fs
0e86925464
Rename the top-level lib/ directory to core/ so the project root immediately communicates which code is core platform and which lives in modules/. PHP namespaces (MintyPHP\*) are unchanged — only the Composer PSR-4 path mapping moves from lib/ to core/. Module-internal lib/ directories (modules/*/lib/) are untouched. Updated across the full stack: - composer.json PSR-4 mapping - bootstrap entry points (web/index.php, bin/*, tests/bootstrap.php) - tooling configs (phpstan.neon, phpunit.xml, php-cs-fixer) - 26 architecture contract tests - enforcement-policy, guard-catalog, quality-gates - all documentation (CLAUDE.md, README, 25 docs/, .agents/skills/) - bin/qa-extended.sh search paths - .claude/settings.local.json permission paths Workflow: .agents/runs/CORE-LIB-RENAME-001/ (Analyst → Planner → Executor → Code Review (4 findings fixed) → Security Review → Acceptance Test → Finalizer) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2.0 KiB
2.0 KiB
Core Boundaries (MUST / MUST NOT)
Schichtgrenzen
- MUST SQL nur in
core/Repository/**halten. - MUST Business-Logik in
core/Service/**halten. - MUST
pages/**auf Input, Auth/AuthZ, Orchestrierung, Response begrenzen. - MUST NOT Business- oder Permission-Logik in
templates/**legen.
Instanziierung
- MUST in Actions/Helpern/Templates nur
app(Foo::class)verwenden. - MUST NOT in
pages/**direktnew ...Service|Gateway|Repositorynutzen. - MUST NOT in
core/Service/**(ausser*Factory.php) direktnew ...Factory|Service|Gateway|Repositorynutzen. - MUST NOT in
pages/admin/**Factory::classreferenzieren oderapp(...Factory::class)->create...nutzen.
Input / Validation
- MUST Input in
pages/**ueberrequestInput()lesen. - MUST NOT
$_POST,$_GET,$_FILES,REQUEST_METHODinpages/**verwenden. - MUST NOT
$_SESSION,$_SERVER,$_COOKIE,$_ENVinpages/**direkt verwenden. - MUST Form-Validation ueber
FormErrorsfuehren. - MUST API-Validation-Fehler ueber
ApiResponse::validationFromFormErrors(...)ausgeben. - MUST NOT
ApiResponse::readJsonBody(...)inpages/api/v1/**verwenden.
List-Data Endpoints
- MUST
pages/**/data().phpals GET-only Endpunkte umsetzen (gridRequireGetRequest()). - MUST Query-Filter ueber
gridParseFilters(...)+filter-schema.phpnormalisieren. - MUST NOT Query-Filter inline/parallele Alias-Parser in
data().phpneu einfuehren.
Security / API
- MUST AuthZ serverseitig erzwingen.
- MUST Tenant-Scope serverseitig erzwingen.
- MUST CSRF auf POST-Endpunkten vor Body-Verarbeitung verifizieren.
- MUST NOT PII/Secrets unredacted in Logs oder Audit-Metadata schreiben.
- MUST SQL nur ueber Repository mit prepared statements ausfuehren.
- MUST extern UUID-first bleiben.
- MUST API-Fehler konsistent halten (
error, optionalerrors). - MUST OpenAPI im selben Merge aktualisieren, wenn API geaendert wird.
Pruef-Hinweis
- Harte Repo-Gates:
tests/Architecture/CoreStarterkitContractTest.php