Design review checklist
This page is a checklist and a template for the design review of a system built on Exponential: a new site, an application, a migration or a large extension. Copy the sections into your decision record and answer each item with a decision and its source.
Contents
- Fit and scope
- Content model and data
- Runtime, caching and scale
- Security
- Integration
- Operations
- Quality, upgrades and ownership
- A decision record template
Fit and scope
- To do: Which product of the family, and does it contain what we need? (What Exponential is)
- To do: Which needs are met by existing features or extensions, and which need new code? (Evaluating Exponential)
- To do: Is the license (GNU GPL, version 2 or later) compatible with how we distribute our code?
Content model and data
- To do: Content classes, attributes and datatypes; which need custom datatypes? (The content model for engineers)
- To do: The shape of the content tree, sections and object states, and how permissions follow them.
- To do: Languages: how many content languages (at most 62), which fallbacks, right-to-left needs (Internationalization and right to left).
- To do: Custom tables: persistent classes, schema files for every driver (Schema changes and migrations).
- To do: Which database, and is it tested in CI? (Databases: choosing and running one)
Runtime, caching and scale
- To do: Which application server (Application servers), and is our code safe in persistent workers?
- To do: Which caches are on, what they are keyed on, how they are invalidated (Caching layers for engineers).
- To do: One machine or several nodes; what is shared (Scaling and clustering).
- To do: Expected traffic, measured page costs, and the headroom (Performance measurement and benchmarks).
- To do: One installation or several sites (Multi-site installations).
Security
- To do: Roles and policies for every kind of user, written down.
- To do: Two-factor sign-in for staff; lockout; session handler (Authentication, sessions and two-factor sign-in).
- To do: Trusted proxies, security headers, CSP plan (HTTP security).
- To do:
ManagedByDeploymentin production. - To do: Where secrets live, and who rotates them.
Integration
- To do: Which APIs: REST, ezjscore endpoints, remote services; authentication for each (API design: REST, ezjscore and headless).
- To do: Background work: cronjob parts, content jobs, expqueue (Console, cronjobs and background work).
- To do: Mail: transport, preferences and consent.
Operations
- To do: Deploy procedure and its order (Deploying a change).
- To do: Monitoring, logs, audit trail, alert recipients (Observability).
- To do: Backups and a tested restore.
- To do: Incident procedure and runbooks (Incident handling).
Quality, upgrades and ownership
- To do: Tests and CI for our own code (Testing strategy).
- To do: How we follow kernel and extension releases, and who reads the upgrade notes (Backward compatibility policy).
- To do: Composer constraints and how we repin (Dependency management with Composer).
- To do: What we contribute back, and whether contributors have signed the CLA (Contributing upstream).
- To do: Known risks and debt we accept (Handling technical debt).
A decision record template
| Field | Content |
|---|---|
| Title | the decision in one line |
| Date and status | the date; proposed, accepted, or replaced by another record |
| Context | the requirement and the constraint |
| Options | two or three, each with its source page |
| Decision | the option chosen |
| Consequences | what becomes easier, what becomes harder, what to watch |
| Review date | when to look at it again, for example after the next 6.0.x release |
Related pages
- Code review checklist
- Planning an Exponential project
- Risk management
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.