ad/COMPLIANCE.md

Compliance: Molodetz against /workspace/dpp/dptemplate.md

Status date: 2026-10-05. Template read in full and never edited. Selection: SELECTION.md. Proof runs: out/pytest-full.log (full suite), out/check-ui.log (six gates), out/dpp-gates.txt (DPP tooling dpp.gates.run_gates, all PASS), out/locust-smoke.log (51 requests, 0 failures), make coverage (76% including the server subprocess).

Legend: MET, PARTIAL (works, but narrower than the template text), NOT MET (missing, with the reason).

Section 1.1 Backend choices

Choice	Status	Where / how
Python >= 3.12	MET	pyproject.toml requires-python = ">=3.12"; venv runs 3.13
FastAPI + Jinja2, server-rendered first	MET	molodetz/main.py; one Jinja2Templates in molodetz/templating.py (gate 1)
uvicorn (standard extras), reload in dev, workers in prod	MET	uvicorn[standard]; make dev (--reload --reload-dir molodetz --backlog 4096), make prod (--workers, --backlog 8192, proxy headers, pinned static version)
SQLite via dataset, sync by design, no ORM/migrations	MET	molodetz/database/core.py: dataset.connect with NullPool, exact connect_args and PRAGMA list; schema sync in database/init_db.py; no threadpool around DB calls (backup DB writes moved out of to_thread)
passlib PBKDF2-SHA256, no JWT	MET	molodetz/utils/auth.py hash_password/verify_password; sessions in sessions table
httpx (HTTP/2) only through the stealth factory; curl_cffi impersonation	MET	molodetz/stealth.py (only file that builds httpx clients) + molodetz/curl_transport.py; httpx[http2]; SSRF guard molodetz/net_guard.py; used by link_check.py (admin repo-link check)
mistune (GFM) server-side, emoji as shortcode source	MET	molodetz/rendering.py; molodetz/emoji_builder.py writes static/js/generated/EmojiMap.js from the emoji library
Pillow, imagehash	MET	molodetz/gallery.py: webp thumbnails as blobs in data/uploads, perceptual-hash dedupe
pypdf	MET	molodetz/cli/commands.py posts import reads .pdf; unit test tests/unit/cli/commands.py
sqlglot	MET	molodetz/database/sql_lint.py parses every raw SQL literal; molodetz system sql-lint; tests/unit/database/sql_lint.py
defusedxml	MET	routers/seo.py sitemap self-check, link_check.py XML titles; tests parse sitemap with it
beautifulsoup4 + lxml	MET	rendering.py (media pass, plain text), docs_search.py, link_check.py
uuid_utils (uuid7)	MET	database/core.py generate_uid(); blob sharding on the uuid7 tail
brotli, zstandard	MET	services/backup.py archive codecs (zstd default, brotli option)
aiofiles	MET	routers/admin/backups.py streams the backup download
python-dotenv, one load_dotenv()	MET	only in molodetz/config.py
locust	MET	locustfile.py, make locust / make locust-headless
playwright (direct API) + Chromium	MET	tests/conftest.py fixtures, no pytest-playwright plugin
pytest, no xdist, no pytest-playwright	MET	pyproject.toml addopts -p no:xdist

Section 1.2 Frontend choices

Choice	Status	Where / how
Pure ES6 modules, one class per file, OO, relative imports, no NPM/bundler	MET	molodetz/static/js/**; Application.js imports components/index.js first; window.app
marked (live content only)	MET	static/vendor/marked.esm.js, used only by dp-content in the editor preview
DOMPurify	MET	static/vendor/purify.es.mjs; fail-closed in utils/ContentRenderer.js; e2e asserts script/javascript:/onclick are stripped
highlight.js	MET	static/vendor/highlight.es.min.js via dp-code
Scripts loaded with type="module"	MET	templates/base.html and page blocks
Hand-written token-driven CSS	MET	static/css/variables.css tokens + per-area sheets; breakpoints exactly 360/480/768/1024 (gate 2)
Optional libs chromadb, weasyprint, cairosvg, faker	MET (not used)	their modules are not selected and the libs are not dependencies

Section 1.3 Bans

Ban	Status	Evidence
No JWT, OAuth/social login, payments, ads, tracking	MET	session cookie + API key only; swagger_ui_oauth2_redirect_url=None; no external scripts (CSP in main.py); test tests/unit/main.py
No JS framework, bundler, transpiler	MET	no package.json; vendored ESM files only
No async DB driver, no threadpool around DB	MET	sync dataset; asyncio.to_thread only for PBKDF2, archive build, DNS
No bare HTTP client	MET	gate 3: client constructions only in stealth.py and curl_transport.py
No hardcoded /static/	MET	gate 5 on templates; static_url() in molodetz/assets.py (also used for the OG image); API test checks rendered HTML

Section 33.1 Structural gates

#	Gate	Status	Where
1	Template env in one file	MET	molodetz/gates.py, tests/unit/gates.py, make check-ui
2	Breakpoints equal closed set	MET	same
3	HTTP client allowlist	MET	same (allowlist: stealth.py, curl_transport.py)
4	Client-render marker allowlist	MET	same (only admin/post_form.html)
5	No bare /static/	MET	same
6	No manual is-loading outside LoadingButton.js	MET	same
7	No em-dash characters or entities	MET	gates.gate_em_dashes + DPP gate_emdash
8	json_error status-first (AST)	MET	gates.gate_json_error_order + DPP gate
9	Reportable/unreportable partition	MET	tests/unit/constants.py (reportable set is empty because section 18 is not selected)
10	Documented auth equals real auth for anon/member/admin	MET	tests/api/docs/api.py over every endpoint in molodetz/docs_api; plus tests/unit/docs_api/registry.py (every product route is documented)
11	Index plans use the index, no temp b-tree	MET	tests/unit/database/init_db.py (EXPLAIN QUERY PLAN for the main read paths)
12	Full suite green, three tiers, one pass	MET	out/pytest-full.log

Section 33.2 Architectural gates

#	Gate	Status	Note
1	Four faces	PARTIAL	HTML, JSON (respond(..., model=)), docs registry: yes. Assistant face skipped because section 16 is not selected
2	Soft-delete reads/inserts	MET	deleted_at IS NULL filters; inserts write deleted_at/deleted_by
3	Cache versions	MET	cache_state version sync for auth/settings; display caches have TTL env pins
4	Role writes invalidate admin cache	MET	database/users.set_role
5	File mutations guard writability	MET	blob writer and backup paths under DATA_PATHS
6	Outbound through the guarded factory	MET	stealth.guarded_async_client
7	Side effects through funnels	MET	utils/audit.py, utils/notifications.py, services/queue.py
8	Destructive assistant tools gated	N/A	no assistant
9	Personal data disclosed	MET	templates/privacy.html covers join requests, sessions, visit counts
10	Events catalogued	MET	events.md
11	Section 31 features	N/A	no value, state-machine or multi-path features (31 not selected)
12	Production data untouched	PARTIAL	the app only writes its own data/; hooks/prod_guard.py exists but cannot be wired into this agent runtime
13	Tree matches SELECTION.md	MET	DPP gate_selection_vs_tree PASS

Other conventions checked

• Layout (section 2): routers and tests/api, tests/e2e mirror URL paths; tests/unit mirrors module paths; cli/main.py; routers/__init__.py does not aggregate; the admin package aggregates on its base router.
• Config (section 3): DATA_PATHS registry, ensure_data_dirs(), APP_VERSION via tomllib, BOOT_ID/STATIC_VERSION, make prod exports MOLODETZ_STATIC_VERSION. The pre-commit hook bumps the patch version (seen working: 1.0.0 to 1.0.4).
• Secrets: the admin password comes only from .env (mode 600, generated randomly, not in git). .env.example has no secrets.
• Browser tests use wait_until="domcontentloaded" on every goto and wait_for_url, and check for horizontal overflow on mobile.
• Makefile (27.1): venv stamp, PYTHONDONTWRITEBYTECODE=1, dev/prod/test matrix, check-ui, preflight, coverage*, locust*, prune/prune-dry-run, tree/tree-loc/zip/delete-pyc/clean.

Not met or narrowed (honest list)

1. Docker, nginx sidecar, instance, docker-* and deploy make targets: not shipped. Section 28.2 is not selected (bare metal only), and deploy would push to a remote, which was not requested.
2. Assistant face (8.2 item 3) and action catalogue: skipped (section 16 not selected).
3. Presence is the CORE subset and works by polling /presence/roster (20 s) plus server-side touch throttling. There is no WebSocket relay; the rest of section 17 is deferred in SELECTION.md.
4. There is no public signup. The only account is the env-bootstrapped admin (retoor), so the birth-date/terms signup flow and its shared e2e helper do not exist. Terms acceptance exists (/terms/accept, TermsGate.js).
5. Votes, reports, comments, maturity partials and the report dialog are absent (sections 18 and 20.2 not selected). The JobPoller, OptimisticAction, StickyScrollPane and emoji picker front-end modules are not built, because no selected feature needs them.
6. Mutation routes parse bodies with a shared json_or_form(request, Model) helper (form or JSON into one Pydantic model) instead of Annotated[Model, Form()]. Validation is equivalent; the signature style differs.
7. The repo-link check on join requests runs inline in the admin request, not as a durable job (section 14.4 not selected).
8. The notification type registry has 6 types (join, backup, system and similar), not the about 20 the template lists for bigger products.
9. .coveragerc uses parallel = True. The template text says "no parallelism", but subprocess coverage of the server (also required there) only works with per-process data files that are then combined. With parallel = False the server data was overwritten (47% instead of 76%).
10. hooks/prod_guard.py (28.3) is present but not wired into any agent hook runner on this box.
11. Web lock (web.lock) path is defined but unused: there is a single web role and services run under service.lock. A suspension check exists in auth, but there is no UI to suspend accounts.
12. fuser is not installed on the box, so locust-run port cleanup is skipped there (the - prefix ignores it).