core.assets Roadmap

Living task list for core.assets — the public asset CDN of the UNVRSL ecosystem.

Current State (audit 2026-07-17, amended 2026-07-19)

Architectural position (clarified 2026-07-17): core.assets is a public CDN — NOT routed through core.console, no API keys, no project scoping. Direct anonymous access (CORS *). It serves static reusable content only: branding, iconography, typography, design tokens, JS utilities.

Explicitly NOT its concern: user data. Avatars/profile images are user content → stored in S3 via core.storage (which IS a console-tied microservice). The User Circle belongs to core.auth's frontend (served from core.auth's own domain, where session context lives).

Status: live and functional. The core serving layer is complete and HTTP-verified. Remaining work is content completion and trust-registry polish.

Built & live-verified

Piece	State

AssetRouter.php	✅ Filesystem walk, type aliases, version resolution, ?list, traversal guard
public/assets.php	✅ CORS, ETag/304, cache policy (immutable explicit / 60s alias), .gz serving, query+path styles
.htaccess	✅ Routing + CORS + no listing
Design system v1	✅ standards (380 lines: tokens/reset/utils), ui (666 lines: components incl. modal/toast), layouts (237)
ui.js	✅ 343 lines — UNVRSL.popup/toast/alert, live-served
Iconography	✅ 8 icons (checkmark, document, toast×5, x)
Branding	✅ universal vector_logo v1–v3 + regional/project-alpha example
suite.json + check.php	✅ Registry + trust-checker logic written

Stubs / gaps

• logic/datetime/v1.js — 0 bytes, empty stub


• typography/ — documented in L2/README but folder doesn't exist yet


• other/test.txt — leftover test file

Dependencies

Depends On

For

core.backend	DocumentShell consumes /design/* + ui.js URLs
Plesk/Apache	.htaccess routing, CORS

(None else — by design. Not tied to core.console.)

Current Sprint

• [ ] check.php execution model — the trust checker is currently served as a downloadable file, which is useless. Add a router exception that executes whitelisted logic/**/check.php-style endpoints and returns their JSON output, without turning core.assets into a general PHP host.


• [ ] suite.json rewrite — current registry is stale (wrong module descriptions, e.g. hypermedia listed as "API gateway"). Rewrite accurately now; a console-generated registry can replace it later (read-only consumption — assets stays public).


• [ ] composer.json — fill in real metadata (name, description, PSR-4 autoload for src/).


• [ ] Cleanup — remove other/test.txt.

Backlog

Phase 1: Content Completion

• [ ] typography/ folder — create per L2 (serif / sans-serif / monospace / misc), @font-face strategy


• [ ] logic/datetime/v1.js — implement or drop the stub


• [ ] Iconography expansion — as projects need them

Phase 2: Design System Evolution

• [ ] Token expansion driven by real project needs (auth frontend first)


• [ ] Dark-mode theming support (auth L2 requires light/dark)


• [ ] New components land in the main design CSS files (standards/ui/layouts) — no per-component CSS folders (aborted path: projects would have needed hundreds of tiny files; all styling ships in the main stylesheets requested via core.backend)

Phase 3: Registry & Trust Polish

• [ ] suite.json possibly generated from core.console's project registry (read-only; assets itself stays publicly accessible, no console round-trip for asset serving)

Completed

• [x] Filesystem AssetRouter + assets.php endpoint (ETag, cache, CORS, gzip, ?list)


• [x] Design system v1 (standards, ui, layouts)


• [x] ui.js popup/toast/alert library


• [x] Branding v1–v3 + iconography set


• [x] suite.json + trust-checker logic


• [x] info.md canonical for version pins (2026-07-19) — ?version=stable/latest read pins from info.md frontmatter; legacy stable.md kept as fallback; L2 + README updated


• [x] Button component CSS deleted (2026-07-19) — aborted per-component path; all styling in main design CSS via core.backend