retoor
3c4334cec9
Full C++23 framework tree: runtime, observability, security, data, app, realtime, supervisor, clients, CLI, example plus enterprise tenancy, audit, operability, governance, supplychain. Postgres via docker compose for tests.
MoloApp Detailed Plans
Index for the fifteen detailed plan files. Each file is self-contained with purpose, best practices, structure, rules, guidelines, specifications, execution steps, validation, references, open questions, and sources.
Index
| # | File | Title | Scope (one line) |
|---|---|---|---|
| 1 | 01-runtime.md | Core Runtime and HTTP Fundamentals | Event loop, lifecycle, HTTP/1.1 + HTTP/2, compression, cookies, static. |
| 2 | 02-observability.md | Observability Backbone | Logging, typed events, metrics, tracing, correlation, zero-cost gating. |
| 3 | 03-security.md | Security | TLS wolfSSL, auth, hashing/crypto, sessions, guards, upload safety. |
| 4 | 04-data.md | Data Layer | ORM dual backends, self-healing, pooling, transactions, KV, cache, pubsub. |
| 5 | 05-request-routing.md | Request/Response, Routing, Views, Templates | App, routers, views, validation/forms, negotiation, templates, middleware, DI, errors. |
| 6 | 06-realtime.md | Realtime (WebSocket, SSE, Socket.IO, Streaming, WebDAV, Client Parity) | Live protocols plus streaming plus WebDAV, every one with client parity. |
| 7 | 07-supervisor-replication.md | Supervisor, Tasks, Replication | Process supervisor, background tasks, pubsub durability, replication, multi-instance. |
| 8 | 08-clients-openapi.md | Clients, OpenAPI, Test Client | HTTP/REST client, REST standards, OpenAPI generation, test client. |
| 9 | 09-cli-ops.md | CLI Tooling, Dev Server, Operations | CLI, dev server, embedder, AI harness, health/metrics, i18n/CSP. |
| 10 | 10-workflow-example.md | Workflow, Testing Discipline, Living Example | Specs, AGENTS.md, autonomous git, integration testing, living example. |
| 11 | 11-tenancy.md | Multi-Tenancy | First-class tenants: isolation strategies, quotas, flags, per-tenant metrics. |
| 12 | 12-audit-compliance.md | Audit and Compliance | Immutable audit log, GDPR export/erasure, retention, PII marking, masking. |
| 13 | 13-operability.md | Operability at Scale | Safe deploys, drains, locks/election, breakers, deadlines, SLO, chaos, debug. |
| 14 | 14-api-governance.md | API Governance | API keys, versioning/deprecation, OpenAPI diff gate, rate tiers, surface rules. |
| 15 | 15-supply-chain.md | Supply Chain and Trust | SBOM, signed provenance, dependency policy, vuln-scan hook, release attestation. |
How files reference each other
- References always use exact sibling filenames (
01-runtime.mdthrough15-supply-chain.md). - Each file has a References section naming Depends on (interfaces it consumes) and Feeds (interfaces it provides).
- Dependency direction (consumes, upstream first):
01-runtime.mddepends on02-observability.md(hooks) and03-security.md(TLS handle); feeds05-request-routing.md,06-realtime.md,08-clients-openapi.md,09-cli-ops.md.02-observability.mddepends on01-runtime.md(lifecycle hooks); feeds04-data.md,05-request-routing.md,06-realtime.md,07-supervisor-replication.md,08-clients-openapi.md,09-cli-ops.md,10-workflow-example.md.03-security.mddepends on01-runtime.mdand02-observability.md; feeds04-data.md,05-request-routing.md,06-realtime.md,07-supervisor-replication.md,09-cli-ops.md,10-workflow-example.md.04-data.mddepends on01-runtime.md,02-observability.md,03-security.md; feeds05-request-routing.md,06-realtime.md,07-supervisor-replication.md,08-clients-openapi.md,10-workflow-example.md.05-request-routing.mddepends on01-runtime.md,02-observability.md,03-security.md,04-data.md; feeds06-realtime.md,07-supervisor-replication.md,08-clients-openapi.md,09-cli-ops.md; follows10-workflow-example.md.06-realtime.mddepends on01-runtime.md,02-observability.md,03-security.md,05-request-routing.md; feeds04-data.md(pubsub bridge),07-supervisor-replication.md,08-clients-openapi.md,10-workflow-example.md.07-supervisor-replication.mddepends on01-runtime.md,02-observability.md,04-data.md,06-realtime.md; feeds09-cli-ops.md,10-workflow-example.md.08-clients-openapi.mddepends on01-runtime.md,02-observability.md,03-security.md,04-data.md,05-request-routing.md; defers realtime clients to06-realtime.md; feeds09-cli-ops.md,10-workflow-example.md.09-cli-ops.mddepends on01-runtime.mdthrough08-clients-openapi.md; feeds10-workflow-example.md.10-workflow-example.mddepends on02-observability.md,08-clients-openapi.md,09-cli-ops.md; feeds01-runtime.mdthrough09-cli-ops.md(spec template, test discipline, release gates).11-tenancy.mddepends on01-runtime.mdthrough09-cli-ops.md(joint hardening milestone with04-data.mdbefore either file freezes); follows10-workflow-example.md; feeds12-audit-compliance.md,14-api-governance.md.12-audit-compliance.mddepends on02-observability.md,03-security.md,04-data.md,05-request-routing.md,07-supervisor-replication.md,11-tenancy.md; feeds09-cli-ops.md,10-workflow-example.md; defers exchange formats to13-operability.md, API policy to14-api-governance.md, attestation to15-supply-chain.md.13-operability.mddepends on01-runtime.md,02-observability.md,04-data.md,05-request-routing.md,06-realtime.md,07-supervisor-replication.md,08-clients-openapi.md,09-cli-ops.md; feeds09-cli-ops.md,10-workflow-example.md,12-audit-compliance.md.14-api-governance.mddepends on01-runtime.md,02-observability.md,03-security.md,04-data.md,05-request-routing.md,08-clients-openapi.md,10-workflow-example.md,11-tenancy.md; feeds09-cli-ops.md,12-audit-compliance.md,13-operability.md; parallel with07-supervisor-replication.md,15-supply-chain.md.15-supply-chain.mddepends on02-observability.md,03-security.md,09-cli-ops.md,10-workflow-example.md; feeds11-tenancy.md,12-audit-compliance.md,13-operability.md,14-api-governance.md.
Overall execution order
Build order follows plan.md section 10, with the file sequence matching dependency order:
01-runtime.mdsteps 1-10 plus02-observability.mdsteps 1-10 (plan step 1: foundation and instrumentation).03-security.mdsteps 1-10 (plan step 2: TLS, auth, guards, uploads).04-data.mdsteps 1-10 (plan step 3: drivers, ORM, sync/heal, KV/cache/pubsub).06-realtime.mdsteps 1-5 plus07-supervisor-replication.mdsteps E7-1 through E7-4 (plan step 4: realtime base, supervisor and task runner).05-request-routing.mdsteps E1-E12 plus08-clients-openapi.mdsteps 1-8 plus09-cli-ops.mdsteps 1-10 (plan step 5: app layer, clients, OpenAPI, CLI/ops).07-supervisor-replication.mdsteps E7-5 through E7-8 (plan step 6: durable streams, replication, multi-instance).10-workflow-example.mdsteps 1-8 throughout and finally (plan step 7: specs, AGENTS.md, pipeline, living example, autonomous end-to-end run).11-tenancy.mdsteps E11-1 through E11-4 jointly with04-data.md(tenant context in the data Context before the data layer hardens), then E11-5 through E11-8 with the app layer (plan step 8: multi-tenancy).12-audit-compliance.mdsteps 1-10 plus13-operability.mdsteps 1-8 (plan step 9: audit/compliance plus operability at scale).14-api-governance.mdsteps 1-8 plus15-supply-chain.mdsteps E15-1 through E15-8 (plan step 10: API governance plus supply chain and trust).
Rule: no file is done until its validation section passes through the real stack and 10-workflow-example.md rule 1 holds (spec updated, docs updated, living example demonstrates it, full suite green, same session).