Publish ITWorx Pulse source

2026-09-03 02:09:19 +02:00
commit bd774932d5
614 changed files with 77116 additions and 0 deletions
@@ -0,0 +1,59 @@
+# Dependency policy
+
+A production dependency is accepted only when it:
+
+- solves a real requirement better than a small maintained implementation;
+- is actively maintained;
+- has a compatible license;
+- has no unresolved unacceptable security issue;
+- supports the selected runtime/browser versions;
+- has clear upgrade and removal paths;
+- does not require excessive privilege or bundle size.
+
+## Selection record
+
+For material dependencies record:
+- package and version range;
+- purpose;
+- alternatives considered;
+- maintenance/release activity;
+- license;
+- security check;
+- bundle/image/runtime impact;
+- locking strategy.
+
+This may be an ADR or a dependency manifest note.
+
+## Default choices to validate during M0/M1
+
+- React + TypeScript + Vite.
+- GridStack for layout.
+- uPlot for high-volume time series.
+- ECharts for complex visualizations.
+- TanStack Query for server state.
+- Accessible UI primitives/component library.
+- Go HTTP/router, OIDC/JWT and PostgreSQL libraries selected from maintained options.
+- PostgreSQL migration tool with explicit CLI and rollback strategy.
+- Playwright and automated accessibility tooling.
+- Testcontainers for integration tests.
+
+These are defaults, not permission to install blindly. Verify current supported versions and compatibility.
+
+## Rules
+
+- Commit lockfiles.
+- Prefer exact image tags/digests in production records.
+- Avoid duplicate libraries for the same concern.
+- Do not use abandonware because an example already uses it.
+- Do not add Redis, Kafka, Elasticsearch or a second metrics database without measured need and ADR.
+- Remove unused dependencies immediately.
+- Run dependency/license/vulnerability checks at milestones and release.
+
+
+## M4-06 WebSocket selection
+
+- Package/version: github.com/coder/websocket v1.8.15, pinned in go.mod and go.sum.
+- Purpose: RFC6455 server upgrade, context-aware reads/writes, ping/pong and bounded frame reads for the authenticated live endpoint.
+- Alternatives considered: hand-rolled RFC6455 handling was rejected because it increases protocol and security risk; gorilla/websocket was not needed for this narrow API; golang.org/x/net/websocket is deprecated.
+- Maintenance/security: current upstream release was resolved locally on 2026-08-01; the module has zero transitive dependencies and the source license is permissive MIT.
+- Runtime impact: server-only dependency, no browser bundle or privilege change; SetReadLimit and write deadlines enforce the endpoint budget.