Reklamator/specs/001-build-an-application/tasks.md

Tasks: Anonymous Feedback Platform (Reklamator)

Input: Design documents from /specs/001-build-an-application/ Prerequisites: plan.md, spec.md, research.md, data-model.md, contracts/

Tests: Per constitution's Test-First Discipline (NON-NEGOTIABLE), tests MUST be written before implementation for each user story.

Organization: Tasks are grouped by user story to enable independent implementation and testing of each story.

Format: - [ ] [ID] [P?] [Story?] Description

• [P]: Can run in parallel (different files, no dependencies)
• [Story]: Which user story this task belongs to (e.g., US1, US2, US3, US4)
• Include exact file paths in descriptions

Path Conventions (from plan.md)

• Project root: reklamator/
• Application code: app/
• Tests: tests/
• Data storage: data/
• Config: config/

---

Phase 1: Setup (Shared Infrastructure)

Purpose: Project initialization and basic structure

• T001 Create project directory structure per plan.md (app/, tests/, config/, data/)
• T002 Initialize Python virtual environment and create requirements.txt with core dependencies
• T003 [P] Create pytest.ini configuration file in project root
• T004 [P] Create .env.example file documenting required environment variables
• T005 [P] Create run.py application entry point with Flask app factory import
• T006 [P] Create .gitignore for Python project (venv/, pycache/, .env, data/)
• T007 [P] Create config/development.py configuration class
• T008 [P] Create config/production.py configuration class
• T009 [P] Create config/testing.py configuration class

---

Phase 2: Foundational (Blocking Prerequisites)

Purpose: Core infrastructure that MUST be complete before ANY user story can be implemented

⚠️ CRITICAL: No user story work can begin until this phase is complete

• T010 Implement Flask app factory in app/__init__.py with config loading
• T011 [P] Create app/models/__init__.py module initialization
• T012 [P] Create app/services/__init__.py module initialization
• T013 [P] Create app/routes/__init__.py module initialization
• T014 [P] Create app/utils/__init__.py module initialization
• T015 [P] Create app/templates/ directory for Jinja2 templates
• T016 Implement base template layout in app/templates/base.html with minimal inline CSS
• T017 [P] Create app/utils/file_validator.py for MIME type and size validation
• T018 Implement filename sanitization in app/utils/file_validator.py
• T019 [P] Create data/users.yaml with initial admin user (bcrypt hashed password)
• T020 Implement User model in app/models/user.py with Flask-Login UserMixin
• T021 Implement user loading from users.yaml in app/models/user.py
• T022 Configure Flask-Login in app/__init__.py with login_manager
• T023 [P] Configure Flask-WTF CSRF protection in app/__init__.py
• T024 [P] Configure Flask-Limiter in app/__init__.py for rate limiting
• T025 Create app/services/auth.py with bcrypt password verification
• T026 [P] Create tests/conftest.py with Flask test client fixture
• T027 [P] Create tests/contract/__init__.py
• T028 [P] Create tests/integration/__init__.py
• T029 [P] Create tests/unit/__init__.py

Checkpoint: Foundation ready - user story implementation can now begin in parallel

---

Phase 3: User Story 1 - Anonymous Feedback Submission (Priority: P1) 🎯 MVP

Goal: Enable anonymous users to submit feedback with text and/or up to 3 file attachments without authentication

Independent Test: Visit /submit/{product_slug}, enter feedback text in any language, optionally attach up to 3 files, submit successfully without login, receive confirmation

Tests for User Story 1 (MUST WRITE FIRST) ⚠️

NOTE: Write these tests FIRST, ensure they FAIL before implementation

• T030 [P] [US1] Contract test for GET /submit/{product_slug} in tests/contract/test_submission_routes.py
• T031 [P] [US1] Contract test for POST /submit/{product_slug} with text only in tests/contract/test_submission_routes.py
• T032 [P] [US1] Contract test for POST /submit/{product_slug} with files only in tests/contract/test_submission_routes.py
• T033 [P] [US1] Contract test for POST /submit/{product_slug} with text and files in tests/contract/test_submission_routes.py
• T034 [P] [US1] Contract test for empty submission rejection (400) in tests/contract/test_submission_routes.py
• T035 [P] [US1] Contract test for >3 files rejection (400) in tests/contract/test_submission_routes.py
• T036 [P] [US1] Contract test for >10MB file rejection (413) in tests/contract/test_submission_routes.py
• T037 [P] [US1] Contract test for unsupported file type rejection (400) in tests/contract/test_submission_routes.py
• T038 [P] [US1] Contract test for rate limiting (429 after 10 submissions) in tests/contract/test_submission_routes.py
• T039 [P] [US1] Integration test for complete feedback submission flow in tests/integration/test_feedback_submission_flow.py

Implementation for User Story 1

• T040 [P] [US1] Create Product model in app/models/product.py with YAML loading
• T041 [P] [US1] Create Feedback model in app/models/feedback.py with validation
• T042 [US1] Implement FeedbackStorageService in app/services/feedback_storage.py (depends on T040, T041)
• T043 [US1] Implement create_feedback method in FeedbackStorageService (UUID generation, directory creation)
• T044 [US1] Implement save_metadata method in FeedbackStorageService (YAML writing)
• T045 [US1] Implement save_content method in FeedbackStorageService (text file writing)
• T046 [US1] Implement save_attachments method in FeedbackStorageService (file copying with sanitization)
• T047 [US1] Integrate ClamAV scanning in app/utils/file_validator.py with clamd library
• T048 [US1] Create submission routes blueprint in app/routes/submission.py
• T049 [US1] Implement GET /submit/{product_slug} route returning submission form template
• T050 [US1] Create submission form template in app/templates/submission_form.html
• T051 [US1] Implement POST /submit/{product_slug} route with form handling
• T052 [US1] Add validation logic in POST route (text or files required, max 3 files, etc.)
• T053 [US1] Add file type validation in POST route using file_validator
• T054 [US1] Add file size validation in POST route (max 10MB per file)
• T055 [US1] Add ClamAV virus scanning in POST route before storage
• T056 [US1] Integrate FeedbackStorageService in POST route to save feedback
• T057 [US1] Add rate limiting decorator to POST route (10/hour/IP)
• T058 [US1] Create success confirmation template in app/templates/submission_success.html
• T059 [US1] Create error display template in app/templates/submission_error.html
• T060 [US1] Add error handling for archived products (404 response)
• T061 [US1] Add error handling for non-existent products (404 response)
• T062 [US1] Register submission blueprint in app/__init__.py
• T063 [US1] Create test product config.yaml in data/products/test-product/ for testing
• T064 [US1] Verify no IP address logging in feedback metadata (FR-055 compliance)

Checkpoint: At this point, User Story 1 should be fully functional - anonymous feedback submission works end-to-end

---

Phase 4: User Story 2 - AI-Powered Feedback Analysis and Translation (Priority: P2)

Goal: Automatically analyze submitted feedback using AI to categorize, summarize, and translate to product owner's preferred language

Independent Test: Submit feedback in non-English language (e.g., German), verify analysis.md is generated with correct category, summary in English, and translation

Tests for User Story 2 (MUST WRITE FIRST) ⚠️

• T065 [P] [US2] Unit test for AIAnalyzer interface in tests/unit/test_ai_analyzer.py
• T066 [P] [US2] Unit test for ClaudeAnalyzer categorization in tests/unit/test_ai_analyzer.py
• T067 [P] [US2] Unit test for ClaudeAnalyzer translation in tests/unit/test_ai_analyzer.py
• T068 [P] [US2] Unit test for ClaudeAnalyzer summary generation in tests/unit/test_ai_analyzer.py
• T069 [P] [US2] Unit test for analysis error handling in tests/unit/test_ai_analyzer.py
• T070 [P] [US2] Integration test for full AI analysis flow in tests/integration/test_ai_analysis_flow.py

Implementation for User Story 2

• T071 [P] [US2] Create AIAnalyzer abstract base class in app/services/ai_analyzer.py
• T072 [P] [US2] Create AnalysisResult dataclass in app/models/feedback.py
• T073 [US2] Implement ClaudeAnalyzer class in app/services/ai_analyzer.py (depends on T071)
• T074 [US2] Implement analyze_feedback method in ClaudeAnalyzer using Anthropic SDK
• T075 [US2] Design prompt for Claude API (categorize + summarize + translate in single call)
• T076 [US2] Implement language detection in ClaudeAnalyzer
• T077 [US2] Implement category extraction from Claude response
• T078 [US2] Implement summary extraction from Claude response
• T079 [US2] Implement translation extraction from Claude response
• T080 [US2] Add error handling for API timeouts (45s timeout)
• T081 [US2] Add retry logic for transient API failures
• T082 [US2] Implement save_analysis method in FeedbackStorageService (writes analysis.md)
• T083 [US2] Create analysis markdown template format in FeedbackStorageService
• T084 [US2] Implement background analysis task using Python threading module
• T085 [US2] Integrate background analysis trigger in submission POST route after successful save
• T086 [US2] Update feedback status to "analyzing" when background task starts
• T087 [US2] Update feedback status to "analyzed" when analysis succeeds
• T088 [US2] Update feedback status to "analysis_failed" on error
• T089 [US2] Store detected language in metadata.yaml original_language field
• T090 [US2] Add ANTHROPIC_API_KEY to .env.example file
• T091 [US2] Verify analysis preserves original content.txt file (FR-016)
• T092 [US2] Verify images are stored but not analyzed via OCR (FR-021)

Checkpoint: At this point, User Stories 1 AND 2 work together - feedback is submitted AND automatically analyzed

---

Phase 5: User Story 3 - Product Owner Dashboard Access (Priority: P3)

Goal: Provide authenticated dashboard for product owners to view, filter, search, and manage feedback for their assigned products

Independent Test: Login as product owner, view dashboard with feedback list, filter by category, search by keyword, view feedback detail, update status, download attachments

Tests for User Story 3 (MUST WRITE FIRST) ⚠️

• T093 [P] [US3] Contract test for GET /login in tests/contract/test_dashboard_routes.py
• T094 [P] [US3] Contract test for POST /login with valid credentials in tests/contract/test_dashboard_routes.py
• T095 [P] [US3] Contract test for POST /login with invalid credentials (401) in tests/contract/test_dashboard_routes.py
• T096 [P] [US3] Contract test for GET /logout in tests/contract/test_dashboard_routes.py
• T097 [P] [US3] Contract test for GET /dashboard (authenticated) in tests/contract/test_dashboard_routes.py
• T098 [P] [US3] Contract test for GET /dashboard (unauthenticated redirect) in tests/contract/test_dashboard_routes.py
• T099 [P] [US3] Contract test for GET /dashboard with filters in tests/contract/test_dashboard_routes.py
• T100 [P] [US3] Contract test for GET /dashboard with search query in tests/contract/test_dashboard_routes.py
• T101 [P] [US3] Contract test for GET /feedback/{id} detail view in tests/contract/test_dashboard_routes.py
• T102 [P] [US3] Contract test for POST /feedback/{id}/status update in tests/contract/test_dashboard_routes.py
• T103 [P] [US3] Contract test for GET /feedback/{id}/attachment/{filename} download in tests/contract/test_dashboard_routes.py
• T104 [P] [US3] Contract test for access control (owner sees only assigned products) in tests/contract/test_dashboard_routes.py
• T105 [P] [US3] Integration test for dashboard access flow in tests/integration/test_dashboard_access_flow.py

Implementation for User Story 3

• T106 [P] [US3] Create dashboard routes blueprint in app/routes/dashboard.py
• T107 [P] [US3] Implement GET /login route returning login form template
• T108 [P] [US3] Create login form template in app/templates/login.html
• T109 [US3] Implement POST /login route with authentication logic
• T110 [US3] Implement GET /logout route with Flask-Login logout_user
• T111 [US3] Implement load_feedback_list method in FeedbackStorageService
• T112 [US3] Implement pagination logic in load_feedback_list (50 items/page)
• T113 [US3] Implement filter_by_category in FeedbackStorageService
• T114 [US3] Implement filter_by_date_range in FeedbackStorageService
• T115 [US3] Implement filter_by_language in FeedbackStorageService
• T116 [US3] Implement filter_by_status in FeedbackStorageService
• T117 [US3] Implement search_feedback in FeedbackStorageService (keyword search in text/translation/summary)
• T118 [US3] Implement sort by timestamp (newest first, FR-041)
• T119 [US3] Implement GET /dashboard route with @login_required decorator
• T120 [US3] Add product access control in GET /dashboard (owner sees only assigned products)
• T121 [US3] Apply filters and search from query parameters in GET /dashboard
• T122 [US3] Create dashboard template in app/templates/dashboard.html with filter form
• T123 [US3] Add pagination links to dashboard template
• T124 [US3] Implement GET /feedback/{feedback_id} detail route with @login_required
• T125 [US3] Add access control check in detail route (verify owner has access to product)
• T126 [US3] Load analysis.md content in detail route
• T127 [US3] Create feedback detail template in app/templates/feedback_detail.html
• T128 [US3] Display original text, translation, summary, category, attachments in detail template
• T129 [US3] Implement POST /feedback/{feedback_id}/status route for status updates
• T130 [US3] Update metadata.yaml status field in status update route
• T131 [US3] Implement GET /feedback/{feedback_id}/attachment/{filename} route for file downloads
• T132 [US3] Add path traversal prevention in attachment download route
• T133 [US3] Add access control in attachment download route
• T134 [US3] Serve files with correct Content-Type and Content-Disposition headers
• T135 [US3] Add error template for access denied (403) in app/templates/error_403.html
• T136 [US3] Add error template for not found (404) in app/templates/error_404.html
• T137 [US3] Register dashboard blueprint in app/__init__.py
• T138 [US3] Create test product owner in data/users.yaml for testing
• T139 [US3] Verify admin users have access to all products (bypass assigned_product_ids check)

Checkpoint: At this point, User Stories 1, 2, AND 3 work together - feedback is submitted, analyzed, and viewable in dashboard

---

Phase 6: User Story 4 - Product/Service Registration and Management (Priority: P4)

Goal: Enable administrators to register products, assign owners, manage product settings, and view statistics

Independent Test: Login as admin, create new product with name/language/owners, verify submission URL works, assign additional owners, archive product, verify submissions blocked

Tests for User Story 4 (MUST WRITE FIRST) ⚠️

• T140 [P] [US4] Contract test for GET /admin/products in tests/contract/test_admin_routes.py
• T141 [P] [US4] Contract test for GET /admin/products/new in tests/contract/test_admin_routes.py
• T142 [P] [US4] Contract test for POST /admin/products with valid data in tests/contract/test_admin_routes.py
• T143 [P] [US4] Contract test for POST /admin/products with duplicate ID (400) in tests/contract/test_admin_routes.py
• T144 [P] [US4] Contract test for GET /admin/products/{id}/edit in tests/contract/test_admin_routes.py
• T145 [P] [US4] Contract test for POST /admin/products/{id} update in tests/contract/test_admin_routes.py
• T146 [P] [US4] Contract test for POST /admin/products/{id}/archive in tests/contract/test_admin_routes.py
• T147 [P] [US4] Contract test for POST /admin/products/{id}/unarchive in tests/contract/test_admin_routes.py
• T148 [P] [US4] Contract test for GET /admin/users in tests/contract/test_admin_routes.py
• T149 [P] [US4] Contract test for POST /admin/users create in tests/contract/test_admin_routes.py
• T150 [P] [US4] Contract test for POST /admin/users/{id} update in tests/contract/test_admin_routes.py
• T151 [P] [US4] Contract test for POST /admin/users/{id}/delete in tests/contract/test_admin_routes.py
• T152 [P] [US4] Contract test for admin role requirement (403 for non-admin) in tests/contract/test_admin_routes.py

Implementation for User Story 4

• T153 [P] [US4] Create admin routes blueprint in app/routes/admin.py
• T154 [US4] Create ProductService in app/services/product_service.py
• T155 [US4] Implement load_all_products in ProductService
• T156 [US4] Implement load_product_by_id in ProductService
• T157 [US4] Implement create_product in ProductService (creates directory + config.yaml)
• T158 [US4] Implement update_product in ProductService (updates config.yaml)
• T159 [US4] Implement archive_product in ProductService (sets status to archived)
• T160 [US4] Implement validate_product_id_unique in ProductService
• T161 [US4] Implement validate_submission_url_slug_unique in ProductService
• T162 [US4] Create UserService in app/services/user_service.py
• T163 [US4] Implement load_all_users in UserService (from users.yaml)
• T164 [US4] Implement create_user in UserService (appends to users.yaml with bcrypt hash)
• T165 [US4] Implement update_user in UserService (updates users.yaml)
• T166 [US4] Implement delete_user in UserService (removes from users.yaml)
• T167 [US4] Implement generate_unique_user_id in UserService
• T168 [US4] Implement GET /admin/products route with @login_required and admin check
• T169 [US4] Create admin products list template in app/templates/admin_products.html
• T170 [US4] Implement GET /admin/products/new route returning form template
• T171 [US4] Create product create form template in app/templates/admin_product_form.html
• T172 [US4] Implement POST /admin/products route with validation
• T173 [US4] Add unique ID and slug validation in POST /admin/products
• T174 [US4] Add at least 1 owner requirement validation in POST /admin/products
• T175 [US4] Implement GET /admin/products/{id}/edit route returning pre-filled form
• T176 [US4] Implement POST /admin/products/{id} route for updates
• T177 [US4] Implement POST /admin/products/{id}/archive route
• T178 [US4] Implement POST /admin/products/{id}/unarchive route
• T179 [US4] Implement GET /admin/users route with @login_required and admin check
• T180 [US4] Create admin users list template in app/templates/admin_users.html
• T181 [US4] Implement GET /admin/users/new route returning form template
• T182 [US4] Create user create form template in app/templates/admin_user_form.html
• T183 [US4] Implement POST /admin/users route with bcrypt password hashing
• T184 [US4] Implement GET /admin/users/{id}/edit route returning pre-filled form
• T185 [US4] Implement POST /admin/users/{id} route for updates (re-hash password if changed)
• T186 [US4] Implement POST /admin/users/{id}/delete route with self-delete prevention
• T187 [US4] Add admin role check decorator in app/utils/decorators.py
• T188 [US4] Apply admin_required decorator to all admin routes
• T189 [US4] Register admin blueprint in app/__init__.py
• T190 [US4] Update submission route to check product status (reject if archived, FR-053)
• T191 [US4] Add product statistics calculation in ProductService (total feedback count)
• T192 [US4] Display statistics in admin products list template

Checkpoint: All user stories (1-4) are now complete and independently functional

---

Phase 7: Polish & Cross-Cutting Concerns

Purpose: Improvements that affect multiple user stories

• T193 [P] Add comprehensive error logging in all routes using Python logging module
• T194 [P] Configure structured logging in app/__init__.py (JSON format)
• T195 [P] Create deployment guide in docs/deployment.md (ClamAV setup, nginx reverse proxy, HTTPS)
• T196 [P] Add HSTS headers in production config for HTTPS enforcement (FR-064)
• T197 [P] Verify CSRF protection on all POST routes (Flask-WTF)
• T198 [P] Verify session cookie security flags (HttpOnly, Secure, SameSite)
• T199 [P] Add input sanitization for all user inputs (XSS prevention)
• T200 [P] Add integration test for 100 concurrent submissions (SC-012) in tests/integration/test_performance.py
• T201 [P] Verify dashboard loads 1000 items in <3s (SC-008) in tests/integration/test_performance.py
• T202 [P] Run quickstart.md validation (manual testing of developer setup guide)
• T203 [P] Add README.md with project overview and quick start link
• T204 [P] Code cleanup and consistency check (PEP 8 compliance)
• T205 [P] Run flake8 linting on all Python files
• T206 [P] Run black formatting on all Python files
• T207 [P] Verify no hardcoded secrets in code (API keys, passwords)
• T208 [P] Add health check endpoint /health for monitoring
• T209 [P] Add environment variable validation on startup
• T210 [P] Create requirements-dev.txt for development dependencies

---

Dependencies & Execution Order

Phase Dependencies

• Setup (Phase 1): No dependencies - can start immediately
• Foundational (Phase 2): Depends on Setup completion - BLOCKS all user stories
• User Story 1 (Phase 3): Depends on Foundational (Phase 2) - MVP deliverable
• User Story 2 (Phase 4): Depends on Foundational (Phase 2) + User Story 1 (feedback must exist to analyze)
• User Story 3 (Phase 5): Depends on Foundational (Phase 2) + User Stories 1 & 2 (feedback and analysis must exist to view)
• User Story 4 (Phase 6): Depends on Foundational (Phase 2) - Can proceed in parallel with US1-3 if staffed
• Polish (Phase 7): Depends on all desired user stories being complete

User Story Dependencies

• User Story 1 (P1): INDEPENDENT - Can start after Foundational, no other story dependencies
• User Story 2 (P2): Depends on User Story 1 (must have feedback to analyze)
• User Story 3 (P3): Depends on User Stories 1 & 2 (must have analyzed feedback to display)
• User Story 4 (P4): INDEPENDENT - Can start after Foundational in parallel with others (admin features)

Within Each User Story

• Tests MUST be written FIRST and verified to FAIL before implementation (constitution requirement)
• Models before services (services depend on models)
• Services before routes (routes depend on services)
• Core implementation before integration
• Story complete and tested before moving to next priority

Parallel Opportunities

Setup Phase (Phase 1):

• Tasks T003-T009 can all run in parallel (different files)

Foundational Phase (Phase 2):

• T011-T015, T017, T019, T021, T023-T024, T027-T029 can run in parallel (different files)

User Story 1 Tests:

• T030-T038 can run in parallel (all test different scenarios in same file but different test functions)

User Story 1 Models:

• T040-T041 can run in parallel (different model files)

User Story 2 Tests:

• T065-T069 can run in parallel (different test functions)

User Story 3 Tests:

• T093-T104 can run in parallel (different test functions)

User Story 4 Tests:

• T140-T152 can run in parallel (different test functions)

Polish Phase (Phase 7):

• Most tasks T193-T210 can run in parallel (different concerns)

Team Parallelization:

• After Foundational (Phase 2), User Story 1 and User Story 4 can proceed in parallel (different domains)
• Once US1 is complete, US2 can start while US4 continues

---

Parallel Example: User Story 1 Tests

# Launch all contract tests for User Story 1 together:
Task: "Contract test for GET /submit/{product_slug} in tests/contract/test_submission_routes.py"
Task: "Contract test for POST /submit/{product_slug} with text only in tests/contract/test_submission_routes.py"
Task: "Contract test for POST /submit/{product_slug} with files only in tests/contract/test_submission_routes.py"
# ... all T030-T038 can be written in parallel

# Launch both model creation tasks together:
Task: "Create Product model in app/models/product.py with YAML loading"
Task: "Create Feedback model in app/models/feedback.py with validation"

---

Implementation Strategy

MVP First (User Story 1 Only)

1. Complete Phase 1: Setup (T001-T009)
2. Complete Phase 2: Foundational (T010-T029) - CRITICAL, blocks all stories
3. Complete Phase 3: User Story 1 (T030-T064)
   • Write tests FIRST (T030-T039)
   • Verify tests FAIL
   • Implement (T040-T064)
   • Verify tests PASS
4. STOP and VALIDATE: Test User Story 1 independently
5. Can deploy/demo basic feedback submission at this point

Incremental Delivery

1. Setup + Foundational (T001-T029) → Foundation ready
2. Add User Story 1 (T030-T064) → Test independently → MVP Deployment 🎯
3. Add User Story 2 (T065-T092) → Test independently → Deploy with AI analysis
4. Add User Story 3 (T093-T139) → Test independently → Deploy with dashboard
5. Add User Story 4 (T140-T192) → Test independently → Deploy multi-product support
6. Polish (T193-T210) → Production-ready deployment

Each story adds value without breaking previous stories.

Parallel Team Strategy

With multiple developers after Foundational phase completes:

Option 1: Sequential (Safest)

• Complete US1 → US2 → US3 → US4 in order (dependencies respected)

Option 2: Parallel (If staffed)

• Developer A: User Story 1 (T030-T064)
• Developer B: User Story 4 (T140-T192) - can work in parallel
• Once US1 complete: Developer A starts US2
• Once US2 complete: Developer A starts US3
• Integrate and test all together

---

Summary Statistics

• Total Tasks: 210
• User Story 1 (P1 - MVP): 35 tasks (T030-T064)
• User Story 2 (P2): 28 tasks (T065-T092)
• User Story 3 (P3): 47 tasks (T093-T139)
• User Story 4 (P4): 53 tasks (T140-T192)
• Setup + Foundational: 29 tasks (T001-T029)
• Polish: 18 tasks (T193-T210)

Parallel Opportunities: ~80 tasks marked [P] can run in parallel with appropriate team structure

MVP Scope: Phases 1-3 (T001-T064) = 64 tasks for basic feedback submission

Test Coverage: 39 test tasks (constitution-mandated test-first approach)

---

Notes

• [P] tasks = different files or independent test functions, no dependencies
• [Story] label maps task to specific user story for traceability
• Each user story designed to be independently completable and testable
• Constitution Requirement: Tests MUST be written and verified to FAIL before implementing each story
• Commit after each task or logical group
• Stop at any checkpoint to validate story independently
• Avoid: vague tasks, same-file conflicts, cross-story dependencies that break independence
• File paths use plan.md structure (app/, tests/, data/, config/)
• All security requirements (FR-055 to FR-064) integrated into relevant tasks