framework: NONE, NONE, NONE web server: CherryPy database: SQLite for dev/test, PostgreSQL for prod, investigating NoSQL data access: SQLAlchemy database schema: SQLAlchemy-migrate OS: Ubuntu, but perhaps eventually NixOS DVCS: Mercurial via BitBucket dependency mgmt: APT, setuptools, perhaps Nix JavaScript: MooTools
I am a web application security engineer (among other things), so I screened and was forced to reject all frameworks because they don't adequately address security (not even webpy), and because they are too heavy.
Instead, I am building a very lightweight, simple, but integrated web content generation layer directly in Python using built-in string formatting. I construct a page using a trivial DOM-like object model that renders to a string web response (HTML, CSS, JS). I push Model data into the DOM-like View under the direction of a page Controller (MVC pattern). However, my View contains the logic to properly encode output contextually to avoid common security vulnerabilities in the web response. Likewise, I have exhaustive input validation to deal with the data in the web request.