From d2b7ba60fd06dc94bd1dcba59f4bf5f5c43a5b96 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 03:30:07 +0900 Subject: [PATCH 1/7] docs: make ScopeWeave README product-first --- README.md | 334 +++++++++++++++++++++++++----------------------------- 1 file changed, 156 insertions(+), 178 deletions(-) diff --git a/README.md b/README.md index 6340c1f4..43ed3805 100644 --- a/README.md +++ b/README.md @@ -1,200 +1,178 @@ # ScopeWeave -Schedule-control (공정관리) tool: a WBS planner with cumulative progress, EVM -(SPI·SV) + S-curve, CPM critical path, and a weekly Gantt overlay — usable in -two modes: - -- **Standalone (static)** — the original zero-dependency HTML/CSS/JS planner. - Works from any static host; data stays in `localStorage`/`wbs.json`. -- **Cloud (SaaS)** — an opt-in Node backend adds accounts + SSO, multi-tenant - workspaces, real-time collaboration, team roles, billing, baselines/history, - webhooks, and a public API. The static client is the frontend; cloud features - layer on without breaking standalone mode. - -> The SaaS pivot lands as a stacked PR train (see **Merge order** below). On -> `develop` as of this branch, only standalone mode exists. - -## Standalone features - -- Pure static runtime: HTML, CSS, JavaScript only -- 3-level WBS hierarchy (`단계 > Activity > Task`) with expand/collapse -- Inline add/edit/delete, row-click edit, and same-level drag-and-drop - subtree reorder -- Automatic day, weight, planned progress, actual progress, and weighted - progress calculations -- CSV import/export using the screen column contract -- Local autosave with optional File System Access API sync to `wbs.json` -- Weekly Gantt modal with planned (`#333333`) and actual (`#34cb03`) overlays -- Responsive column reduction for screens under 800px - -## Cloud (SaaS) features - -- **Auth**: email/password (scrypt) + JWT (7d, revocable via logout-everywhere), - SSO (OIDC + PKCE, built-in mock IdP for dev), personal access tokens (`swk_`, - hash-stored) -- **Multi-tenancy**: workspaces (orgs) with owner/admin/member/viewer roles — - enforced server-side; invites (revocable), member removal, leave, rename, - ownership transfer -- **Collaboration**: SSE live sync, optimistic concurrency (409 on stale - version), task comments -- **Schedule control**: EVM (SPI·SV) + S-curve, CPM critical path with slack, - predecessors, baselines (freeze/compare — slip table), revision history + - restore -- **PM analysis**: deterministic requirements/RFI/RFP readiness, WBS estimation - coverage, inter-event dependency risk, and procurement package section checks - from the existing WBS fields -- **Billing**: Free (2 projects / 3 members) vs Pro ₩19,000/mo — server-enforced - 402 caps; Stripe when configured, mock otherwise -- **Platform**: signed webhooks (HMAC-SHA256, retry + delivery log, secret - rotation), audit log, workspace export (JSON), cross-project search, - project duplicate (templates), rate limiting (opt-in), metrics - (JSON + Prometheus), structured logs -- **Docs**: complete API reference at [`docs/api.md`](docs/api.md) (served at - `/docs/api.md`); deploy guide at [`docs/deploy.md`](docs/deploy.md) - -## Architecture +[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/ContextualWisdomLab/scopeweave) -``` -index.html + app.js + styles.css + toast-state.css ← static client (eval-safe; no top-level imports) - ├─ analytics.js ← EVM/S-curve/CPM (window.ScopeWeaveAnalytics) - └─ cloud-sync.js ← opt-in cloud overlay (window.ScopeWeaveCloud) -server/ - ├─ server.mjs ← @hono/node-server entry (PORT, default 8787) - ├─ app.mjs ← Hono routes: auth/SSO, projects, teams, billing, - │ webhooks, baselines, revisions, comments, search… - ├─ auth.mjs ← scrypt + pinned-HS256 JWT + PAT hashing (node:crypto) - ├─ billing.mjs ← plans/caps; Stripe via dynamic import - └─ db.mjs ← node:sqlite schema (Postgres-portable) -``` +**Schedule-control workspace for building a WBS, tracking plan versus actual, and turning project structure into explainable schedule evidence.** + +ScopeWeave helps a project manager structure work, maintain planned and actual dates, inspect weighted progress, understand critical-path and earned-value signals, and share the same planning model in a lightweight browser-only workflow or an optional self-hosted server mode. + +The repository keeps those modes deliberately compatible: the standalone planner remains useful without an account or backend, while the server adds authenticated shared workspaces and API-backed collaboration for teams that need it. + +## What ScopeWeave provides + +| Need | Current product capability | +| --- | --- | +| Build a work breakdown structure | Three-level `단계 → Activity → Task` hierarchy with inline editing and same-level subtree reordering | +| Track schedule execution | Planned/actual dates, weighted progress, weekly Gantt overlays, and baseline comparisons | +| Understand schedule risk | CPM critical-path/slack calculations and predecessor consistency checks | +| Review delivery performance | EVM/S-curve signals including SPI and schedule variance, plus deterministic readiness analysis from plan evidence | +| Exchange planning data | CSV import/export and the user-facing `wbs.json` model | +| Work without a backend | Browser `localStorage` plus optional File System Access API synchronization | +| Collaborate through a server | Authenticated workspaces, project persistence, revision history, comments, search, SSE updates, and public API surfaces | +| Integrate adjacent services | Explicit optional contracts for `contextual-orchestrator` and Clearfolio rather than copied implementations or shared databases | -Only two runtime dependencies (`hono`, `@hono/node-server`); everything else is -Node built-ins. `node:sqlite` is for dev/self-host — swap the driver for managed -Postgres in production. +## Choose a mode -## Local development +### Standalone planner -Standalone: +The standalone application is plain HTML, CSS, and JavaScript. It can be served from any ordinary static host and keeps the working plan in the browser unless the user explicitly connects a writable `wbs.json` file. ```bash -python3 -m http.server 4173 # open http://127.0.0.1:4173 +python3 -m http.server 4173 ``` -Cloud (Node 22.13+ or 23.4+): +Open `http://127.0.0.1:4173`. + +This is the simplest way to evaluate the WBS, CSV, Gantt, CPM, EVM, baseline, and local planning flows without creating an account or running a database. + +### Self-hosted server mode + +The repository also contains a Node/Hono backend that serves the same client and adds authenticated, server-backed workspace features. Current package metadata requires Node.js `^22.13.0 || >=23.4.0`. + +Install from the lockfile and create one persistent signing secret: ```bash -npm install -# Persist this across restarts (do not re-mint every boot — that invalidates JWTs). -export SCOPEWEAVE_JWT_SECRET="${SCOPEWEAVE_JWT_SECRET:-$(openssl rand -base64 32)}" -npm run server # serves the API + the static client on :8787 +npm ci + +install -d -m 700 "$HOME/.config/scopeweave" +if [ ! -s "$HOME/.config/scopeweave/jwt-secret" ]; then + umask 077 + openssl rand -base64 32 > "$HOME/.config/scopeweave/jwt-secret" +fi +export SCOPEWEAVE_JWT_SECRET="$(cat "$HOME/.config/scopeweave/jwt-secret")" + +npm run server ``` -Docker: set a **persistent** `SCOPEWEAVE_JWT_SECRET` first, then run `docker compose up` -(see `Dockerfile.server` / `docs/deploy.md`). +Open `http://127.0.0.1:8787`. + +Do not mint a different signing secret on every restart: rotating `SCOPEWEAVE_JWT_SECRET` intentionally invalidates existing sessions. Managed deployments should keep it in the platform secret manager. + +For container deployment, use `docker compose up --build` only after supplying the same persistent secret. See [`docs/deploy.md`](docs/deploy.md) for the full deployment contract and current scaling ceiling. + +## Product boundary + +ScopeWeave owns project schedule-control behavior represented by this repository: WBS structure, plan/actual state, local and server persistence of that model, schedule analytics, project collaboration surfaces, and explicit integration adapters. + +It does **not** make every adjacent system part of its own product boundary: + +- `contextual-orchestrator` remains authoritative for model/provider routing when AI briefing is enabled; +- Clearfolio remains authoritative for its document/viewer job state when attachments are connected; +- OIDC providers remain authoritative for external identity; +- Stripe remains authoritative for live payment processing when configured; +- customer infrastructure remains authoritative for TLS termination, secrets, database topology, backup, and deployment policy. + +Unset external integrations use the repository's documented development/test behavior where one exists; a mock or deterministic fallback is not evidence that a real provider transaction occurred. + +## Standalone data model + +Every standalone mutation autosaves to browser `localStorage`. On supported Chromium-family browsers, the user can explicitly connect a writable `wbs.json` through the File System Access API and keep the same user-facing JSON schema synchronized. + +CSV import replaces the current plan using the screen column contract; CSV export produces `wbs_export_YYYYMMDD.csv`. Synthetic hierarchy wrapper rows used internally are not written into the external `wbs.json` representation. + +The user guide documents the current hierarchy, validation, save, CSV, Gantt, and PM-analysis behavior: [`docs/user-guide.md`](docs/user-guide.md). -### Environment +## Server mode and integration context -| Var | Purpose | +The self-hosted server currently uses Hono with `@hono/node-server` and `node:sqlite` for the single-node path. The deployment guide names SQLite as the development/self-host single-writer ceiling and describes managed PostgreSQL as the intended multi-instance persistence boundary rather than pretending the current SQLite path scales horizontally. + +Important optional integration settings include: + +| Setting | Purpose | | --- | --- | -| `SCOPEWEAVE_JWT_SECRET` | **Required** — JWT signing secret (at least 32 non-whitespace characters; startup fails closed otherwise) | -| `SCOPEWEAVE_DB` | SQLite path (default `data.db`; `:memory:` for tests) | -| `PORT` | API port (default 8787) | -| `OIDC_ISSUER/CLIENT_ID/CLIENT_SECRET/REDIRECT_URI` | Real SSO IdP (mock when unset) | -| `STRIPE_SECRET_KEY` | Real checkout (mock URL when unset) | -| `SCOPEWEAVE_RATE_LIMIT_MAX` (+`_WINDOW_MS`) | Opt-in per-IP rate limiting | -| `SCOPEWEAVE_DEV=1` | Dev-only endpoints (activate-pro) | +| `SCOPEWEAVE_JWT_SECRET` | Required server-mode session signing secret | +| `SCOPEWEAVE_DB` | SQLite path for the current single-node server path | +| `OIDC_ISSUER`, `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET`, `OIDC_REDIRECT_URI` | External OIDC identity provider | +| `STRIPE_SECRET_KEY`, `STRIPE_PRICE_ID`, `STRIPE_WEBHOOK_SECRET` | Live billing integration | +| `ORCHESTRATOR_URL`, `ORCHESTRATOR_TOKEN` | `contextual-orchestrator` integration | +| `CLEARFOLIO_URL`, `CLEARFOLIO_HMAC_SECRET` | Clearfolio integration | +| `SCOPEWEAVE_RATE_LIMIT_MAX`, `SCOPEWEAVE_RATE_LIMIT_WINDOW_MS` | Optional per-IP fixed-window rate limiting | + +Development mock paths for billing or identity are not production configuration. See [`docs/deploy.md`](docs/deploy.md), [`docs/api.md`](docs/api.md), and [`docs/orchestrator-production.md`](docs/orchestrator-production.md) before enabling external integrations. + +## Architecture at a glance + +```text +Browser + | + +---- standalone -----------------------+ + | | + | localStorage / optional wbs.json | + | | + +---- self-hosted server ---------------+ + | + v + ScopeWeave API + auth · workspace · project + schedule · history · collaboration + | + +---- node:sqlite (single-node path) + | + +---- explicit external adapters + OIDC / Stripe / orchestrator / Clearfolio +``` + +The static client remains intentionally evaluable without top-level module imports; optional browser modules bridge through the documented `window.ScopeWeave*` contracts. Server and provider concerns stay behind their own interfaces rather than being copied into the standalone planner. + +## Security and trust boundaries + +The current server path uses a configured signing secret, scrypt password handling, hash-stored personal access tokens and webhook secrets, server-side workspace authorization, and optional rate limiting. Secrets must not be logged or committed. -## Verification +A successful local calculation, mock provider path, API response, or test result is evidence only for the operation it actually performed. It does not prove an external IdP authenticated a person, Stripe completed a payment, Clearfolio finished a document job, or an AI provider produced a result unless the corresponding integration evidence says so. + +Read [`docs/security.md`](docs/security.md) and the operational/deployment documentation before exposing server mode beyond a local evaluation environment. + +## Verify the source + +Install from the checked-in lockfile: ```bash -npm run test:api # API smoke (auth, tenancy, RBAC, billing, webhooks, …) + rate limit -npm run test:unit # EVM/S-curve, CPM, baseline-compare (pure math) -npm run test:e2e # Playwright UI suite -python3 -m pytest tests/config +npm ci ``` -`app.js` must stay eval-safe (no top-level `import`/`export`) — the e2e harness -evaluates it with `new Function`. Optional modules bridge via `window.*` globals. - -## Merge order (SaaS PR stack) - -`#233` first — it fixes pre-existing infra misconfigs that fail the required -`trivy-fs` gate on **every** PR. Then the stack in order (each PR is based on -the previous; merging in order auto-retargets the next): - -| Order | PR | Slice | -| --- | --- | --- | -| 0 | #233 | fix(ci): trivy-fs misconfigs (Dockerfile HEALTHCHECK, k8s uid/gid + namespace) | -| 1 | #212 | multi-tenant backend foundation (auth·projects·SSE·isolation) | -| 2 | #214 | client wiring (login UI, cloud save, live sync) | -| 3 | #215 | EVM (SPI·SV) + S-curve | -| 4 | #216 | teams + RBAC | -| 5 | #217 | billing + plan gating | -| 6 | #218, #219 | CPM engine + UI | -| 7 | #220 | public API + PAT | -| 8 | #221 | predecessors (editor + CSV) | -| 9 | #222 | Dockerfile + compose | -| 10 | #223 | landing page | -| 11 | #224 | audit log | -| 12 | #225 | workspace export | -| 13 | #226 | onboarding (샘플로 시작) | -| 14 | #227 | observability (metrics + logs) | -| 15 | #228 | signed webhooks | -| 16 | #230 | English landing (i18n) | -| 17 | #231 | SSO (OIDC) | -| 18 | #232 | webhook retry + delivery log | -| 19 | #234 | lifecycle (delete project / change pw / delete account) | -| 20 | #236 | baselines | -| 21 | #237 | rate limiting | -| 22 | #238 | create workspaces | -| 23 | #239 | baseline-vs-actual comparison UI | -| 24 | #240 | project duplicate | -| 25 | #241 | Prometheus metrics | -| 26 | #242 | webhook secret rotation | -| 27 | #243 | invite revocation | -| 28 | #244 | leave + rename workspace | -| 29 | #245 | complete API docs | -| 30 | #246 | ownership transfer | -| 31 | #247 | cross-project search | -| 32 | #248 | logout everywhere | -| 33 | #249 | revision history + restore | -| 34 | #250 | task comments | -| 35 | #251 | SEO (OG cards, hreflang, robots, sitemap) | -| 36 | (this PR) | README: architecture + merge map | - -## Repository contract - -- The static client stays static-host compatible for GitHub Pages - (standalone mode is preserved). -- Runtime dependencies are minimized (`hono`, `@hono/node-server` only, added - by the SaaS stack); CI/dev-only automation under `.github/`, `scripts/`, - `tests/`, and `docs/` is allowed. -- OpenCode Review, Strix Security Scan, and PR Review Merge Scheduler are - inherited from the organization-level required workflows in - `ContextualWisdomLab/.github`, not copied into this repository. - -## Persistence model - -- Standalone: every mutation autosaves to `localStorage`; `wbs.json` seeds - static hosting; File System Access API can sync a writable `wbs.json`. -- Cloud: projects live server-side with versioned saves (last 20 revisions), - SSE fan-out to collaborators, and offline fallback to the standalone model. -- Synthetic hierarchy wrapper rows generated from imported flat records are - excluded from external `wbs.json` sync so the saved JSON remains in the - user-facing schema. -- Requirements/RFI/RFP and WBS-estimation analysis is computed locally from the - single `tasks` array. It is a readiness signal over evidence already present - in the plan, not an external estimator or LLM judgment. - -## Security workflow - -- Organization required workflows provide OpenCode Review, Strix Security - Scan, PR Review Merge Scheduler, failed-check explanation, and coverage - evidence. -- Repository-local workflows remain for ScopeWeave-specific static delivery - and companion SCA lanes, including dependency review, OSV, Trivy, - Scorecard, and Pages. -- Server hardening: pinned-HS256 JWT (no header-alg trust), scrypt passwords, - hash-only PAT/webhook-secret storage (secrets shown once), server-side RBAC, - secrets never logged. - -See `docs/user-guide.md` for operator guidance and `docs/api.md` for the API. +Then run the repository's current verification paths: + +```bash +npm run test:api +npm run test:unit +npm run test:e2e +npm run test:fuzz +``` + +The repository also contains targeted configuration and security evidence under `tests/` and organization-required security workflows. A green source revision is engineering evidence for that exact revision; it is not a release, deployment, customer, or commercial claim. + +## Current maturity + +The current package metadata is `1.0.0` and the repository is private-package marked for npm, but **there is no published GitHub release**. The source checkout contains both standalone and server-mode implementation; the old stacked-PR merge train is historical development context and no longer belongs on the customer landing page. + +Treat source version metadata, development mocks, successful checks, and documentation as distinct from release publication and production deployment evidence. + +## Documentation map + +- [`docs/user-guide.md`](docs/user-guide.md) — standalone planner workflow, storage, CSV, validation, Gantt, and PM analysis. +- [`docs/api.md`](docs/api.md) — current server API contract. +- [`docs/deploy.md`](docs/deploy.md) — self-hosted deployment, secrets, persistence, TLS, and scaling guidance. +- [`docs/security.md`](docs/security.md) — security and trust-boundary guidance. +- [`docs/orchestrator-production.md`](docs/orchestrator-production.md) — production-oriented orchestrator integration. +- [`docs/operations/`](docs/operations/) — operator procedures and evidence. +- [`docs/research/`](docs/research/) and [`docs/doctoring/`](docs/doctoring/) — research/standards traceability. + +## Contributing + +Keep standalone mode usable without a server and keep server-only behavior behind explicit boundaries. Changes to schedule mathematics, authentication, tenant isolation, persistence, billing, provider calls, or externally visible APIs should update their tests and documentation together. + +Do not move merge queues, agent workflow instructions, or internal PR-stack maps back into the customer README. Those are contributor/governance concerns, not product value. + +## License + +ScopeWeave is licensed under the [MIT License](LICENSE). Third-party Node packages, provider APIs, external services, and other dependencies retain their own license and service terms and are not relicensed by ScopeWeave. From 7883206f96b3c4c0cd12a4cd334fe70d602e9b22 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 10:35:01 +0900 Subject: [PATCH 2/7] docs: fold public Pages hub into README lane --- docs/index.html | 66 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 docs/index.html diff --git a/docs/index.html b/docs/index.html new file mode 100644 index 00000000..2cc3bf6b --- /dev/null +++ b/docs/index.html @@ -0,0 +1,66 @@ + + + + + + + ScopeWeave Docs + + + +
+

ScopeWeave

+

Schedule-control WBS planning that works as a standalone static planner and as a Cloud/SaaS workspace over the same planning model.

+ +
+ Open planner + GitHub repository + Releases + Ask DeepWiki +
+ +

Publication truth: this documentation hub describes capabilities present on protected develop. Open pull requests and planned migrations are not shipped product evidence until integrated and revalidated.

+ +

Product responsibility

+

ScopeWeave owns schedule-control planning, WBS hierarchy and editing, deterministic schedule analysis, portable project data, and the optional authenticated cloud collaboration layer. Standalone operation remains a product invariant: cloud capabilities must not make local planning depend on a server, database, credential, or model.

+

Protected develop includes the static planner plus a Node/Hono Cloud/SaaS runtime with account, tenant, collaboration, billing/entitlement, audit, search, integration, and observability surfaces. The current protected persistence profile uses Node SQLite; planned PostgreSQL work is not described here as already shipped.

+ +

Start here

+
+ User guidePlan, edit, analyze, import/export, and use the planner. + API referenceCloud/SaaS endpoints and integration contracts. + Deployment guideRuntime configuration and deployment boundaries. + Security notesAuthentication, tenancy, secrets, and fail-closed expectations. + ArchitectureAs-built authority, trust boundaries, and service composition. + ChangelogProtected product changes and unreleased work classification. +
+ +

Architecture at a glance

+

The static browser planner owns the canonical standalone interaction model. cloud-sync.js adds an optional authenticated cloud overlay. The server layer owns cloud HTTP/API composition, authentication, tenancy, current SQLite persistence, billing boundaries, document integration, bounded attachment refresh, and contextual-orchestrator integration. Cross-service systems are consumed through explicit APIs/adapters rather than shared application databases.

+ +

Onboarding

+

For a no-server evaluation, open the planner on this Pages site or serve the repository with a local static HTTP server. For the Cloud/SaaS profile, install the pinned Node dependencies, provide a durable JWT signing secret, run the server, and follow the deployment guide before exposing the service. Integration consumers should start with the API reference and keep tenant and authorization decisions server-owned.

+ +

Verification and release boundary

+

Repository-native unit/API, browser, coverage, fuzz, dependency, OSV, and security workflows plus organization-required protected checks form the integration evidence. Pending, skipped, cancelled, failed, stale, predecessor-head, or model-only evidence is not equivalent to a passing current revision. Published releases remain distinct from active pull-request behavior.

+ +
ScopeWeave is maintained by ContextualWisdomLab. This Pages hub complements the interactive planner rather than replacing it.
+
+ + From 62dfd3523428ef4aba47964b19ae9f5cadb423eb Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 10:35:11 +0900 Subject: [PATCH 3/7] docs: stage product documentation hub on Pages --- .github/workflows/pages.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 8b0fba65..c8858acb 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -30,11 +30,11 @@ jobs: with: enablement: true - - name: Stage runtime files + - name: Stage runtime and documentation files run: | mkdir -p _site/docs cp index.html 404.html app.js cloud-sync.js analytics.js styles.css toast-state.css wbs.json _site/ - cp docs/user-guide.md _site/docs/ + cp docs/index.html docs/user-guide.md docs/api.md docs/deploy.md docs/security.md _site/docs/ - name: Upload static artifact uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 From f43d7f0b76b8dbc39d267316de6aa81c143c39dc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 09:10:27 +0900 Subject: [PATCH 4/7] docs: use shared styles and rendered guide links --- docs/index.html | 28 ++++++---------------------- 1 file changed, 6 insertions(+), 22 deletions(-) diff --git a/docs/index.html b/docs/index.html index 2cc3bf6b..e08380f6 100644 --- a/docs/index.html +++ b/docs/index.html @@ -5,25 +5,9 @@ ScopeWeave Docs - + - +

ScopeWeave

Schedule-control WBS planning that works as a standalone static planner and as a Cloud/SaaS workspace over the same planning model.

@@ -43,10 +27,10 @@

Product responsibility

Start here

- User guidePlan, edit, analyze, import/export, and use the planner. - API referenceCloud/SaaS endpoints and integration contracts. - Deployment guideRuntime configuration and deployment boundaries. - Security notesAuthentication, tenancy, secrets, and fail-closed expectations. + User guidePlan, edit, analyze, import/export, and use the planner. + API referenceCloud/SaaS endpoints and integration contracts. + Deployment guideRuntime configuration and deployment boundaries. + Security notesAuthentication, tenancy, secrets, and fail-closed expectations. ArchitectureAs-built authority, trust boundaries, and service composition. ChangelogProtected product changes and unreleased work classification.
From ce089cdfba9450c4690759c1228feaaa637c8b69 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 09:10:28 +0900 Subject: [PATCH 5/7] style: share documentation hub rules --- styles.css | 83 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) diff --git a/styles.css b/styles.css index 9d715f00..3374da34 100644 --- a/styles.css +++ b/styles.css @@ -1110,3 +1110,86 @@ tbody tr.cpm-critical { background: rgba(234, 88, 12, 0.04); } .pm-recommendations li + li { margin-top: 4px; } + + +/* Documentation hub */ +.docs-hub { + line-height: 1.6; +} + +.docs-hub main { + max-width: 920px; + margin: 0 auto; + padding: 48px 24px 72px; +} + +.docs-hub h1 { + margin: 0 0 20px; + font-size: clamp(2.2rem, 7vw, 4.6rem); + line-height: 1; + letter-spacing: -0.04em; +} + +.docs-hub h2 { + margin-top: 42px; +} + +.docs-hub .lede { + max-width: 760px; + font-size: 1.18rem; +} + +.docs-hub .status { + margin: 28px 0; + padding: 12px 16px; + border-left: 4px solid currentColor; + opacity: 0.86; +} + +.docs-hub .grid { + display: grid; + grid-template-columns: repeat(auto-fit, minmax(230px, 1fr)); + gap: 14px; + margin: 22px 0; +} + +.docs-hub .card { + display: block; + padding: 18px; + border: 1px solid currentColor; + border-radius: 14px; + text-decoration: none; +} + +.docs-hub .card strong { + display: block; + margin-bottom: 6px; +} + +.docs-hub .card span { + opacity: 0.75; +} + +.docs-hub .actions { + display: flex; + flex-wrap: wrap; + gap: 12px; + margin: 28px 0; +} + +.docs-hub .actions a { + padding: 9px 14px; + border: 1px solid currentColor; + border-radius: 999px; + text-decoration: none; +} + +.docs-hub code { + font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; +} + +.docs-hub footer { + margin-top: 56px; + font-size: 0.95rem; + opacity: 0.72; +} From 6fa08b0a6ab149876a73c64318343a3c0ad65aec Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 09:10:30 +0900 Subject: [PATCH 6/7] ci: publish rendered documentation entry point --- .github/workflows/pages.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index c8858acb..b3e3511c 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -34,7 +34,7 @@ jobs: run: | mkdir -p _site/docs cp index.html 404.html app.js cloud-sync.js analytics.js styles.css toast-state.css wbs.json _site/ - cp docs/index.html docs/user-guide.md docs/api.md docs/deploy.md docs/security.md _site/docs/ + cp docs/index.html _site/docs/ - name: Upload static artifact uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 From 59fd484c5b7b5d7efb56289fc5ea20ddebaa1c4e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 7 Sep 2026 09:30:36 +0900 Subject: [PATCH 7/7] fix(docs): satisfy Stylelint color keyword case --- styles.css | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/styles.css b/styles.css index 3374da34..a04f1503 100644 --- a/styles.css +++ b/styles.css @@ -1142,7 +1142,7 @@ tbody tr.cpm-critical { background: rgba(234, 88, 12, 0.04); } .docs-hub .status { margin: 28px 0; padding: 12px 16px; - border-left: 4px solid currentColor; + border-left: 4px solid currentcolor; opacity: 0.86; } @@ -1156,7 +1156,7 @@ tbody tr.cpm-critical { background: rgba(234, 88, 12, 0.04); } .docs-hub .card { display: block; padding: 18px; - border: 1px solid currentColor; + border: 1px solid currentcolor; border-radius: 14px; text-decoration: none; } @@ -1179,7 +1179,7 @@ tbody tr.cpm-critical { background: rgba(234, 88, 12, 0.04); } .docs-hub .actions a { padding: 9px 14px; - border: 1px solid currentColor; + border: 1px solid currentcolor; border-radius: 999px; text-decoration: none; }