A reusable comment thread any sidecar can attach to any page, tied to
real logged-in accounts (never anonymous), auto-approved on submission
with hide/delete moderation at /admin/comments — only a verified account
can post, so there's no anonymous-spam vector to pre-vet against.
Framework-level (novaconium/lib, novaconium/migrations, novaconium/pages),
not App/migrations, matching Admin auth and Media manager's shape. A page
needs its own sidecar to use it — this repo has no client-side JS, so
comments ride the same server-rendered POST pattern as every other
dynamic feature, which is also what excludes a page from the static
cache. App/pages/blog/comments-demo/ demonstrates the pattern without
touching existing posts that are referenced elsewhere as the
sidecar-less example.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Every account created after the first must confirm a 24-hour link
(Lib\Mailer::sendMail(), log-file or MailJet) before AdminAuth::attempt()
allows login, folded into the same generic pass/fail as a disabled account
or wrong password. First user and pre-migration rows are grandfathered;
create-admin-user.php also auto-verifies for lockout recovery.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Features section becomes a "Novaconium Features" blog post
(App/pages/blog/novaconium-features/), demonstrating the framework's own
content model rather than living as a long bullet list in README.md.
Getting started is trimmed to the minimum needed to run the site and
reach /admin/docs, which is now the single canonical source for every
topic (Docker, deploying, project layout, etc.) instead of being
mirrored into README.md. Third-party section kept as-is. AGENTS.md's
documentation-duplication rule updated to describe this new split so
future changes don't re-bloat the README. Also adds an ASCII art banner
above the title.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
code