Kaleta 2.1.0

Kaleta 2.1 is about trust: a published promise of what stays compatible, tests that hold Kaleta to it, and fast pages that stay fast. It also adds English names for the design tokens, security.txt and a Docker image.

A release policy you can plan with

docs/RELEASE-POLICY.md says what you can rely on when you build sites on Kaleta:

• Pace: about one minor release a month, patch and security releases when needed, a major release at most once a year.
• Updates: from any version to the latest in one step.
• Deprecation: before anything is removed, it is
  • announced;
  • shown in System status on the sites that use it;
  • kept for at least two minor releases and six months;
  • removed only in a major release.
• The public contract: the Claude connection, design tokens, builder elements, the site export, content addresses and the update channel.

Recorded contracts

What sites and Claude connections rely on is now recorded in the repository, and the tests fail when any of it is removed or changed:

• all 74 MCP tools, with their parameters, types, required parameters and annotations;
• 97 design tokens;
• 36 builder elements with their content properties.

English design token names

Every design token also has an English name: --ka-color-primary, --ka-color-text, --ka-space-m, --ka-step-2, --ka-radius, --ka-shadow-m, --ka-type-lead and so on.

• They follow a token overridden in a section: a dark section that sets --ka-barva-text gives var(--ka-color-text) its colour too.
• To restyle a section, keep overriding the stored name.

Fast pages, kept fast

• An output budget in CI: every page of every starter site must score at least 90 in Lighthouse performance and 100 in accessibility, best practices and SEO. Today all of them score 99–100.
• Descriptions for search engines: a page without its own description now gets the start of its first longer paragraph, as collection items already did. The news list falls back to the site name and the latest headlines.
• Right-sized images: lazy-loaded images use sizes="auto", so the browser picks the file by the width the image really has on the page.

security.txt

Settings → SEO and GEO → Advanced → Security contact takes an e-mail address or an https page.

• The site then publishes /.well-known/security.txt (RFC 9116), so people who find a problem know whom to tell.
• It is also settable over the Claude connection (update_settings → security_contact).

Docker

• compose.yaml runs Kaleta with MariaDB: KALETA_DB_PASSWORD=… docker compose up -d.
• Each release is built from its signed package into ghcr.io/phprs-cms/kaleta.
• The site lives in a volume and updates itself like any other installation.

Fixes and clean-up

• The guide, the Czech handbook and the Claude-connection description now say the right thing: menu and look changes from Claude go into the draft look.
• The shipped .htaccess and the nginx example (now system/nginx.example.conf) are commented in English.
• The empty system/class-aliases.php is gone. Packages still carry it for sites updating from 1.x, whose old updater would otherwise break mid-update, and the new version deletes it afterwards.
• Translations of features removed in 2.0 are gone.

For contributors

• The MCP layer is rebuilt:
  • Mcp\Catalog lists every tool once, with its access (read, write, destructive) and the extension it needs;
  • each tool is one method (toolSiteInfo for site_info), grouped in Mcp\Handlers traits by area;
  • tools/list is byte for byte the same as in 2.0.
• Public contracts: after a deliberate addition to the MCP interface, the design tokens or the builder elements, record it with php tools/contracts.php --update.
• PHPStan runs in CI (level 5, phpstan.neon.dist). The findings of today are in a baseline, and new code must add none.
• tools/test-lighthouse.sh installs every starter site and holds it to the output budget.
• The update test also starts from 2.0.

Updating

Update from Settings → Backups and updates. It works from every earlier release; tested from 1.2, 1.4.1, 1.9 and 2.0.