HiveGrid-Wireframes/hivegrid-cloud/docs/feature-manifests/core.json

{
  "schemaVersion": "1.0",
  "id": "core",
  "title": "Minimal Boilerplate Core",
  "classification": "core",
  "status": "proposed",
  "owner": "core-pruning",
  "description": "Umbrella manifest for features that remain in the default ToolCTRL boilerplate after pruning.",
  "rationale": [
    "The boilerplate must support authenticated SaaS operation without marketing, CRM, AI, or support-product assumptions.",
    "Core should preserve web app and admin shells, auth, tenant membership, database/runtime primitives, transactional email, and minimal billing."
  ],
  "codeAreas": [
    "apps/web/app/routes/login.tsx",
    "apps/web/app/routes/register.tsx",
    "apps/web/app/routes/app.$tenant*",
    "apps/web/app/routes/admin*",
    "apps/web/app/modules/users",
    "apps/web/app/modules/rows",
    "packages/db",
    "packages/create-toolctrl",
    "server/server.ts",
      "prisma",
      "prisma/migrations/20260527035000_04_api_key_log_tenant_scope",
      "prisma/migrations/20260527035500_04_runtime_query_indexes",
      "prisma/migrations/20260528090400_outbox_done_retention_index",
      "apps/web/app/modules/emails",
    "packages/mail",
    "scripts/verify-source-health.mjs",
    "scripts/verify-route-inventory.mjs",
    "scripts/verify-bundle-size.mjs",
    "apps/web/app/application/pricing",
    "apps/web/app/components/core/pricing",
    "packages/entitlements/src/blueprints.ts",
    "packages/entitlements/src/product-access.ts"
  ],
  "dependencies": [
    "auth-tenancy",
    "rows-entities-runtime",
    "billing",
    "transactional-mail",
    "admin-app-shell",
    "product-core"
  ],
  "consumers": [
    "plugin-candidates",
    "remove-candidates"
  ],
  "integration": {
    "ownership": "system-only",
    "surfaces": {
      "adminRoutes": [
        "apps/web/app/routes/admin*"
      ],
      "tenantRoutes": [
        "apps/web/app/routes/app.$tenant*"
      ],
      "publicRoutes": [
        "apps/web/app/routes/login.tsx",
        "apps/web/app/routes/register.tsx"
      ],
      "apiRoutes": [
        "apps/api/src/app.ts",
        "apps/api/src/routes/*.ts",
        "/healthz",
        "/readyz",
        "/v1/health",
        "/v1/openapi.json",
        "/v1/docs",
        "/v1/api-keys/validate",
        "/v1/usage"
      ]
    },
    "configuration": {
      "admin": [
        "Platform defaults required by retained core features"
      ],
      "tenant": [
        "Tenant settings required by retained app flows"
      ],
      "environment": [
        "DATABASE_URL",
        "SESSION_SECRET",
        "APP_BASE_DOMAIN",
        "WEB_APP_HOST",
        "ADMIN_APP_HOST",
        "API_HOST",
        "APP_PROTOCOL"
      ],
      "secrets": [
        "Core platform secrets are deployment-owned."
      ]
    },
    "workers": {
      "required": false,
      "queues": [],
      "jobs": [
        "cleanup.run:outbox-done-retention",
        "cleanup.run:workflow-execution-stalled-reconcile"
      ],
      "notes": [
        "Core stays worker-optional locally; staging/production worker-general owns outbox dispatch, DONE-row retention, and conservative repair of queued manual/API workflow executions whose initial outbox dispatch failed."
      ]
    },
    "externalProviders": [],
    "permissions": [
      "admin.*",
      "app.*"
    ],
    "auditEvents": [
      "core.configuration.updated"
    ],
    "billingImpacts": [
      "Depends on billing manifest for subscription behavior."
    ],
    "uat": [
      "A new project can run auth, tenant shell, admin shell, database, mail, billing, and the CRM SaaS Product Core blueprint.",
      "The local scaffold CLI can generate core, saas, and full workspace profiles without copying secrets or build artifacts.",
      "The Node web runtime emits baseline security headers, including CSP frame-ancestor/object restrictions and HTTPS HSTS.",
      "Source-health and route-inventory gates keep the API composition file and web route growth within reviewed budgets."
    ]
  },
  "boundaries": {
    "mustKeep": [
      "Authentication and account recovery",
      "Tenant membership and role/permission enforcement",
      "Tenant app shell and admin shell",
      "Prisma-backed persistence foundation",
      "Transactional email required by auth and tenant operations",
      "Minimal subscription and pricing foundation"
    ],
    "mayMoveToPlugin": [
      "Product-specific admin dashboards",
      "Advanced entity builder UI",
      "Provider-specific adapters beyond the selected defaults"
    ],
    "mustNotTouch": [
      "Application routes and navigation during manifest Phase 1",
      "Chatbot, affiliate, and marketing code owned by parallel workers"
    ]
  },
  "pruning": {
    "phase": "1",
    "action": "keep",
    "notes": [
      "This manifest defines the target default surface, not an implementation change.",
      "Use the child manifests for more precise dependency and boundary checks."
    ]
  },
  "validation": {
    "source": [
      "docs/feature-inventory.md",
      "docs/architecture-migration-status.md",
      "BOILERPLATE-PLAN.md",
      "prisma/schema/core.prisma",
      "prisma/schema/outbox.prisma",
      "prisma/schema/plugins.prisma",
      "prisma/schema/ai.prisma"
    ],
    "lastReviewed": "2026-05-29"
  }
}