Source-led developer record
Developers and contributors
This page documents what can be checked in the stable Posnic source. It distinguishes observed behavior from documentation that has drifted and from features that are not publicly specified.
How the local application is assembled
Electron starts the local services
The Electron main process starts the bundled MongoDB service and the in-process Express API, then serves the desktop user interface. This describes the source at the pinned release, not every future build.
Ports are derived, not fixed at 5555
The release searches MongoDB ports 47000-47899 and API ports 42000-42899, then saves the selected pair in .ports.json. Stock documentation examples use MongoDB 47590 and API 42590. Integrations should read the installation's selected port instead of assuming a universal number.
The desktop screens use the local API
The repository contains an Express API with route groups for sales, products, inventory, customers, reports and administration. Authentication, authorization and request shape still matter; source availability is not a promise that every route is a supported external integration contract.
Verify the implementation in local-ports.js, the API source and the API document.
Reproduced API test result
We installed the exact stable release API dependencies and ran its curated Jest suite on 17 August 2026. These numbers report that one command and should not be read as an independent security audit or a full installed-shop acceptance test.
204 total; two skipped.
7,966 total; 13 skipped.
The command exited successfully.
Node 24.19.0 and npm 11.17.0.
Reproduction command
git checkout b531ef4308c4dc3a25f250551a54fc5616e3b8d9
npm --prefix api ci --ignore-scripts --no-audit --no-fund
npm --prefix api test
The run emitted Mongoose validateSync() deprecation warnings. It did not run the repository's hosted functional or Playwright paths, did not provision a real shop database, and did not prove hardware, installer or cloud behavior.
API documentation has a count conflict
Three files in the same stable commit publish different endpoint totals. Until the source inventory and documents are reconciled, Posnic does not use one of these counts as a marketing fact.
| Source | Published total | How to use it |
|---|---|---|
| docs/API.md | 487 endpoints, 24 route groups and 102 request schemas | Useful as the most detailed API inventory, but still documentation rather than a generated contract. |
| README.md | 484 endpoints | Conflicts with the detailed API document. |
| docs/ARCHITECTURE.md | 478 endpoints | Conflicts with both other totals. |
Practical rule: inspect the route and schema at the exact release you deploy, test the calls you depend on, and pin your integration to a release commit.
What is not a published contract
No public sync protocol specification
The v1.3.0 tree does not contain the previously advertised SYNC-PROTOCOL.md. Posnic therefore does not claim that any third-party server can implement a supported sync provider from a public specification.
No public plugin marketplace roadmap
The stable repository does not provide an approved plugin-marketplace specification or delivery commitment. Proposed capabilities belong in public issues or discussions before they are presented as a roadmap.
Contribute with the same evidence standard
Start with scope
Use a focused issue for changes that affect persisted data, sync, packaging or behavior operators depend on.
Follow the contribution guide
Contributors retain copyright and sign commits using the Developer Certificate of Origin. Include focused tests and explain operator-visible behavior.
Report security privately
Do not publish a suspected vulnerability as a normal issue. Follow the repository's private reporting instructions.
Evidence reviewed 17 August 2026 against commit b531ef4308c4dc3a25f250551a54fc5616e3b8d9. See the product facts, runtime benchmark and organization record for the other evidence layers.