core.backend Roadmap
core.backend Roadmap
Living task list for core.backend — the Composer SDK that applications install to talk to the UNVRSL platform.
Current State (audit 2026-07-17)
Built:
DocumentShell(htmlTemplateInit) — config-driven HTML document shell with automatic core.assets injection (standards, ui, layouts css + ui.js)- Composer package:
unvrsl/core-backend, PSR-4UNVRSL\Core\→src/ - README with Plesk installation instructions
Stubbed (empty files):
bootstrap/init.php— autoloaded globally, 0 bytessrc/datetime/datetime-parsers.php— placeholder for datetime utilities
Not started:
- API client (the SDK's core purpose): no Client class, no request signing, no service wrappers
→ Full code inventory: core.backend Code Reference
Dependencies
| Depends On | For |
| core.console | API gateway endpoint, key validation scheme (request signing target) |
| core.assets | Stylesheet/JS URLs injected by DocumentShell; User Circle script |
| core.auth | Session/token formats the SDK must validate |
| core.storage | First service wrapper target (browser-upload L2 flow) |
| Plesk | Composer path registration per domain (install mechanics) |
Current Sprint
- [ ] Client foundation —
UNVRSL\Core\Client: api_key + base_url config, curl transport, JSON envelope handling, timeout/retry - [ ] Request signing — HMAC-SHA256 per core.console key scheme
- [ ] Typed errors — AuthError, QuotaExceeded, NotFound, ValidationError, ServerError (no silent arrays)
- [ ] Storage wrapper (first service) —
$client->storage(): pools, objects, upload (single + transparent multipart with parallel parts per browser-upload L2), download, delete
Backlog
Phase 1: Remaining Service Wrappers
- [ ] hypermedia: process request, job status polling, job outputs
- [ ] ai: conversations, messages, SSE streaming reader (curl
CURLOPT_WRITEFUNCTION, no framework) - [ ] auth: token validation helper, session refresh for server-side apps
Phase 2: Utilities
- [ ] datetime-parsers.php — implement: ISO 8601 ⇄ MySQL datetime, timezone helpers (UTC storage ⇄ user-local display), duration/relative formatting
- [ ] bootstrap/init.php — decide purpose (env loader? error handler? constants?) or remove from autoload if unused
- [ ] DocumentShell: User Circle injection toggle (auto-inject core.assets user-circle.js when a session cookie is present)
- [ ] DocumentShell: CSP nonce support, per-page asset version pinning
Phase 3: Quality
- [ ] PHPUnit suite (unit for utils, integration vs core.console sandbox)
- [ ] Tagged releases (v0.1.0) instead of dev-main only
- [ ] Per-service usage examples in README
Completed
- [x] Composer package init with PSR-4 autoload
- [x] DocumentShell with core.assets auto-injection
- [x] Plesk installation documentation