[antosubash]

Summary

Closes #513
Closes #509
Closes #523
Closes #516
Closes #502

• Framework pagination helper (PageParams + paginate) to replace per-module copies with inconsistent validation #513: shared pagination
  • simple_module_db.PageParams, Page and paginate. paginate counts the same statement as a subquery and keeps its execution options, so include_deleted and all_tenants are respected. It clamps to the last page before computing the offset. Pages are capped at MAX_PAGE = 1_000_000.
  • simple_module_hosting provides page_params(n) (strict) and lenient_page_params(n) (clamps), each taking a route's own default page size.
  • PaginationBar in packages/ui, translated.
  • Migrated: users, file_storage, audit_log, settings, background_tasks (executions and outbox) and tenants.
  • Behaviour change: JSON list APIs return 422 for page ≤ 0 or page > 1,000,000, and per_page must be between 1 and 200. Browser view routes clamp instead. The tenants admin list uses a fixed page size.
• Two module scaffolders produce different modules (scripts/new_module.py vs smpy CLI templates) #509: one scaffolder
  • make new-module now calls the smpy CLI's create_module(framework_repo=True). An overlay adds the in-repo wiring: host pyproject, testpaths/extra-paths, the release.yml matrix, and i18n pages.
  • The scripts/_templates_*.py f-string templates and their tests are deleted, leaving one test suite.
  • Behaviour change: both variants now scaffold constants, models, contracts, a service, deps, locales, permissions and a menu item, and a fresh module passes make lint and make doctor.
  • Singularising is conservative, so a module named status scaffolds as Status.
• Small framework helpers for repeated boilerplate: AuditLink.for_model, independent_session #523: helpers
  • AuditLink.for_model(Model, …), with all 7 sites ported.
  • simple_module_db.independent_session(app): commits on success and rolls back on error. Ported where the semantics match exactly: the api_tokens last-used touch and the permissions startup.
• Route guard monkeypatches FastAPI private internals with an unbounded fastapi>=0.115 pin #516: FastAPI bound
  • fastapi>=0.140,<0.157. The locked 0.156.4 stays.
  • A contract test fails with a clear message if the private FastAPI or Starlette APIs that the route guard relies on change.
• Design: put the event outbox behind a framework transport protocol instead of inside background_tasks #502: outbox interface (small fix, as agreed)
  • Core docs describe DurableTransport as the extension point.
  • file_storage declares background_tasks as an optional tasks extra, and a test proves uploads degrade cleanly without it.
  • The follow-up, running the outbox without Celery, is filed as background_tasks: run the durable outbox without Celery (in-process dispatcher + sweep) #565.
• Also:
  • bump_version.py now bumps optional-dependency pins on sibling packages.
  • uv.lock is refreshed.

Verification

• Local CI, after merging main:
  • make lint passes.
  • make test-py: 5112 passed, 22 skipped.
  • make test-js: 672 passed.
  • make ci-doctor and make ci-css-build pass.
• /ship (2 rounds):
  • Optimize made one cleanup commit.
  • Round 1 review was clean after 2 passes, with 8 fixes in total; an independent Codex review contributed two of them, the count query's execution options and the tenants page size.
  • Browser QA found 3 bugs and fixed them all: the outbox view returned 422 on a bad page, the JSON APIs had no page cap, and the users admin API didn't validate at all.
  • Round 2 review was clean after 2 passes, and a targeted re-test of the round-2 changes was clean.
• Reports:
  • QA report: https://claude.ai/artifact/SgcEyEumYbEoUndJP8GbE8
  • Ship report: https://claude.ai/artifact/JWs9jeAb5ZprcbEss8X9Dj

Report links are Claude Artifacts and start private — the author can share them from claude.ai/code/artifacts if reviewers need access.

Known limitations (accepted)

• Irregular plurals such as movies and houses are not singularised correctly when scaffolding.
• Four pagers keep their own UI rather than PaginationBar: users, settings, the file storage selection footer, and tenants (which only knows whether there is a next page).
• paginate does not support joinedload on collections.

Test plan

• CI is green
• Audit log and background task tables page correctly with PaginationBar

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

[cloudflare-workers-and-pages]

Deploying simple-module-python with    Cloudflare Pages

Latest commit:	0f93657
Status:	✅  Deploy successful!
Preview URL:	https://4d6359b8.simple-module-python.pages.dev
Branch Preview URL:	https://chore-tier3-batch-502-523.simple-module-python.pages.dev

View logs

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-21T14:10:06.780902Z	c735eb3	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.