# Code Generation Summary — U7 Repository Documentation

**Date**: 2026-07-28

## Files Created

- `WEBSITE_WORKSPACE.md` — the website workspace contract (FR-09): target path, required structure,
  forbidden/reserved paths, SPA-fallback behaviour, same-origin `/api/v1` calls, applicable CSP
  policy, Umami inclusion, and why the atomic release switch can't touch it

## Files Modified

- `README.md` — "Productie Setup" section rewritten:
  - `/` now documented as `wwwroot/web/`, linking to `WEBSITE_WORKSPACE.md`; noted that a missing
    `wwwroot/web/` at startup serves a built-in placeholder rather than failing
  - New `/health` row and a dedicated "Health-check endpoint" subsection distinguishing liveness
    from `Availability/status` / `System/capabilities`
  - "Build & Publish" rewritten around the actual Gitea Actions pipeline (push → automatic test
    deploy, `workflow_dispatch` + flag → production) instead of a bare manual `dotnet publish`
  - New runtime configuration entries: `Observability__SentryDsn`,
    `SecurityHeaders__AllowedScriptOrigins__0` / `AllowedConnectOrigins__0`
  - **§2a rewritten**: removed the outdated instruction to manually configure a persistent Data
    Protection key ring — U2 already made this automatic (`PersistKeysToDbContext` with an explicit
    discriminator), so the README no longer tells the reader to do work that's already done
  - **§3 rewritten**: documented the automatic, fail-fast `ApplicationDbContext` migration at
    startup and the pre-production backup, replacing the old "can be handled via a CI/CD pipeline"
    hand-wave with what's actually built
- `frontend/.env.example` — documented the same-origin default for `VITE_API_BASE_URL`; added
  `VITE_SENTRY_DSN`, `VITE_APP_ENV`, `VITE_UMAMI_SCRIPT_URL`, `VITE_UMAMI_WEBSITE_ID`, each noted as
  optional

## Verification (Step 13.5 — this unit's own check)

No code, no test project — this is a documentation-only unit (same as its "no components" listing
in `unit-of-work.md`). Every factual claim was checked directly against source rather than against
the design record (see Step 4 in the code generation plan for the full checklist): `Program.cs`,
`SlpModularCms.Api.csproj`, `AvailabilityMiddleware`, U2's Data Protection extensions, U3's
`SecurityHeadersOptions` validation, U4's Sentry/Umami configuration, and U6's infrastructure design
for the publish/deploy specifics. No discrepancies found.

## Deferred to Operations (not built here, by design — Q8 of Requirements = A)

- Host setup instructions, the rollback procedure, and the FTPS switch path (FR-23)
- Actual Gitea variable/secret values
- UptimeRobot, Sentry alert rules, and the `dotnet-appsettings` compliance gate