Open Tasks

Done this session

- [x] Fixed `auth.php` — removed hardcoded `register` app reference, now
reads `APP_ROOT . '/.env'` dynamically; added `BOOTSTRAP_LOADED`
runtime guard
- [x] Fixed `paths.php` — added `BOOTSTRAP_LOADED` marker for the guard above
- [x] Created `testdb.php` (`voice/tests/testdb.php`) — tests config +
DB connectivity for a scaffolded app, never echoes `DB_PASS`
- [x] Created starter `voice.index.php` template — demonstrates the
required bootstrap order, token-replaced by `scaffold.appname.sh`
- [x] Wired both into `defapp`'s actual template tree and confirmed via a
full scaffold → lint → execute → audit test cycle
- [x] Fixed two bugs found in `audit.bootstrap.sh` itself while testing
(premature exit under `set -e`; global vs. per-app violation count)
- [x] Added `voice.index.php` and `tests/` to what `audit.bootstrap.sh`
actually checks (previously only checked `public/pages/admin/api`)

Still open

- [ ] `paths.php` still has one hardcoded fallback path
(`/Users/rbutare/websites`), used before `.env` can be loaded. Options:
derive from `__DIR__` (`dirname(__DIR__, 2)` from
`system/php/paths.php`), or explicitly document it as the one
intentional exception to Rule #1. Not yet decided or fixed.
- [ ] `docs-index.json`'s grouping schema is new — not yet validated against
a real UI consuming it; confirm the field set actually fits whatever
renders it.
- [ ] `audit.bootstrap.sh`'s hardcoded-pattern regex is a starting set
(`/Users/`, `/home/{user}/websites`, `localhost:port`, inline
`password=`) — not exhaustive; extend as new patterns turn up.
- [ ] Real `auth_login_required()` result isn't enforced anywhere yet — it's
read (in `voice.index.php`) but nothing actually blocks access
when it returns `true`. Login enforcement itself is unbuilt.
- [ ] `user_preferences` table (designed, SQL written, not yet created in
the real database)

Roadmap — setup to first line of app code

1. Decide the `paths.php` hardcoded-fallback question (above) — this is
the last known Rule #1 gap in the core bootstrap files
2. Run `audit.bootstrap.sh --all --strict` against every real app
(`register`, `aiwizard`, `family-tree`, etc.) to find any existing
violations before converting them to v2
3. Convert remaining active apps to the v2 structure using the same
process validated on `defapp` (see `defapp.install.sh` from earlier, or
re-scaffold + migrate content for apps not yet touched)
4. Generate manifests for all existing apps (`manifest.sh -n {app}` for
each), then `manifest.sh -g` once to produce the first real
`project.registry.json`
5. Build real login enforcement — `auth_login_required()` currently
only reports a flag; wire it to the `user_groups` schema and an actual
session check
6. Create the `user_preferences` table in the live database
7. Scaffold the first genuinely new app end to end with
`scaffold.appname.sh`, confirm `testdb.php` connects to a real database
(not just "driver not found" like the sandbox test), and treat that as
the point where standard-setup work ends and actual app coding begins