[antosubash]

Summary

• framework: unify public-route checks before the 0.1.0 shim removal #593: simple_module_hosting.public_access.is_public(app, method, path) is the single answer to "is this route public?" for AuthMiddleware, maintenance mode, rate limiting and the SM031 check (which keeps its placeholder substitution on top). The legacy get_public_paths() fallback goes through legacy_provider_public_paths (one deprecation warning per provider class); a provider that raises is logged once per process instead of silently treated as not public. Superseded banners on the two old specs that still taught get_public_paths().
• framework hygiene: process-global state, silent fail-open excepts, untyped app.state, undated compat #594 (scoped; item 3, typed app.state accessors, deferred as noted on the issue):
  • The test plugin resets process-wide mail sender, lease backend and Sentry state per test (autouse). A second app built inside one test no longer clobbers the first.
  • Fail-open handlers (setup gate, DB listeners, menu providers, plural rules, invalidation decoder) log a WARNING once with a traceback. Outcomes are unchanged, and the policy is in docs/framework-conventions.md.
  • The register_event_handlers(app=None) default and the requires_framework=None bypass are dated for removal in 0.1.0 and tracked by test_deprecation_expiry.py. No per-module runtime warning: it flooded every boot.
  • Starlette Route.matches contract test for the route guard.
  • run_deferred_startup and the error-page renderer moved to leaf modules, so no lazy imports dodge cycles.
• modules/auth now declares its existing simple_module_hosting dependency (+ uv.lock).

Verification

• Browser/HTTP-verified on port 8216: anonymous public vs protected routes, maintenance mode on/off (503 HTML/JSON, health and sign-in reachable, admin bypass), /setup closed; no console errors
• Local CI: make lint, make test-py (5708 passed), make test-js (748 passed), full e2e suite (49 passed); framework db/testing/hosting/core + auth on Postgres (2188 passed)
• Code review: 2 Sonnet passes + Codex, clean
• Verification report: https://claude.ai/artifact/8Evu3sxEfM5PzReSfQsmss

QA Report

• Full QA cycle completed (1 iteration)
• 0 bugs found, 0 fixed
• Categories tested: Happy Path (public routes, maintenance mode, setup gate)
• Full QA report: https://claude.ai/artifact/VL5RmT5WNFa5NWsfFcBVWc

Report links are Claude Artifacts and start private; the author can share them from claude.ai/code/artifacts if reviewers need access.

Test plan

• Turn on maintenance mode: / answers 503, /health and /users/login stay reachable
• CI is green (including the Postgres workflow)

Closes #593
Closes #594

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-23T10:34:12.705626Z	224728c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cloudflare-workers-and-pages]

Deploying simple-module-python with    Cloudflare Pages

Latest commit:	7dfcaeb
Status:	✅  Deploy successful!
Preview URL:	https://923cc16f.simple-module-python.pages.dev
Branch Preview URL:	https://fix-debt-batch-5.simple-module-python.pages.dev

View logs