Adds landing page at root URL (/) that displays all active products with links to feedback submission forms. This replaces the requirement for users to know direct product URLs.
Changes:
- Added Product.load_active() method to filter and sort active products alphabetically
- Created landing route blueprint with error handling and structured logging
- Registered landing blueprint in app factory, replacing old index route
- Created landing page template with product list and empty state
- Added comprehensive contract tests (6 tests) covering active products, filtering, sorting, XSS prevention
- Added integration test for complete user flow from landing page to submission form
All 7 tests pass. User Story 1 (P1 - MVP) complete.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Feature: Enable visitors to discover and select products for feedback submission
## What was specified:
User Stories (prioritized and independently testable):
- P1: Browse and Select Product - Core discoverability functionality
- P2: See Product Availability Status - Transparency about active/archived
- P3: Direct Navigation Compatibility - Backwards compatibility preserved
Functional Requirements (14 total):
- Landing page at root URL (/) showing active products
- File-based product retrieval and filtering (status=active)
- Product name display with clickable navigation
- Graceful handling of missing descriptions
- Alphabetical sorting and empty state handling
- Server-side rendering (no JavaScript)
- XSS prevention via HTML escaping
- Access logging for monitoring
Success Criteria (8 measurable outcomes):
- ≤2 clicks to reach submission form
- <1s load time for 100 products
- Zero broken direct URLs (backwards compatibility)
- XSS prevention validated
- Works without JavaScript
Edge Cases Covered:
- No active products scenario
- All products archived
- Missing descriptions
- Long/special character product names
- Invalid submission_url_slug
## Artifacts created:
- specs/002-at-the-moment/spec.md - Full feature specification
- specs/002-at-the-moment/checklists/requirements.md - Implementation checklist
## Next steps:
- Run /speckit.plan to generate implementation plan
- Create tasks.md from plan template
- Implement feature following TDD discipline
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
All 18 Phase 7 polish tasks have been implemented and committed
(commit 5675784). This update aligns the tasks.md documentation with
the actual implementation status.
Implementation completed:
- T193-T194: Comprehensive error logging and structured JSON logging
- T195: Complete deployment guide (docs/deployment.md)
- T196-T199: Security hardening (HSTS, CSRF, cookies, XSS)
- T200-T201: Performance tests for concurrency and dashboard load
- T202-T207: Code quality, validation, and verification
- T208-T209: Health check endpoint and environment validation
- T210: Development dependencies (requirements-dev.txt)
Resolves constitution Principle V compliance (Documentation as Code).
Project status: All in-scope phases complete (1-5, 7). Phase 6 deferred.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Updated specifications to reflect that User Story 4 (Product/Service
Registration and Management) is out of scope for the proof-of-concept.
Admin UI for product/user management is deferred in favor of manual
YAML file editing.
Specification Updates:
spec.md:
- Marked User Story 4 as [DEFERRED FOR POC]
- Added rationale: Manual management sufficient for POC
- Added manual management approach documentation
- Preserved original requirements (strikethrough) for future reference
- Updated FR-045 to FR-054 to indicate DEFERRED or IMPLEMENTED status
- Clarified which features work via YAML vs need admin UI
plan.md:
- Added POC Scope Update note in Summary section
- Documented that User Stories 1-3 are IMPLEMENTED
- Explained User Story 4 deferral and manual management approach
- Preserved original plan structure for future reference
tasks.md:
- Marked Phase 6 header as [DEFERRED FOR POC]
- Added comprehensive rationale and manual management guide
- Documented what's already implemented (models, access control)
- Listed manual operations: create product, edit product, create user, etc.
- Clarified that underlying features work, only admin UI is deferred
- Preserved all T140-T192 tasks for future implementation
- Added "Future Consideration" note
Rationale:
For a proof-of-concept, the admin UI adds no validation value. The core
functionality (anonymous submission, AI analysis, dashboard access) is
fully implemented and testable. Products and users can be managed via
YAML files:
- Products: data/products/{id}/config.yaml
- Users: data/users.yaml (with bcrypt passwords)
What Works Without Admin UI:
✅ Multi-product support (Product model + access control)
✅ Product owner assignment (via users.yaml product_ids field)
✅ Unique submission URLs per product (submission_url_slug)
✅ Archived product blocking (checked in submission route)
✅ Role-based access (owners see assigned, admins see all)
Decision Benefits:
- Reduces POC scope to essential features
- Eliminates ~53 admin UI tasks (T140-T192)
- Maintains all core product/user functionality
- Enables faster POC validation
- Can be implemented later if scaling is needed
Next Steps:
Focus on Phase 7 (Polish) - production hardening, documentation,
performance verification, and deployment readiness.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Verification revealed Phase 4 was 96% complete (27/28 tasks). Implemented
missing retry logic (T081) and marked all tasks as complete in tasks.md.
Implementation Status:
- Tests (T065-T070): ✅ 6/6 complete
- 5 unit tests for AIAnalyzer interface and extraction methods
- 2 integration tests for full analysis flow
- All tests passing
- Core Implementation (T071-T092): ✅ 22/22 complete
- AIAnalyzer abstract base class with interface
- AnalysisResult dataclass for structured results
- ClaudeAnalyzer with Anthropic SDK integration
- Single-call prompt design (categorize + summarize + translate)
- Language detection and category extraction
- Summary and translation extraction with regex
- 45s API timeout handling
- NEW: Retry logic with exponential backoff (3 retries, 1s/2s/4s)
- Retries transient errors (rate limits, server errors)
- Does not retry timeouts or non-retryable errors
- Analysis storage to analysis.md
- Background threading for async analysis
- Automatic trigger on feedback submission
- Status transitions: new → analyzing → analyzed/analysis_failed
- Language and category stored in metadata.yaml
- ANTHROPIC_API_KEY documented in .env.example
- FR-016 compliance: Original content.txt preserved
- FR-021 compliance: Images stored but not OCR'd
New Implementation:
- Added retry logic for transient API failures (T081):
- Max 3 retries with exponential backoff (1s, 2s, 4s)
- Only retries rate limits and server errors
- Does not retry timeouts or permanent errors
- File: app/services/ai_analyzer.py lines 70-123
Test Results:
- 8 tests passed (unit + integration + contract)
- All analysis features verified working
- Manual analysis trigger tested
- Background analysis tested
- Error handling and status transitions verified
Integration Points:
- Automatic analysis on submission (app/routes/submission.py:93-94)
- Manual analysis trigger (app/routes/dashboard.py:207-285)
- Analysis storage (app/services/feedback_storage.py:476-548)
- Status management throughout analysis lifecycle
🎯 CHECKPOINT: User Stories 1 AND 2 work together seamlessly - feedback
is submitted AND automatically analyzed with categorization, summarization,
and translation. Manual re-analysis also available via dashboard.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Phase 3 verification revealed that all 35 tasks (T030-T064) for User Story 1
(Anonymous Feedback Submission) are fully implemented and tested. Updated
tasks.md to reflect completion status.
Implementation Status:
- Tests (T030-T039): ✅ 10/10 complete
- 9 contract tests passing (1 intentionally skipped)
- 2 integration tests passing
- Models (T040-T041): ✅ 2/2 complete
- Product model with YAML loading
- Feedback model with validation
- Storage Service (T042-T046): ✅ 5/5 complete
- FeedbackStorageService with all methods
- File Validation (T047): ✅ 1/1 complete
- ClamAV integration with graceful degradation
- Routes & Templates (T048-T062): ✅ 15/15 complete
- Submission blueprint with GET/POST routes
- Form, success, and error templates
- Validation, virus scanning, rate limiting
- Error handling for archived/non-existent products
- Test Data & Compliance (T063-T064): ✅ 2/2 complete
- Test product configuration
- FR-055 compliance (no IP logging)
Test Results:
- 10 tests passed, 1 skipped (by design)
- All validation, security, and error handling verified
- End-to-end submission flow working correctly
🎯 MVP CHECKPOINT: User Story 1 is independently functional and fully tested.
Anonymous users can submit feedback with text and/or attachments without
authentication. All security requirements (file validation, virus scanning,
rate limiting) are operational.
This marks the completion of the MVP scope as defined in the project
constitution - basic feedback submission is production-ready.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Changed terminology from "API" to "Routes" to better reflect server-rendered HTML approach:
- Renamed submission_api.md → submission_routes.md
- Renamed dashboard_api.md → dashboard_routes.md
- Renamed admin_api.md → admin_routes.md
- Updated headers to clarify "Response Type: Server-rendered HTML (no JavaScript required)"
- Updated references in plan.md and quickstart.md
This clarifies that the application uses traditional web routes with form submissions
and HTML responses, not REST API endpoints with JSON.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Complete Phase 0 (Research) and Phase 1 (Design) of implementation planning workflow:
- plan.md: Technical context, constitution check, and project structure
- research.md: Technology decisions for AI integration, file storage, authentication, security
- data-model.md: Domain entities with validation rules and state transitions
- contracts/: API specifications for submission, dashboard, and admin endpoints
- quickstart.md: Developer setup guide with test-first workflow
- CLAUDE.md: Updated agent context with tech stack
All constitutional requirements validated. Ready for task generation phase.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
gurixandClaude