Colophon CMS: the build log

Pinning a Rust version takes one small file. On my laptop, that file was being silently ignored. So Colophon's first check makes sure its checks are real.

Colophon's local stack: a database, a cache, file storage and sign-in, all started with one command. Docker said every service was healthy, so I broke one on purpose to see whether anyone would notice.

Colophon learned to say when something's wrong: one error format, honest health checks, a separate frontend that tests it, and load tests in the millions. The millions found nothing. The frontend found a bug on day one.

Colophon's writing editor and the format behind it. The editor opens a document only if it can give it back byte for byte, because the library underneath quietly throws away whatever it doesn't understand.

The editor keeps honest writers honest. The server has to stop everyone else. Colophon's validator refuses all 34 bad test documents with exactly the right error and location, and checks 71,000 documents a second.

Colophon's renderer turns a stored article into the page readers see. There's one of it, it refuses rather than guesses, and a test reads back everything it produces to make sure nothing in it can run.

Colophon's design system: Material 3 colours generated from one blue, checked for contrast in every theme by CI, and an accessibility scanner that found two real problems on its first run. With this, the foundation milestone is done.

Colophon now knows who is asking: sign-in through a real identity provider, sessions only the server can end, and projects that the database itself hides from everyone but their members. Plus the first load test that has to talk to the database on every request.

Colophon now saves articles. Every save is a new revision that can never be changed, a save on top of someone else's is refused instead of overwriting it, and the server can be killed just before or just after a save without losing it or saving it twice.

The Studio now edits real drafts. It saves as you type, keeps your unsaved words on your own device, and when someone else saved first it shows both versions and lets you choose, instead of quietly overwriting anyone.

A simulator that runs thousands of repeatable, randomized days of editors colliding, answers going missing and browsers crashing, checking after every step that no acknowledged save was lost. It caught every bug I planted, agreed with the real database save for save, and found a real one in the Studio.

Colophon stops assuming every entry is an article. A project defines its own content types (text, rich text, numbers, booleans, choices, dates), the server checks every entry against its type, a type can only change in ways that keep every stored entry valid, and the Studio draws its editor from the type.

Colophon gets a command line. You sign in by approving a short code in the Studio, and then the terminal creates and lists exactly the same records the Studio edits, safely retried, with exit codes scripts can rely on. With this, the spec's first slice works end to end.

Colophon stops being a one-person tool. An owner invites someone with a link that works once, the invitee sees exactly what they're joining before they join, one small table decides what owners, developers, editors and publishers may do, and a project can never be left without an owner, even when two owners step down at the same moment.

Signing in to Colophon no longer lets you create anything. The person who runs the server makes the first administrator once, from a terminal, and nobody can do it a second time; only administrators create projects, and everyone else arrives by invitation. With this, the first milestone's proof gate is met.

Colophon gets review. A changeset pins the exact versions of the entries in it, an approval is tied to a fingerprint of exactly that set, and editing anything afterwards means it has to be approved again. Two people can't approve a version neither of them is looking at.

Colophon can publish. An approved changeset becomes a numbered release in a single step, two releases racing for the same number can't both win, anyone can read what's published (including any earlier release, exactly as it was), and the code that serves the public reads through a database account that can't see drafts at all.

Colophon now tells the outside world when it publishes. A background worker announces every release to your webhooks, keeps trying when they're down, gives up cleanly when they refuse, skips an older release once a newer one is queued, survives being killed halfway through, and only ever calls public addresses.

A simulator now races publishers, crashes workers and scrambles the network thousands of times a run, and a crash loop really kills the server over and over while it publishes. Building the simulator found a real ordering bug in the previous step; it's fixed, and neither the simulator nor the crash loop finds anything lost or doubled. The second milestone is done.

Colophon's public API now has a cache, built so it can't hand out an old release by mistake: every answer is filed under the exact release it came from, the current release is always checked against the database, a thousand requests for the same thing cause one database read, and if the cache dies, answers keep coming straight from the database.

Colophon can now unpublish. A takedown is reviewed like any change, the server stops serving the article at once, even through links to old releases, and every CDN in front of it is told to drop its copies. Until a CDN confirms, the release says the removal is still pending.

Every release now gets one honest label: published in the CMS, website update pending, verified at so many locations, or needs attention. Probes look for each release from outside and keep what they saw, so 'verified' always comes with evidence and says where from. Along the way, logging finally named a slowdown CI had been tripping over for two steps.

Colophon now runs a real website: every release is built into a static site where every page says which release it is, checked, and swapped in all at once, so a reader never gets half a release. A probe then reads the live page, and the release's receipt says the site really shows it. It runs on my laptop for now: before it goes public, the Studio gets designed properly.

The Studio got a design of its own, twice: the first one looked like every other generated dashboard, so I rebuilt it from a reference I liked. Editors can now search titles, see what's live and what changed, compare versions and review exact diffs. And the load test that seemed to say the redesign made saves slower turned out to be measuring my laptop's ever-growing test database.

Being built now.