Development
How Spillway is built, how to contribute, where it is going.
Spillway CMS security review, second pass (2026-11-05): package registry and domain importer
Scope: the working tree of branch phase-4 on the day the two surfaces landed, read file by file. Reviewed: the package registry (packages/core/src/registry/, routes/registry.ts, modules/tar.ts reader and writer, modules/registry-client.ts, kits/registry.ts, sso/github.ts with the GitHub branch of…
Spillway CMS security review (2026-11-05)
Scope: the committed tree at HEAD of branch phase-2b (764a78a), read with git show, never the working copy. Packages reviewed: core, blocks, admin, fleet, sdk, shared, plus Dockerfile, docker-compose.yml, .github/workflows/ci.yml and pnpm-lock.yaml. SSO, theme/menus and personalization/analytics…
Open decisions and debatable changes
A running list of things that need Kevin's call or a second opinion. Newest at the top of each section. Items move to the roadmap or the spec once decided.
Gap analysis: KWALL Drupal starter vs. Spillway
Read-only comparison of the higher-education Drupal starter at kwall-drupal-starter (Drupal 11 on Pantheon, custom upstream) against Spillway on the phase-2b branch, as of 2026-11-05. Spillway status was taken from the code, not the roadmap: "Shipped" means a route, table and admin screen exist;…
Benchmarks
How fast one Spillway process is on a realistic site, measured the same way every time, with the numbers from before and after the performance pass and the targets the project aims for. The script is scripts/bench.mjs (pnpm bench); the numbers in benchmarks.json next to this file are the recorded…
Admin UX review and design system
Date: 2026-11-05. Scope: packages/admin (the React admin at /admin). Goal set by the product owner: review the admin screens of enterprise Drupal, WordPress and the leading SaaS/headless platforms, and make Spillway's admin look and feel enterprise, stay accessible, and lead on user experience.
spillwaycms.com: the project website and registry
The project website is built on Spillway itself, hosted through the fleet, and is where people learn the product, read the docs, and publish modules, themes and kits for everyone else. Clean and simple: one site, four jobs.
Releases, versioning and support
How a Spillway release is cut, what the version number promises, how long a release is supported, how to upgrade, and how security issues and deprecations are handled. The short version for operators is in install.md; this is the policy behind it.
Roadmap
Spillway is built in phases. Each phase ships as a usable release; nothing in a later phase is required to run the earlier ones. Dates are not promised. Items move between phases as we learn. Phases 1 to 3b and the Phase 4 features are built; what is still ahead is listed under Phase 4 and in…
Contributing guide
This is the long version of CONTRIBUTING.md. It covers the repository layout, the dev loop and how to add the three things people add most: an API route, an admin screen and a block.
Architecture
Spillway is one Node process. It serves the JSON API, the admin SPA and the public pages from the same Hono app, against one SQLite file or a Postgres database. There is no queue, no cache server and no separate renderer unless you add one: Redis, Meilisearch and Postgres plug in through…