prepare repo

TODO.md

@@ -8,122 +8,139 @@ This file is the single source of truth for roadmap and delivery progress.
 - [~] Partially done
 - [x] Done
 
+## Priority Legend
+
+- `[P1]` Critical path / prerequisite
+- `[P2]` Important but not blocking
+- `[P3]` Nice-to-have / optimization
+
 ## MVP 0: Foundations
 
 ### MVP1 Gate: Mandatory Before Feature Work
 
-- [ ] RBAC domain model finalized (roles, permissions, resource scopes)
-- [ ] RBAC enforcement at route and action level in admin
-- [ ] Permission matrix documented and tested
-- [ ] Reusable CRUD base patterns (list/detail/editor/service/repository)
-- [ ] Shared CRUD validation strategy (Zod + server-side enforcement)
-- [ ] Shared error and audit hooks for CRUD mutations
+- [ ] [P1] RBAC domain model finalized (roles, permissions, resource scopes)
+- [ ] [P1] RBAC enforcement at route and action level in admin
+- [ ] [P1] Permission matrix documented and tested
+- [ ] [P1] Reusable CRUD base patterns (list/detail/editor/service/repository)
+- [ ] [P1] Shared CRUD validation strategy (Zod + server-side enforcement)
+- [ ] [P1] Shared error and audit hooks for CRUD mutations
 
 ### Admin App
 
-- [x] Separate Next.js admin app in monorepo
-- [x] App Router + TypeScript + `src/` structure
-- [x] Shared DB access via `@cms/db`
-- [~] Base admin dashboard shell and roadmap page (`/todo`)
-- [ ] Authentication and session model (`admin`, `editor`, `manager`)
-- [ ] Protected admin routes and session handling
-- [ ] Core admin IA (pages/media/users/commissions/settings)
+- [x] [P1] Separate Next.js admin app in monorepo
+- [x] [P1] App Router + TypeScript + `src/` structure
+- [x] [P1] Shared DB access via `@cms/db`
+- [~] [P2] Base admin dashboard shell and roadmap page (`/todo`)
+- [ ] [P1] Authentication and session model (`admin`, `editor`, `manager`)
+- [ ] [P1] Protected admin routes and session handling
+- [ ] [P1] Core admin IA (pages/media/users/commissions/settings)
 
 ### Public App
 
-- [x] Separate Next.js public app in monorepo
-- [x] App Router + TypeScript + `src/` structure
-- [~] Public app connected to shared data layer
-- [ ] Public layout system (header/footer/navigation)
-- [ ] Header banner rendering from CMS-managed content
-- [ ] Basic SEO defaults (metadata, OG, sitemap, robots)
+- [x] [P1] Separate Next.js public app in monorepo
+- [x] [P1] App Router + TypeScript + `src/` structure
+- [~] [P1] Public app connected to shared data layer
+- [ ] [P2] Public layout system (header/footer/navigation)
+- [ ] [P1] Header banner rendering from CMS-managed content
+- [ ] [P2] Basic SEO defaults (metadata, OG, sitemap, robots)
 
 ### Testing
 
-- [x] Vitest + Testing Library + MSW baseline
-- [x] Playwright baseline with web/admin projects
-- [ ] CI workflow for lint/typecheck/unit/e2e gates
-- [ ] Test data strategy (seed fixtures + isolated e2e data)
-- [ ] RBAC policy unit tests and permission regression suite
-- [ ] CRUD contract tests for shared service patterns
+- [x] [P1] Vitest + Testing Library + MSW baseline
+- [x] [P1] Playwright baseline with web/admin projects
+- [ ] [P1] CI workflow for lint/typecheck/unit/e2e gates
+- [ ] [P1] Test data strategy (seed fixtures + isolated e2e data)
+- [ ] [P1] RBAC policy unit tests and permission regression suite
+- [ ] [P1] CRUD contract tests for shared service patterns
 
 ### Delivery Pipeline And Runtime
 
-- [x] Theoretical Gitea Actions workflow scaffold (`.gitea/workflows/ci-cd-theoretical.yml`)
-- [x] Bun-based Dockerfiles for public and admin apps
-- [x] Staging and production docker-compose templates
-- [ ] Registry credentials and image push strategy
-- [ ] Staging deployment automation against real host
-- [ ] Production promotion and rollback procedure
+- [x] [P2] Theoretical Gitea Actions workflow scaffold (`.gitea/workflows/ci-cd-theoretical.yml`)
+- [x] [P2] Bun-based Dockerfiles for public and admin apps
+- [x] [P2] Staging and production docker-compose templates
+- [ ] [P1] Registry credentials and image push strategy
+- [ ] [P1] Staging deployment automation against real host
+- [ ] [P1] Production promotion and rollback procedure
+
+### Git Flow And Branching
+
+- [ ] [P1] Protect `main` and `staging` branches in Gitea
+- [ ] [P1] Define PR gates: lint + typecheck + unit + e2e list minimum
+- [ ] [P1] Enforce one todo item per branch naming convention
+- [ ] [P2] Add PR template requiring linked TODO step
+- [ ] [P2] Define branch lifecycle for `todo/*`, `refactor/*`, and `code/*`
+- [x] [P2] Conventional commit schema documentation (`CONTRIBUTING.md`)
+- [x] [P2] Changelog scaffold and generation scripts (`CHANGELOG.md`, `bun run changelog:*`)
+- [ ] [P1] Release tagging and changelog publication policy in CI
 
 ## MVP 1: Core CMS Business Features
 
 ### Admin App (Primary Focus)
 
-- [ ] Page management (create/edit/publish/unpublish/schedule)
-- [ ] Navigation management (menus, nested items, order, visibility)
-- [ ] Media library (upload, browse, replace, delete)
-- [ ] Media enrichment metadata (alt text, copyright, author, source, tags)
-- [ ] Media refinement for artworks (medium, dimensions, year, framing, availability)
-- [ ] Users management (invite, roles, status)
-- [ ] Commissions management (request intake, owner, due date, notes)
-- [ ] Kanban workflow for commissions (new, scoped, in-progress, review, done)
-- [ ] Header banner management (message, CTA, active window)
+- [ ] [P1] Page management (create/edit/publish/unpublish/schedule)
+- [ ] [P1] Navigation management (menus, nested items, order, visibility)
+- [ ] [P1] Media library (upload, browse, replace, delete)
+- [ ] [P1] Media enrichment metadata (alt text, copyright, author, source, tags)
+- [ ] [P1] Media refinement for artworks (medium, dimensions, year, framing, availability)
+- [ ] [P1] Users management (invite, roles, status)
+- [ ] [P1] Commissions management (request intake, owner, due date, notes)
+- [ ] [P1] Kanban workflow for commissions (new, scoped, in-progress, review, done)
+- [ ] [P1] Header banner management (message, CTA, active window)
 
 ### Public App
 
-- [ ] Dynamic page rendering from CMS page entities
-- [ ] Navigation rendering from managed menu structure
-- [ ] Media entity rendering with enrichment data
-- [ ] Artwork views and listing filters
-- [ ] Commission request submission flow
-- [ ] Header banner render logic and fallbacks
+- [ ] [P1] Dynamic page rendering from CMS page entities
+- [ ] [P1] Navigation rendering from managed menu structure
+- [ ] [P1] Media entity rendering with enrichment data
+- [ ] [P2] Artwork views and listing filters
+- [ ] [P1] Commission request submission flow
+- [ ] [P1] Header banner render logic and fallbacks
 
 ### News / Blog (Secondary Track)
 
-- [ ] News/blog content type (not primary CMS domain)
-- [ ] Admin list/editor for news posts
-- [ ] Public news index + detail pages
-- [ ] Tag/category and basic archive support
+- [ ] [P2] News/blog content type (not primary CMS domain)
+- [ ] [P2] Admin list/editor for news posts
+- [ ] [P2] Public news index + detail pages
+- [ ] [P3] Tag/category and basic archive support
 
 ### Testing
 
-- [ ] Unit tests for content schemas and service logic
-- [ ] Component tests for admin forms (pages/media/navigation)
-- [ ] E2E happy paths: create page, publish, see on public app
-- [ ] E2E happy paths: media upload + artwork refinement display
-- [ ] E2E happy paths: commissions kanban transitions
+- [ ] [P1] Unit tests for content schemas and service logic
+- [ ] [P1] Component tests for admin forms (pages/media/navigation)
+- [ ] [P1] E2E happy paths: create page, publish, see on public app
+- [ ] [P1] E2E happy paths: media upload + artwork refinement display
+- [ ] [P1] E2E happy paths: commissions kanban transitions
 
 ## MVP 2: Production Readiness
 
 ### Admin App
 
-- [ ] Audit log for key content operations
-- [ ] Revision history for pages/navigation/media metadata
-- [ ] Permission matrix refinement with granular scopes
-- [ ] Error boundaries and UX fallback states
+- [ ] [P1] Audit log for key content operations
+- [ ] [P2] Revision history for pages/navigation/media metadata
+- [ ] [P1] Permission matrix refinement with granular scopes
+- [ ] [P2] Error boundaries and UX fallback states
 
 ### Public App
 
-- [ ] Revalidation strategy and cache tuning
-- [ ] Performance budget checks (Core Web Vitals)
-- [ ] 404/500 content-aware error pages
-- [ ] Accessibility review and fixes
+- [ ] [P1] Revalidation strategy and cache tuning
+- [ ] [P2] Performance budget checks (Core Web Vitals)
+- [ ] [P1] 404/500 content-aware error pages
+- [ ] [P1] Accessibility review and fixes
 
 ### Platform
 
-- [x] Bun workspace + Biome + Turbo baseline
-- [x] Prisma + PostgreSQL baseline
-- [ ] Monitoring and alerting baseline
-- [ ] Backup and migration rollback playbook
-- [ ] Release/versioning checklist per environment
+- [x] [P1] Bun workspace + Biome + Turbo baseline
+- [x] [P1] Prisma + PostgreSQL baseline
+- [ ] [P1] Monitoring and alerting baseline
+- [ ] [P1] Backup and migration rollback playbook
+- [ ] [P2] Release/versioning checklist per environment
 
 ### Testing
 
-- [ ] Visual regression workflow for critical templates
-- [ ] Load/perf tests for key public routes
-- [ ] Flake tracking and quarantine policy for e2e
-- [ ] Coverage thresholds and enforcement policy
+- [ ] [P2] Visual regression workflow for critical templates
+- [ ] [P2] Load/perf tests for key public routes
+- [ ] [P2] Flake tracking and quarantine policy for e2e
+- [ ] [P1] Coverage thresholds and enforcement policy
 
 ## Discovery Log
 
@@ -135,5 +152,6 @@ This file is the single source of truth for roadmap and delivery progress.
 
 - Mark completed items by switching `[ ]` to `[x]`.
 - Mark ongoing work by switching `[ ]` to `[~]`.
+- Prefix each task with `[P1]`, `[P2]`, or `[P3]`.
 - Add new findings to Discovery Log with date.
 - Keep MVP scope changes in this file first, then implement.