITE_API_BASE_URL`; added
+  `VITE_SENTRY_DSN`, `VITE_APP_ENV`, `VITE_UMAMI_SCRIPT_URL`, `VITE_UMAMI_WEBSITE_ID`, each noted as
+  optional
+
+## Verification (Step 13.5 — this unit's own check)
+
+No code, no test project — this is a documentation-only unit (same as its "no components" listing
+in `unit-of-work.md`). Every factual claim was checked directly against source rather than against
+the design record (see Step 4 in the code generation plan for the full checklist): `Program.cs`,
+`SlpModularCms.Api.csproj`, `AvailabilityMiddleware`, U2's Data Protection extensions, U3's
+`SecurityHeadersOptions` validation, U4's Sentry/Umami configuration, and U6's infrastructure design
+for the publish/deploy specifics. No discrepancies found.
+
+## Deferred to Operations (not built here, by design — Q8 of Requirements = A)
+
+- Host setup instructions, the rollback procedure, and the FTPS switch path (FR-23)
+- Actual Gitea variable/secret values
+- UptimeRobot, Sentry alert rules, and the `dotnet-appsettings` compliance gate