Gap analysis: KWALL Drupal starter vs. Spillway

Read-only comparison of the higher-education Drupal starter at kwall-drupal-starter (Drupal 11 on Pantheon, custom upstream) against Spillway on the phase-2b branch, as of 2026-11-05. Spillway status was taken from the code, not the roadmap: "Shipped" means a route, table and admin screen exist; "In progress (2b)" means the branch has a dependency, contract or scaffold but no working feature yet; "Planned" cites the roadmap phase; "Missing" means neither.

What is actually on phase-2b beyond the committed v0.2: a 0008_api_tokens migration, a packages/fleet scaffold (types, errors, http), pg and @extism/extism added to core/package.json, jose and node-saml added in the last commit, and a Phase 3 contract block in packages/shared/src/index.ts for API tokens and the MCP server. No SSO, menu, personalization, analytics, Postgres dialect, MCP endpoint or module runtime code exists yet.

1. Inventory of the Drupal starter

The starter is Pantheon's drupal-composer-managed upstream with KWALL's modules, theme and config. config/ and recipes/ are empty; the real site configuration (1,634 files) is shipped inside web/modules/custom/kwall_starter_helper/site-configs/full-feature-edu, with variants city (adds a Services type and a water-leak webform), portal (adds an Audience vocabulary, permissions_by_term, masquerade and a login-walled site) and news-site-fixes. core.extension.yml enables 264 modules on the standard profile. Thirty-one composer patches are carried against core and contrib.

Contrib modules by purpose

Custom modules

Content types and fields

Paragraph (component) types: 58

Layout: layout (margins, padding, background color or media), from_library, drupal_block, view_reference, webform_reference. Hero and banners: header_banner, hero_slideshow and hero_slide, hero_video, banner_with_* (three), announcement_banner. Content: wysiwyg, heading, image, gallery, media_with_text, video_text, embedded_video, uploaded_video, accordion and accordion_item, tabs and tab_item, glossary, document_list and item, label_with_text, countdown. Calls to action: cta_block, buttons, buttons_cta, button_with_label, full_width_image_and_cta, featured_image_text_cta, icon_link, icon_links_grid, colored_icons_grid, sidebar_links_with_icons, menu_quick_links. Data-driven: news_list, featured_news, featured_events, featured_news_and_events, testimonials, person_spotlight, stat_row and stat_item, colored_stat_bar_item, card_item, card_with_image_item, contact_information, hours_of_operation and item, social_media_icons, footer_links_column, footer_contact_link.

Block content types: basic, component_block, paragraphs_block, header_banner, layout_block, links_with_heading, footer_block (site name, logo, address, phone, copyright, links, social links).

Taxonomies (15)

article_type, categories, tags, news_category, degree_type, interest_area (with icon), department, person_department, person_type, event_type, event_topic, event_location (links to a campus-map Location), document_category, glossary_section, media_directory (folders for the media browser). Hierarchy is Drupal-native; tvi lets a vocabulary pick its term-page view.

Roles, workflow, moderation

Roles: administrator, content_editor (create and edit all content types, draft and review transitions, schedule, view scheduled, editoria11y, media browsers), content_publisher (editor plus publish and archived_published transitions, homepage), group_member (media and toolbar only; real rights come from group roles), plus anonymous and authenticated. Editorial workflow: Draft, Needs review, Published, Archived, applied only to article, homepage and page bundles. Group type site_section (departments) with group roles group_administrator, group_publisher, group_editor, member, outsider; group content is page only, group menus via group_content_menu. Content lock on nodes with a 180-minute timeout; diff on revisions; workbench_email enabled with no templates in config; scheduler enabled for alert, article, event and page (publish and unpublish), with "view scheduled content" and three scheduled-content views.

Views (58)

Public: newsroom (keyword, category, publish year, 10 per page), directory (keyword, department), programs_grid (keyword, AJAX finder), calendar_main_page (day, week, month, year, list; keyword, date, type), calendar_calendar_view, mini_calendar, ical_events_feed, campus_map, documents (keyword, department, category), glossary, search (Solr full text with excerpt), archive, taxonomy_term, frontpage. Blocks and attachments: featured news and events, related articles/events/programs, news_lists, filtered listings for articles and events, alerts (block and REST export), social_grid, connect_with_us. Admin: content, moderated_content, moderated_group_content, scheduled content/media/terms, locked_content, redirect, media and media_library, paragraphs_library, config_log, editoria11y results, webform_submissions, group members and nodes, social_post_dashboard.

Menus, webforms, SEO, theme

Menus: main, mega-menu (menu links carry a Layout Builder layout), footer, header-action-navigation, utility-navigation left and right, plus account, admin, tools. Webforms: contact (two email handlers, captcha), email_signup, review_webform (fieldsets, flexbox, radios, checkboxes, datetime, terms of service). Metatag defaults for global, front, node (title, description from page summary, OG image from thumbnail), taxonomy term, user, 403 and 404; schema.org via schema_metatag for article, event, person, place; simple_sitemap per bundle with priorities; pathauto patterns per type; redirect with auto-redirect on alias change and query passthrough; rabbit_hole per type. Theme kwall_starter on bootstrap5: twelve regions (alerts, nav branding, nav main, nav additional, hero, breadcrumb, two sidebars, content, content bottom, footer, invisible), theme settings for eleven colors (three primary, secondary, three alert levels, four neutrals), three fonts from a Google-font catalog, logo; Webpack and SCSS build; 67 image styles and 6 responsive image sets on bootstrap5 breakpoints; Twig overrides for 27 paragraphs, menus, views, nodes.

Conventions from CLAUDE.md and README

Pantheon Integrated Composer; composer code-sniff and code-fix with Drupal and DrupalPractice standards; frontend assets built per module with Gulp or Webpack and committed; configuration shipped in module config/install and the helper's site-config sets rather than config/sync; Quicksilver scripts run drush site-install and notify a Firebase function on deploy_product; branding is pulled from the KWALL customer portal by site slug.

2. Comparison table

3. Ranked gap list

Critical

1. Scheduled publish and unpublish. The starter enables scheduler on pages, articles, events and alerts, with a "Scheduled content" view and moderation integration, and a campus communications team relies on it for embargoed news, term-start pages and alert expiry. Spillway has no date on the entity and no clock. Implement in core, Phase 2b: add publishAt and unpublishAt columns to entity, a content.schedule permission (editor and up), POST /api/entities/:id/schedule and unschedule, and a lightweight in-process ticker (every 60 seconds, plus a spillway run-scheduled CLI for cron on multi-instance setups) that publishes through publishEntity so checks, cache tags and audit all apply. Show a "Scheduled" filter in the content list and a banner on the entity. Unpublish-at should move the entity to archived, which also gives that status its first endpoint.

2. Menu management. Every site in the starter has a main menu, a mega menu, two utility menus, a footer menu and department sub-menus; pages pick their menu parent on the edit form and pathauto derives the path from it. Spillway has no menu at all and the shell has no navigation. Implement in core, Phase 2b (already listed as in progress): a menu and menu_item table (label, link to entity or URL, parent, weight, new tab, optional description and icon), GET/PUT /api/menus/:key, a drag-and-drop tree editor, a "Menu placement" rail on the entity editor, a {menu} path token, and a Navigation block plus header and footer slots in the shell that render named menus.

3. Global header and footer. The starter configures branding, utility navigation, search, social links, address and copyright through theme regions and a footer block. Spillway renders a bare shell. Implement in core alongside menus: a per-site "layout" document with header and footer zones edited in Puck (logo from media, menus, search toggle, social links, address, copyright) and rendered around every page; cache-tag it site:<id> so one save invalidates the whole site.

4. Taxonomy. Fifteen vocabularies drive every listing filter (department, category, degree type, event type) and several term pages. Spillway's select options are flat strings owned by one type. Implement in core, Phase 2b or early 3: a vocabulary and term model (hierarchy via parent, slug, description, optional path pattern for term pages), a taxonomy field type that references a vocabulary (single or multiple), term pages rendered as a Collection filtered by term, and term filters exposed to Collections and search.

5. Image styles and responsive images. The starter has 67 styles, focal-point cropping and WebP. Spillway serves originals, so a 4 MB hero is sent to a phone. Implement in core, Phase 2b: on-demand resizing with sharp behind /media/:id/:filename?w=&h=&fit=&format=, a focal point stored on MediaItem, named presets in site settings, srcset and sizes emitted by the Image, Hero and Cards blocks, and cached derivatives under DATA_DIR/media/derived.

High

6. Visitor-facing listing filters and pagination. The newsroom, directory, calendar and program finder all have keyword plus taxonomy and date filters with pagination. Spillway Collections are fixed queries. Extend the Collection block (core, Phase 2b): filters: 'none' | 'inline', an exposed list of fields (keyword over searchable fields, taxonomy, date range, select), server-rendered filter form with query-string state, page size and pager, and an items.json endpoint for progressive enhancement. This unlocks the directory, newsroom and program finder as kits rather than code.

7. Events with recurrence and calendar. Events are the highest-traffic listing on most campus sites. Implement as a module and kit, Phase 3 once modules exist (or as core field types sooner): a daterange field type with timezone, an recurrence field (RRULE, exclusions, occurrence expansion stored in a side table so Collections can sort by next occurrence), an event type in a higher-ed kit, a Calendar block (month, week, list), an /events.ics feed and per-event add-to-calendar links.

8. Higher-ed content kit (people, programs, news, alerts). The starter ships Person, Program, Article, Event, Alert, Location and Testimonial with their vocabularies, listings and components. Spillway should ship an installable "Higher education" kit (Phase 2b, after taxonomy): content types, vocabularies with seed terms, collections and block presets, plus sample pages. Alerts need a small core hook: a site-level alerts setting rendered above the header with level, expiry and a dismissed cookie.

9. Rich text internal links and media embed. Editors link to pages by searching for them (linkit) and embed images, documents and videos inline. Implement in core, Phase 2b: a link dialog in the Tiptap editor that searches entities and media (storing entity:<id> so links survive slug changes, resolved at render), image and document embeds that reference media ids, and tables. Keep the HTML sanitized with an allow-list rather than the current trust-the-editor policy.

10. Reusable component library. paragraphs_library and from_library let one promo or contact card be placed on many pages and edited once. Implement in core, Phase 2b: a shared_block entity (a saved Puck component tree with a label), a "Save to library" action on any block, a Shared block that references it and is resolved at render, tagged shared:<id> for invalidation.

11. Department delegation. The site_section group type gives a department its own editors, publishers, pages and menu while the central team keeps the shell. Spillway roles are site-wide. Implement in core, Phase 3 alongside multisite: a section entity (name, path prefix, menu), sectionId on entities, and section-scoped role assignments (editor of section X). Permissions checks already go through requireEditAccess, which is the seam.

12. Workflow notifications. workbench_email is enabled for submit, approve and reject emails. Implement in core, Phase 2b: an outbox table plus the existing SMTP connector; events entity.submitted, entity.rejected, entity.published, comment.added with templates in site settings; a per-user digest preference; and the same events on a webhook for Slack or Teams.

Medium

13. Content locking. Two editors on one landing page is common on a marketing team. Implement in core, Phase 2b: entity_lock (entity, user, expires) acquired on open, refreshed by heartbeat, released on close, breakable by content.edit_any, with a 409 on save when another user holds it.

14. Revision diff and pruning. Add a side-by-side comparison of two revisions (field by field, block by block for layouts) in the admin and GET /api/entities/:id/revisions/:a/diff/:b; add a per-type "keep N revisions" setting and a prune job. Core, Phase 2b.

15. Webform parity: conditions, multi-step, file uploads, captcha. Done in Phase 4: visibleWhen on fields, steps, a file field type stored under DATA_DIR/form-uploads, Turnstile or hCaptcha by site setting (docs/api.md "Forms"). Salesforce, Slate and Mailchimp connectors stay on the roadmap.

16. Google Tag Manager and analytics settings. A tracking section in site settings (GTM container id, GA4 id, consent mode, path exclusions), emitted by the shell, with a dataLayer event on form submit. Core, Phase 2b; small.

17. Per-entity SEO fields on every type and richer schema.org. Promote seoTitle, seoDescription, ogImage, noindex and canonical to built-in fields on any type with a path (hidden behind an "SEO" tab), and generate Event, Person and Course JSON-LD from the kit's types. Core, Phase 2b.

18. Search facets and autocomplete. Add type and taxonomy facets with counts to /search and /api/search, and a suggest endpoint; this stays on FTS5 until Meilisearch (Phase 3).

19. Config as code. The starter's whole structure is YAML that ships with the upstream, which is how one team runs dozens of sites. Add spillway export --structure and import --structure for types, vocabularies, collections, forms, menus and theme, with a kit manifest format; this is also what the fleet API will push. Core, Phase 3 with fleet.

20. Clone and bulk actions. Duplicate entity, and multi-select publish, unpublish, archive, delete and change-author on the content list. Core, Phase 2b; small.

Low

21. Media folders, media types and replace-in-place. Folders (or tags) in the media library, a document type with a download block, replacing a file while keeping its id, and "where is this used" from the existing reference table.
22. Campus map and locations. A location type with address and coordinates and a Map block; a kit item once a map provider setting exists.
23. Glossary, documents library, hours of operation, countdown, stats, testimonials, share bar, social feed. Blocks for the higher-ed kit; the social feed importer is a module candidate.
24. Environment indicator and mail reroute. An ENVIRONMENT variable shown in the admin header and a MAIL_REROUTE_TO that catches all outbound mail outside production.
25. Translation widget. gtranslate-style machine translation is a stopgap; proper localization is Phase 3 and already has the locale column and AI translate task.

Items the starter has that the Spillway spec never mentions: scheduling, taxonomy, menus, image styles and focal point, alerts, events and calendar, content locking, revision diff and pruning, department delegation via groups, GTM, campus map, glossary, documents library, social feed import, config as code, clone and bulk actions, environment indicator, mail reroute, captcha.

4. Already better in Spillway

• Review workflow in one piece. Draft, review, publish, reject with a note, a review queue, field-level comments and pre-publish checks that block publishing on errors are core, where the starter needs content_moderation, workflows, moderation_sidebar, moderation_dashboard, workbench_email and editoria11y and still has no comments.
• Redirects with a 404 log. The starter needs redirect plus a custom view and path_redirect_import; Spillway logs top misses next to the redirect screen and creates redirects on slug changes automatically.
• Forms with CRM delivery and UTM capture. Webhook with HMAC signature, HubSpot, email, redelivery, CSV, UTM and referrer capture, honeypot and rate limiting are built in; the starter needs webform, webform_submission_log, captcha, honeypot and a third-party HubSpot bridge.
• Collections for marketers. A saved query with a preview and a block, instead of Views UI, viewsreference and the news_list paragraph's hand-built curation fields.
• SEO files and structured data. sitemap.xml, robots.txt, llms.txt and JSON-LD (WebSite, Organization, WebPage, Article, BreadcrumbList) without metatag, schema_metatag, simple_sitemap or easy_breadcrumb.
• AI with governance. Brand profile with banned words, page from brief, assist, alt text, type design, per-task provider routing across Anthropic, OpenAI, Google and xAI, a token cap, a usage report and an audit row per call; the AI never publishes. The starter has openai_* and the ai module with no brand layer or cap.
• Audit log on every write in the same transaction, versus config_log for configuration and dblog for events.
• Cache tags on every page from one process, with no Pantheon-specific module, and headers a CDN can purge by.
• Security defaults without seckit, password_policy or username_enumeration_prevention: scrypt, HMAC-stored sessions, CSRF header, login rate limit with constant-time email handling, MIME sniffing and sandboxed SVG.
• One process, one file. Install in five minutes with Docker and SQLite, backups as a file copy, versus Composer, Solr, Redis, MariaDB and a Pantheon workflow.
• Same JSON API for everything the admin does, with the API tokens and MCP contract on this branch extending it to agents, where the starter adds jsonapi_extras and a bespoke REST export for alerts.

Spillway 0.1.0 · Edit this page on GitHub