Scaffold Phase 0: Django project, deploy config, base layout
Django 5.2 with dev/test/prod settings, SQLite tuned for Litestream
(WAL, IMMEDIATE transactions), ULID primary keys via a shared base
model, and a custom User model ahead of the first migration.
Minimal accessible base template with dark mode via color-scheme and
an optional theme picker. /healthz answers before host validation so
Fly checks pass.
Dockerfile (dev and prod targets), compose for local dev, fly.toml
with placeholder app/region, Litestream backups to B2, and a Forgejo
Actions workflow. Migrations run in bin/start because Fly release
machines don't mount volumes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 06:59:34 -04:00
|
|
|
[project]
|
|
|
|
|
name = "intent"
|
|
|
|
|
version = "0.1.0"
|
|
|
|
|
description = "Track the why behind features, across implementations."
|
|
|
|
|
requires-python = ">=3.13"
|
|
|
|
|
dependencies = [
|
|
|
|
|
"django>=5.2,<5.3",
|
2026-10-27 07:10:27 -04:00
|
|
|
"django-allauth[socialaccount]>=65.21",
|
Harden for launch: limits, CSP, moderation, admin 2FA (Phase 5)
- Rate limits in the shared cache for comments, issues, uploads and
invites; a limited HTMX reply keeps the draft.
- Content-Security-Policy (self only, no inline script or style, bucket
origin for images and frames) and Permissions-Policy on every page.
htmx configured not to inject styles or eval.
- Moderation: deactivating a user ends their sessions and keeps their
content; deleted accounts show as "ghost"; reserved usernames; the
admin won't delete an org's last owner.
- Admin requires a TOTP code (django-otp), with add_admin_totp to enrol.
- Email provider chosen by environment through django-anymail.
- Playwright browser tests: axe WCAG 2.1 AA on every page in light and
dark, no CSP violations, keyboard walkthrough, theme toggle. Explicit
Canvas/CanvasText on :root fixes dark-mode contrast detection.
- bin/start creates the data dir if missing; docs/operations.md runbook.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 10:51:06 -04:00
|
|
|
"django-anymail==15.2",
|
|
|
|
|
"django-otp==1.7.5",
|
Scaffold Phase 0: Django project, deploy config, base layout
Django 5.2 with dev/test/prod settings, SQLite tuned for Litestream
(WAL, IMMEDIATE transactions), ULID primary keys via a shared base
model, and a custom User model ahead of the first migration.
Minimal accessible base template with dark mode via color-scheme and
an optional theme picker. /healthz answers before host validation so
Fly checks pass.
Dockerfile (dev and prod targets), compose for local dev, fly.toml
with placeholder app/region, Litestream backups to B2, and a Forgejo
Actions workflow. Migrations run in bin/start because Fly release
machines don't mount volumes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 06:59:34 -04:00
|
|
|
"django-storages[s3]>=1.14.6",
|
|
|
|
|
"gunicorn>=26.2.0",
|
2026-10-27 07:58:16 -04:00
|
|
|
"markdown-it-py>=4.2.0",
|
|
|
|
|
"nh3>=0.3.7",
|
Scaffold Phase 0: Django project, deploy config, base layout
Django 5.2 with dev/test/prod settings, SQLite tuned for Litestream
(WAL, IMMEDIATE transactions), ULID primary keys via a shared base
model, and a custom User model ahead of the first migration.
Minimal accessible base template with dark mode via color-scheme and
an optional theme picker. /healthz answers before host validation so
Fly checks pass.
Dockerfile (dev and prod targets), compose for local dev, fly.toml
with placeholder app/region, Litestream backups to B2, and a Forgejo
Actions workflow. Migrations run in bin/start because Fly release
machines don't mount volumes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 06:59:34 -04:00
|
|
|
"python-ulid>=4.0.1",
|
|
|
|
|
"sentry-sdk[django]>=2.73.0",
|
|
|
|
|
"whitenoise>=6.12.0",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[dependency-groups]
|
|
|
|
|
dev = [
|
Harden for launch: limits, CSP, moderation, admin 2FA (Phase 5)
- Rate limits in the shared cache for comments, issues, uploads and
invites; a limited HTMX reply keeps the draft.
- Content-Security-Policy (self only, no inline script or style, bucket
origin for images and frames) and Permissions-Policy on every page.
htmx configured not to inject styles or eval.
- Moderation: deactivating a user ends their sessions and keeps their
content; deleted accounts show as "ghost"; reserved usernames; the
admin won't delete an org's last owner.
- Admin requires a TOTP code (django-otp), with add_admin_totp to enrol.
- Email provider chosen by environment through django-anymail.
- Playwright browser tests: axe WCAG 2.1 AA on every page in light and
dark, no CSP violations, keyboard walkthrough, theme toggle. Explicit
Canvas/CanvasText on :root fixes dark-mode contrast detection.
- bin/start creates the data dir if missing; docs/operations.md runbook.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 10:51:06 -04:00
|
|
|
"playwright==1.64.1",
|
Scaffold Phase 0: Django project, deploy config, base layout
Django 5.2 with dev/test/prod settings, SQLite tuned for Litestream
(WAL, IMMEDIATE transactions), ULID primary keys via a shared base
model, and a custom User model ahead of the first migration.
Minimal accessible base template with dark mode via color-scheme and
an optional theme picker. /healthz answers before host validation so
Fly checks pass.
Dockerfile (dev and prod targets), compose for local dev, fly.toml
with placeholder app/region, Litestream backups to B2, and a Forgejo
Actions workflow. Migrations run in bin/start because Fly release
machines don't mount volumes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 06:59:34 -04:00
|
|
|
"pytest>=9.1.1",
|
|
|
|
|
"pytest-django>=4.14.0",
|
|
|
|
|
"ruff>=0.17.3",
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
[tool.ruff]
|
|
|
|
|
line-length = 100
|
|
|
|
|
target-version = "py313"
|
|
|
|
|
extend-exclude = ["*/migrations/*"]
|
|
|
|
|
|
|
|
|
|
[tool.ruff.lint]
|
|
|
|
|
select = ["E", "F", "I", "UP", "B", "DJ"]
|
|
|
|
|
|
|
|
|
|
[tool.pytest.ini_options]
|
|
|
|
|
DJANGO_SETTINGS_MODULE = "config.settings.test"
|
|
|
|
|
testpaths = ["tests"]
|
Harden for launch: limits, CSP, moderation, admin 2FA (Phase 5)
- Rate limits in the shared cache for comments, issues, uploads and
invites; a limited HTMX reply keeps the draft.
- Content-Security-Policy (self only, no inline script or style, bucket
origin for images and frames) and Permissions-Policy on every page.
htmx configured not to inject styles or eval.
- Moderation: deactivating a user ends their sessions and keeps their
content; deleted accounts show as "ghost"; reserved usernames; the
admin won't delete an org's last owner.
- Admin requires a TOTP code (django-otp), with add_admin_totp to enrol.
- Email provider chosen by environment through django-anymail.
- Playwright browser tests: axe WCAG 2.1 AA on every page in light and
dark, no CSP violations, keyboard walkthrough, theme toggle. Explicit
Canvas/CanvasText on :root fixes dark-mode contrast detection.
- bin/start creates the data dir if missing; docs/operations.md runbook.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-27 10:51:06 -04:00
|
|
|
markers = [
|
|
|
|
|
"browser: real-browser tests (Playwright + Chromium); skip with -m 'not browser'",
|
|
|
|
|
]
|