Changelog — v1

v1.0.3 — 2026-09-12

Display names: Core Backend and Middleware Backend (paths unchanged: /v1/core/, /v1/middleware/).
GitHub Pages workflow runs only on the deploy-github-pages branch.

Playbooks are how to build each layer.
IDOR only on Core Backend API-key path settings and Middleware Backend. Frontend browse x-api-key is public. Do not assign IDOR to Vue; if a control is missing, recommend it on Core Backend/Middleware Backend.

Framing pass (no winner-URL moves).

Product: PMS — hotels, shortlets, and apartments are all property (property_category).
Three equal playbooks: Frontend (screens), Middleware Backend (processors, webhooks, workers), Core Backend (recommended Nellalink usage / do-not-add).
Home and v1 overview lead with all three; not frontend-only.

Team	Action
Product	Read playbooks as guest/owner flows
Frontend	Screens against winner URLs
Middleware Backend	Folders + workers from the Middleware Backend playbook
Core Backend	Stay generic; follow recommended usage

First published lodging docs.

Architecture: frontend → Core Backend for auth/CRUD; frontend → Middleware Backend for processors; Middleware Backend → Core Backend to persist.
Frontend playbooks: sign up/login, owner property setup, guest search, checkout/pay, manage booking — each step has one winner URL.
Core Backend conventions: property, room, rate_plan, booking, payment + metadata catalog.
Middleware Backend contracts (to implement except file-manager): availability, payments, refunds, emails, google-rates.
Hosting: /v1 stable, /next drafts. Iteration prompt + IDOR checklist.

Team	Action
Frontend	Build screens against winner URLs (stop new Convex-only features)
Middleware Backend	Implement route folders from `specs/middleware/v1`
Core Backend	Stay generic; consider object-level ACL on GET/PUT entity by uuid (IDOR)