@rigstate/mcp 0.4.2

package/package.json

@@ -0,0 +1,43 @@
+{
+    "name": "@rigstate/mcp",
+    "version": "0.4.2",
+    "description": "Rigstate MCP Server - Model Context Protocol for AI Editors",
+    "type": "module",
+    "main": "./dist/index.js",
+    "bin": {
+        "rigstate-mcp": "./dist/index.js"
+    },
+    "scripts": {
+        "dev": "tsup --watch",
+        "build": "tsup",
+        "lint": "tsc --noEmit",
+        "start": "node dist/index.js",
+        "test": "node dist/index.js --help"
+    },
+    "dependencies": {
+        "@modelcontextprotocol/sdk": "^1.0.0",
+        "@supabase/supabase-js": "^2.39.0",
+        "@rigstate/rules-engine": "0.1.0",
+        "dotenv": "^17.2.3",
+        "uuid": "^9.0.0",
+        "zod": "^3.22.4"
+    },
+    "devDependencies": {
+        "@types/node": "^20.11.5",
+        "tsup": "^8.0.1",
+        "typescript": "^5.3.3"
+    },
+    "engines": {
+        "node": ">=18.0.0"
+    },
+    "keywords": [
+        "rigstate",
+        "mcp",
+        "model-context-protocol",
+        "ai-editor",
+        "cursor",
+        "claude"
+    ],
+    "author": "Rigstate",
+    "license": "MIT"
+}

package/roadmap.json

@@ -0,0 +1,531 @@
+{
+  "project": "Rigstate Core",
+  "last_synced": "2026-01-07T08:39:15.001Z",
+  "roadmap": [
+    {
+      "id": "e503e35a-d480-457b-a771-63cf0297b48a",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 6,
+      "title": "Refactor: Architectural Cleanup",
+      "status": "LOCKED",
+      "prompt_content": "Frank here. I've detected a compliance violation. Here is the plan to fix it:\n1. Review the violation: \"Repository not yet indexed, but memories exist.\".\n2. Apply the specific Guardian rule found in settings.\n3. Refactor the code to adhere to the standard.\n4. Run tests to confirm stability.",
+      "verification_criteria": {
+        "label": "Technical Debt",
+        "priority": "High",
+        "generated_by": "The Guardian",
+        "original_issue": "Repository not yet indexed, but memories exist."
+      },
+      "type": "CODE",
+      "created_at": "2026-01-05T13:56:28.859126+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": null,
+      "sprint_number": 1,
+      "escalated_by": null,
+      "escalated_at": "2026-01-05T13:56:28.859126+00:00",
+      "visibility": "private",
+      "priority": "MEDIUM",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "8f2f2655-f846-4561-bde8-b4618fa8ae28",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 999,
+      "title": "SQL Search Path Security Vulnerability",
+      "status": "COMPLETED",
+      "prompt_content": "CONTEXT: supabase/migrations/20260101000012_prompt_versioning.sql (Issue: SQL_INJECTION)\nOBJECTIVE: Database function ensure_single_active_prompt_version() lacks SET search_path = ''.\nGUARDIAN CONSTRAINTS: Update migration to include search_path isolation for all functions.\nDEFINITION OF DONE: SQL Search Path Security Vulnerability is resolved and verified by a new scan.\n\n#auto-guardian",
+      "verification_criteria": null,
+      "type": "MANUAL",
+      "created_at": "2026-01-05T13:50:36.911455+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": null,
+      "sprint_number": 1,
+      "escalated_by": null,
+      "escalated_at": "2026-01-05T13:50:36.911455+00:00",
+      "visibility": "private",
+      "priority": "HIGH",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "8b31ac01-cf36-4668-98bd-3b6f83fd0042",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 999,
+      "title": "L-max Breach: lab.ts (689 lines)",
+      "status": "COMPLETED",
+      "prompt_content": "CONTEXT: apps/web/src/actions/lab.ts (Issue: POLICY_VIOLATION)\nOBJECTIVE: File exceeds 400 line limit for logic modules.\nGUARDIAN CONSTRAINTS: Split lab.ts into domain-specific modules (lab-core, lab-blueprints, lab-feedback).\nDEFINITION OF DONE: L-max Breach: lab.ts (689 lines) is resolved and verified by a new scan.\n\n#auto-guardian",
+      "verification_criteria": null,
+      "type": "MANUAL",
+      "created_at": "2026-01-05T13:50:36.911455+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": null,
+      "sprint_number": 1,
+      "escalated_by": null,
+      "escalated_at": "2026-01-05T13:50:36.911455+00:00",
+      "visibility": "private",
+      "priority": "HIGH",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "9c28bc40-043c-4c68-9235-f47b71ca5d86",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 999,
+      "title": "Missing Input Validation: admin.ts",
+      "status": "COMPLETED",
+      "prompt_content": "CONTEXT: apps/web/src/actions/admin.ts (Issue: UNVALIDATED_INPUT)\nOBJECTIVE: Server Actions in admin.ts lack Zod validation (validateInput).\nGUARDIAN CONSTRAINTS: Apply validateInput with Zod schemas to all administrative actions.\nDEFINITION OF DONE: Missing Input Validation: admin.ts is resolved and verified by a new scan.\n\n#auto-guardian",
+      "verification_criteria": null,
+      "type": "MANUAL",
+      "created_at": "2026-01-05T13:50:36.911455+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": null,
+      "sprint_number": 1,
+      "escalated_by": null,
+      "escalated_at": "2026-01-05T13:50:36.911455+00:00",
+      "visibility": "private",
+      "priority": "HIGH",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "f3735dc7-ade5-4eee-bfd5-bb75c63fd399",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 999,
+      "title": "L-max Warning: context-engine.ts (468 lines)",
+      "status": "COMPLETED",
+      "prompt_content": "CONTEXT: apps/web/src/lib/context-engine.ts (Issue: POLICY_VIOLATION)\nOBJECTIVE: Core engine file is approaching monolith status.\nGUARDIAN CONSTRAINTS: Extract RAG logic and specific parsers into sub-utilities.\nDEFINITION OF DONE: L-max Warning: context-engine.ts (468 lines) is resolved and verified by a new scan.\n\n#auto-guardian",
+      "verification_criteria": null,
+      "type": "MANUAL",
+      "created_at": "2026-01-05T13:50:36.911455+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": null,
+      "sprint_number": 1,
+      "escalated_by": null,
+      "escalated_at": "2026-01-05T13:50:36.911455+00:00",
+      "visibility": "private",
+      "priority": "HIGH",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "31ae7181-be64-4d59-80f5-7a9d880f5741",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 999,
+      "title": "Insecure RLS Policy: system_prompts",
+      "status": "COMPLETED",
+      "prompt_content": "CONTEXT: supabase/migrations/20260101000012_prompt_versioning.sql (Issue: POLICY_VIOLATION)\nOBJECTIVE: system_prompts policy allows direct INSERT/UPDATE by any authenticated user.\nGUARDIAN CONSTRAINTS: Restrict write access to super_admin profiles only.\nDEFINITION OF DONE: Insecure RLS Policy: system_prompts is resolved and verified by a new scan.\n\n#auto-guardian",
+      "verification_criteria": null,
+      "type": "MANUAL",
+      "created_at": "2026-01-05T13:50:36.911455+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": null,
+      "sprint_number": 1,
+      "escalated_by": null,
+      "escalated_at": "2026-01-05T13:50:36.911455+00:00",
+      "visibility": "private",
+      "priority": "HIGH",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "aa6a6ff4-8028-4e91-8af0-0fa53c05dbb0",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 1000,
+      "title": "Create `error_logs` Table and API Route",
+      "status": "LOCKED",
+      "prompt_content": "Create the `error_logs` table in Supabase with the specified schema (id, user_id, project_id, error_message, stack_trace, url, created_at) and configure Row Level Security (RLS) to protect the data.  Implement a POST API route `/api/v1/errors` to receive error logs from the client and server.  This route should validate the incoming data and insert it into the `error_logs` table.",
+      "verification_criteria": null,
+      "type": "CODE",
+      "created_at": "2026-01-06T10:18:03.712575+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": "Setup database table and logging API.",
+      "sprint_number": 1,
+      "escalated_by": "Frank",
+      "escalated_at": "2026-01-06T10:18:03.63+00:00",
+      "visibility": "private",
+      "priority": "MEDIUM",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "a8e185f3-f9c5-4534-96f5-fd5d50bc84fb",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 1001,
+      "title": "Implement ErrorBoundary Component",
+      "status": "LOCKED",
+      "prompt_content": "Create an `ErrorBoundary` React component that catches uncaught exceptions in the application.  This component should wrap the main application content or individual pages.  When an error is caught, the component should display a user-friendly error message and asynchronously send the error details (error message, stack trace, URL) to the `/api/v1/errors` endpoint.",
+      "verification_criteria": null,
+      "type": "CODE",
+      "created_at": "2026-01-06T10:18:03.712575+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": "Build React ErrorBoundary Component.",
+      "sprint_number": 2,
+      "escalated_by": "Frank",
+      "escalated_at": "2026-01-06T10:18:03.63+00:00",
+      "visibility": "private",
+      "priority": "MEDIUM",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "e1c1d0b4-f636-4f4c-99a4-736c575935fc",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 1002,
+      "title": "Wrap Application with ErrorBoundary",
+      "status": "LOCKED",
+      "prompt_content": "Wrap the main application content or individual routes/pages with the `ErrorBoundary` component to ensure that all uncaught exceptions are handled. Implement a strategy to capture necessary context data such as `user_id` and `project_id` within the `ErrorBoundary` to provide more granular context in error logs.",
+      "verification_criteria": null,
+      "type": "CODE",
+      "created_at": "2026-01-06T10:18:03.712575+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": "Integrate ErrorBoundary into Application.",
+      "sprint_number": 2,
+      "escalated_by": "Frank",
+      "escalated_at": "2026-01-06T10:18:03.63+00:00",
+      "visibility": "private",
+      "priority": "MEDIUM",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "5fca8601-8fb3-4bf9-bfb2-7bc24feda26f",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 1003,
+      "title": "Build Admin Dashboard for Error Overview",
+      "status": "LOCKED",
+      "prompt_content": "Create an admin dashboard within the application to provide an overview of the errors logged in the `error_logs` table. This dashboard should display information such as the error message, stack trace, user ID, project ID, and timestamp. Implement filtering and sorting capabilities to help administrators quickly identify and address critical issues.",
+      "verification_criteria": null,
+      "type": "CODE",
+      "created_at": "2026-01-06T10:18:03.712575+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": "Create Admin Error Monitoring Dashboard.",
+      "sprint_number": 3,
+      "escalated_by": "Frank",
+      "escalated_at": "2026-01-06T10:18:03.63+00:00",
+      "visibility": "private",
+      "priority": "MEDIUM",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "a8165a27-1f1d-45d5-87f4-468b2cfce98d",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 1004,
+      "title": "Integrate with Sentry (Optional)",
+      "status": "LOCKED",
+      "prompt_content": "Integrate the application with Sentry (or a similar error tracking service) to enhance error monitoring and reporting capabilities. Configure the `ErrorBoundary` component to send error events to Sentry in addition to logging them to the `error_logs` table.  Leverage Sentry's features for grouping, alerting, and advanced error analysis.",
+      "verification_criteria": null,
+      "type": "CODE",
+      "created_at": "2026-01-06T10:18:03.712575+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": "Integrate Sentry for Enhanced Monitoring.",
+      "sprint_number": 3,
+      "escalated_by": "Frank",
+      "escalated_at": "2026-01-06T10:18:03.63+00:00",
+      "visibility": "private",
+      "priority": "MEDIUM",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "41baefd7-baf3-44d3-9aad-8faf64fb7d6a",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 1005,
+      "title": "Setup React Query Provider",
+      "status": "LOCKED",
+      "prompt_content": "Install React Query and configure the QueryClientProvider at the root of the application to enable client-side caching. This includes setting up default query options and potentially a custom retry strategy.",
+      "verification_criteria": null,
+      "type": "CODE",
+      "created_at": "2026-01-06T10:35:29.41946+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": "Configure React Query for client-side caching.",
+      "sprint_number": 1,
+      "escalated_by": "Frank",
+      "escalated_at": "2026-01-06T10:35:29.377+00:00",
+      "visibility": "private",
+      "priority": "MEDIUM",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "de44fe4e-fc90-442f-87ec-8432c69324cd",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 1006,
+      "title": "Implement Server-Side Caching with unstable_cache",
+      "status": "LOCKED",
+      "prompt_content": "Identify frequently accessed data in server components (e.g., project context, tech stack, roadmap) and wrap the data fetching functions with `unstable_cache`. Define appropriate TTLs based on the data's volatility.",
+      "verification_criteria": null,
+      "type": "CODE",
+      "created_at": "2026-01-06T10:35:29.41946+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": "Enable server-side caching for frequent data.",
+      "sprint_number": 2,
+      "escalated_by": "Frank",
+      "escalated_at": "2026-01-06T10:35:29.377+00:00",
+      "visibility": "private",
+      "priority": "MEDIUM",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "569aad50-0096-40c5-8e3a-41a65fb7e30f",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 1007,
+      "title": "Implement Cache Invalidation on Mutations",
+      "status": "LOCKED",
+      "prompt_content": "When mutations occur (e.g., updating a project, adding a new tech stack), trigger cache invalidation for relevant queries using React Query's `queryClient.invalidateQueries` and Next.js's `revalidatePath` or `revalidateTag`.",
+      "verification_criteria": null,
+      "type": "CODE",
+      "created_at": "2026-01-06T10:35:29.41946+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": "Invalidate cache on data modification events.",
+      "sprint_number": 2,
+      "escalated_by": "Frank",
+      "escalated_at": "2026-01-06T10:35:29.377+00:00",
+      "visibility": "private",
+      "priority": "MEDIUM",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "2cf3faac-067d-4a6c-99dc-938cf8bfd1b8",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 1008,
+      "title": "Monitor Performance and Adjust TTLs",
+      "status": "LOCKED",
+      "prompt_content": "Monitor the application's performance (response times, database load) after implementing the caching layer. Adjust the TTLs for cached data based on observed performance and data staleness requirements. Refactor as needed.",
+      "verification_criteria": null,
+      "type": "CODE",
+      "created_at": "2026-01-06T10:35:29.41946+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": "Monitor and fine-tune cache configurations.",
+      "sprint_number": 3,
+      "escalated_by": "Frank",
+      "escalated_at": "2026-01-06T10:35:29.377+00:00",
+      "visibility": "private",
+      "priority": "MEDIUM",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "a0500716-55ec-4e66-99b0-4f51f59243f1",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 1009,
+      "title": "Implement Rate Limiting Middleware",
+      "status": "LOCKED",
+      "prompt_content": "Create a middleware function that implements the sliding window algorithm using either Upstash Redis (preferred) or an in-memory store as a fallback. The middleware should check the number of requests from a given IP address (or API key if available) within the current time window.  Include logic for configurable rate limits.",
+      "verification_criteria": null,
+      "type": "CODE",
+      "created_at": "2026-01-06T11:27:18.659272+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": "Create rate limiting middleware function",
+      "sprint_number": 1,
+      "escalated_by": "Frank",
+      "escalated_at": "2026-01-06T11:27:18.571+00:00",
+      "visibility": "private",
+      "priority": "MEDIUM",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "4d51757b-2c33-4e14-9cf4-0d4dc638c6e9",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 1010,
+      "title": "Configure Rate Limits",
+      "status": "LOCKED",
+      "prompt_content": "Define a configuration structure for specifying rate limits per endpoint (e.g., requests per minute).  Implement logic to read these configurations, allowing different limits for different routes.  Initially, set reasonable defaults.",
+      "verification_criteria": null,
+      "type": "CODE",
+      "created_at": "2026-01-06T11:27:18.659272+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": "Define and read rate limit configurations",
+      "sprint_number": 2,
+      "escalated_by": "Frank",
+      "escalated_at": "2026-01-06T11:27:18.571+00:00",
+      "visibility": "private",
+      "priority": "MEDIUM",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "8eb5f854-30e0-41d4-bb88-27d854e3c60e",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 1011,
+      "title": "Apply Middleware to Public API Routes",
+      "status": "LOCKED",
+      "prompt_content": "Apply the rate-limiting middleware to all routes under `/api/v1/*`. Ensure the middleware is correctly integrated into the application's request processing pipeline.",
+      "verification_criteria": null,
+      "type": "CODE",
+      "created_at": "2026-01-06T11:27:18.659272+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": "Apply middleware to /api/v1/* routes",
+      "sprint_number": 2,
+      "escalated_by": "Frank",
+      "escalated_at": "2026-01-06T11:27:18.571+00:00",
+      "visibility": "private",
+      "priority": "MEDIUM",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "3784e7a0-629c-419d-9327-1743444466dc",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 1012,
+      "title": "Implement 429 Response",
+      "status": "LOCKED",
+      "prompt_content": "When the rate limit is exceeded, return a 429 Too Many Requests HTTP response with a `Retry-After` header indicating how long the client should wait before making another request.  Test this thoroughly.",
+      "verification_criteria": null,
+      "type": "CODE",
+      "created_at": "2026-01-06T11:27:18.659272+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": "Return 429 with Retry-After header",
+      "sprint_number": 2,
+      "escalated_by": "Frank",
+      "escalated_at": "2026-01-06T11:27:18.571+00:00",
+      "visibility": "private",
+      "priority": "MEDIUM",
+      "is_legacy": false,
+      "completed_at": null
+    },
+    {
+      "id": "d95fba4b-170c-4713-a80d-dc4d255a281c",
+      "project_id": "bb9f8445-39fd-438c-8ab6-8057f5514395",
+      "step_number": 1013,
+      "title": "Admin Configurable API Keys",
+      "status": "LOCKED",
+      "prompt_content": "Implement functionality so an admin user can configure specific rate limits for specific API keys. The system should fall back to the default IP-based rate limiting when an API key is not provided.",
+      "verification_criteria": null,
+      "type": "CODE",
+      "created_at": "2026-01-06T11:27:18.659272+00:00",
+      "sprint_id": 0,
+      "sprint_focus": "Foundation",
+      "sprint_description": null,
+      "estimated_minutes": 20,
+      "verification_type": null,
+      "verification_path": null,
+      "verification_match": null,
+      "summary": "Allow admin configuration per API key",
+      "sprint_number": 3,
+      "escalated_by": "Frank",
+      "escalated_at": "2026-01-06T11:27:18.571+00:00",
+      "visibility": "private",
+      "priority": "MEDIUM",
+      "is_legacy": false,
+      "completed_at": null
+    }
+  ]
+}