# Contributor handoff — strapi/strapi

> Canonical page: https://codevetter.com/unpack/strapi/agent-handoff

# Contributor handoff — strapi/strapi

Scanned commit 93476f908c08d6d3d5215c06483829e3c6da1b32 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Use this brief as an anchored navigation aid for the pinned commit, then inspect the owning package and tests before changing behavior. Tests and CI were inspected, not executed; the inventory and coverage assessment are bounded. Preserve transaction, authorization, provider, and license boundaries, and distinguish current implementation from historical contributor descriptions. This investigation authorized public-source reads only and performed no repository execution or edits.
- Begin with repository conventions and the owning manifest: contributor changes target develop, shared types come from @strapi/types, and package scripts define available checks. Tests and CI cited here were inspected, not executed; their definitions establish intended checks rather than passing results. — [AGENTS.md#L221-225](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/AGENTS.md#L221-L225) [AGENTS.md#L248-253](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/AGENTS.md#L248-L253) [packages/core/core/package.json#L45-57](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/package.json#L45-L57) [.github/workflows/tests.yml#L175-228](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/.github/workflows/tests.yml#L175-L228)
- Treat examples as development sandboxes, with the documented examples/complex migration-fixture exception. Production framework fixes belong in the relevant packages; migration filters explicitly include the fixture and tests/migration paths. — [AGENTS.md#L257-262](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/AGENTS.md#L257-L262) [.github/filters.yaml#L30-39](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/.github/filters.yaml#L30-L39)
- Before lifecycle edits, read Strapi.start/load/register/bootstrap and providers/registries. isLoaded becomes true after bootstrap, which performs database synchronization before routing and plugin/provider/user bootstrap hooks. — [packages/core/core/src/Strapi.ts#L264-275](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/Strapi.ts#L264-L275) [packages/core/core/src/Strapi.ts#L427-448](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/Strapi.ts#L427-L448) [packages/core/core/src/Strapi.ts#L453-489](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/Strapi.ts#L453-L489) [packages/core/core/src/Strapi.ts#L521-532](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/Strapi.ts#L521-L532) [packages/core/core/src/providers/registries.ts#L27-38](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/providers/registries.ts#L27-L38)
- For content changes, read controller/service boundaries, document-service/repository.ts, entries.ts, and transaction/event helpers. Preserve documentId versus row-id semantics, published API defaults versus draft Document Service defaults, and after-commit event emission. — [packages/core/core/src/core-api/service/collection-type.ts#L56-77](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/core-api/service/collection-type.ts#L56-L77) [packages/core/core/src/core-api/service/core-service.ts#L1-7](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/core-api/service/core-service.ts#L1-L7) [packages/core/core/src/services/document-service/repository.ts#L328-374](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/document-service/repository.ts#L328-L374) [packages/core/core/src/services/document-service/events.ts#L49-57](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/document-service/events.ts#L49-L57)
- For security-sensitive changes, inspect endpoint composition, controller sanitization, users-permissions strategy/JWT mode, and MCP handlePost. Preserve confirmation/block checks and scope verification; MCP authentication lives inside the handler rather than ordinary route authentication. — [packages/core/core/src/services/server/compose-endpoint.ts#L85-93](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/server/compose-endpoint.ts#L85-L93) [packages/core/core/src/core-api/controller/index.ts#L51-70](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/core-api/controller/index.ts#L51-L70) [packages/plugins/users-permissions/server/src/strategies/users-permissions.js#L31-61](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/plugins/users-permissions/server/src/strategies/users-permissions.js#L31-L61) [packages/plugins/users-permissions/server/src/strategies/users-permissions.js#L85-112](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/plugins/users-permissions/server/src/strategies/users-permissions.js#L85-L112) [packages/core/core/src/services/mcp/handlers/handlePost.ts#L32-53](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/core/src/services/mcp/handlers/handlePost.ts#L32-L53)
- For admin/provider edits, preserve plugin registration interfaces, protected Content Manager routes, temporary-upload cleanup, and stream/buffer fallbacks. Keep licensed feature gates and retained content types intact when Review Workflows or Content Releases are disabled. — [packages/core/content-manager/admin/src/router.tsx#L60-94](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/content-manager/admin/src/router.tsx#L60-L94) [packages/core/admin/admin/src/StrapiApp.tsx#L243-267](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/admin/admin/src/StrapiApp.tsx#L243-L267) [packages/core/upload/server/src/services/upload.ts#L255-289](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/upload/server/src/services/upload.ts#L255-L289) [packages/core/upload/server/src/services/provider.ts#L13-32](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/upload/server/src/services/provider.ts#L13-L32) [packages/core/review-workflows/server/src/index.ts#L9-26](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/review-workflows/server/src/index.ts#L9-L26) [packages/core/content-releases/server/src/index.ts#L10-28](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/content-releases/server/src/index.ts#L10-L28)
- In a separately authorized execution task, start with matching package tests, then API or Playwright behavior checks as appropriate. Root scripts separate Jest/Nx, Vitest, API, frontend and type-check lanes; repository guidance requires regenerating integration apps rather than trusting stale fixtures. — [package.json#L69-105](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/package.json#L69-L105) [AGENTS.md#L148-156](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/AGENTS.md#L148-L156) [AGENTS.md#L185-195](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/AGENTS.md#L185-L195)
- Verify drift-prone documentation against source: AGENTS recommends Node 22–26 while package.json allows 20–26 and pins Yarn 4.12.0; CONTRIBUTING still states Yarn v1.2.0+. The Content Manager introduction describes a pre-V5 package location, while current source registers it from its own package. — [AGENTS.md#L3-5](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/AGENTS.md#L3-L5) [package.json#L214-217](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/package.json#L214-L217) [CONTRIBUTING.md#L57-59](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/CONTRIBUTING.md#L57-L59) [docs/docs/docs/01-core/content-manager/00-intro.md#L9-11](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/docs/docs/docs/01-core/content-manager/00-intro.md#L9-L11) [packages/core/content-manager/admin/src/index.ts#L18-46](https://github.com/strapi/strapi/blob/93476f908c08d6d3d5215c06483829e3c6da1b32/packages/core/content-manager/admin/src/index.ts#L18-L46)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)