Roadmap: harden and future-proof a mature static site

🤖 Generated by the Daily AI Engineer

Roadmap-of-record refresh (2026-07-10 strategy review). The prior roadmap epic #30 and all its children (#31–#35: social/SEO metadata, JSON-LD, responsive hero, conversion analytics, CI a11y guard) are delivered, the backlog was empty, and the product is healthy — current deps, strict CI gate (lint/typecheck/unit/E2E+axe), hardened tenant manifests (read-only rootfs via #95). Remaining direction is enhancement, not repair.

Themes (each filed as a child issue, oldest-first queue order)

security: add a Content-Security-Policy (and HSTS) to nginx #97 — Security headers: add a Content-Security-Policy (and HSTS) — the one notable security gap on the site today. (S)
perf/privacy: self-host the Lora and Inter fonts #98 — Self-host the Google Fonts — removes the last third-party origins (privacy + LCP), and shrinks security: add a Content-Security-Policy (and HSTS) to nginx #97's CSP. (S)
ci: add a performance/Core-Web-Vitals budget gate #99 — CI performance budget gate — guard Core Web Vitals the way a11y is already guarded (deferred from Roadmap: a discoverable, fast & accessible marketing site (first strategy review, 2026 H1) #30). (M)
refactor: single source for booking URL and build-time config #100 — Extract build-time config from content.ts — de-duplicate the booking URL that also lives in docker/nginx.conf (deferred from Roadmap: a discoverable, fast & accessible marketing site (first strategy review, 2026 H1) #30). (S–M)
content: use a domain-based contact address instead of Gmail #101 — Domain-based contact address — owner decision; one-line change if adopted. (S)

Feature flags: deliberately N/A here — a fully-static site has no runtime to evaluate flags; revisit only if a dynamic surface appears.

🔗 Related PRs

devantler-tech/monorepo#1991 - docs: prioritise substantive issues over easy wins [closed]

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

Create Plan

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

feat(fonts): self-host Lora and Inter as build assets (#103)

ci: add a warn-only Lighthouse Core-Web-Vitals budget gate (#114)

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Strategy review, 2026-10-17

Where the site is. Mature and healthy. All four July themes are delivered: the CSP and HSTS (#97), self-hosted fonts (#98), the performance budget gate (#99) and the single-source booking URL (#100). Since then it moved to SvelteKit 3 (#299), meets its LCP budget with the Lighthouse budgets enforced (#305), stopped serving stale pages after a deploy (#306), and gained a contributor guide (#303). No open pull requests.

The gap that matters most is delivery, not features. Updates reach main but not visitors. Dependency updates are titled chore(...), so they never cut a release, and the site is rebuilt and published only on a release. Nine updates merged today (#307–#315, Vite among them) sit unreleased behind v1.13.12, and the SvelteKit 3 move went live only because an unrelated fix shipped the next day. wedding-app had the same gap and fixed it in wedding-app#408.

Roadmap, in the order I recommend:

#	Item	Size	State
1	#316 Release updates to the packages that ship in the built site	S	Refined, ready to pull
2	#317 Pin both Docker base images by digest so their patches reach the site (blocked by #316)	S	Refined, ready once #316 lands
3	#206 Move the site to GitHub Pages	M–L	Needs the maintainer to confirm the DNS-stability reading in its body; now linked under this epic
4	#101 Domain-based contact address	S	The client's decision

If #206 goes ahead, #317 becomes unnecessary (no image to patch), and #316's rule decides when Pages publishes instead of when the image is rebuilt, so #316 is worth doing first either way.

Upstream release review (key dependencies):

Dependency	Here	What it means
SvelteKit / adapter-static	3.x / 4.x since #299	Live since v1.13.10. No action.
Svelte, Vite	5.57, 8.3.2 → 8.3.4 (#315)	Weekly patch releases; they reach visitors only after #316.
Node	26 (build only)	Node 26 is due to become LTS this month on the Node.js schedule. The site is already on it; no action.
nginx-unprivileged	floating `1-alpine`	No Dependabot update has ever arrived for either base image; #317.
TypeScript	6.0.3	7.0 is out. business-site holds it until the Svelte tooling supports it (business-site#137); do the same here and do not merge a TypeScript 7 update early.

Decisions for the maintainer: confirm or reject the DNS-stability reading in #206, and pass #101 to the client if it is still wanted.

Navigation Menu

Repository navigation

Roadmap: harden and future-proof a mature static site #96

Themes (each filed as a child issue, oldest-first queue order)

Strategy review, 2026-10-17

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Roadmap: harden and future-proof a mature static site #96

Description

Themes (each filed as a child issue, oldest-first queue order)

Activity

coderabbitai commented on Jul 10, 2026

devantler commented on Oct 17, 2026

Strategy review, 2026-10-17

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions