[jacksteamdev]

Summary

Extract CMS into AstrologyEngine/cms and pin its v0.1.0 contract package.

web ── pinned contract tarball ── CMS release
web dev:stack ── HTTP + temporary local contract link ── sibling CMS checkout
web CI ── package source revision ── isolated CMS browser-test instances

CMS owns the Worker, D1 migrations, catalog, seed and operations docs. Web installs/builds independently; bun run dev:stack starts both checkouts with persistent local data and restores the installed contract on shutdown. CI pins the CMS source revision for browser tests.

Hosted deployment and preview creation remain gated by CMS_DEPLOY_ENABLED until setup ticket #39 is complete. Deployed builds require snapshots from their target CMS. Existing APIs, Worker bindings and database names are preserved.

Evidence

• Before: web imported apps/cms source and seed files; browser tests and review tooling required the nested service directory.
  After: contract installs from a public immutable-version release URL; CMS CI passed independently.
• CMS: 158 service tests and eight packaging/release tests; web: 17 Node tests, 36 verification tests and 65 browser tests passed. Types, lint, formatting, build and both environment dry runs passed.
• Real stack verified with a checkout path containing spaces and $, alternate ports, watched contract/seed edits, persistent edits across restart, review wrapper, competing launcher and SIGTERM restoration. Manifests and lockfiles stayed unchanged.
• A clean web clone with no sibling CMS installed, type-checked, linted and built successfully. Final CI and hosted review passed on 61068ce; the review finding is fixed and resolved.
• Disabled staging is reported in the run summary; a published web prerelease fails explicitly while the provisioning gate is disabled.
• No hosted provisioning or Cloudflare deployment was performed. CMS deploy automation is disabled; release App setup remains in #39.

Merge Danger

Door: two-way

The CMS repository and initial package already exist. Reverting web restores the nested integration; no D1 migration or data move accompanies this change.

Blast Radius: development

Build, CI and development wiring change. Hosted deployment and preview creation stay disabled until the explicit setup gate is enabled in each repository; closed-preview cleanup remains active.

[claude]

Reviewed the full diff. The extraction into the contract package, the dev-stack supervisor and lock handling, and the new CI browser job look sound. I found one issue worth addressing, noted inline.

[github-actions]

Review complete. Run log

Scope: incremental since 6139730656d817c00d9243c82764367b38019299; commit: 61068cee0c3cacaba4e3cbab171d0eaab96bf470.

[claude]

Incremental review of the diff 6139730..61068ce found no new issues. The gate job, the deploy condition and the docs change are consistent with each other.