Reklamator/specs/001-build-an-application/tasks.md

# Tasks: Anonymous Feedback Platform (Reklamator)

**Input**: Design documents from `/specs/001-build-an-application/`
**Prerequisites**: plan.md, spec.md, research.md, data-model.md, contracts/

**Tests**: Per constitution's Test-First Discipline (NON-NEGOTIABLE), tests MUST be written before implementation for each user story.

**Organization**: Tasks are grouped by user story to enable independent implementation and testing of each story.

## Format: `- [ ] [ID] [P?] [Story?] Description`
- **[P]**: Can run in parallel (different files, no dependencies)
- **[Story]**: Which user story this task belongs to (e.g., US1, US2, US3, US4)
- Include exact file paths in descriptions

## Path Conventions (from plan.md)
- Project root: `reklamator/`
- Application code: `app/`
- Tests: `tests/`
- Data storage: `data/`
- Config: `config/`

---

## Phase 1: Setup (Shared Infrastructure)

**Purpose**: Project initialization and basic structure

- [ ] T001 Create project directory structure per plan.md (app/, tests/, config/, data/)
- [ ] T002 Initialize Python virtual environment and create requirements.txt with core dependencies
- [ ] T003 [P] Create pytest.ini configuration file in project root
- [ ] T004 [P] Create .env.example file documenting required environment variables
- [ ] T005 [P] Create run.py application entry point with Flask app factory import
- [ ] T006 [P] Create .gitignore for Python project (venv/, __pycache__/, .env, data/)
- [ ] T007 [P] Create config/development.py configuration class
- [ ] T008 [P] Create config/production.py configuration class
- [ ] T009 [P] Create config/testing.py configuration class

---

## Phase 2: Foundational (Blocking Prerequisites)

**Purpose**: Core infrastructure that MUST be complete before ANY user story can be implemented

**⚠️ CRITICAL**: No user story work can begin until this phase is complete

- [ ] T010 Implement Flask app factory in app/__init__.py with config loading
- [ ] T011 [P] Create app/models/__init__.py module initialization
- [ ] T012 [P] Create app/services/__init__.py module initialization
- [ ] T013 [P] Create app/routes/__init__.py module initialization
- [ ] T014 [P] Create app/utils/__init__.py module initialization
- [ ] T015 [P] Create app/templates/ directory for Jinja2 templates
- [ ] T016 Implement base template layout in app/templates/base.html with minimal inline CSS
- [ ] T017 [P] Create app/utils/file_validator.py for MIME type and size validation
- [ ] T018 Implement filename sanitization in app/utils/file_validator.py
- [ ] T019 [P] Create data/users.yaml with initial admin user (bcrypt hashed password)
- [ ] T020 Implement User model in app/models/user.py with Flask-Login UserMixin
- [ ] T021 Implement user loading from users.yaml in app/models/user.py
- [ ] T022 Configure Flask-Login in app/__init__.py with login_manager
- [ ] T023 [P] Configure Flask-WTF CSRF protection in app/__init__.py
- [ ] T024 [P] Configure Flask-Limiter in app/__init__.py for rate limiting
- [ ] T025 Create app/services/auth.py with bcrypt password verification
- [ ] T026 [P] Create tests/conftest.py with Flask test client fixture
- [ ] T027 [P] Create tests/contract/__init__.py
- [ ] T028 [P] Create tests/integration/__init__.py
- [ ] T029 [P] Create tests/unit/__init__.py

**Checkpoint**: Foundation ready - user story implementation can now begin in parallel

---

## Phase 3: User Story 1 - Anonymous Feedback Submission (Priority: P1) 🎯 MVP

**Goal**: Enable anonymous users to submit feedback with text and/or up to 3 file attachments without authentication

**Independent Test**: Visit /submit/{product_slug}, enter feedback text in any language, optionally attach up to 3 files, submit successfully without login, receive confirmation

### Tests for User Story 1 (MUST WRITE FIRST) ⚠️

**NOTE: Write these tests FIRST, ensure they FAIL before implementation**

- [ ] T030 [P] [US1] Contract test for GET /submit/{product_slug} in tests/contract/test_submission_routes.py
- [ ] T031 [P] [US1] Contract test for POST /submit/{product_slug} with text only in tests/contract/test_submission_routes.py
- [ ] T032 [P] [US1] Contract test for POST /submit/{product_slug} with files only in tests/contract/test_submission_routes.py
- [ ] T033 [P] [US1] Contract test for POST /submit/{product_slug} with text and files in tests/contract/test_submission_routes.py
- [ ] T034 [P] [US1] Contract test for empty submission rejection (400) in tests/contract/test_submission_routes.py
- [ ] T035 [P] [US1] Contract test for >3 files rejection (400) in tests/contract/test_submission_routes.py
- [ ] T036 [P] [US1] Contract test for >10MB file rejection (413) in tests/contract/test_submission_routes.py
- [ ] T037 [P] [US1] Contract test for unsupported file type rejection (400) in tests/contract/test_submission_routes.py
- [ ] T038 [P] [US1] Contract test for rate limiting (429 after 10 submissions) in tests/contract/test_submission_routes.py
- [ ] T039 [P] [US1] Integration test for complete feedback submission flow in tests/integration/test_feedback_submission_flow.py

### Implementation for User Story 1

- [ ] T040 [P] [US1] Create Product model in app/models/product.py with YAML loading
- [ ] T041 [P] [US1] Create Feedback model in app/models/feedback.py with validation
- [ ] T042 [US1] Implement FeedbackStorageService in app/services/feedback_storage.py (depends on T040, T041)
- [ ] T043 [US1] Implement create_feedback method in FeedbackStorageService (UUID generation, directory creation)
- [ ] T044 [US1] Implement save_metadata method in FeedbackStorageService (YAML writing)
- [ ] T045 [US1] Implement save_content method in FeedbackStorageService (text file writing)
- [ ] T046 [US1] Implement save_attachments method in FeedbackStorageService (file copying with sanitization)
- [ ] T047 [US1] Integrate ClamAV scanning in app/utils/file_validator.py with clamd library
- [ ] T048 [US1] Create submission routes blueprint in app/routes/submission.py
- [ ] T049 [US1] Implement GET /submit/{product_slug} route returning submission form template
- [ ] T050 [US1] Create submission form template in app/templates/submission_form.html
- [ ] T051 [US1] Implement POST /submit/{product_slug} route with form handling
- [ ] T052 [US1] Add validation logic in POST route (text or files required, max 3 files, etc.)
- [ ] T053 [US1] Add file type validation in POST route using file_validator
- [ ] T054 [US1] Add file size validation in POST route (max 10MB per file)
- [ ] T055 [US1] Add ClamAV virus scanning in POST route before storage
- [ ] T056 [US1] Integrate FeedbackStorageService in POST route to save feedback
- [ ] T057 [US1] Add rate limiting decorator to POST route (10/hour/IP)
- [ ] T058 [US1] Create success confirmation template in app/templates/submission_success.html
- [ ] T059 [US1] Create error display template in app/templates/submission_error.html
- [ ] T060 [US1] Add error handling for archived products (404 response)
- [ ] T061 [US1] Add error handling for non-existent products (404 response)
- [ ] T062 [US1] Register submission blueprint in app/__init__.py
- [ ] T063 [US1] Create test product config.yaml in data/products/test-product/ for testing
- [ ] T064 [US1] Verify no IP address logging in feedback metadata (FR-055 compliance)

**Checkpoint**: At this point, User Story 1 should be fully functional - anonymous feedback submission works end-to-end

---

## Phase 4: User Story 2 - AI-Powered Feedback Analysis and Translation (Priority: P2)

**Goal**: Automatically analyze submitted feedback using AI to categorize, summarize, and translate to product owner's preferred language

**Independent Test**: Submit feedback in non-English language (e.g., German), verify analysis.md is generated with correct category, summary in English, and translation

### Tests for User Story 2 (MUST WRITE FIRST) ⚠️

- [ ] T065 [P] [US2] Unit test for AIAnalyzer interface in tests/unit/test_ai_analyzer.py
- [ ] T066 [P] [US2] Unit test for ClaudeAnalyzer categorization in tests/unit/test_ai_analyzer.py
- [ ] T067 [P] [US2] Unit test for ClaudeAnalyzer translation in tests/unit/test_ai_analyzer.py
- [ ] T068 [P] [US2] Unit test for ClaudeAnalyzer summary generation in tests/unit/test_ai_analyzer.py
- [ ] T069 [P] [US2] Unit test for analysis error handling in tests/unit/test_ai_analyzer.py
- [ ] T070 [P] [US2] Integration test for full AI analysis flow in tests/integration/test_ai_analysis_flow.py

### Implementation for User Story 2

- [ ] T071 [P] [US2] Create AIAnalyzer abstract base class in app/services/ai_analyzer.py
- [ ] T072 [P] [US2] Create AnalysisResult dataclass in app/models/feedback.py
- [ ] T073 [US2] Implement ClaudeAnalyzer class in app/services/ai_analyzer.py (depends on T071)
- [ ] T074 [US2] Implement analyze_feedback method in ClaudeAnalyzer using Anthropic SDK
- [ ] T075 [US2] Design prompt for Claude API (categorize + summarize + translate in single call)
- [ ] T076 [US2] Implement language detection in ClaudeAnalyzer
- [ ] T077 [US2] Implement category extraction from Claude response
- [ ] T078 [US2] Implement summary extraction from Claude response
- [ ] T079 [US2] Implement translation extraction from Claude response
- [ ] T080 [US2] Add error handling for API timeouts (45s timeout)
- [ ] T081 [US2] Add retry logic for transient API failures
- [ ] T082 [US2] Implement save_analysis method in FeedbackStorageService (writes analysis.md)
- [ ] T083 [US2] Create analysis markdown template format in FeedbackStorageService
- [ ] T084 [US2] Implement background analysis task using Python threading module
- [ ] T085 [US2] Integrate background analysis trigger in submission POST route after successful save
- [ ] T086 [US2] Update feedback status to "analyzing" when background task starts
- [ ] T087 [US2] Update feedback status to "analyzed" when analysis succeeds
- [ ] T088 [US2] Update feedback status to "analysis_failed" on error
- [ ] T089 [US2] Store detected language in metadata.yaml original_language field
- [ ] T090 [US2] Add ANTHROPIC_API_KEY to .env.example file
- [ ] T091 [US2] Verify analysis preserves original content.txt file (FR-016)
- [ ] T092 [US2] Verify images are stored but not analyzed via OCR (FR-021)

**Checkpoint**: At this point, User Stories 1 AND 2 work together - feedback is submitted AND automatically analyzed

---

## Phase 5: User Story 3 - Product Owner Dashboard Access (Priority: P3)

**Goal**: Provide authenticated dashboard for product owners to view, filter, search, and manage feedback for their assigned products

**Independent Test**: Login as product owner, view dashboard with feedback list, filter by category, search by keyword, view feedback detail, update status, download attachments

### Tests for User Story 3 (MUST WRITE FIRST) ⚠️

- [ ] T093 [P] [US3] Contract test for GET /login in tests/contract/test_dashboard_routes.py
- [ ] T094 [P] [US3] Contract test for POST /login with valid credentials in tests/contract/test_dashboard_routes.py
- [ ] T095 [P] [US3] Contract test for POST /login with invalid credentials (401) in tests/contract/test_dashboard_routes.py
- [ ] T096 [P] [US3] Contract test for GET /logout in tests/contract/test_dashboard_routes.py
- [ ] T097 [P] [US3] Contract test for GET /dashboard (authenticated) in tests/contract/test_dashboard_routes.py
- [ ] T098 [P] [US3] Contract test for GET /dashboard (unauthenticated redirect) in tests/contract/test_dashboard_routes.py
- [ ] T099 [P] [US3] Contract test for GET /dashboard with filters in tests/contract/test_dashboard_routes.py
- [ ] T100 [P] [US3] Contract test for GET /dashboard with search query in tests/contract/test_dashboard_routes.py
- [ ] T101 [P] [US3] Contract test for GET /feedback/{id} detail view in tests/contract/test_dashboard_routes.py
- [ ] T102 [P] [US3] Contract test for POST /feedback/{id}/status update in tests/contract/test_dashboard_routes.py
- [ ] T103 [P] [US3] Contract test for GET /feedback/{id}/attachment/{filename} download in tests/contract/test_dashboard_routes.py
- [ ] T104 [P] [US3] Contract test for access control (owner sees only assigned products) in tests/contract/test_dashboard_routes.py
- [ ] T105 [P] [US3] Integration test for dashboard access flow in tests/integration/test_dashboard_access_flow.py

### Implementation for User Story 3

- [ ] T106 [P] [US3] Create dashboard routes blueprint in app/routes/dashboard.py
- [ ] T107 [P] [US3] Implement GET /login route returning login form template
- [ ] T108 [P] [US3] Create login form template in app/templates/login.html
- [ ] T109 [US3] Implement POST /login route with authentication logic
- [ ] T110 [US3] Implement GET /logout route with Flask-Login logout_user
- [ ] T111 [US3] Implement load_feedback_list method in FeedbackStorageService
- [ ] T112 [US3] Implement pagination logic in load_feedback_list (50 items/page)
- [ ] T113 [US3] Implement filter_by_category in FeedbackStorageService
- [ ] T114 [US3] Implement filter_by_date_range in FeedbackStorageService
- [ ] T115 [US3] Implement filter_by_language in FeedbackStorageService
- [ ] T116 [US3] Implement filter_by_status in FeedbackStorageService
- [ ] T117 [US3] Implement search_feedback in FeedbackStorageService (keyword search in text/translation/summary)
- [ ] T118 [US3] Implement sort by timestamp (newest first, FR-041)
- [ ] T119 [US3] Implement GET /dashboard route with @login_required decorator
- [ ] T120 [US3] Add product access control in GET /dashboard (owner sees only assigned products)
- [ ] T121 [US3] Apply filters and search from query parameters in GET /dashboard
- [ ] T122 [US3] Create dashboard template in app/templates/dashboard.html with filter form
- [ ] T123 [US3] Add pagination links to dashboard template
- [ ] T124 [US3] Implement GET /feedback/{feedback_id} detail route with @login_required
- [ ] T125 [US3] Add access control check in detail route (verify owner has access to product)
- [ ] T126 [US3] Load analysis.md content in detail route
- [ ] T127 [US3] Create feedback detail template in app/templates/feedback_detail.html
- [ ] T128 [US3] Display original text, translation, summary, category, attachments in detail template
- [ ] T129 [US3] Implement POST /feedback/{feedback_id}/status route for status updates
- [ ] T130 [US3] Update metadata.yaml status field in status update route
- [ ] T131 [US3] Implement GET /feedback/{feedback_id}/attachment/{filename} route for file downloads
- [ ] T132 [US3] Add path traversal prevention in attachment download route
- [ ] T133 [US3] Add access control in attachment download route
- [ ] T134 [US3] Serve files with correct Content-Type and Content-Disposition headers
- [ ] T135 [US3] Add error template for access denied (403) in app/templates/error_403.html
- [ ] T136 [US3] Add error template for not found (404) in app/templates/error_404.html
- [ ] T137 [US3] Register dashboard blueprint in app/__init__.py
- [ ] T138 [US3] Create test product owner in data/users.yaml for testing
- [ ] T139 [US3] Verify admin users have access to all products (bypass assigned_product_ids check)

**Checkpoint**: At this point, User Stories 1, 2, AND 3 work together - feedback is submitted, analyzed, and viewable in dashboard

---

## Phase 6: User Story 4 - Product/Service Registration and Management (Priority: P4)

**Goal**: Enable administrators to register products, assign owners, manage product settings, and view statistics

**Independent Test**: Login as admin, create new product with name/language/owners, verify submission URL works, assign additional owners, archive product, verify submissions blocked

### Tests for User Story 4 (MUST WRITE FIRST) ⚠️

- [ ] T140 [P] [US4] Contract test for GET /admin/products in tests/contract/test_admin_routes.py
- [ ] T141 [P] [US4] Contract test for GET /admin/products/new in tests/contract/test_admin_routes.py
- [ ] T142 [P] [US4] Contract test for POST /admin/products with valid data in tests/contract/test_admin_routes.py
- [ ] T143 [P] [US4] Contract test for POST /admin/products with duplicate ID (400) in tests/contract/test_admin_routes.py
- [ ] T144 [P] [US4] Contract test for GET /admin/products/{id}/edit in tests/contract/test_admin_routes.py
- [ ] T145 [P] [US4] Contract test for POST /admin/products/{id} update in tests/contract/test_admin_routes.py
- [ ] T146 [P] [US4] Contract test for POST /admin/products/{id}/archive in tests/contract/test_admin_routes.py
- [ ] T147 [P] [US4] Contract test for POST /admin/products/{id}/unarchive in tests/contract/test_admin_routes.py
- [ ] T148 [P] [US4] Contract test for GET /admin/users in tests/contract/test_admin_routes.py
- [ ] T149 [P] [US4] Contract test for POST /admin/users create in tests/contract/test_admin_routes.py
- [ ] T150 [P] [US4] Contract test for POST /admin/users/{id} update in tests/contract/test_admin_routes.py
- [ ] T151 [P] [US4] Contract test for POST /admin/users/{id}/delete in tests/contract/test_admin_routes.py
- [ ] T152 [P] [US4] Contract test for admin role requirement (403 for non-admin) in tests/contract/test_admin_routes.py

### Implementation for User Story 4

- [ ] T153 [P] [US4] Create admin routes blueprint in app/routes/admin.py
- [ ] T154 [US4] Create ProductService in app/services/product_service.py
- [ ] T155 [US4] Implement load_all_products in ProductService
- [ ] T156 [US4] Implement load_product_by_id in ProductService
- [ ] T157 [US4] Implement create_product in ProductService (creates directory + config.yaml)
- [ ] T158 [US4] Implement update_product in ProductService (updates config.yaml)
- [ ] T159 [US4] Implement archive_product in ProductService (sets status to archived)
- [ ] T160 [US4] Implement validate_product_id_unique in ProductService
- [ ] T161 [US4] Implement validate_submission_url_slug_unique in ProductService
- [ ] T162 [US4] Create UserService in app/services/user_service.py
- [ ] T163 [US4] Implement load_all_users in UserService (from users.yaml)
- [ ] T164 [US4] Implement create_user in UserService (appends to users.yaml with bcrypt hash)
- [ ] T165 [US4] Implement update_user in UserService (updates users.yaml)
- [ ] T166 [US4] Implement delete_user in UserService (removes from users.yaml)
- [ ] T167 [US4] Implement generate_unique_user_id in UserService
- [ ] T168 [US4] Implement GET /admin/products route with @login_required and admin check
- [ ] T169 [US4] Create admin products list template in app/templates/admin_products.html
- [ ] T170 [US4] Implement GET /admin/products/new route returning form template
- [ ] T171 [US4] Create product create form template in app/templates/admin_product_form.html
- [ ] T172 [US4] Implement POST /admin/products route with validation
- [ ] T173 [US4] Add unique ID and slug validation in POST /admin/products
- [ ] T174 [US4] Add at least 1 owner requirement validation in POST /admin/products
- [ ] T175 [US4] Implement GET /admin/products/{id}/edit route returning pre-filled form
- [ ] T176 [US4] Implement POST /admin/products/{id} route for updates
- [ ] T177 [US4] Implement POST /admin/products/{id}/archive route
- [ ] T178 [US4] Implement POST /admin/products/{id}/unarchive route
- [ ] T179 [US4] Implement GET /admin/users route with @login_required and admin check
- [ ] T180 [US4] Create admin users list template in app/templates/admin_users.html
- [ ] T181 [US4] Implement GET /admin/users/new route returning form template
- [ ] T182 [US4] Create user create form template in app/templates/admin_user_form.html
- [ ] T183 [US4] Implement POST /admin/users route with bcrypt password hashing
- [ ] T184 [US4] Implement GET /admin/users/{id}/edit route returning pre-filled form
- [ ] T185 [US4] Implement POST /admin/users/{id} route for updates (re-hash password if changed)
- [ ] T186 [US4] Implement POST /admin/users/{id}/delete route with self-delete prevention
- [ ] T187 [US4] Add admin role check decorator in app/utils/decorators.py
- [ ] T188 [US4] Apply admin_required decorator to all admin routes
- [ ] T189 [US4] Register admin blueprint in app/__init__.py
- [ ] T190 [US4] Update submission route to check product status (reject if archived, FR-053)
- [ ] T191 [US4] Add product statistics calculation in ProductService (total feedback count)
- [ ] T192 [US4] Display statistics in admin products list template

**Checkpoint**: All user stories (1-4) are now complete and independently functional

---

## Phase 7: Polish & Cross-Cutting Concerns

**Purpose**: Improvements that affect multiple user stories

- [ ] T193 [P] Add comprehensive error logging in all routes using Python logging module
- [ ] T194 [P] Configure structured logging in app/__init__.py (JSON format)
- [ ] T195 [P] Create deployment guide in docs/deployment.md (ClamAV setup, nginx reverse proxy, HTTPS)
- [ ] T196 [P] Add HSTS headers in production config for HTTPS enforcement (FR-064)
- [ ] T197 [P] Verify CSRF protection on all POST routes (Flask-WTF)
- [ ] T198 [P] Verify session cookie security flags (HttpOnly, Secure, SameSite)
- [ ] T199 [P] Add input sanitization for all user inputs (XSS prevention)
- [ ] T200 [P] Add integration test for 100 concurrent submissions (SC-012) in tests/integration/test_performance.py
- [ ] T201 [P] Verify dashboard loads 1000 items in <3s (SC-008) in tests/integration/test_performance.py
- [ ] T202 [P] Run quickstart.md validation (manual testing of developer setup guide)
- [ ] T203 [P] Add README.md with project overview and quick start link
- [ ] T204 [P] Code cleanup and consistency check (PEP 8 compliance)
- [ ] T205 [P] Run flake8 linting on all Python files
- [ ] T206 [P] Run black formatting on all Python files
- [ ] T207 [P] Verify no hardcoded secrets in code (API keys, passwords)
- [ ] T208 [P] Add health check endpoint /health for monitoring
- [ ] T209 [P] Add environment variable validation on startup
- [ ] T210 [P] Create requirements-dev.txt for development dependencies

---

## Dependencies & Execution Order

### Phase Dependencies

- **Setup (Phase 1)**: No dependencies - can start immediately
- **Foundational (Phase 2)**: Depends on Setup completion - BLOCKS all user stories
- **User Story 1 (Phase 3)**: Depends on Foundational (Phase 2) - MVP deliverable
- **User Story 2 (Phase 4)**: Depends on Foundational (Phase 2) + User Story 1 (feedback must exist to analyze)
- **User Story 3 (Phase 5)**: Depends on Foundational (Phase 2) + User Stories 1 & 2 (feedback and analysis must exist to view)
- **User Story 4 (Phase 6)**: Depends on Foundational (Phase 2) - Can proceed in parallel with US1-3 if staffed
- **Polish (Phase 7)**: Depends on all desired user stories being complete

### User Story Dependencies

- **User Story 1 (P1)**: INDEPENDENT - Can start after Foundational, no other story dependencies
- **User Story 2 (P2)**: Depends on User Story 1 (must have feedback to analyze)
- **User Story 3 (P3)**: Depends on User Stories 1 & 2 (must have analyzed feedback to display)
- **User Story 4 (P4)**: INDEPENDENT - Can start after Foundational in parallel with others (admin features)

### Within Each User Story

- Tests MUST be written FIRST and verified to FAIL before implementation (constitution requirement)
- Models before services (services depend on models)
- Services before routes (routes depend on services)
- Core implementation before integration
- Story complete and tested before moving to next priority

### Parallel Opportunities

**Setup Phase (Phase 1)**:
- Tasks T003-T009 can all run in parallel (different files)

**Foundational Phase (Phase 2)**:
- T011-T015, T017, T019, T021, T023-T024, T027-T029 can run in parallel (different files)

**User Story 1 Tests**:
- T030-T038 can run in parallel (all test different scenarios in same file but different test functions)

**User Story 1 Models**:
- T040-T041 can run in parallel (different model files)

**User Story 2 Tests**:
- T065-T069 can run in parallel (different test functions)

**User Story 3 Tests**:
- T093-T104 can run in parallel (different test functions)

**User Story 4 Tests**:
- T140-T152 can run in parallel (different test functions)

**Polish Phase (Phase 7)**:
- Most tasks T193-T210 can run in parallel (different concerns)

**Team Parallelization**:
- After Foundational (Phase 2), User Story 1 and User Story 4 can proceed in parallel (different domains)
- Once US1 is complete, US2 can start while US4 continues

---

## Parallel Example: User Story 1 Tests

```bash
# Launch all contract tests for User Story 1 together:
Task: "Contract test for GET /submit/{product_slug} in tests/contract/test_submission_routes.py"
Task: "Contract test for POST /submit/{product_slug} with text only in tests/contract/test_submission_routes.py"
Task: "Contract test for POST /submit/{product_slug} with files only in tests/contract/test_submission_routes.py"
# ... all T030-T038 can be written in parallel

# Launch both model creation tasks together:
Task: "Create Product model in app/models/product.py with YAML loading"
Task: "Create Feedback model in app/models/feedback.py with validation"
```

---

## Implementation Strategy

### MVP First (User Story 1 Only)

1. Complete Phase 1: Setup (T001-T009)
2. Complete Phase 2: Foundational (T010-T029) - CRITICAL, blocks all stories
3. Complete Phase 3: User Story 1 (T030-T064)
   - Write tests FIRST (T030-T039)
   - Verify tests FAIL
   - Implement (T040-T064)
   - Verify tests PASS
4. **STOP and VALIDATE**: Test User Story 1 independently
5. Can deploy/demo basic feedback submission at this point

### Incremental Delivery

1. Setup + Foundational (T001-T029) → Foundation ready
2. Add User Story 1 (T030-T064) → Test independently → **MVP Deployment** 🎯
3. Add User Story 2 (T065-T092) → Test independently → Deploy with AI analysis
4. Add User Story 3 (T093-T139) → Test independently → Deploy with dashboard
5. Add User Story 4 (T140-T192) → Test independently → Deploy multi-product support
6. Polish (T193-T210) → Production-ready deployment

Each story adds value without breaking previous stories.

### Parallel Team Strategy

With multiple developers after Foundational phase completes:

**Option 1: Sequential (Safest)**
- Complete US1 → US2 → US3 → US4 in order (dependencies respected)

**Option 2: Parallel (If staffed)**
- Developer A: User Story 1 (T030-T064)
- Developer B: User Story 4 (T140-T192) - can work in parallel
- Once US1 complete: Developer A starts US2
- Once US2 complete: Developer A starts US3
- Integrate and test all together

---

## Summary Statistics

- **Total Tasks**: 210
- **User Story 1 (P1 - MVP)**: 35 tasks (T030-T064)
- **User Story 2 (P2)**: 28 tasks (T065-T092)
- **User Story 3 (P3)**: 47 tasks (T093-T139)
- **User Story 4 (P4)**: 53 tasks (T140-T192)
- **Setup + Foundational**: 29 tasks (T001-T029)
- **Polish**: 18 tasks (T193-T210)

**Parallel Opportunities**: ~80 tasks marked [P] can run in parallel with appropriate team structure

**MVP Scope**: Phases 1-3 (T001-T064) = 64 tasks for basic feedback submission

**Test Coverage**: 39 test tasks (constitution-mandated test-first approach)

---

## Notes

- [P] tasks = different files or independent test functions, no dependencies
- [Story] label maps task to specific user story for traceability
- Each user story designed to be independently completable and testable
- **Constitution Requirement**: Tests MUST be written and verified to FAIL before implementing each story
- Commit after each task or logical group
- Stop at any checkpoint to validate story independently
- Avoid: vague tasks, same-file conflicts, cross-story dependencies that break independence
- File paths use plan.md structure (app/, tests/, data/, config/)
- All security requirements (FR-055 to FR-064) integrated into relevant tasks