8054c1e1e4
- Environment-split settings: base/local/test/prod with django-environ - Postgres + Redis + Celery wiring (broker, beat, result backend) - All 9 domain app stubs: accounts, courses, cms, tracking, quizzes, training, certificates, reports, notifications - api app: /healthz/ endpoint, custom DRF exception handler, SecurityAuditMiddleware, permissions/throttle/upload-validation stubs - DRF global baseline: JWT+session auth, closed-by-default permissions, cursor/page pagination, drf-spectacular schema generation - Dockerfile (multi-env build arg), docker-compose.yml (local), docker-compose.test.yml (CI-friendly tmpfs Postgres) - pytest.ini with smoke + settings marker definitions - tests/test_smoke.py: startup, URL resolution, healthcheck shape - tests/test_settings_matrix.py: per-profile security assertions - .github/workflows/ci.yml: test, lint, schema CI jobs - .env.example with all required vars documented - .gitignore Co-Authored-By: Paperclip <noreply@paperclip.ing>
3.8 KiB
3.8 KiB
TRA-252 Point-4 Audit Matrix
Date: 2026-05-06
Source section: TRA-207 -> # 4) Django-Umsetzung (Architektur-Entwurf)
Parent decomposition: TRA-251
Mapping Rule
- Every Point-4 architecture requirement must map to >=1 executable child ticket.
- API-first and frontend-separate must be explicit in coverage notes.
Coverage Matrix
| Point-4 Requirement | Coverage Tickets | Coverage Notes |
|---|---|---|
accounts app (OIDC, profile, group->role mapping) |
TRA-253, TRA-254 | API contract/auth surface in TRA-253; domain breakdown and OIDC sync in TRA-254. |
courses app (course/module/lesson/page, enrollment, ordering) |
TRA-254 | Explicitly covered in backend domain plan A. |
cms app (rich text, media, themes, attachments) |
TRA-254, TRA-257 | Backend/domain scope in TRA-254; frontend consumption/UX planning in TRA-257. |
tracking app (heartbeat/focus events, dwell-time fulfillment, audit log) |
TRA-254, TRA-258 | Core logic ownership in TRA-254; quality gates for dwell-time correctness in TRA-258. |
quizzes app (questions/choices/attempts/grading/banks) |
TRA-255, TRA-258 | Domain/service decomposition in TRA-255; grading and reliability tests in TRA-258. |
training app (offline/blended sessions, attendance, signoff, evidence) |
TRA-255, TRA-257 | Backend state model in TRA-255; frontend trainer/dashboard execution track in TRA-257. |
certificates app (templates/render jobs/issues/verification) |
TRA-255, TRA-259 | Functional pipeline in TRA-255; security/ops hardening and async controls in TRA-259. |
reports app (aggregations, exports) |
TRA-256, TRA-257 | Backend aggregation/export architecture in TRA-256; frontend/report UI consumption in TRA-257. |
notifications app (email queue/events) |
TRA-256, TRA-259 | Event and delivery model in TRA-256; operational resilience in TRA-259. |
api app (DRF endpoints for UI/external) |
TRA-253, TRA-257, TRA-258 | API-first contract governance in TRA-253; frontend decoupled dependency gates in TRA-257; contract-test/release quality in TRA-258. |
| Dwell-time core logic | TRA-254, TRA-258 | Domain logic plus test-gate ownership established. |
| Quiz evaluation core logic | TRA-255, TRA-258 | Assessment rules and verification test strategy both mapped. |
| Training modes core logic | TRA-255, TRA-257 | Backend mode state machine + separate frontend plan tracked. |
| Certificate pipeline core logic | TRA-255, TRA-259 | Functional flow and ops/security controls both mapped. |
| OIDC group-role sync core logic | TRA-253, TRA-254 | API authn/authz contract + backend synchronization responsibilities mapped. |
| UI/frontend track (catalog/course/player/quiz/trainer/cert download) | TRA-257 | Dedicated separated frontend execution plan exists and depends on versioned API contracts. |
| Tests/quality track | TRA-258 | Unit/integration/e2e and API contract quality gates explicitly defined. |
| Operations stack (Postgres/Redis/S3/Celery/Nginx/Docker/Nix/backups/metrics/logs/FFmpeg) | TRA-259 | Security/ops hardening issue owns operational controls and sequencing. |
API-First + Frontend-Separate Enforcement
- Backend API contracts are owned first by
TRA-253. - Frontend execution is explicitly separated in
TRA-257and gated by API contract readiness. - Quality gates in
TRA-258enforce contract compliance between backend and frontend tracks.
Gap Audit
- Gap status: no uncovered Point-4 bullets found as of 2026-05-06.
- Gap-fill evidence: child tickets
TRA-253throughTRA-260cover all required Point-4 buckets (apps, core logic, UI track, quality track, operations stack, capacity).
Update Procedure
When new architecture requirements are added to Point-4:
- Add requirement row to this matrix.
- Link to at least one executable ticket.
- If no ticket exists, create it under
TRA-251scope and append identifier.