Feature Inventory

This document is the source inventory for making WebBlocks CMS product features discoverable. It is a product and operational visibility inventory, not a runtime contract. Detailed technical contracts remain in the linked docs.

The inventory helps new users and AI/operator workflows understand which CMS capabilities exist, where they appear in admin/public/API surfaces, and which user-facing documentation pages are still missing. It is also suitable as a Markdown source page for a future source-linked CMS documentation page.

Inventory Columns

  • Feature: the product capability or documented direction.
  • Area: the product area that owns the feature.
  • Status: implemented, documented direction, planned only, or needs clearer docs.
  • Admin path: the browser admin surface when one exists.
  • Public behavior: what public visitors or rendered sites experience.
  • API support: whether Internal Content API or discovery surfaces expose it.
  • Source / implementation notes: short source or implementation context.
  • Existing docs: current repo-relative documentation links.
  • Documentation gap / next docs page: the next documentation need.

Core Content Model And Page Builder

<table><thead><tr><th>Feature</th><th>Area</th><th>Status</th><th>Admin path</th><th>Public behavior</th><th>API support</th><th>Source / implementation notes</th><th>Existing docs</th><th>Documentation gap / next docs page</th></tr></thead><tbody><tr><td>Sites</td><td>Core content</td><td>Implemented</td><td><code>/webadmin/sites</code></td><td>Site-scoped public routing, branding, locales, variables, and content</td><td>Discoverable through Internal Content API</td><td>Root content scope for pages, domains, locales, media, and navigation</td><td><a href="/docs/multisite">docs/multisite.md</a>, <a href="/docs/core-concepts">docs/core-concepts.md</a></td><td>covered</td></tr><tr><td>Locales / Localization</td><td>Core content</td><td>Implemented</td><td><code>/webadmin/locales</code>, site edit locales</td><td>Locale-aware pages and public URLs</td><td>Discoverable through Internal Content API</td><td>Localized page translations and locale routing</td><td><a href="/docs/localization">docs/localization.md</a>, <a href="/docs/multisite">docs/multisite.md</a></td><td>covered</td></tr><tr><td>Pages</td><td>Page Builder</td><td>Implemented</td><td><code>/webadmin/pages</code></td><td>Published pages render through CMS public routing</td><td>Pages read and content plan support</td><td>Relational pages, translations, slots, and blocks</td><td><a href="/docs/core-concepts">docs/core-concepts.md</a>, <a href="/docs/internal-content-api">docs/internal-content-api.md</a></td><td>needs user guide</td></tr><tr><td>Page Layouts</td><td>Page Builder</td><td>Implemented</td><td><code>/webadmin/page-layouts</code>, Edit Page settings</td><td>Public shell and slot wrapper behavior</td><td>Discoverable for content planning</td><td>Managed layouts with layout slots and body classes</td><td><a href="/docs/page-layouts">docs/page-layouts.md</a></td><td>covered</td></tr><tr><td>Slots</td><td>Page Builder</td><td>Implemented</td><td>Edit Page slot editor</td><td>Slot regions render page-owned or shared content</td><td>Content plans target page-owned slots</td><td>Slots separate page regions from block content</td><td><a href="/docs/core-concepts">docs/core-concepts.md</a>, <a href="/docs/page-layouts">docs/page-layouts.md</a></td><td>needs Page Builder overview</td></tr><tr><td>Shared Slots</td><td>Page Builder</td><td>Implemented</td><td><code>/webadmin/shared-slots</code>, Edit Page slot source</td><td>Reusable site-scoped slot block trees render in pages</td><td>Shared Slot API foundations and assignment support</td><td>Shared content references, not copied templates</td><td><a href="/docs/core-concepts">docs/core-concepts.md</a>, <a href="/docs/internal-content-api">docs/internal-content-api.md</a></td><td>needs user guide</td></tr><tr><td>Blocks</td><td>Page Builder</td><td>Implemented</td><td>Edit Page slot block editor</td><td>Blocks render public page content</td><td>Block/content discovery and content plans</td><td>Relational block trees with translations and settings</td><td><a href="/docs/core-concepts">docs/core-concepts.md</a>, <a href="/docs/public-block-render-markup">docs/public-block-render-markup.md</a></td><td>needs Page Builder overview</td></tr><tr><td>Block Type Contracts</td><td>Page Builder</td><td>Implemented</td><td><code>/webadmin/block-types</code> contract modal</td><td>Guides safe renderer and editor behavior</td><td>Content contract and discovery surfaces expose block contracts</td><td>Contract registry defines fields, settings, and capabilities</td><td><a href="/docs/block-type-contracts">docs/block-type-contracts.md</a>, <a href="/docs/api-discovery">docs/api-discovery.md</a></td><td>covered</td></tr><tr><td>Page Builder</td><td>Page Builder</td><td>Implemented</td><td>Edit Page</td><td>Authors public pages from layouts, slots, and blocks</td><td>Draft-safe content validate/apply</td><td>Core editing model for page-owned content</td><td><a href="/docs/core-concepts">docs/core-concepts.md</a>, <a href="/docs/ai-page-building-guide">docs/ai-page-building-guide.md</a></td><td>needs Page Builder overview</td></tr><tr><td>Page Assets</td><td>Page Builder</td><td>Implemented</td><td>Edit Page -&gt; Page Management -&gt; Assets</td><td>Page-scoped CSS and JS render only on the owning page</td><td>Not a primary content plan surface</td><td>Relational page assets under site-scoped public paths</td><td><a href="/docs/public-assets">docs/public-assets.md</a>, <a href="../README.md">README.md</a></td><td>needs user guide</td></tr><tr><td>Media Library</td><td>Content assets</td><td>Implemented</td><td><code>/webadmin/media</code></td><td>Public media files can be referenced by blocks and assets</td><td>Existing media references are planned for later API use</td><td>Site-scoped media management and usage checks</td><td><a href="/docs/core-concepts">docs/core-concepts.md</a>, <a href="/docs/public-assets">docs/public-assets.md</a></td><td>needs media guide</td></tr><tr><td>Navigation</td><td>Public structure</td><td>Implemented</td><td><code>/webadmin/navigation</code></td><td>Navigation blocks and menus render public navigation</td><td>Navigation API foundations</td><td>Site-scoped menus and items with groups and icons</td><td><a href="/docs/internal-content-api">docs/internal-content-api.md</a>, <a href="../README.md">README.md</a></td><td>needs user guide</td></tr><tr><td>Navbar / Header composition</td><td>Public structure</td><td>Implemented</td><td>Page Builder block picker</td><td>Navbar, brand, navigation, and header actions compose public headers</td><td>Creatable when discovered in block contracts</td><td>System-owned navbar primitives and composable children</td><td><a href="/docs/public-block-render-markup">docs/public-block-render-markup.md</a>, <a href="../README.md">README.md</a></td><td>needs Page Builder overview</td></tr><tr><td>Page Preview</td><td>Editorial</td><td>Implemented</td><td>Edit Page -&gt; Preview</td><td>Authenticated preview for draft, in-review, and published pages</td><td>Preview URLs may be reported by operator workflows</td><td>Uses public rendering with noindex preview banner</td><td><a href="/docs/editorial-workflow">docs/editorial-workflow.md</a>, <a href="/docs/internal-content-api">docs/internal-content-api.md</a></td><td>covered</td></tr><tr><td>Page Revisions</td><td>Editorial</td><td>Implemented</td><td>Edit Page revisions</td><td>Restores prior page content safely for editors</td><td>Not a primary API write surface</td><td>Page revision snapshots with actor/source metadata</td><td><a href="/docs/revisions">docs/revisions.md</a></td><td>covered</td></tr><tr><td>Shared Slot Revisions</td><td>Editorial</td><td>Implemented</td><td>Shared Slot revisions</td><td>Restores reusable shared content</td><td>Not a primary API write surface</td><td>Shared Slot revision history and restore</td><td><a href="/docs/revisions">docs/revisions.md</a></td><td>covered</td></tr><tr><td>Page Converter</td><td>Page Builder</td><td>Implemented</td><td><code>/webadmin/pages</code>, Import/Convert flows</td><td>Creates draft CMS pages from reviewed static HTML analysis</td><td>Uses internal content planning concepts, not a public API</td><td>Scoped HTML analysis and signed conversion plans</td><td><a href="/docs/page-converter-roadmap">docs/page-converter-roadmap.md</a>, <a href="../README.md">README.md</a></td><td>needs user guide</td></tr><tr><td>Single Page Import</td><td>Page Builder</td><td>Implemented</td><td><code>/webadmin/pages</code> -&gt; Import Page</td><td>Creates one draft page from a documented JSON payload</td><td>Separate from Internal Content API</td><td>Admin modal workflow for reviewed single-page JSON import</td><td><a href="../README.md">README.md</a></td><td>needs user guide</td></tr></tbody></table>

Editorial Workflow And Permissions

<table><thead><tr><th>Feature</th><th>Area</th><th>Status</th><th>Admin path</th><th>Public behavior</th><th>API support</th><th>Source / implementation notes</th><th>Existing docs</th><th>Documentation gap / next docs page</th></tr></thead><tbody><tr><td>Draft / In Review / Published / Archived workflow</td><td>Editorial</td><td>Implemented</td><td>Edit Page -&gt; Overview</td><td>Public routes render published pages only</td><td>API remains draft-first for content writes</td><td>Page statuses separate authoring, review, publication, and archive</td><td><a href="/docs/editorial-workflow">docs/editorial-workflow.md</a></td><td>covered</td></tr><tr><td>Editor role</td><td>Permissions</td><td>Implemented</td><td><code>/webadmin/users</code>, role management</td><td>Editors can manage assigned content within permissions</td><td>Authorization affects admin/API access</td><td>CMS role separate from host product admin status</td><td><a href="/docs/users-and-permissions">docs/users-and-permissions.md</a></td><td>covered</td></tr><tr><td>Site Admin role</td><td>Permissions</td><td>Implemented</td><td><code>/webadmin/users</code>, role management</td><td>Site admins manage assigned site content</td><td>Authorization affects admin/API access</td><td>Site-scoped administrative role</td><td><a href="/docs/users-and-permissions">docs/users-and-permissions.md</a></td><td>covered</td></tr><tr><td>Super Admin role</td><td>Permissions</td><td>Implemented</td><td><code>/webadmin/users</code>, role management</td><td>Install-level CMS administration</td><td>Required for token and system operations</td><td>CMS super admin is a CMS role, not host admin status</td><td><a href="/docs/users-and-permissions">docs/users-and-permissions.md</a>, <a href="../ARCHITECTURE_DECISIONS.md">ARCHITECTURE_DECISIONS.md</a></td><td>covered</td></tr><tr><td>Assigned-site access</td><td>Permissions</td><td>Implemented</td><td>User management</td><td>Restricts admin work to assigned sites</td><td>Applies to API authorization</td><td>Site memberships constrain CMS access</td><td><a href="/docs/users-and-permissions">docs/users-and-permissions.md</a>, <a href="/docs/multisite">docs/multisite.md</a></td><td>covered</td></tr><tr><td>Workflow transitions</td><td>Editorial</td><td>Implemented</td><td>Edit Page -&gt; Overview</td><td>Controls when pages can become public or leave publication</td><td>Publish workflow remains separate from normal content plans</td><td>Transition permissions guard editorial state changes</td><td><a href="/docs/editorial-workflow">docs/editorial-workflow.md</a></td><td>covered</td></tr><tr><td>Publish permissions</td><td>Permissions</td><td>Implemented</td><td>Role/user permissions</td><td>Determines who can publish public pages</td><td>Publish API capability is advanced and separate</td><td>Publication is intentionally not default for AI/operator writes</td><td><a href="/docs/editorial-workflow">docs/editorial-workflow.md</a>, <a href="/docs/internal-content-api">docs/internal-content-api.md</a></td><td>needs AI/operator example</td></tr><tr><td>Archive permissions</td><td>Permissions</td><td>Implemented</td><td>Role/user permissions</td><td>Controls removal from public publication</td><td>Not a normal content plan behavior</td><td>Archive is editorial workflow, not destructive deletion</td><td><a href="/docs/editorial-workflow">docs/editorial-workflow.md</a></td><td>covered</td></tr><tr><td>Revision restore permissions</td><td>Permissions</td><td>Implemented</td><td>Page and Shared Slot revision screens</td><td>Restored content affects future public rendering after publication</td><td>Not a normal content plan behavior</td><td>Restore flows require CMS authorization</td><td><a href="/docs/revisions">docs/revisions.md</a></td><td>covered</td></tr><tr><td>CMS profile page</td><td>Admin UX</td><td>Implemented</td><td><code>/webadmin/profile</code></td><td>No direct public behavior</td><td>Not API-oriented</td><td>Signed-in admins manage their own profile</td><td><a href="../README.md">README.md</a></td><td>needs user guide</td></tr><tr><td>Install-level users</td><td>Permissions</td><td>Implemented</td><td><code>/webadmin/users</code></td><td>No direct public behavior</td><td>Authorization affects API tokens and access</td><td>CMS user management attaches CMS roles to host users</td><td><a href="/docs/users-and-permissions">docs/users-and-permissions.md</a></td><td>covered</td></tr></tbody></table>

Public Site Features

<table><thead><tr><th>Feature</th><th>Area</th><th>Status</th><th>Admin path</th><th>Public behavior</th><th>API support</th><th>Source / implementation notes</th><th>Existing docs</th><th>Documentation gap / next docs page</th></tr></thead><tbody><tr><td>Public page rendering</td><td>Public site</td><td>Implemented</td><td>Page Builder and public settings</td><td>Renders published CMS pages from layouts, slots, and blocks</td><td>Content plans can create draft renderable pages</td><td>Public presenter resolves sites, pages, slots, shared slots, and blocks</td><td><a href="/docs/core-concepts">docs/core-concepts.md</a>, <a href="/docs/public-block-render-markup">docs/public-block-render-markup.md</a></td><td>needs Page Builder overview</td></tr><tr><td>Public search</td><td>Public site</td><td>Implemented</td><td>Maintenance -&gt; Search Rebuild, public search settings</td><td>Site/locale-scoped public search results</td><td>Not a delivery API</td><td>Database-backed search index</td><td><a href="/docs/search">docs/search.md</a></td><td>covered</td></tr><tr><td>Search modal</td><td>Public site</td><td>Implemented</td><td>Header Actions block and public assets</td><td>Header-triggered search modal</td><td>Not API-oriented</td><td>Uses CMS-owned public search modal runtime</td><td><a href="/docs/search">docs/search.md</a>, <a href="../README.md">README.md</a></td><td>covered</td></tr><tr><td>Search Form block</td><td>Public blocks</td><td>Implemented</td><td>Page Builder block picker</td><td>Renders public search form</td><td>Creatable when discovered in block contracts</td><td>Block-based search entry point</td><td><a href="/docs/search">docs/search.md</a>, <a href="/docs/public-block-render-markup">docs/public-block-render-markup.md</a></td><td>covered</td></tr><tr><td>Visitor Reports</td><td>Analytics</td><td>Implemented</td><td><code>/webadmin/visitor-reports</code></td><td>Privacy-safe public traffic reporting</td><td>Not a public delivery API</td><td>Visitor event aggregates and reporting</td><td><a href="../README.md">README.md</a></td><td>needs user guide</td></tr><tr><td>Site Branding / SEO defaults</td><td>Public site</td><td>Implemented</td><td>Edit Site -&gt; Branding, SEO Defaults</td><td>Public metadata fallback and brand assets</td><td>Site discovery surfaces expose context</td><td>Site-owned display name, tagline, SEO defaults, favicon, social image</td><td><a href="/docs/core-concepts">docs/core-concepts.md</a>, <a href="../README.md">README.md</a></td><td>needs user guide</td></tr><tr><td>Page-level SEO overrides</td><td>Public site</td><td>Implemented</td><td>Page translation settings</td><td>Locale-aware page metadata overrides</td><td>Page read surfaces include page metadata context</td><td>SEO values live on page translations</td><td><a href="../README.md">README.md</a>, <a href="/docs/localization">docs/localization.md</a></td><td>needs user guide</td></tr><tr><td>Favicon / social image</td><td>Public site</td><td>Implemented</td><td>Edit Site -&gt; Branding</td><td>Public favicon and social preview fallbacks</td><td>Not a primary API write surface</td><td>Site-level brand media support</td><td><a href="../README.md">README.md</a></td><td>needs user guide</td></tr><tr><td>Site variables</td><td>Public site</td><td>Implemented</td><td>Edit Site -&gt; Variables</td><td>Replaces <code>{{ site.variable_key }}</code> tokens in supported public rendering</td><td>Not a primary API write surface</td><td>Relational reusable site-scoped text tokens</td><td><a href="../README.md">README.md</a></td><td>needs user guide</td></tr><tr><td>Multisite routing</td><td>Public site</td><td>Implemented</td><td><code>/webadmin/sites</code>, domain management</td><td>Routes requests to the matching site/domain</td><td>Site discovery supports operator context</td><td>Primary and alias domains per site</td><td><a href="/docs/multisite">docs/multisite.md</a>, <a href="/docs/coexistence">docs/coexistence.md</a></td><td>covered</td></tr><tr><td>Localized public URLs</td><td>Public site</td><td>Implemented</td><td>Locales and page translations</td><td>Locale-aware page paths and fallbacks</td><td>Locale discovery supports operator context</td><td>Page translations and locale routing</td><td><a href="/docs/localization">docs/localization.md</a></td><td>covered</td></tr></tbody></table>

Forms And Messages

Contact Form and Contact Messages are first-class WebBlocks CMS features. The user-facing setup, submission, spam handling, email fallback, and troubleshooting guide now lives in docs/contact-forms-and-messages.md.

<table><thead><tr><th>Feature</th><th>Area</th><th>Status</th><th>Admin path</th><th>Public behavior</th><th>API support</th><th>Source / implementation notes</th><th>Existing docs</th><th>Documentation gap / next docs page</th></tr></thead><tbody><tr><td>Contact Form block</td><td>Forms</td><td>Implemented</td><td>Page Builder block picker</td><td>Renders a public form and stores submissions</td><td>Creatable through content plans when <code>contact_form</code> is discovered</td><td>First-class block with recipient fallback support</td><td><a href="/docs/contact-forms-and-messages">docs/contact-forms-and-messages.md</a>, <a href="/docs/block-type-contracts">docs/block-type-contracts.md</a>, <a href="/docs/public-block-render-markup">docs/public-block-render-markup.md</a></td><td>covered</td></tr><tr><td>Contact Messages admin screen</td><td>Forms</td><td>Implemented</td><td><code>/webadmin/contact-messages</code></td><td>No public listing; admins review submissions</td><td>Not a public delivery API</td><td>Admin table includes delivery and spam status</td><td><a href="/docs/contact-forms-and-messages">docs/contact-forms-and-messages.md</a>, <a href="../README.md">README.md</a></td><td>covered</td></tr><tr><td>Contact form submission storage</td><td>Forms</td><td>Implemented</td><td>Contact Messages</td><td>Stores real public submissions for review</td><td>Not API-oriented</td><td>Submissions are stored before email notification attempts</td><td><a href="/docs/contact-forms-and-messages">docs/contact-forms-and-messages.md</a></td><td>covered</td></tr><tr><td>Anti-spam check discard</td><td>Forms</td><td>Implemented</td><td>Contact Form renderer and submission handling</td><td>Filled generated check-field submissions receive normal success redirect and are discarded</td><td>Not API-oriented</td><td>CMS-owned hidden <code>.wb-form-check</code> generated by native renderer</td><td><a href="/docs/contact-forms-and-messages">docs/contact-forms-and-messages.md</a></td><td>covered</td></tr><tr><td>Spam scoring / quarantine</td><td>Forms</td><td>Implemented</td><td>Contact Messages</td><td>Suspicious submissions can be quarantined for admin review</td><td>Not API-oriented</td><td>Conservative spam signals for links, commercial patterns, and repeat IPs</td><td><a href="/docs/contact-forms-and-messages">docs/contact-forms-and-messages.md</a></td><td>covered</td></tr><tr><td>Email notification fallback chain</td><td>Forms</td><td>Implemented</td><td>Contact Form block, Edit Site -&gt; Contact, environment mail</td><td>Attempts recipient resolution from block, site, and safe mail fallback</td><td>Not API-oriented</td><td>Delivery attempts happen after durable storage; setup guidance covers <code>.env</code>, site recipients, and cache clearing</td><td><a href="/docs/contact-forms-and-messages">docs/contact-forms-and-messages.md</a>, <a href="/docs/installation">docs/installation.md</a>, <a href="/docs/getting-started">docs/getting-started.md</a></td><td>covered</td></tr><tr><td>Contact mail diagnose command</td><td>Operations</td><td>Implemented</td><td>Operator-side diagnostic</td><td>No public behavior</td><td>Not API-oriented</td><td>Secret-safe mail configuration diagnostics and controlled SMTP send checks</td><td><a href="/docs/contact-forms-and-messages">docs/contact-forms-and-messages.md</a>, <a href="/docs/operations">docs/operations.md</a>, <a href="../README.md">README.md</a></td><td>covered</td></tr><tr><td>Delivery status / failure details</td><td>Forms</td><td>Implemented</td><td>Contact Messages</td><td>No public failure disclosure</td><td>Not API-oriented</td><td>Saved messages include admin-visible notification status</td><td><a href="/docs/contact-forms-and-messages">docs/contact-forms-and-messages.md</a></td><td>covered</td></tr></tbody></table>

Internal Content API And AI Operations

The Internal Content API is for trusted AI/operator tools. It is not a public delivery API, not an AI vendor integration, and not an import/export replacement. AI/operator tools must use live discovery and must not guess block handles.

Recommended additional docs:

<table><thead><tr><th>Feature</th><th>Area</th><th>Status</th><th>Admin path</th><th>Public behavior</th><th>API support</th><th>Source / implementation notes</th><th>Existing docs</th><th>Documentation gap / next docs page</th></tr></thead><tbody><tr><td>API Tokens</td><td>AI operations</td><td>Implemented</td><td><code>/webadmin/system/api-tokens</code></td><td>No public behavior</td><td>Bearer token authentication</td><td>Tokens are hashed and shown once</td><td><a href="/docs/internal-content-api">docs/internal-content-api.md</a>, <a href="/docs/api-discovery">docs/api-discovery.md</a></td><td>covered</td></tr><tr><td>Token capabilities</td><td>AI operations</td><td>Implemented</td><td>API token create/edit</td><td>No public behavior</td><td>Capability-scoped API authorization</td><td>Publish/delete capabilities are advanced opt-ins</td><td><a href="/docs/internal-content-api">docs/internal-content-api.md</a></td><td>needs AI/operator example</td></tr><tr><td>API discovery endpoint</td><td>AI operations</td><td>Implemented</td><td>No browser admin path</td><td>No public behavior</td><td>Discovery root for trusted tools</td><td>Starts from API base URL and token</td><td><a href="/docs/api-discovery">docs/api-discovery.md</a></td><td>covered</td></tr><tr><td>OpenAPI endpoint</td><td>AI operations</td><td>Implemented</td><td>No browser admin path</td><td>No public behavior</td><td>Machine-readable API contract</td><td>Linked from discovery</td><td><a href="/docs/api-discovery">docs/api-discovery.md</a>, <a href="/docs/internal-content-api">docs/internal-content-api.md</a></td><td>covered</td></tr><tr><td>AI guide endpoint</td><td>AI operations</td><td>Implemented</td><td>No browser admin path</td><td>No public behavior</td><td>Guide link from discovery</td><td>Helps operators build safely</td><td><a href="/docs/ai-page-building-guide">docs/ai-page-building-guide.md</a></td><td>needs overview</td></tr><tr><td>Content contract endpoint</td><td>AI operations</td><td>Implemented</td><td>No browser admin path</td><td>No public behavior</td><td>Block/content contract discovery</td><td>Required before content planning</td><td><a href="/docs/api-discovery">docs/api-discovery.md</a>, <a href="/docs/block-type-contracts">docs/block-type-contracts.md</a></td><td>covered</td></tr><tr><td>Examples endpoint</td><td>AI operations</td><td>Implemented</td><td>No browser admin path</td><td>No public behavior</td><td>Example content plan discovery</td><td>Linked from discovery</td><td><a href="/docs/api-discovery">docs/api-discovery.md</a></td><td>needs AI/operator example</td></tr><tr><td>Pages read API</td><td>AI operations</td><td>Implemented</td><td>No browser admin path</td><td>No public behavior</td><td>Read-only page inspection</td><td>Resource-style endpoint under the internal API</td><td><a href="/docs/internal-content-api">docs/internal-content-api.md</a></td><td>covered</td></tr><tr><td>Block/content discovery</td><td>AI operations</td><td>Implemented</td><td>No browser admin path</td><td>No public behavior</td><td>Block contract and content inspection</td><td>Prevents guessed block handles</td><td><a href="/docs/block-type-contracts">docs/block-type-contracts.md</a>, <a href="/docs/api-discovery">docs/api-discovery.md</a></td><td>covered</td></tr><tr><td>Content validate</td><td>AI operations</td><td>Implemented</td><td>No browser admin path</td><td>No public behavior</td><td>Validates content plans before apply</td><td>Required safety step for operator workflows</td><td><a href="/docs/internal-content-api">docs/internal-content-api.md</a>, <a href="/docs/ai-page-building-guide">docs/ai-page-building-guide.md</a></td><td>covered</td></tr><tr><td>Content apply</td><td>AI operations</td><td>Implemented</td><td>No browser admin path</td><td>Creates draft CMS content, not public by default</td><td>Applies approved content plans</td><td>Draft-first and non-destructive by default</td><td><a href="/docs/internal-content-api">docs/internal-content-api.md</a>, <a href="/docs/ai-page-building-guide">docs/ai-page-building-guide.md</a></td><td>covered</td></tr><tr><td>Draft-safe page creation</td><td>AI operations</td><td>Implemented</td><td>Resulting page appears in Pages</td><td>Draft pages can be previewed before publication</td><td>Supported through content plans</td><td>Creates pages, slots, translations, and block trees</td><td><a href="/docs/internal-content-api">docs/internal-content-api.md</a></td><td>needs AI/operator example</td></tr><tr><td>replace_existing_draft_page / draft-safe replacement model</td><td>AI operations</td><td>Implemented</td><td>Existing draft page in Pages</td><td>Replaces draft page-owned managed slots only</td><td>Supported validate/apply mode</td><td>Uses expected path or updated-at safety guards</td><td><a href="/docs/internal-content-api">docs/internal-content-api.md</a>, <a href="/docs/markdown-docs-to-cms-sync">docs/markdown-docs-to-cms-sync.md</a></td><td>needs AI/operator example</td></tr><tr><td>Navigation API foundations</td><td>AI operations</td><td>Implemented</td><td>Navigation resources in admin</td><td>Planned content can affect public navigation after approval</td><td>Navigation menu/item foundations</td><td>Safe foundations without broad destructive behavior</td><td><a href="/docs/internal-content-api">docs/internal-content-api.md</a></td><td>needs AI/operator example</td></tr><tr><td>Shared Slots API foundations</td><td>AI operations</td><td>Implemented</td><td>Shared Slots admin</td><td>Shared content can render across pages after approval</td><td>Shared Slot and assignment foundations</td><td>Compatible same-site assignment support</td><td><a href="/docs/internal-content-api">docs/internal-content-api.md</a></td><td>needs AI/operator example</td></tr><tr><td>JSON-only errors</td><td>AI operations</td><td>Implemented</td><td>No browser admin path</td><td>No public behavior</td><td>API errors return JSON</td><td>Separates operator API from browser admin responses</td><td><a href="/docs/internal-content-api">docs/internal-content-api.md</a></td><td>covered</td></tr><tr><td>CSRF-free Bearer API write behavior</td><td>AI operations</td><td>Implemented</td><td>No browser admin path</td><td>No public behavior</td><td>Bearer writes do not depend on browser CSRF</td><td>Trusted token contract for operator tools</td><td><a href="/docs/internal-content-api">docs/internal-content-api.md</a></td><td>covered</td></tr><tr><td>Preview URL reporting</td><td>AI operations</td><td>Implemented</td><td>Edit Page preview</td><td>Operators can review draft previews</td><td>Apply responses can report preview context</td><td>Preview remains authenticated and draft-safe</td><td><a href="/docs/ai-page-building-guide">docs/ai-page-building-guide.md</a>, <a href="/docs/editorial-workflow">docs/editorial-workflow.md</a></td><td>covered</td></tr><tr><td>Draft-first AI page building workflow</td><td>AI operations</td><td>Implemented</td><td>Pages and preview screens</td><td>AI-created pages are drafts until approved</td><td>Discovery, validate, apply workflow</td><td>Requires live discovery and exact contracts</td><td><a href="/docs/ai-page-building-guide">docs/ai-page-building-guide.md</a></td><td>needs <code>docs/ai-page-building-overview.md</code></td></tr><tr><td>Markdown docs-to-CMS sync runbook</td><td>Documentation</td><td>Documented direction</td><td>No runtime admin path</td><td>Future source-linked docs pages can publish Markdown-derived content</td><td>Would use discovery, validate, and approved draft-safe apply workflows</td><td>Markdown source remains authoritative and changed <code>docs/</code> files drive AI/operator planning</td><td><a href="/docs/markdown-docs-to-cms-sync">docs/markdown-docs-to-cms-sync.md</a></td><td>covered</td></tr></tbody></table>

Operations

<table><thead><tr><th>Feature</th><th>Area</th><th>Status</th><th>Admin path</th><th>Public behavior</th><th>API support</th><th>Source / implementation notes</th><th>Existing docs</th><th>Documentation gap / next docs page</th></tr></thead><tbody><tr><td>System Updates</td><td>Operations</td><td>Implemented</td><td><code>/webadmin/system/updates</code></td><td>Updates installed CMS code and package assets</td><td>Not a public delivery API</td><td>Package-native update flow</td><td><a href="/docs/updates">docs/updates.md</a>, <a href="/docs/operations">docs/operations.md</a></td><td>needs operator guide</td></tr><tr><td>Release package updates</td><td>Operations</td><td>Implemented</td><td>System Updates</td><td>Public site behavior changes after approved update</td><td>Not API-oriented</td><td>Consumes package release artifacts</td><td><a href="/docs/updates">docs/updates.md</a>, <a href="/docs/package-architecture">docs/package-architecture.md</a></td><td>needs operator guide</td></tr><tr><td>Package-native update root</td><td>Operations</td><td>Implemented</td><td>System Updates</td><td>No direct public behavior</td><td>Not API-oriented</td><td>Canonical package root is <code>vendor/fklavyenet/webblocks-cms</code></td><td><a href="/docs/package-architecture">docs/package-architecture.md</a>, <a href="../ARCHITECTURE_DECISIONS.md">ARCHITECTURE_DECISIONS.md</a></td><td>covered</td></tr><tr><td>Update migrations</td><td>Operations</td><td>Implemented</td><td>System Updates</td><td>Keeps runtime-required schema aligned</td><td>Not API-oriented</td><td>Package update migrations support existing installs</td><td><a href="/docs/updates">docs/updates.md</a>, <a href="../ARCHITECTURE_DECISIONS.md">ARCHITECTURE_DECISIONS.md</a></td><td>covered</td></tr><tr><td>Update readiness</td><td>Operations</td><td>Implemented</td><td>System Updates</td><td>No public behavior</td><td>Not API-oriented</td><td>Readiness and release detail checks before update</td><td><a href="/docs/updates">docs/updates.md</a></td><td>needs operator guide</td></tr><tr><td>Last update run</td><td>Operations</td><td>Implemented</td><td>System Updates</td><td>No public behavior</td><td>Not API-oriented</td><td>Last-run reporting for operators</td><td><a href="/docs/updates">docs/updates.md</a>, <a href="../README.md">README.md</a></td><td>needs operator guide</td></tr><tr><td>Support report</td><td>Operations</td><td>Implemented</td><td>System Updates</td><td>No public behavior</td><td>Not API-oriented</td><td>Downloadable support diagnostics for update issues</td><td><a href="/docs/updates">docs/updates.md</a></td><td>needs operator guide</td></tr><tr><td>Backups</td><td>Operations</td><td>Implemented</td><td><code>/webadmin/backups</code></td><td>Protects site content and install state</td><td>Not API-oriented</td><td>Backup records and storage disk</td><td><a href="/docs/operations">docs/operations.md</a></td><td>covered</td></tr><tr><td>Restore</td><td>Operations</td><td>Implemented</td><td><code>/webadmin/backups</code> restore flow</td><td>Restored content can affect public site</td><td>Not API-oriented</td><td>Controlled backup restore workflow</td><td><a href="/docs/operations">docs/operations.md</a></td><td>covered</td></tr><tr><td>Site Export / Import</td><td>Operations</td><td>Implemented</td><td><code>/webadmin/site-transfers/exports</code>, <code>/webadmin/site-transfers/imports</code></td><td>Moves site content between installs</td><td>Separate from Internal Content API</td><td>Packages content, media, navigation, and related site data</td><td><a href="/docs/operations">docs/operations.md</a>, <a href="../README.md">README.md</a></td><td>needs user guide</td></tr><tr><td>Site Clone / Promotion</td><td>Operations</td><td>Implemented / documented</td><td>Site and promotion workflows</td><td>Cloned/promoted site content can become public</td><td>Not a public delivery API</td><td>Package-based site transfer and promotion concepts</td><td><a href="/docs/operations">docs/operations.md</a>, <a href="../README.md">README.md</a></td><td>needs operator guide</td></tr><tr><td>Search Rebuild</td><td>Operations</td><td>Implemented</td><td>Maintenance -&gt; Search Rebuild</td><td>Refreshes public search index</td><td>Not API-oriented</td><td>Rebuilds database-backed public search</td><td><a href="/docs/search">docs/search.md</a>, <a href="/docs/operations">docs/operations.md</a></td><td>covered</td></tr><tr><td>Catalog repair commands</td><td>Operations</td><td>Implemented</td><td>Operator-side maintenance</td><td>Repairs CMS catalogs used by admin/rendering</td><td>Not API-oriented</td><td>Maintenance commands for catalog consistency</td><td><a href="/docs/operations">docs/operations.md</a>, <a href="../README.md">README.md</a></td><td>needs operator guide</td></tr><tr><td>Install wizard</td><td>Installation</td><td>Implemented</td><td>First-run install screens</td><td>Creates initial CMS install state</td><td>Not API-oriented</td><td>Browser-guided first-run setup</td><td><a href="/docs/installation">docs/installation.md</a></td><td>covered</td></tr><tr><td>Package consumer install</td><td>Installation</td><td>Implemented</td><td>Package install workflow</td><td>Enables CMS public/admin routes in a host</td><td>Not API-oriented</td><td>Package installer prepares schema, assets, and first user</td><td><a href="/docs/installation">docs/installation.md</a>, <a href="../README.md">README.md</a></td><td>covered</td></tr><tr><td>Native local development</td><td>Development</td><td>Implemented docs</td><td>Local development only</td><td>Local <code>.test</code> development environment</td><td>Not API-oriented</td><td>HTTPS-only local development guidance</td><td><a href="/docs/native-local-development">docs/native-local-development.md</a></td><td>covered</td></tr><tr><td>Testing strategy</td><td>Development</td><td>Implemented docs</td><td>Development workflow</td><td>No direct public behavior</td><td>Not API-oriented</td><td>Risk-based test scripts and validation guidance</td><td><a href="/docs/testing-strategy">docs/testing-strategy.md</a></td><td>covered</td></tr></tbody></table>

Plugin System

<table><thead><tr><th>Feature</th><th>Area</th><th>Status</th><th>Admin path</th><th>Public behavior</th><th>API support</th><th>Source / implementation notes</th><th>Existing docs</th><th>Documentation gap / next docs page</th></tr></thead><tbody><tr><td>Plugin host architecture</td><td>Plugins</td><td>Implemented foundations</td><td><code>/webadmin/system/plugins</code></td><td>Plugins can add public behavior when enabled</td><td>Not a generic public API</td><td>CMS core is a plugin host</td><td><a href="/docs/plugin-system">docs/plugin-system.md</a>, <a href="../ARCHITECTURE_DECISIONS.md">ARCHITECTURE_DECISIONS.md</a></td><td>covered</td></tr><tr><td>Manual ZIP plugin install</td><td>Plugins</td><td>Implemented</td><td>System -&gt; Plugins -&gt; Upload</td><td>Installed plugins are disabled by default</td><td>Not API-oriented</td><td>Storage-owned install path and package validation</td><td><a href="/docs/plugin-system">docs/plugin-system.md</a></td><td>needs plugin lifecycle guide</td></tr><tr><td>Disabled-by-default plugin lifecycle</td><td>Plugins</td><td>Implemented</td><td>System -&gt; Plugins</td><td>Disabled plugins are inert</td><td>Not API-oriented</td><td>Installed packages must be explicitly enabled</td><td><a href="/docs/plugin-system">docs/plugin-system.md</a></td><td>covered</td></tr><tr><td>Enable / disable</td><td>Plugins</td><td>Implemented</td><td>System -&gt; Plugins</td><td>Enables or removes active plugin behavior</td><td>Not API-oriented</td><td>Compatibility and setup checks guard activation</td><td><a href="/docs/plugin-system">docs/plugin-system.md</a></td><td>needs plugin lifecycle guide</td></tr><tr><td>Plugin setup / migrations</td><td>Plugins</td><td>Implemented foundations</td><td>Plugin detail/setup screens</td><td>Plugin behavior may require setup before routes work</td><td>Not API-oriented</td><td>Missing plugin-owned tables show controlled setup guidance</td><td><a href="/docs/plugin-system">docs/plugin-system.md</a></td><td>needs plugin lifecycle guide</td></tr><tr><td>Plugin permissions</td><td>Plugins</td><td>Implemented</td><td>Role/user permission management</td><td>Controls access to plugin admin routes</td><td>Not API-oriented</td><td>Permissions are handle-prefixed</td><td><a href="/docs/plugin-system">docs/plugin-system.md</a></td><td>covered</td></tr><tr><td>Plugin admin routes</td><td>Plugins</td><td>Implemented</td><td><code>/webadmin/plugins/{plugin-handle}</code></td><td>Plugin browser admin behavior when enabled</td><td>Not API-oriented</td><td>Routes are enabled-only and namespace-guarded</td><td><a href="/docs/plugin-system">docs/plugin-system.md</a></td><td>covered</td></tr><tr><td>Plugin health/status</td><td>Plugins</td><td>Implemented</td><td>System -&gt; Plugins</td><td>No direct public behavior</td><td>Not API-oriented</td><td>Health checks and compatibility status</td><td><a href="/docs/plugin-system">docs/plugin-system.md</a></td><td>covered</td></tr><tr><td>Plugin-owned blocks/block packs</td><td>Plugins</td><td>Implemented foundations</td><td>Block picker when plugin is active</td><td>Plugin blocks can render public content</td><td>Discoverable when block contracts expose them</td><td>Plugin block handles are plugin-owned</td><td><a href="/docs/plugin-system">docs/plugin-system.md</a>, <a href="/docs/block-type-contracts">docs/block-type-contracts.md</a></td><td>needs plugin lifecycle guide</td></tr><tr><td>Public asset hooks</td><td>Plugins</td><td>Implemented foundations</td><td>Plugin registration</td><td>Plugins can contribute safe public assets</td><td>Not API-oriented</td><td>Safe head and body-end contribution hooks</td><td><a href="/docs/plugin-system">docs/plugin-system.md</a></td><td>covered</td></tr><tr><td>Plugin Catalog browser</td><td>Plugins</td><td>Implemented</td><td>System -&gt; Plugins -&gt; Browse Plugin Catalog</td><td>No direct public site behavior</td><td>Reads catalog metadata, not a public delivery API</td><td>Public catalog metadata browsing</td><td><a href="/docs/plugin-system">docs/plugin-system.md</a>, <a href="/docs/plugin-ecosystem-and-catalog">docs/plugin-ecosystem-and-catalog.md</a></td><td>needs plugin lifecycle guide</td></tr><tr><td>Catalog install</td><td>Plugins</td><td>Implemented</td><td>Plugin Catalog detail</td><td>Installed plugin remains disabled until enabled</td><td>Not API-oriented</td><td>Checksum-verified catalog artifact install</td><td><a href="/docs/plugin-system">docs/plugin-system.md</a></td><td>needs plugin lifecycle guide</td></tr><tr><td>Catalog-backed plugin updates</td><td>Plugins</td><td>Implemented</td><td>System -&gt; Plugins</td><td>Updated plugin behavior after approved update</td><td>Not API-oriented</td><td>Reuses checksum and package validation path</td><td><a href="/docs/plugin-system">docs/plugin-system.md</a></td><td>needs plugin lifecycle guide</td></tr><tr><td>Manual uninstall</td><td>Plugins</td><td>Implemented</td><td>System -&gt; Plugins</td><td>Removes disabled uploaded plugin package</td><td>Not API-oriented</td><td>Preserves plugin-owned database tables</td><td><a href="/docs/plugin-system">docs/plugin-system.md</a></td><td>covered</td></tr><tr><td>WebBlocks UI Manager as operator plugin, not bundled CMS core feature</td><td>Plugins</td><td>Implemented architecture</td><td>Installed only when manually uploaded/enabled</td><td>No ordinary CMS runtime behavior</td><td>Not API-oriented</td><td>First-party operator plugin remains outside bundled core</td><td><a href="/docs/plugin-system">docs/plugin-system.md</a>, <a href="../ARCHITECTURE_DECISIONS.md">ARCHITECTURE_DECISIONS.md</a></td><td>covered</td></tr></tbody></table>

Documentation And Product Site Readiness

Current docs are technically rich, but feature discoverability is incomplete. This inventory should help decide which user-facing docs pages are missing and which source pages can later be published as source-linked documentation pages in a target documentation site.

Priority documentation pages:

  1. AI Page Building Overview
  2. Page Builder Overview
  3. Feature Inventory
  4. Forms / Messages troubleshooting
  5. Plugin lifecycle guide
  6. System Updates operator guide

webblocksui.com marketing content should remain separate from technical documentation. Marketing pages can summarize product value, while Markdown documentation should remain the source for technical and operator guidance.