diff --git a/specs/001-build-an-application/tasks.md b/specs/001-build-an-application/tasks.md new file mode 100644 index 0000000..b665bad --- /dev/null +++ b/specs/001-build-an-application/tasks.md @@ -0,0 +1,469 @@ +# Tasks: Anonymous Feedback Platform (Reklamator) + +**Input**: Design documents from `/specs/001-build-an-application/` +**Prerequisites**: plan.md, spec.md, research.md, data-model.md, contracts/ + +**Tests**: Per constitution's Test-First Discipline (NON-NEGOTIABLE), tests MUST be written before implementation for each user story. + +**Organization**: Tasks are grouped by user story to enable independent implementation and testing of each story. + +## Format: `- [ ] [ID] [P?] [Story?] Description` +- **[P]**: Can run in parallel (different files, no dependencies) +- **[Story]**: Which user story this task belongs to (e.g., US1, US2, US3, US4) +- Include exact file paths in descriptions + +## Path Conventions (from plan.md) +- Project root: `reklamator/` +- Application code: `app/` +- Tests: `tests/` +- Data storage: `data/` +- Config: `config/` + +--- + +## Phase 1: Setup (Shared Infrastructure) + +**Purpose**: Project initialization and basic structure + +- [ ] T001 Create project directory structure per plan.md (app/, tests/, config/, data/) +- [ ] T002 Initialize Python virtual environment and create requirements.txt with core dependencies +- [ ] T003 [P] Create pytest.ini configuration file in project root +- [ ] T004 [P] Create .env.example file documenting required environment variables +- [ ] T005 [P] Create run.py application entry point with Flask app factory import +- [ ] T006 [P] Create .gitignore for Python project (venv/, __pycache__/, .env, data/) +- [ ] T007 [P] Create config/development.py configuration class +- [ ] T008 [P] Create config/production.py configuration class +- [ ] T009 [P] Create config/testing.py configuration class + +--- + +## Phase 2: Foundational (Blocking Prerequisites) + +**Purpose**: Core infrastructure that MUST be complete before ANY user story can be implemented + +**⚠️ CRITICAL**: No user story work can begin until this phase is complete + +- [ ] T010 Implement Flask app factory in app/__init__.py with config loading +- [ ] T011 [P] Create app/models/__init__.py module initialization +- [ ] T012 [P] Create app/services/__init__.py module initialization +- [ ] T013 [P] Create app/routes/__init__.py module initialization +- [ ] T014 [P] Create app/utils/__init__.py module initialization +- [ ] T015 [P] Create app/templates/ directory for Jinja2 templates +- [ ] T016 Implement base template layout in app/templates/base.html with minimal inline CSS +- [ ] T017 [P] Create app/utils/file_validator.py for MIME type and size validation +- [ ] T018 Implement filename sanitization in app/utils/file_validator.py +- [ ] T019 [P] Create data/users.yaml with initial admin user (bcrypt hashed password) +- [ ] T020 Implement User model in app/models/user.py with Flask-Login UserMixin +- [ ] T021 Implement user loading from users.yaml in app/models/user.py +- [ ] T022 Configure Flask-Login in app/__init__.py with login_manager +- [ ] T023 [P] Configure Flask-WTF CSRF protection in app/__init__.py +- [ ] T024 [P] Configure Flask-Limiter in app/__init__.py for rate limiting +- [ ] T025 Create app/services/auth.py with bcrypt password verification +- [ ] T026 [P] Create tests/conftest.py with Flask test client fixture +- [ ] T027 [P] Create tests/contract/__init__.py +- [ ] T028 [P] Create tests/integration/__init__.py +- [ ] T029 [P] Create tests/unit/__init__.py + +**Checkpoint**: Foundation ready - user story implementation can now begin in parallel + +--- + +## Phase 3: User Story 1 - Anonymous Feedback Submission (Priority: P1) 🎯 MVP + +**Goal**: Enable anonymous users to submit feedback with text and/or up to 3 file attachments without authentication + +**Independent Test**: Visit /submit/{product_slug}, enter feedback text in any language, optionally attach up to 3 files, submit successfully without login, receive confirmation + +### Tests for User Story 1 (MUST WRITE FIRST) ⚠️ + +**NOTE: Write these tests FIRST, ensure they FAIL before implementation** + +- [ ] T030 [P] [US1] Contract test for GET /submit/{product_slug} in tests/contract/test_submission_routes.py +- [ ] T031 [P] [US1] Contract test for POST /submit/{product_slug} with text only in tests/contract/test_submission_routes.py +- [ ] T032 [P] [US1] Contract test for POST /submit/{product_slug} with files only in tests/contract/test_submission_routes.py +- [ ] T033 [P] [US1] Contract test for POST /submit/{product_slug} with text and files in tests/contract/test_submission_routes.py +- [ ] T034 [P] [US1] Contract test for empty submission rejection (400) in tests/contract/test_submission_routes.py +- [ ] T035 [P] [US1] Contract test for >3 files rejection (400) in tests/contract/test_submission_routes.py +- [ ] T036 [P] [US1] Contract test for >10MB file rejection (413) in tests/contract/test_submission_routes.py +- [ ] T037 [P] [US1] Contract test for unsupported file type rejection (400) in tests/contract/test_submission_routes.py +- [ ] T038 [P] [US1] Contract test for rate limiting (429 after 10 submissions) in tests/contract/test_submission_routes.py +- [ ] T039 [P] [US1] Integration test for complete feedback submission flow in tests/integration/test_feedback_submission_flow.py + +### Implementation for User Story 1 + +- [ ] T040 [P] [US1] Create Product model in app/models/product.py with YAML loading +- [ ] T041 [P] [US1] Create Feedback model in app/models/feedback.py with validation +- [ ] T042 [US1] Implement FeedbackStorageService in app/services/feedback_storage.py (depends on T040, T041) +- [ ] T043 [US1] Implement create_feedback method in FeedbackStorageService (UUID generation, directory creation) +- [ ] T044 [US1] Implement save_metadata method in FeedbackStorageService (YAML writing) +- [ ] T045 [US1] Implement save_content method in FeedbackStorageService (text file writing) +- [ ] T046 [US1] Implement save_attachments method in FeedbackStorageService (file copying with sanitization) +- [ ] T047 [US1] Integrate ClamAV scanning in app/utils/file_validator.py with clamd library +- [ ] T048 [US1] Create submission routes blueprint in app/routes/submission.py +- [ ] T049 [US1] Implement GET /submit/{product_slug} route returning submission form template +- [ ] T050 [US1] Create submission form template in app/templates/submission_form.html +- [ ] T051 [US1] Implement POST /submit/{product_slug} route with form handling +- [ ] T052 [US1] Add validation logic in POST route (text or files required, max 3 files, etc.) +- [ ] T053 [US1] Add file type validation in POST route using file_validator +- [ ] T054 [US1] Add file size validation in POST route (max 10MB per file) +- [ ] T055 [US1] Add ClamAV virus scanning in POST route before storage +- [ ] T056 [US1] Integrate FeedbackStorageService in POST route to save feedback +- [ ] T057 [US1] Add rate limiting decorator to POST route (10/hour/IP) +- [ ] T058 [US1] Create success confirmation template in app/templates/submission_success.html +- [ ] T059 [US1] Create error display template in app/templates/submission_error.html +- [ ] T060 [US1] Add error handling for archived products (404 response) +- [ ] T061 [US1] Add error handling for non-existent products (404 response) +- [ ] T062 [US1] Register submission blueprint in app/__init__.py +- [ ] T063 [US1] Create test product config.yaml in data/products/test-product/ for testing +- [ ] T064 [US1] Verify no IP address logging in feedback metadata (FR-055 compliance) + +**Checkpoint**: At this point, User Story 1 should be fully functional - anonymous feedback submission works end-to-end + +--- + +## Phase 4: User Story 2 - AI-Powered Feedback Analysis and Translation (Priority: P2) + +**Goal**: Automatically analyze submitted feedback using AI to categorize, summarize, and translate to product owner's preferred language + +**Independent Test**: Submit feedback in non-English language (e.g., German), verify analysis.md is generated with correct category, summary in English, and translation + +### Tests for User Story 2 (MUST WRITE FIRST) ⚠️ + +- [ ] T065 [P] [US2] Unit test for AIAnalyzer interface in tests/unit/test_ai_analyzer.py +- [ ] T066 [P] [US2] Unit test for ClaudeAnalyzer categorization in tests/unit/test_ai_analyzer.py +- [ ] T067 [P] [US2] Unit test for ClaudeAnalyzer translation in tests/unit/test_ai_analyzer.py +- [ ] T068 [P] [US2] Unit test for ClaudeAnalyzer summary generation in tests/unit/test_ai_analyzer.py +- [ ] T069 [P] [US2] Unit test for analysis error handling in tests/unit/test_ai_analyzer.py +- [ ] T070 [P] [US2] Integration test for full AI analysis flow in tests/integration/test_ai_analysis_flow.py + +### Implementation for User Story 2 + +- [ ] T071 [P] [US2] Create AIAnalyzer abstract base class in app/services/ai_analyzer.py +- [ ] T072 [P] [US2] Create AnalysisResult dataclass in app/models/feedback.py +- [ ] T073 [US2] Implement ClaudeAnalyzer class in app/services/ai_analyzer.py (depends on T071) +- [ ] T074 [US2] Implement analyze_feedback method in ClaudeAnalyzer using Anthropic SDK +- [ ] T075 [US2] Design prompt for Claude API (categorize + summarize + translate in single call) +- [ ] T076 [US2] Implement language detection in ClaudeAnalyzer +- [ ] T077 [US2] Implement category extraction from Claude response +- [ ] T078 [US2] Implement summary extraction from Claude response +- [ ] T079 [US2] Implement translation extraction from Claude response +- [ ] T080 [US2] Add error handling for API timeouts (45s timeout) +- [ ] T081 [US2] Add retry logic for transient API failures +- [ ] T082 [US2] Implement save_analysis method in FeedbackStorageService (writes analysis.md) +- [ ] T083 [US2] Create analysis markdown template format in FeedbackStorageService +- [ ] T084 [US2] Implement background analysis task using Python threading module +- [ ] T085 [US2] Integrate background analysis trigger in submission POST route after successful save +- [ ] T086 [US2] Update feedback status to "analyzing" when background task starts +- [ ] T087 [US2] Update feedback status to "analyzed" when analysis succeeds +- [ ] T088 [US2] Update feedback status to "analysis_failed" on error +- [ ] T089 [US2] Store detected language in metadata.yaml original_language field +- [ ] T090 [US2] Add ANTHROPIC_API_KEY to .env.example file +- [ ] T091 [US2] Verify analysis preserves original content.txt file (FR-016) +- [ ] T092 [US2] Verify images are stored but not analyzed via OCR (FR-021) + +**Checkpoint**: At this point, User Stories 1 AND 2 work together - feedback is submitted AND automatically analyzed + +--- + +## Phase 5: User Story 3 - Product Owner Dashboard Access (Priority: P3) + +**Goal**: Provide authenticated dashboard for product owners to view, filter, search, and manage feedback for their assigned products + +**Independent Test**: Login as product owner, view dashboard with feedback list, filter by category, search by keyword, view feedback detail, update status, download attachments + +### Tests for User Story 3 (MUST WRITE FIRST) ⚠️ + +- [ ] T093 [P] [US3] Contract test for GET /login in tests/contract/test_dashboard_routes.py +- [ ] T094 [P] [US3] Contract test for POST /login with valid credentials in tests/contract/test_dashboard_routes.py +- [ ] T095 [P] [US3] Contract test for POST /login with invalid credentials (401) in tests/contract/test_dashboard_routes.py +- [ ] T096 [P] [US3] Contract test for GET /logout in tests/contract/test_dashboard_routes.py +- [ ] T097 [P] [US3] Contract test for GET /dashboard (authenticated) in tests/contract/test_dashboard_routes.py +- [ ] T098 [P] [US3] Contract test for GET /dashboard (unauthenticated redirect) in tests/contract/test_dashboard_routes.py +- [ ] T099 [P] [US3] Contract test for GET /dashboard with filters in tests/contract/test_dashboard_routes.py +- [ ] T100 [P] [US3] Contract test for GET /dashboard with search query in tests/contract/test_dashboard_routes.py +- [ ] T101 [P] [US3] Contract test for GET /feedback/{id} detail view in tests/contract/test_dashboard_routes.py +- [ ] T102 [P] [US3] Contract test for POST /feedback/{id}/status update in tests/contract/test_dashboard_routes.py +- [ ] T103 [P] [US3] Contract test for GET /feedback/{id}/attachment/{filename} download in tests/contract/test_dashboard_routes.py +- [ ] T104 [P] [US3] Contract test for access control (owner sees only assigned products) in tests/contract/test_dashboard_routes.py +- [ ] T105 [P] [US3] Integration test for dashboard access flow in tests/integration/test_dashboard_access_flow.py + +### Implementation for User Story 3 + +- [ ] T106 [P] [US3] Create dashboard routes blueprint in app/routes/dashboard.py +- [ ] T107 [P] [US3] Implement GET /login route returning login form template +- [ ] T108 [P] [US3] Create login form template in app/templates/login.html +- [ ] T109 [US3] Implement POST /login route with authentication logic +- [ ] T110 [US3] Implement GET /logout route with Flask-Login logout_user +- [ ] T111 [US3] Implement load_feedback_list method in FeedbackStorageService +- [ ] T112 [US3] Implement pagination logic in load_feedback_list (50 items/page) +- [ ] T113 [US3] Implement filter_by_category in FeedbackStorageService +- [ ] T114 [US3] Implement filter_by_date_range in FeedbackStorageService +- [ ] T115 [US3] Implement filter_by_language in FeedbackStorageService +- [ ] T116 [US3] Implement filter_by_status in FeedbackStorageService +- [ ] T117 [US3] Implement search_feedback in FeedbackStorageService (keyword search in text/translation/summary) +- [ ] T118 [US3] Implement sort by timestamp (newest first, FR-041) +- [ ] T119 [US3] Implement GET /dashboard route with @login_required decorator +- [ ] T120 [US3] Add product access control in GET /dashboard (owner sees only assigned products) +- [ ] T121 [US3] Apply filters and search from query parameters in GET /dashboard +- [ ] T122 [US3] Create dashboard template in app/templates/dashboard.html with filter form +- [ ] T123 [US3] Add pagination links to dashboard template +- [ ] T124 [US3] Implement GET /feedback/{feedback_id} detail route with @login_required +- [ ] T125 [US3] Add access control check in detail route (verify owner has access to product) +- [ ] T126 [US3] Load analysis.md content in detail route +- [ ] T127 [US3] Create feedback detail template in app/templates/feedback_detail.html +- [ ] T128 [US3] Display original text, translation, summary, category, attachments in detail template +- [ ] T129 [US3] Implement POST /feedback/{feedback_id}/status route for status updates +- [ ] T130 [US3] Update metadata.yaml status field in status update route +- [ ] T131 [US3] Implement GET /feedback/{feedback_id}/attachment/{filename} route for file downloads +- [ ] T132 [US3] Add path traversal prevention in attachment download route +- [ ] T133 [US3] Add access control in attachment download route +- [ ] T134 [US3] Serve files with correct Content-Type and Content-Disposition headers +- [ ] T135 [US3] Add error template for access denied (403) in app/templates/error_403.html +- [ ] T136 [US3] Add error template for not found (404) in app/templates/error_404.html +- [ ] T137 [US3] Register dashboard blueprint in app/__init__.py +- [ ] T138 [US3] Create test product owner in data/users.yaml for testing +- [ ] T139 [US3] Verify admin users have access to all products (bypass assigned_product_ids check) + +**Checkpoint**: At this point, User Stories 1, 2, AND 3 work together - feedback is submitted, analyzed, and viewable in dashboard + +--- + +## Phase 6: User Story 4 - Product/Service Registration and Management (Priority: P4) + +**Goal**: Enable administrators to register products, assign owners, manage product settings, and view statistics + +**Independent Test**: Login as admin, create new product with name/language/owners, verify submission URL works, assign additional owners, archive product, verify submissions blocked + +### Tests for User Story 4 (MUST WRITE FIRST) ⚠️ + +- [ ] T140 [P] [US4] Contract test for GET /admin/products in tests/contract/test_admin_routes.py +- [ ] T141 [P] [US4] Contract test for GET /admin/products/new in tests/contract/test_admin_routes.py +- [ ] T142 [P] [US4] Contract test for POST /admin/products with valid data in tests/contract/test_admin_routes.py +- [ ] T143 [P] [US4] Contract test for POST /admin/products with duplicate ID (400) in tests/contract/test_admin_routes.py +- [ ] T144 [P] [US4] Contract test for GET /admin/products/{id}/edit in tests/contract/test_admin_routes.py +- [ ] T145 [P] [US4] Contract test for POST /admin/products/{id} update in tests/contract/test_admin_routes.py +- [ ] T146 [P] [US4] Contract test for POST /admin/products/{id}/archive in tests/contract/test_admin_routes.py +- [ ] T147 [P] [US4] Contract test for POST /admin/products/{id}/unarchive in tests/contract/test_admin_routes.py +- [ ] T148 [P] [US4] Contract test for GET /admin/users in tests/contract/test_admin_routes.py +- [ ] T149 [P] [US4] Contract test for POST /admin/users create in tests/contract/test_admin_routes.py +- [ ] T150 [P] [US4] Contract test for POST /admin/users/{id} update in tests/contract/test_admin_routes.py +- [ ] T151 [P] [US4] Contract test for POST /admin/users/{id}/delete in tests/contract/test_admin_routes.py +- [ ] T152 [P] [US4] Contract test for admin role requirement (403 for non-admin) in tests/contract/test_admin_routes.py + +### Implementation for User Story 4 + +- [ ] T153 [P] [US4] Create admin routes blueprint in app/routes/admin.py +- [ ] T154 [US4] Create ProductService in app/services/product_service.py +- [ ] T155 [US4] Implement load_all_products in ProductService +- [ ] T156 [US4] Implement load_product_by_id in ProductService +- [ ] T157 [US4] Implement create_product in ProductService (creates directory + config.yaml) +- [ ] T158 [US4] Implement update_product in ProductService (updates config.yaml) +- [ ] T159 [US4] Implement archive_product in ProductService (sets status to archived) +- [ ] T160 [US4] Implement validate_product_id_unique in ProductService +- [ ] T161 [US4] Implement validate_submission_url_slug_unique in ProductService +- [ ] T162 [US4] Create UserService in app/services/user_service.py +- [ ] T163 [US4] Implement load_all_users in UserService (from users.yaml) +- [ ] T164 [US4] Implement create_user in UserService (appends to users.yaml with bcrypt hash) +- [ ] T165 [US4] Implement update_user in UserService (updates users.yaml) +- [ ] T166 [US4] Implement delete_user in UserService (removes from users.yaml) +- [ ] T167 [US4] Implement generate_unique_user_id in UserService +- [ ] T168 [US4] Implement GET /admin/products route with @login_required and admin check +- [ ] T169 [US4] Create admin products list template in app/templates/admin_products.html +- [ ] T170 [US4] Implement GET /admin/products/new route returning form template +- [ ] T171 [US4] Create product create form template in app/templates/admin_product_form.html +- [ ] T172 [US4] Implement POST /admin/products route with validation +- [ ] T173 [US4] Add unique ID and slug validation in POST /admin/products +- [ ] T174 [US4] Add at least 1 owner requirement validation in POST /admin/products +- [ ] T175 [US4] Implement GET /admin/products/{id}/edit route returning pre-filled form +- [ ] T176 [US4] Implement POST /admin/products/{id} route for updates +- [ ] T177 [US4] Implement POST /admin/products/{id}/archive route +- [ ] T178 [US4] Implement POST /admin/products/{id}/unarchive route +- [ ] T179 [US4] Implement GET /admin/users route with @login_required and admin check +- [ ] T180 [US4] Create admin users list template in app/templates/admin_users.html +- [ ] T181 [US4] Implement GET /admin/users/new route returning form template +- [ ] T182 [US4] Create user create form template in app/templates/admin_user_form.html +- [ ] T183 [US4] Implement POST /admin/users route with bcrypt password hashing +- [ ] T184 [US4] Implement GET /admin/users/{id}/edit route returning pre-filled form +- [ ] T185 [US4] Implement POST /admin/users/{id} route for updates (re-hash password if changed) +- [ ] T186 [US4] Implement POST /admin/users/{id}/delete route with self-delete prevention +- [ ] T187 [US4] Add admin role check decorator in app/utils/decorators.py +- [ ] T188 [US4] Apply admin_required decorator to all admin routes +- [ ] T189 [US4] Register admin blueprint in app/__init__.py +- [ ] T190 [US4] Update submission route to check product status (reject if archived, FR-053) +- [ ] T191 [US4] Add product statistics calculation in ProductService (total feedback count) +- [ ] T192 [US4] Display statistics in admin products list template + +**Checkpoint**: All user stories (1-4) are now complete and independently functional + +--- + +## Phase 7: Polish & Cross-Cutting Concerns + +**Purpose**: Improvements that affect multiple user stories + +- [ ] T193 [P] Add comprehensive error logging in all routes using Python logging module +- [ ] T194 [P] Configure structured logging in app/__init__.py (JSON format) +- [ ] T195 [P] Create deployment guide in docs/deployment.md (ClamAV setup, nginx reverse proxy, HTTPS) +- [ ] T196 [P] Add HSTS headers in production config for HTTPS enforcement (FR-064) +- [ ] T197 [P] Verify CSRF protection on all POST routes (Flask-WTF) +- [ ] T198 [P] Verify session cookie security flags (HttpOnly, Secure, SameSite) +- [ ] T199 [P] Add input sanitization for all user inputs (XSS prevention) +- [ ] T200 [P] Add integration test for 100 concurrent submissions (SC-012) in tests/integration/test_performance.py +- [ ] T201 [P] Verify dashboard loads 1000 items in <3s (SC-008) in tests/integration/test_performance.py +- [ ] T202 [P] Run quickstart.md validation (manual testing of developer setup guide) +- [ ] T203 [P] Add README.md with project overview and quick start link +- [ ] T204 [P] Code cleanup and consistency check (PEP 8 compliance) +- [ ] T205 [P] Run flake8 linting on all Python files +- [ ] T206 [P] Run black formatting on all Python files +- [ ] T207 [P] Verify no hardcoded secrets in code (API keys, passwords) +- [ ] T208 [P] Add health check endpoint /health for monitoring +- [ ] T209 [P] Add environment variable validation on startup +- [ ] T210 [P] Create requirements-dev.txt for development dependencies + +--- + +## Dependencies & Execution Order + +### Phase Dependencies + +- **Setup (Phase 1)**: No dependencies - can start immediately +- **Foundational (Phase 2)**: Depends on Setup completion - BLOCKS all user stories +- **User Story 1 (Phase 3)**: Depends on Foundational (Phase 2) - MVP deliverable +- **User Story 2 (Phase 4)**: Depends on Foundational (Phase 2) + User Story 1 (feedback must exist to analyze) +- **User Story 3 (Phase 5)**: Depends on Foundational (Phase 2) + User Stories 1 & 2 (feedback and analysis must exist to view) +- **User Story 4 (Phase 6)**: Depends on Foundational (Phase 2) - Can proceed in parallel with US1-3 if staffed +- **Polish (Phase 7)**: Depends on all desired user stories being complete + +### User Story Dependencies + +- **User Story 1 (P1)**: INDEPENDENT - Can start after Foundational, no other story dependencies +- **User Story 2 (P2)**: Depends on User Story 1 (must have feedback to analyze) +- **User Story 3 (P3)**: Depends on User Stories 1 & 2 (must have analyzed feedback to display) +- **User Story 4 (P4)**: INDEPENDENT - Can start after Foundational in parallel with others (admin features) + +### Within Each User Story + +- Tests MUST be written FIRST and verified to FAIL before implementation (constitution requirement) +- Models before services (services depend on models) +- Services before routes (routes depend on services) +- Core implementation before integration +- Story complete and tested before moving to next priority + +### Parallel Opportunities + +**Setup Phase (Phase 1)**: +- Tasks T003-T009 can all run in parallel (different files) + +**Foundational Phase (Phase 2)**: +- T011-T015, T017, T019, T021, T023-T024, T027-T029 can run in parallel (different files) + +**User Story 1 Tests**: +- T030-T038 can run in parallel (all test different scenarios in same file but different test functions) + +**User Story 1 Models**: +- T040-T041 can run in parallel (different model files) + +**User Story 2 Tests**: +- T065-T069 can run in parallel (different test functions) + +**User Story 3 Tests**: +- T093-T104 can run in parallel (different test functions) + +**User Story 4 Tests**: +- T140-T152 can run in parallel (different test functions) + +**Polish Phase (Phase 7)**: +- Most tasks T193-T210 can run in parallel (different concerns) + +**Team Parallelization**: +- After Foundational (Phase 2), User Story 1 and User Story 4 can proceed in parallel (different domains) +- Once US1 is complete, US2 can start while US4 continues + +--- + +## Parallel Example: User Story 1 Tests + +```bash +# Launch all contract tests for User Story 1 together: +Task: "Contract test for GET /submit/{product_slug} in tests/contract/test_submission_routes.py" +Task: "Contract test for POST /submit/{product_slug} with text only in tests/contract/test_submission_routes.py" +Task: "Contract test for POST /submit/{product_slug} with files only in tests/contract/test_submission_routes.py" +# ... all T030-T038 can be written in parallel + +# Launch both model creation tasks together: +Task: "Create Product model in app/models/product.py with YAML loading" +Task: "Create Feedback model in app/models/feedback.py with validation" +``` + +--- + +## Implementation Strategy + +### MVP First (User Story 1 Only) + +1. Complete Phase 1: Setup (T001-T009) +2. Complete Phase 2: Foundational (T010-T029) - CRITICAL, blocks all stories +3. Complete Phase 3: User Story 1 (T030-T064) + - Write tests FIRST (T030-T039) + - Verify tests FAIL + - Implement (T040-T064) + - Verify tests PASS +4. **STOP and VALIDATE**: Test User Story 1 independently +5. Can deploy/demo basic feedback submission at this point + +### Incremental Delivery + +1. Setup + Foundational (T001-T029) → Foundation ready +2. Add User Story 1 (T030-T064) → Test independently → **MVP Deployment** 🎯 +3. Add User Story 2 (T065-T092) → Test independently → Deploy with AI analysis +4. Add User Story 3 (T093-T139) → Test independently → Deploy with dashboard +5. Add User Story 4 (T140-T192) → Test independently → Deploy multi-product support +6. Polish (T193-T210) → Production-ready deployment + +Each story adds value without breaking previous stories. + +### Parallel Team Strategy + +With multiple developers after Foundational phase completes: + +**Option 1: Sequential (Safest)** +- Complete US1 → US2 → US3 → US4 in order (dependencies respected) + +**Option 2: Parallel (If staffed)** +- Developer A: User Story 1 (T030-T064) +- Developer B: User Story 4 (T140-T192) - can work in parallel +- Once US1 complete: Developer A starts US2 +- Once US2 complete: Developer A starts US3 +- Integrate and test all together + +--- + +## Summary Statistics + +- **Total Tasks**: 210 +- **User Story 1 (P1 - MVP)**: 35 tasks (T030-T064) +- **User Story 2 (P2)**: 28 tasks (T065-T092) +- **User Story 3 (P3)**: 47 tasks (T093-T139) +- **User Story 4 (P4)**: 53 tasks (T140-T192) +- **Setup + Foundational**: 29 tasks (T001-T029) +- **Polish**: 18 tasks (T193-T210) + +**Parallel Opportunities**: ~80 tasks marked [P] can run in parallel with appropriate team structure + +**MVP Scope**: Phases 1-3 (T001-T064) = 64 tasks for basic feedback submission + +**Test Coverage**: 39 test tasks (constitution-mandated test-first approach) + +--- + +## Notes + +- [P] tasks = different files or independent test functions, no dependencies +- [Story] label maps task to specific user story for traceability +- Each user story designed to be independently completable and testable +- **Constitution Requirement**: Tests MUST be written and verified to FAIL before implementing each story +- Commit after each task or logical group +- Stop at any checkpoint to validate story independently +- Avoid: vague tasks, same-file conflicts, cross-story dependencies that break independence +- File paths use plan.md structure (app/, tests/, data/, config/) +- All security requirements (FR-055 to FR-064) integrated into relevant tasks