[development] clarification on CVS access control for new projects

[Derek Wright]

i've gotten quite a few questions about 1 detail of the new CVS  
access control stuff: what about directories in /contributions/ 
modules/ that don't yet have projects associated with them?

originally (i.e for about 24 hours), all commits/tags were prevented  
in such directories (under the influence of chx, i err'ed on the side  
of the tightest restrictions). ;)  however, killes asked me to change  
this, and that happened yesterday morning.  so, now all the commit  
access control stuff is only in place for directories that are  
associated with a published project node.  this means that once  
someone has a cvs account, they can create new directories in the  
repository and commit their code.  once it's there, they're free to  
create a project node that points to their new directory and wait for  
that to be published and approved.  however, tagging *is* restricted  
to published projects.

so, the workflow for adding a new project is:

0) contrib author applies for CVS account (as always)

once approved...

1) contrib authors add their code to an available directory in CVS

2) author submits a project node pointing to their directory

3) site admin reviews the node, decides if it's a fork/duplicate, or  
worthy

assuming it's good...

4) site admin publishes the node
(this should be the _only_ way a project node gets published, but  
it's not.  see http://drupal.org/node/64100)

5) now author has ability to branch/tag their code

6) based on branches/tags, project module creates appropriate tarballs
(also see http://drupal.org/node/58066)


does that make sense?  anyone got any suggestions for improvement?   
anyone have an opinion where this should be documented?  maybe i  
should just edit/clarify/exapand on http://drupal.org/node/7765?

let me know...

thanks,
-derek (dww)