# Contributor handoff — payloadcms/payload

> Canonical page: https://codevetter.com/unpack/payload/agent-handoff

# Contributor handoff — payloadcms/payload

Scanned commit e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Read the relevant configuration, operation, adapter, and feature fixture before editing across boundaries. Tests and CI were inspected, not executed; the suggested commands are future verification choices, not results from this investigation. The inventory is bounded, and environment files were intentionally excluded under the read-only authority. Preserve small changes and distinguish runtime behavior from stale prose, configured bypasses, and generated wiring.
- Use the current manifest and source for version-sensitive decisions: package.json says 4.0.0-canary.37, while AGENTS.md architecture notes still describe Payload 3.x and incorrectly generalize database adapters as Drizzle-based relative to MongoDB implementation. — [package.json#L1-5](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/package.json#L1-L5) [AGENTS.md#L28-35](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/AGENTS.md#L28-L35) [packages/db-mongodb/src/create.ts#L1-10](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/db-mongodb/src/create.ts#L1-L10)
- Before changing startup or config features, read buildConfig, sanitizeConfig, and BasePayload.init: sanitization injects internal collections and jobs, and initialization binds the actual runtime adapters. — [packages/payload/src/config/build.ts#L10-32](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/config/build.ts#L10-L32) [packages/payload/src/config/sanitize.ts#L569-646](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/config/sanitize.ts#L569-L646) [packages/payload/src/index.ts#L992-1019](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/index.ts#L992-L1019)
- For HTTP mutations, inspect handleEndpoints, wrapInternalEndpoints, and the shared collection operation; body parsing and slug injection occur before operation-level authorization and persistence. — [packages/payload/src/utilities/handleEndpoints.ts#L234-269](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/utilities/handleEndpoints.ts#L234-L269) [packages/payload/src/utilities/wrapInternalEndpoints.ts#L6-19](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/utilities/wrapInternalEndpoints.ts#L6-L19) [packages/payload/src/collections/operations/create.ts#L226-250](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/payload/src/collections/operations/create.ts#L226-L250)
- Follow repository conventions for object arguments, types, separate import type statements, translated config labels, stable hook arguments, and logger objects using msg/err. — [AGENTS.md#L55-66](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/AGENTS.md#L55-L66) [AGENTS.md#L87-90](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/AGENTS.md#L87-L90)
- Server components must reference client exports through the prescribed client bundle, and explicit named exports are required for new bundling work; the shared root renderer demonstrates the client-boundary import. — [AGENTS.md#L443-458](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/AGENTS.md#L443-L458) [packages/ui/src/views/Root/index.tsx#L20-24](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/packages/ui/src/views/Root/index.tsx#L20-L24)
- Payload-backed integration tests should use the shared test.suite wrapper and fixture arguments; fixtures own initialization/reset/destruction, while files and other non-database side effects require test cleanup. — [AGENTS.md#L167-180](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/AGENTS.md#L167-L180) [AGENTS.md#L199-203](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/AGENTS.md#L199-L203) [test/__helpers/int/vitest.ts#L107-129](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/test/__helpers/int/vitest.ts#L107-L129)
- Future verification can start with focused unit or integration scripts, then adapter-specific integration or production E2E checks as needed; tests and CI were inspected, not executed, and production preparation contains destructive directory-reset steps that are outside this read-only task. — [package.json#L97-99](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/package.json#L97-L99) [package.json#L128-144](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/package.json#L128-L144) [.github/workflows/main.yml#L308-321](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/.github/workflows/main.yml#L308-L321)
- For UI changes, apply the repository accessibility requirements and token/CSS conventions; generate visual baselines only in the pinned Playwright Docker environment, and do not infer correctness from Next builds that ignore type errors. — [AGENTS.md#L64-66](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/AGENTS.md#L64-L66) [AGENTS.md#L251-260](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/AGENTS.md#L251-L260) [AGENTS.md#L367-416](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/AGENTS.md#L367-L416) [next.config.mjs#L19-21](https://github.com/payloadcms/payload/blob/e6cd442f40563b2dd95cebcc6a3ffaa2dbbc68f2/next.config.mjs#L19-L21)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)