What's available today
Every item states what it gives you.
Foundation
Sign in / sign out / captcha
An authentication loop you can use as is
Sign in with account, email or phone; BCrypt is the only password scheme, no weak-hash option is offered
Users / roles / menus
The main admin path
Three tables tell one story; column comments match the implementation; menus and front-end routes share one source
Button-level permissions
Control down to each button
Permission codes are defined centrally, literals are banned; the build verifies all three places agree
Departments / data scope
People see what they should
By department / self / custom range / all; injected by the data access layer, business code is unaware
Dictionaries / parameter config
Everyday config is not hardcoded
Cached, and the cache is observable rather than a naked query
Operation log / sign-in log
Traceable when something goes wrong
Written asynchronously so the main path is not blocked; correlatable with traceId
File upload
Generic attachment support
Type and size allowlists are enforced on the server, not in the browser
API documentation
Front-end and back-end stop negotiating by word of mouth
OpenAPI is exported at build time from the same source as the permission-code list
Dynamic routes and permission directives
Zero authorization logic in the front end
The front end only shows and hides; it never decides permissions
Scheduled tasks / message consumption
Non-HTTP entry points are observable too
They share the same traceId as HTTP requests
Engineering quality
Architecture guardrails
Conventions enforced by machine
Layering and dependency direction are mandatory; six banned patterns (field injection, controller reaching straight to Mapper, System.out, new Date() and more); no dependency cycles
Contract consistency
Docs never drift from code
Registered endpoint count, permission codes and error-code ranges are compared against source in real time; a mismatch fails the build
Deny-by-default authorization
Authorization is never forgotten
An endpoint without an auth annotation fails at startup; anonymous access returns a fixed error code
End-to-end traceId
Locate a problem in five minutes
HTTP, scheduled tasks, message consumption and thread pools all read the same value
Structured logging
Logs are searchable and aggregatable
traceId and userId are top-level fields; phone numbers and passwords are masked by default
Operation audit
Sensitive actions leave a trail
Permission changes, deletes, exports and sign-ins trace back to person, time, IP and traceId
Query and write quality
It does not do the things that cause incidents
Condition allowlist plus wildcard escaping; a type mismatch throws instead of silently dropping the condition; a stable secondary sort is added when none is given; unified pagination with deep-page protection
Transaction and migration discipline
One source of truth for data
Writes go through one exit; transaction boundaries are held by architecture assertions; the soft-delete column is NOT NULL DEFAULT 0; migrations are append-only
Skeleton generator
A new module in 30 minutes
Generates directories, migration scripts and test skeletons, and registers the module, permission codes and menus; the output ships with tests and passes the build on the first run
Approval instance layer (capability pack)
Outsourced OA essentials, ready now
Flow definition plus fixed-chain nodes, instances and tasks, approval trails with traceId, joint and any signing, rejection; pluggable, and the core has no dependency once it is removed
One command to boot the environment
A new machine is sign-in ready in 10 minutes
Migrations create tables, seed data and the initial administrator; you only need JDK 21 and MySQL 8, no intranet address and no manual table creation
CI and quality gates
Every commit gets a check-up
Build, tests, guard rules, formatting and commit hooks, all in one command
What you get
A sign-in-ready admin console, a reproducible set of engineering-quality metrics, one command to boot the environment, and a generator that produces code which passes the build as is.
By the way: code that fails the architecture check cannot be merged.
What we deliberately don't do
| Not doing | Why not | If you need it |
|---|---|---|
| Workflow engine and visual designer | A ten-year project; today we ship the instance layer only | Cover fixed chains with the approval instance layer; extend complex flows through a capability pack |
| Multi-tenancy | The core repository does not introduce a tenant dimension | Isolate by department with row-level data scope; tenancy is a later direction |
| Field-level permissions and a masking framework | Today only log masking is on by default | Handle sensitive fields in the serialization layer; a capability pack later |
| Performance benchmark baselines | "Easier to maintain" shows up in conventions and quality, not in benchmark numbers | Read the query and write quality section; benchmarks are a later direction |
| Calling large models inside the framework | Cost, keys and model turnover are all traps, and it means owning the model's quality | Write code with any AI tool and let this framework's build gates hold the line |
| Transport / storage encryption and national cryptography | The discipline of keeping keys external comes first | Solve it at the gateway and database layers; it does not enter the core repository |
| Multiple databases and domestic-platform adaptation | We accept the "MySQL first" trade-off | Adapt through a capability pack when needed; the core stays untouched |
| Low-code and online form builders | Once the pitch is "zero code", complex scenarios will break | Use the skeleton generator plus hand-written business code |
| Built-in business modules (shop / CRM / membership) | The core repository holds zero business code; shipping business is exactly what locks users in | Keep business in your own repository and extend through capability packs |
| Container images and orchestration files | The delivery shape is a jar plus a database; choosing operations tooling for users only widens our promise surface | Package it to your own standards; the deployment guide covers the non-container path only |
| (Website) any competitor comparison | Our public story is about ourselves only | We publish the dimensions and the methods; you run the numbers |
| (Website) customer logos and case walls | We have no authorized endorsements yet | Look at engineering quality and build evidence; we will add cases when they are real |