@terreno/mcp 57.17.0 → 57.19.2

package/src/docs/versioned/57.17.0/tasks/native-module-baseline.md

@@ -0,0 +1,42 @@
+# Tasks: Native module baseline for the next major release
+
+IP: [native-module-baseline](../implementationPlans/native-module-baseline.md)
+
+## Phase 1 — Dependencies + config
+
+- [ ] **Task 1.1**: Catalog + app package manifests
+  - Description: add the seven packages to root catalog (sorted) and to example-frontend + demo deps via `catalog:`
+  - Files: root `package.json`, `example-frontend/package.json`, `demo/package.json`
+  - Depends on: none
+  - Acceptance: `bun install` + full compile green
+- [ ] **Task 1.2**: Config plugins + build properties
+  - Description: stripe + purchases plugins; `expo-build-properties` Kotlin 2.x / compileSdk 36 pins
+  - Files: `example-frontend/app.json`, `demo/app.json`
+  - Depends on: 1.1
+  - Acceptance: `expo config` resolves without errors; web export unaffected
+
+## Phase 2 — Builds + verification
+
+- [ ] **Task 2.1**: EAS dev builds
+  - Description: iOS + Android dev-client builds via existing eas-dev-build workflow
+  - Files: `eas.json` profiles if needed
+  - Depends on: Phase 1
+  - Acceptance: both builds compile
+- [ ] **Task 2.2**: Diagnostics story
+  - Description: hidden demo story listing resolved native module versions
+  - Files: `demo/stories/NativeModules.stories.tsx`, `demo/demoConfig.tsx`
+  - Depends on: 2.1
+  - Acceptance: story shows all seven modules on a dev build; screenshot evidence
+- [ ] **Task 2.3**: Expo Go degradation doc
+  - Description: document which flows need a dev build (stripe, local-auth) vs preview modes (purchases)
+  - Files: `docs/` upgrade note draft
+  - Depends on: 2.1
+  - Acceptance: reviewed checklist in the note
+
+## Phase 3 — Release
+
+- [ ] **Task 3.1**: Upgrade note + major release coordination
+  - Description: consumer checklist (rebuild dev clients, add plugins, merchant id); breaking-release CI gate
+  - Files: upgrade notes location per release process
+  - Depends on: Phase 2
+  - Acceptance: breaking-release CI gate passes on the release PR

package/src/docs/versioned/57.17.0/tasks/notification-center.md

@@ -0,0 +1,102 @@
+# Tasks: In-app notification center
+
+IP: [notification-center.md](../implementationPlans/notification-center.md)  
+**Closes:** https://github.com/TerrenoLabs/terreno/issues/1179
+
+**Feature profile:** false (full IP)
+
+## Phase 1 — Tracer (inbox write + sync)
+
+- [x] **Task 1.1**: Notification model + `NotificationsApp` + `notify()` inbox write
+  - Delivers: `new NotificationsApp()` registers owner-scoped `/notifications` with `create: []`, `sync: {scope: {type: "owner"}}`, `isDeletedPlugin` + `syncPlugin`; `getNotificationService().notify({userId, title, body, href?, kind?})` inserts a row and change-stream/sync can see it; HTTP/sync create is 403/nack
+  - Files: `api/src/models/notification.ts`, `api/src/types/notification.ts`, `api/src/notifications/notificationsApp.ts`, `api/src/notifications/notificationService.ts`, `api/src/notifications/notificationsApp.test.ts`, `api/src/index.ts`
+  - Blocked by: none
+  - Skills: `terreno-backend-api`, `mongoose-schema-safety`, `backend-test-env`, `update-docs`
+  - Docs: stub **In-app notifications** in `docs/reference/api.md` (do not mix with Slack/Zoom notifiers)
+  - Acceptance: bun + supertest — `notify` creates one owner row; unauthenticated list 401; other user cannot read; POST `/notifications` 403 or disabled; every schema field has `description`
+
+- [x] **Task 1.2**: Owner mark-read and dismiss
+  - Delivers: `preUpdate` allows only `readAt` (ISO/date or `null`); `delete` soft-deletes; other fields in PATCH are stripped/rejected; unread query is `readAt` unset/null
+  - Files: `api/src/notifications/notificationsApp.ts`, tests in `notificationsApp.test.ts`
+  - Blocked by: 1.1
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: one sentence on patch/delete in the api.md stub
+  - Acceptance: bun tests — PATCH `{readAt}` persists; PATCH `{title: "x"}` does not change title; DELETE hides from list; second user 403
+
+## Phase 2 — Preferences, comms fan-out, retention
+
+- [x] **Task 2.1**: Preference model + defaults + `notificationsBeforeSend`
+  - Delivers: `NotificationPreference` unique `ownerId`, four booleans default true; missing row treated as all on; export duck-typed `notificationsBeforeSend({channel, userId})` that cancels when that boolean is false (`verification` channel never cancelled by this hook)
+  - Files: `api/src/models/notificationPreference.ts`, `api/src/types/notificationPreference.ts`, preference router on `NotificationsApp`, tests
+  - Blocked by: 1.1
+  - Skills: `terreno-backend-api`, `mongoose-schema-safety`, `backend-test-env`
+  - Docs: prefs table in api.md stub
+  - Acceptance: bun tests — no row → beforeSend does not cancel; `mail: false` → `{cancel: true}` for `channel: "mail"`; inapp false → `notify` does **not** insert a Notification
+
+- [x] **Task 2.2**: Optional comms fan-out from `notify()`
+  - Delivers: `NotificationsApp({getComms})`; after inbox write, call `sendMail` / `sendSms` / `sendPushToUser` when that pref is on and destination exists (email from User, phone if present on user, push via comms); missing `getComms` or missing destination skips that channel without failing `notify`; do not import `@terreno/comms` from `@terreno/api`
+  - Files: `api/src/notifications/notificationService.ts`, tests with a fake `getComms`
+  - Blocked by: 2.1
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: fan-out order in api.md
+  - Acceptance: bun tests — fake mail called when pref on + email present; mail not called when pref off; `notify` resolves when `getComms` throws after inbox write (log `logger.error`, still return the notification id)
+
+- [x] **Task 2.3**: Mark-all-read + `retainDays`
+  - Delivers: `POST /notifications/mark-all-read` sets `readAt` on the caller's unread rows; `retainDays` default `0` (no sweep); `retainDays > 0` tombstones (`deleted`) rows with `created` older than N days (best-effort on `notify` and/or a small `sweepExpired()`); **no** Mongo TTL index
+  - Files: `notificationsApp.ts`, `notificationService.ts`, tests
+  - Blocked by: 1.2
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: `retainDays` default 0 in api.md
+  - Acceptance: bun tests — mark-all-read only affects caller; retainDays 0 leaves old rows; retainDays 1 tombstones a row dated 2 days ago via Luxon; collection indexes do not include a TTL expireAfterSeconds on Notification
+
+## Phase 3 — UI
+
+- [x] **Task 3.1**: `NotificationBell` + `NotificationInbox`
+  - Delivers: presentational components (no syncdb import); bell shows badge from `unreadCount`; inbox lists items, mark read/unread, dismiss, tap calls `onOpen`; empty and loading states; `testID`s
+  - Files: `ui/src/NotificationBell.tsx`, `ui/src/NotificationInbox.tsx`, tests, `ui/src/index.tsx` exports
+  - Blocked by: none
+  - Skills: `terreno-ui`, `update-docs`, `verify-ui-changes`
+  - Docs: stub props in `docs/reference/ui.md`
+  - Acceptance: bun `ui` tests with `renderWithTheme`; badge hidden at 0; `onOpen` fired with the item; dismiss/mark callbacks fired
+
+- [x] **Task 3.2**: `NotificationPreferences`
+  - Delivers: four `BooleanField`s bound to `{inapp, mail, push, sms}`; `onChange` per channel
+  - Files: `ui/src/NotificationPreferences.tsx`, test, export
+  - Blocked by: none
+  - Skills: `terreno-ui`
+  - Docs: prefs props in ui.md
+  - Acceptance: bun tests — toggling mail calls `onChange("mail", false)`
+
+- [x] **Task 3.3**: Demo stories
+  - Delivers: demoConfig entries with fixture unread/read items and prefs toggles
+  - Files: `demo/stories/` + `demo/demoConfig.tsx` (or current demo registration)
+  - Blocked by: 3.1, 3.2
+  - Skills: `terreno-ui`, `verify-ui-changes`
+  - Docs: none (4.1)
+  - Acceptance: demo route renders bell + inbox + prefs without a backend
+
+## Phase 4 — Example app + docs
+
+- [x] **Task 4.1**: example-backend register + demo notify
+  - Delivers: `NotificationsApp({getComms: getCommsService})`; compose `notificationsBeforeSend` into `CommsApp` `beforeSend`; authenticated demo route (follow `commsDev`) that `notify`s the current user
+  - Files: `example-backend/src/server.ts`, `example-backend/src/api/` demo route + test
+  - Blocked by: 2.2, 2.3
+  - Skills: `terreno-backend-api`, `backend-test-env`
+  - Docs: none (4.3)
+  - Acceptance: bun tests — registered routes exist; demo notify 401 without auth; 200 with auth creates a row
+
+- [x] **Task 4.2**: example-frontend syncdb + bell + prefs
+  - Delivers: collections `notifications` and `notification-preferences`; bell on todos header; settings preferences screen; `onOpen` uses Expo Router for in-app `href`; optional “send test” calling the demo route
+  - Files: `example-frontend/store/syncdb.ts` (codegen/list), todos screen, settings route, tests if present
+  - Blocked by: 3.1, 3.2, 4.1
+  - Skills: `terreno-data-fetching`, `terreno-ui`, `verify-ui-changes`, `generate-sdk` (only if a non-sync demo route needs SDK)
+  - Docs: none (4.3)
+  - Acceptance: `useQuery` lists notify rows after demo send; mark read persists; prefs toggle survives reload (syncdb); no new RTK CRUD hooks for the collection
+
+- [x] **Task 4.3**: Diátaxis docs + rules + changelog
+  - Delivers: `docs/how-to/in-app-notifications.md`; finish `docs/reference/api.md` and `docs/reference/ui.md`; `docs/reference/comms.md` beforeSend composition; `docs/how-to/README.md` link; `.rulesync/rules/api` mention + `bun run rules`; `changelog/unreleased/notification-center.md`
+  - Files: those docs + rules
+  - Blocked by: 4.2
+  - Skills: `update-docs`
+  - Docs: (this task)
+  - Acceptance: a stranger can register the plugin and wire the bell from the how-to without reading the IP; website/how-to index lists the page

package/src/docs/versioned/57.17.0/tasks/offline-mode.md

@@ -0,0 +1,141 @@
+# Task List: Offline Mode
+
+**Status:** Closed (2026-08-20) — IP deferred; superseded by `@terreno/syncdb`. Open tasks below will not be executed.
+
+*Structured task breakdown for automated implementation. Each task should be independently implementable and testable.*
+
+## Phase 1: RTK Core Offline Framework
+
+- [ ] **Task 1.1**: Formalize offline state and queue record types
+  - Description: Extend the offline slice state to represent connection quality, auth-blocked replay, queue record statuses, base timestamps, optimistic/server IDs, and persisted queue versioning. Keep the slice default inert until offline mode is mounted by a consuming app.
+  - Files: `rtk/src/offlineSlice.ts`, `rtk/src/useOfflineStatus.ts`, `rtk/src/index.ts`, related `rtk/src/*.test.ts`
+  - Depends on: none
+  - Acceptance: Unit tests cover enqueue/dequeue/status transitions, conflict storage, auth-blocked state, queue version defaults, and selectors for `online`, `spotty`, `offline`, queued mutations, conflicts, and replay-paused state.
+
+- [ ] **Task 1.2**: Replace endpoint-name-only offline gating with modelRouter config
+  - Description: Introduce a typed `OfflineModelRouterConfig` that maps model names and modelRouter operations to generated RTK Query endpoint names. Preserve a migration path for existing endpoint-name configuration only if it is already shipped behavior; otherwise replace it with the modelRouter config.
+  - Files: `rtk/src/offlineGate.ts`, `rtk/src/offlineMiddleware.ts`, `rtk/src/index.ts`, `rtk/src/offlineGate.test.ts`
+  - Depends on: Task 1.1
+  - Acceptance: Tests prove disabled/default config never defers mutations, enabled modelRouter endpoints are deferred while offline, unconfigured custom routes are not deferred, and array operations can be configured separately from create/update/delete.
+
+- [ ] **Task 1.3**: Add optimistic create ID strategy
+  - Description: Add default ObjectId-compatible ID generation for optimistic modelRouter creates, inject the generated ID into the configured request field, and support per-model overrides for `generateId`, request field, and server ID reconciliation strategy.
+  - Files: `rtk/src/offlineMiddleware.ts`, `rtk/src/offlineGate.ts`, `rtk/src/offlineIds.ts` (new if useful), `rtk/src/index.ts`, related tests
+  - Depends on: Task 1.2
+  - Acceptance: Tests verify default IDs are stable and ObjectId-shaped, custom generators are used, optimistic create cache entries use the same local ID as the queued mutation, and a server-returned replacement ID can be mapped when explicitly configured.
+
+- [ ] **Task 1.4**: Harden optimistic cache update strategies
+  - Description: Make optimistic cache updates explicit per modelRouter operation while providing safe defaults for create, update, delete, array push, array update, and array remove. Expose an override hook so app teams can customize cache updates for complex list filters or response shapes.
+  - Files: `rtk/src/offlineMiddleware.ts`, `rtk/src/offlineOptimistic.ts` (new if useful), `rtk/src/useOfflineStatus.ts`, related tests
+  - Depends on: Task 1.3
+  - Acceptance: Tests cover optimistic insert, patch, remove, and array mutations against RTK Query cache entries, including rollback or conflict marking when replay fails with a non-network/non-auth error.
+
+- [ ] **Task 1.5**: Pause replay on auth refresh failure without clearing cache
+  - Description: Separate token-refresh failure from explicit logout. If refresh cannot complete because the server/network is unavailable or refresh returns a retryable failure, mark replay as auth-blocked and keep RTK Query cache, queue, conflicts, and optimistic records intact. Reserve destructive cleanup for the actual logout action.
+  - Files: `rtk/src/emptyApi.ts`, `rtk/src/authSlice.ts`, `rtk/src/offlineMiddleware.ts`, `rtk/src/offlineSlice.ts`, related tests
+  - Depends on: Task 1.1
+  - Acceptance: Tests simulate expired access tokens with unreachable refresh endpoint and verify queued mutations are held, cache data remains, and replay resumes after auth is refreshed; explicit logout still clears tokens and configured offline/cache state.
+
+- [ ] **Task 1.6**: Implement keep-mine and use-server conflict resolution
+  - Description: Add conflict resolution actions/helpers. `useServer` should discard the queued mutation and patch cache to the server value. `keepMine` should update the queued mutation with the latest server timestamp, reapply the local optimistic value, and retry replay with fresh precondition headers.
+  - Files: `rtk/src/offlineSlice.ts`, `rtk/src/offlineMiddleware.ts`, `rtk/src/useOfflineStatus.ts`, `rtk/src/index.ts`, related tests
+  - Depends on: Task 1.4
+  - Acceptance: Tests cover `409 Conflict` replay responses, stored local/server values, resolving with `useServer`, resolving with `keepMine`, and preventing duplicate conflict records for the same queued mutation.
+
+## Phase 2: Connection Quality and UI
+
+- [ ] **Task 2.1**: Upgrade server status monitoring to connection quality
+  - Description: Extend `useServerStatus` to compute `online`, `spotty`, and `offline` from browser/native reachability events, health-check failures, latency, and recent failure rate. Make health URL, interval, timeout, latency threshold, failure count, and failure-rate thresholds configurable.
+  - Files: `rtk/src/useServerStatus.ts`, `rtk/src/offlineSlice.ts`, `rtk/src/index.ts`, related tests
+  - Depends on: Task 1.1
+  - Acceptance: Tests cover all three connection states, threshold overrides, transition from spotty back to online, transition to offline after configured consecutive failures, and no polling when status monitoring is disabled.
+
+- [ ] **Task 2.2**: Expose richer offline status hooks
+  - Description: Expand `useOfflineStatus` to return connection quality, queue length, syncing state, auth-blocked state, conflicts, local-only helpers, and conflict resolution callbacks while preserving low-level selectors for custom UI.
+  - Files: `rtk/src/useOfflineStatus.ts`, `rtk/src/offlineSlice.ts`, `rtk/src/index.ts`, related tests
+  - Depends on: Task 1.6, Task 2.1
+  - Acceptance: Hook tests or focused unit tests verify returned state and callbacks for queued, syncing, auth-blocked, conflicted, local-only, and healthy states.
+
+- [ ] **Task 2.3**: Update offline banner for online, spotty, offline, syncing, and auth-blocked states
+  - Description: Evolve `OfflineBanner` so apps can show offline, spotty connection, syncing queued changes, pending changes, and auth-blocked sync messaging. Keep props simple enough for custom state sources.
+  - Files: `ui/src/OfflineBanner.tsx`, `ui/src/index.tsx`, `ui/src/OfflineBanner.test.tsx` (new if absent), `demo/stories/OfflineBanner.stories.tsx` (new or update)
+  - Depends on: Task 2.1
+  - Acceptance: UI tests or stories cover hidden/online, spotty, offline, syncing, pending queue, and auth-blocked variants with clear copy and accessible test IDs.
+
+- [ ] **Task 2.4**: Add conflict resolution UI components
+  - Description: Add reusable conflict UI that renders unresolved conflicts and lets users choose "Keep mine" or "Use server". Keep it generic by accepting display renderers for local and server values.
+  - Files: `ui/src/OfflineConflictList.tsx` (new), `ui/src/OfflineConflictCard.tsx` (new), `ui/src/index.tsx`, `ui/src/*.test.tsx`, `demo/stories/OfflineConflict*.stories.tsx`
+  - Depends on: Task 2.2
+  - Acceptance: Tests or stories cover no-conflict, single-conflict, multiple-conflict, keep-mine click, use-server click, dismissed/resolved conflict filtering, and custom value rendering.
+
+## Phase 3: modelRouter Backend Contract
+
+- [ ] **Task 3.1**: Verify client-provided modelRouter create IDs
+  - Description: Add backend tests that prove modelRouter create accepts a client-provided ObjectId-compatible `_id` when the schema allows it and rejects invalid IDs through existing validation/error handling.
+  - Files: `api/src/api.ts`, `api/src/tests/*.test.ts` or existing modelRouter test file, `api/src/tests.ts`
+  - Depends on: Task 1.3
+  - Acceptance: API tests pass for create with client `_id`, returned document keeps that `_id`, duplicate IDs fail safely, and invalid IDs return a clear validation/error response.
+
+- [ ] **Task 3.2**: Formalize conflict response tests for modelRouter updates
+  - Description: Add/extend modelRouter tests for `If-Unmodified-Since` and `X-Unmodified-Since-ISO` headers to guarantee stale updates return `409 Conflict` with the current server document and fresh updates succeed.
+  - Files: `api/src/api.ts`, `api/src/tests/*.test.ts` or existing modelRouter test file
+  - Depends on: none
+  - Acceptance: API tests cover conflict by HTTP-date header, conflict by ISO header, success with current timestamp, missing timestamp behavior, and response body shape consumed by `@terreno/rtk`.
+
+- [ ] **Task 3.3**: Document the modelRouter offline contract
+  - Description: Add docs for modelRouter offline compatibility: supported CRUD/array endpoints, client-provided IDs, conflict headers, expected `409` response shape, permissions behavior, and explicit non-support for custom sync endpoints in v1.
+  - Files: `api/README.md` or package docs, `rtk/README.md` or package docs, `docs/implementationPlans/offline-mode.md`
+  - Depends on: Task 3.1, Task 3.2
+  - Acceptance: Docs show a modelRouter route configuration and matching frontend offline config, and clearly state that custom route sync is future work.
+
+## Phase 4: Example App Integration
+
+- [ ] **Task 4.1**: Enable offline mode for example todos
+  - Description: Wire the example frontend store to mount the offline reducer, persist the offline slice, configure todos modelRouter endpoints for offline create/update/delete, and keep API cache persistence consistent with the offline plan.
+  - Files: `example-frontend/store/index.ts`, `example-frontend/store/sdk.ts`, `example-frontend/app/_layout.tsx`, `example-frontend/package.json` if scripts need updates
+  - Depends on: Task 1.6, Task 2.2
+  - Acceptance: Example app can create, update, and delete todos while offline; queued todos survive app reload when persistence is enabled; replay syncs after the backend is reachable again.
+
+- [ ] **Task 4.2**: Integrate connection banner and sync state in the example app
+  - Description: Add root-level status monitoring and display `OfflineBanner` for offline, spotty, syncing, pending queue, and auth-blocked states. Ensure copy is visible without disrupting auth navigation.
+  - Files: `example-frontend/app/_layout.tsx`, `example-frontend/app/(tabs)/_layout.tsx`, `example-frontend/app/(tabs)/index.tsx`
+  - Depends on: Task 2.3, Task 4.1
+  - Acceptance: Manual test can trigger offline/spotty/syncing/auth-blocked states and see the correct banner copy and pending queue count.
+
+- [ ] **Task 4.3**: Add example conflict resolution flow
+  - Description: Show unresolved todo conflicts in the example app and wire "Keep mine" / "Use server" actions to the RTK conflict resolution helpers.
+  - Files: `example-frontend/app/(tabs)/index.tsx`, `example-frontend/components/*` if a local wrapper is useful
+  - Depends on: Task 2.4, Task 4.1
+  - Acceptance: Manual test can create a stale update conflict, see local/server values, choose "Use server" to accept server state, and choose "Keep mine" to replay local state.
+
+- [ ] **Task 4.4**: Add example backend support tests or fixtures for offline scenarios
+  - Description: Ensure the example backend todo model and route can support client IDs and conflict timestamps. Add tests or fixtures that make the example integration verifiable without modifying generated SDK files manually.
+  - Files: `example-backend/src/models/todo.ts`, `example-backend/src/api/todos.ts`, `example-backend/src/**/*.test.ts`
+  - Depends on: Task 3.1, Task 3.2
+  - Acceptance: Example backend tests pass and confirm todos work with the modelRouter offline contract.
+
+## Phase 5: Verification, Documentation, and Release Readiness
+
+- [ ] **Task 5.1**: Add package-level offline mode docs
+  - Description: Write consumer documentation for enabling offline mode, configuring modelRouter endpoints, selecting ID strategy, configuring connection quality, handling auth-blocked replay, and rendering conflict UI.
+  - Files: `rtk/README.md`, `ui/README.md` if present, `docs/implementationPlans/offline-mode.md`
+  - Depends on: Task 1.6, Task 2.4, Task 3.3
+  - Acceptance: Docs include copy-pasteable store setup, model config, status hook usage, `OfflineBanner`, and conflict resolution examples.
+
+- [ ] **Task 5.2**: Add end-to-end manual verification guide
+  - Description: Document the exact local steps to verify offline create/update/delete, replay, auth-blocked behavior, spotty status, and conflict resolution using example backend and frontend.
+  - Files: `docs/offline-mode-verification.md` (new) or relevant docs directory, `docs/implementationPlans/offline-mode.md`
+  - Depends on: Task 4.3
+  - Acceptance: Guide lists setup commands, offline simulation steps, expected UI states, and cleanup steps; it does not require editing generated SDK files manually.
+
+- [ ] **Task 5.3**: Run focused validation suite
+  - Description: Run and fix failures for the focused packages touched by offline mode.
+  - Files: no source changes expected unless validation finds failures
+  - Depends on: Task 5.1, Task 5.2
+  - Acceptance: `bun run rtk:compile` or equivalent package compile passes, `bun run ui:test` passes for new UI tests, `bun run api:test` passes for modelRouter tests, and example package checks used by the repo pass or have documented blockers.
+
+- [ ] **Task 5.4**: Regenerate SDK only if backend API surface changes
+  - Description: If implementation changes OpenAPI output for modelRouter conflict responses or example backend route schemas, regenerate `example-frontend/store/openApiSdk.ts` using the SDK generation workflow. If no OpenAPI surface changed, explicitly skip this task in the implementation PR notes.
+  - Files: `example-frontend/store/openApiSdk.ts`, `example-frontend/openapi-config.ts`
+  - Depends on: Task 3.3, Task 4.4
+  - Acceptance: Generated SDK is updated only from the backend OpenAPI spec and never edited manually; PR notes state whether SDK regeneration was required.

package/src/docs/versioned/57.17.0/tasks/org-management-ui.md

@@ -0,0 +1,107 @@
+# Tasks: Organizations as a first-class primitive (admin UI + RBAC)
+
+IP: [org-management-ui](../implementationPlans/org-management-ui.md)
+
+Supporting skills (all tasks): `update-docs`. Models: `mongoose-schema-safety`. API tests: `backend-test-env`. Admin UI: `terreno-ui`, `building-terreno-apps`, `verify-ui-changes`. SDK: `generate-sdk`. Data: `terreno-data-fetching`.
+
+## Phase 1 — Models + context
+
+- [x] **Task 1.1**: Organization + Membership models
+  - Delivers: persist orgs and per-org `roleName` (`org-admin` \| `member`)
+  - Files: `api/src/orgs/organizationModel.ts`, types, `api/src/orgs/*.test.ts`
+  - Blocked by: none
+  - Docs: field `description`s (OpenAPI); note in `docs/reference/api.md` stub section if the page is updated later in 6.1
+  - Acceptance: unit tests for compound unique index and duplicate membership rejection
+- [x] **Task 1.2**: `orgScopedPlugin`
+  - Delivers: required indexed `organizationId` on consumer schemas
+  - Files: `api/src/orgs/orgPlugin.ts` + tests
+  - Blocked by: 1.1
+  - Docs: none until 6.1
+  - Acceptance: save without org fails; index present
+- [x] **Task 1.3**: Org context middleware + `OrgQueryFilter`
+  - Delivers: Q13 header matrix; lists never cross orgs
+  - Files: `api/src/orgs/orgContext.ts`, `orgPermissions.ts`, `api/src/permissions.ts` (stop using `User.organizationIds`)
+  - Blocked by: 1.1, 1.2
+  - Docs: none until 6.1
+  - Acceptance: supertest — operator missing header on scoped list → 400; org-admin of one org omits header → scoped; org A member never reads org B including `$or` / query-param attacks; non-member header → 403
+
+## Phase 2 — RBAC
+
+- [x] **Task 2.1**: `organization` statements + `operator` role + membership-scoped `org-admin`
+  - Delivers: platform vs org grants as in the IP tables
+  - Files: `api/src/rbac/statements.ts`, `roleModel.ts`, resolve/can path for Membership `roleName`, tests
+  - Blocked by: 1.3
+  - Docs: `docs/reference/api.md` RBAC/org note (or 6.1)
+  - Acceptance: `org-admin` on org A cannot `organization:list` all orgs; `operator` can; `user.roles` containing `org-admin` is not how grants work (test that membership wins)
+
+## Phase 3 — OrgsApp routes
+
+- [x] **Task 3.1**: Operator org CRUD + `/orgs/mine`
+  - Delivers: create/list-all/mine/read/patch/soft-delete + `onOrgAudit`
+  - Files: `api/src/orgs/orgsApp.ts`, exports, OpenAPI, supertest
+  - Blocked by: 2.1
+  - Docs: none until 6.1
+  - Acceptance: org-admin 403 on `GET /orgs`; operator 200; create does not require membership; disable/soft-delete suspends memberships
+- [x] **Task 3.2**: Members attach / patch / delete + last-admin guards
+  - Delivers: existing-user attach; no email; last `org-admin` protected
+  - Files: `api/src/orgs/orgsApp.ts` + tests
+  - Blocked by: 3.1
+  - Docs: none until 6.1
+  - Acceptance: attach by email of existing user; unknown email 404; demote last org-admin 400; no comms/send invoked
+
+## Phase 4 — Admin backend
+
+- [x] **Task 4.1**: Admin org routes + AdminApp tenant context
+  - Delivers: admin UI can call org APIs; generic admin model lists use context filter
+  - Files: `admin-backend/src/*` (org registration or aliases), AdminApp queryFilter/preCreate, tests
+  - Blocked by: 3.2
+  - Docs: `docs/reference/admin-backend.md` org section (may land with 6.1)
+  - Acceptance: operator `/admin` list of an org-scoped model without header → 400; with header → only that org; org-admin cannot hit all-orgs admin list
+
+## Phase 5 — Admin frontend
+
+- [x] **Task 5.1**: `OrgDirectoryScreen` (operator)
+  - Delivers: all-orgs table, create, disable, enter org
+  - Files: `admin-frontend/src/orgs/OrgDirectoryScreen.tsx` + tests
+  - Blocked by: 4.1
+  - Docs: `docs/reference/admin-frontend.md` component section
+  - Acceptance: loading/error/empty; org-admin nav hidden in unit test via role prop/fixture
+- [x] **Task 5.2**: `OrgSwitcher` + `useOrgContext` (header + URL)
+  - Delivers: Q10/Q13 client behavior for org-admins and operators-in-org
+  - Files: `admin-frontend/src/orgs/OrgSwitcher.tsx`, `useOrgContext.tsx`, `AdminShellLayout` slot
+  - Blocked by: 5.1
+  - Docs: admin-frontend reference
+  - Acceptance: switching sets `X-Organization-Id` on subsequent admin queries (test with mocked api); single-org org-admin still renders org name
+- [x] **Task 5.3**: Org settings + members table
+  - Delivers: settings PATCH; members DataTable; add existing user; last-admin error; disabled Invite; billing placeholder
+  - Files: `admin-frontend/src/orgs/OrgSettingsScreen.tsx`, `OrgMembersScreen.tsx` + tests
+  - Blocked by: 5.2, 3.2
+  - Docs: admin-frontend reference
+  - Acceptance: Invite control disabled; billing placeholder visible; last-admin error shown
+- [x] **Task 5.4**: Host wiring — admin-spa + example-frontend `/admin`
+  - Delivers: routes on both hosts; SDK regen
+  - Files: `admin-spa/app/orgs/*`, `example-frontend/app/admin/orgs/*`, `example-frontend/store/openApiSdk.ts` (generated)
+  - Blocked by: 5.3
+  - Docs: `docs/reference/admin-spa.md` nav entry
+  - Acceptance: `cd example-frontend && bun run sdk` compiles; both apps have `/admin/orgs` routes
+- [x] **Task 5.5**: Frontend verification
+  - Delivers: evidence org-admin vs operator flows
+  - Files: `/opt/cursor/artifacts/` (not in repo)
+  - Blocked by: 5.4, 6.2
+  - Docs: none
+  - Acceptance: login operator → directory → create/open org → members; login org-admin → no directory → switcher → members only that org; screenshots/video on the PR (`verify-ui-changes`)
+
+## Phase 6 — Example + docs
+
+- [x] **Task 6.1**: Docs (same slice as behavior; can land incrementally but must be complete before Brew)
+  - Delivers: stranger can operate orgs from docs
+  - Files: `docs/how-to/add-organizations.md`, `docs/explanation/organizations.md`, `docs/reference/api.md`, `docs/reference/admin-backend.md`, `docs/reference/admin-frontend.md`, `docs/reference/admin-spa.md`, `.rulesync/**` if agent rules need org context
+  - Blocked by: 4.1 (content must match shipped routes)
+  - Docs: (this task)
+  - Acceptance: `bun run website:build` (or package docs check used in CI); how-to has one minimal OrgsApp + AdminApp example
+- [x] **Task 6.2**: example-backend migration + seeds
+  - Delivers: Membership instead of `User.organizationIds`; operator + two org-admins
+  - Files: `example-backend/src/models/user.ts`, `types/models/userTypes.ts`, `api/projects.ts`, `scripts/seed-*`, `access.ts`, `rbacRoles.ts`, tests
+  - Blocked by: 3.2, 2.1
+  - Docs: seed users named in `docs/how-to/add-organizations.md`
+  - Acceptance: grep finds no `organizationIds` on User; isolation tests pass; seed creates operator@example.com

package/src/docs/versioned/57.17.0/tasks/orgs-and-teams.md

@@ -0,0 +1,72 @@
+# Tasks: Organizations, teams, and multi-tenant scoping
+
+**Superseded.** Do not execute. Canonical tasks: [org-management-ui](org-management-ui.md).
+
+IP: [orgs-and-teams](../implementationPlans/orgs-and-teams.md) (superseded by [org-management-ui](../implementationPlans/org-management-ui.md))
+
+## Phase 1 — Models + plugin
+
+- [ ] **Task 1.1**: Organization + Membership models
+  - Description: schemas per IP (five-type pattern, descriptions, plugins, compound unique index), statics `findActiveForUser`/`isMember`/`isOrgAdmin`
+  - Files: `api/src/orgs/organizationModel.ts`, type files
+  - Depends on: none
+  - Acceptance: unit tests incl. duplicate-membership rejection
+- [ ] **Task 1.2**: `orgScopedPlugin`
+  - Description: adds required indexed `organizationId` to a schema
+  - Files: `api/src/orgs/orgPlugin.ts`
+  - Depends on: 1.1
+  - Acceptance: plugin test on a sample schema; save without org fails
+
+## Phase 2 — Context + permissions
+
+- [ ] **Task 2.1**: Org context middleware
+  - Description: `X-Organization-Id` → `req.organization`/`req.membership`; 403 on non-membership; no header → no context
+  - Files: `api/src/orgs/orgContext.ts`
+  - Depends on: 1.1
+  - Acceptance: supertest for member/non-member/missing header
+- [ ] **Task 2.2**: `IsOrgMember`, `IsOrgAdmin`, `OrgQueryFilter`
+  - Description: permission methods + query filter (header-scoped or all-memberships)
+  - Files: `api/src/orgs/orgPermissions.ts`
+  - Depends on: 2.1
+  - Acceptance: **tenant isolation suite** — org A member never reads org B rows, incl. crafted `$or`/query-param attempts
+- [ ] **Task 2.3**: modelRouter integration + `preCreate` org injection helper
+  - Description: end-to-end org-scoped CRUD on a test model
+  - Files: `api/src/orgs/*`, `api/src/tests.ts`
+  - Depends on: 2.2
+  - Acceptance: create injects context org; list/read/update/delete respect scope
+
+## Phase 3 — Routes + app
+
+- [ ] **Task 3.1**: `OrgsApp` plugin + org CRUD routes
+  - Description: create (with `maxOrgsPerUser`), list-my-orgs, read, patch, soft delete with membership cascade
+  - Files: `api/src/orgs/orgsApp.ts`
+  - Depends on: Phase 2
+  - Acceptance: supertest per route; OpenAPI entries present
+- [ ] **Task 3.2**: Member management routes + last-admin guards
+  - Description: list/patch/delete members; cannot demote/remove last admin
+  - Files: `api/src/orgs/orgsApp.ts`
+  - Depends on: 3.1
+  - Acceptance: guard tests pass
+- [ ] **Task 3.3**: `onOrgAudit` hook + exports
+  - Description: audit hook mirroring `onAdminAudit`; public exports from `@terreno/api`
+  - Files: `api/src/orgs/orgsApp.ts`, `api/src/index.ts`
+  - Depends on: 3.1
+  - Acceptance: hook fires for create/role-change/delete in tests
+
+## Phase 4 — Example + docs
+
+- [ ] **Task 4.1**: example-backend org-scoped `Project` model + routes + seeds
+  - Description: demo model with `orgScopedPlugin` + `OrgQueryFilter`; seed two orgs with distinct data
+  - Files: `example-backend/src/models/project.ts`, `src/api/projects.ts`, `scripts/seed*`
+  - Depends on: Phase 3
+  - Acceptance: seeded backend proves isolation via curl/supertest
+- [ ] **Task 4.2**: Admin registration + SDK regen
+  - Description: register Organization/Membership in AdminApp; `cd example-frontend && bun run sdk`
+  - Files: `example-backend/src/server.ts`, `example-frontend/store/openApiSdk.ts`
+  - Depends on: 4.1
+  - Acceptance: admin panel lists orgs; SDK compiles
+- [ ] **Task 4.3**: Docs
+  - Description: `docs/how-to/add-organizations.md`, reference updates, rulesync
+  - Files: `docs/how-to/add-organizations.md`, `docs/reference/api.md`, `.rulesync/**`
+  - Depends on: Phase 3
+  - Acceptance: `bun run rules:check` passes

package/src/docs/versioned/57.17.0/tasks/oss-governance-baseline.md

@@ -0,0 +1,129 @@
+# Task List: OSS Governance Baseline
+
+See: [`docs/implementationPlans/oss-governance-baseline.md`](../implementationPlans/oss-governance-baseline.md)
+
+**RTK deprecation flag:** None. No task here touches `@terreno/rtk`, syncdb, or auth. Safe to implement before PR #869.
+
+## Instructions for the implementing agent
+
+- Do **not** change any source code under `*/src/`. This IP is documentation, metadata, and CI configuration only.
+- Do **not** rewrite existing `README.md` prose. Only append the new governance section and badge.
+- Answer keys used below follow the IP decisions recorded 2026-07-29 (**MIT**, DCO, Contributor Covenant 2.1, `security@terreno.app`, `conduct@terreno.app`, Conventional Commits CI-enforced). If the IP decision table changes, follow the IP.
+- Run `bun run lint` before each commit. Run `bun run rules:check` if you touch anything under `.rulesync/`.
+- One commit per task unless a task explicitly says otherwise.
+
+## Phase 1: Legal baseline
+
+- [x] **Task 1.1**: Add root `LICENSE` and `NOTICE`
+  - Description: Copy the MIT License text to a new root `LICENSE` (use the standard MIT template; `mcp-server` already ships MIT). Create `NOTICE` containing the project name, the copyright line `Copyright 2026 Flourish Health, Inc.`, and a one-line statement that the project is licensed under MIT. Include acknowledgement of vendored `api/src/vendor/wesleytodd-openapi/` with a pointer to its own `LICENSE`.
+  - Files: `LICENSE` (new), `NOTICE` (new)
+  - Depends on: none
+  - Acceptance: `LICENSE` exists at repo root with standard MIT text; `NOTICE` mentions the vendored openapi code. Do not compare against `api/LICENSE` or `ui/LICENSE` — those remain Apache-2.0 until Task 1.4.
+
+- [x] **Task 1.2**: Audit license coverage across published packages
+  - Description: Read `.github/workflows/publish-on-tag.yml` and list every package it publishes. For each one, record in a scratch table: whether a `LICENSE` file exists, whether `package.json` has a `files` array, whether `LICENSE` is included in that array, and the `license` field value. Write the findings as a markdown table in the PR description. Do not fix anything in this task.
+  - Files: none (findings go in the PR body)
+  - Depends on: none
+  - Acceptance: PR body contains a table with one row per published package and the four columns above; the table is derived from the actual repo, not copied from the IP.
+
+- [x] **Task 1.3**: Add `LICENSE` to every published package
+  - Description: For each package identified in Task 1.2 that lacks a `LICENSE`, create one by copying the root `LICENSE`. Packages to cover: `rtk`, `ai`, `admin-backend`, `admin-frontend`, `admin-spa`, `api-health`, `feature-flags`, `mcp-server`, `test`. Do not create `LICENSE` files in non-published directories (`demo`, `example-frontend`, `example-backend`, `website`, `terraform`).
+  - Files: `rtk/LICENSE`, `ai/LICENSE`, `admin-backend/LICENSE`, `admin-frontend/LICENSE`, `admin-spa/LICENSE`, `api-health/LICENSE`, `feature-flags/LICENSE`, `mcp-server/LICENSE`, `test/LICENSE` (all new)
+  - Depends on: Task 1.1, Task 1.2
+  - Acceptance: every published package directory contains a `LICENSE` identical to the root `LICENSE`.
+
+- [x] **Task 1.4**: Align `license` fields and `files` arrays
+  - Description: Set `"license": "MIT"` in the root `package.json` and in every published package's `package.json` (relicense `api`/`ui` from Apache-2.0). For every package that has an explicit `files` array, add `"LICENSE"` to it (`ui`, `rtk`, `admin-frontend`, `admin-spa`, `mcp-server` at minimum — confirm against Task 1.2 findings). Do not otherwise reorder or reformat `package.json`.
+  - Files: `package.json`, `ui/package.json`, `rtk/package.json`, `admin-frontend/package.json`, `admin-spa/package.json`, `mcp-server/package.json`, plus any others found in Task 1.2
+  - Depends on: Task 1.3
+  - Acceptance: `bun pm pack --dry-run` run inside each published package lists `LICENSE` among the packed files; no `package.json` declares a license other than `MIT`.
+
+- [x] **Task 1.5**: Verify relicensing consent for `api` and `ui`
+  - Description: Run `git log --format='%an <%ae>' -- api/ ui/ | sort -u` and list every distinct author. Report the list in the PR body, flagging any address that is not a `@flourish.health` address or a known bot. Do **not** proceed to merge the Apache-2.0 → MIT change for `api`/`ui` if a non-Flourish human contributor appears; instead leave a `TODO` note in the PR body requesting sign-off. (`mcp-server` is already MIT.)
+  - Files: none (findings go in the PR body)
+  - Depends on: Task 1.4
+  - Acceptance: PR body lists all `api`/`ui` authors and explicitly states either "all Flourish/bot — safe to relicense" or names the contributors needing sign-off.
+
+- [x] **Task 1.6**: Add a license-coverage CI check
+  - Description: Create `scripts/check-license-coverage.ts` (Bun, TypeScript, `const` arrow functions, explicit return types). It should: read the list of published packages from `.github/workflows/publish-on-tag.yml` (parse job names or a hardcoded list with a comment pointing at the workflow), then for each assert (a) `LICENSE` exists, (b) `package.json` `license` equals the root `package.json` `license`, (c) if a `files` array exists it contains `LICENSE`. Print one line per failure and `process.exit(1)` when any check fails. Add a `check:licenses` script to the root `package.json` and a job to `.github/workflows/repo-policies.yml` that runs it.
+  - Files: `scripts/check-license-coverage.ts` (new), `package.json`, `.github/workflows/repo-policies.yml`
+  - Depends on: Task 1.4
+  - Acceptance: `bun run check:licenses` exits 0 on a clean tree; temporarily deleting `rtk/LICENSE` makes it exit 1 with a message naming `rtk`; the new CI job appears in `repo-policies.yml`.
+
+## Phase 2: Contribution process
+
+- [x] **Task 2.1**: Write `CONTRIBUTING.md`
+  - Description: Create `CONTRIBUTING.md` covering, in this order: (1) Code of Conduct link; (2) ways to contribute (issue, discussion, docs fix, code); (3) development setup — `bun run bootstrap`, Bun version requirement, MongoDB replica-set requirement for `example-backend` (single-node replset is enough, change streams need it), the seeded users `test@example.com` / `superuser@example.com` with password `testpassword123`; (4) per-package commands table pulled from the root `package.json` scripts (`bun run api:test`, `bun run ui:test`, `bun run lint`, `bun run compile`); (5) code style pointers — link `AGENTS.md`, call out the no-barrel-imports rule and `bun run check:no-barrel-imports`, the Luxon requirement, and the logging conventions; (6) test expectations — new features ship with tests, coverage must not drop; (7) the IP process — link `docs/implementationPlans/README.md` and `IP_TEMPLATE.md`, explain when an IP is required (new package, new public API, cross-package change) versus not (bug fix, docs); (8) DCO sign-off instructions (`git commit -s`); (9) PR expectations — draft by default, CI green, screenshots for UI changes.
+  - Files: `CONTRIBUTING.md` (new)
+  - Depends on: none
+  - Acceptance: every command shown in `CONTRIBUTING.md` exists in a `package.json` `scripts` block; the seeded credentials match `example-backend/src/scripts/`; no reference to `.claude/` or other agent-private paths.
+
+- [x] **Task 2.2**: Add `CODE_OF_CONDUCT.md`
+  - Description: Add Contributor Covenant 2.1 verbatim, with the enforcement contact set to `conduct@terreno.app`. Do not modify the covenant text other than the contact line and the project name.
+  - Files: `CODE_OF_CONDUCT.md` (new)
+  - Depends on: none
+  - Acceptance: file states "Contributor Covenant" and version 2.1; contact address is present and is not a placeholder.
+
+- [x] **Task 2.3**: Add `SECURITY.md`
+  - Description: Create `SECURITY.md` with: a supported-versions table (current minor supported; previous minor receives security fixes only), reporting instructions naming GitHub private vulnerability reporting as the primary channel and `security@terreno.app` as fallback, a 5-business-day acknowledgement commitment, a statement that reporters should not open public issues for vulnerabilities, and a note that CodeQL runs on the repo (`.github/workflows/codeql-analysis.yml`).
+  - Files: `SECURITY.md` (new)
+  - Depends on: none
+  - Acceptance: file exists at repo root so GitHub surfaces it under Security → Policy; both reporting channels are named.
+
+- [x] **Task 2.4**: Add a DCO check for external PRs
+  - Description: Add a workflow job (either in `repo-policies.yml` or a new `.github/workflows/dco.yml`) that, for pull requests whose head repository differs from the base repository, verifies every commit message contains a `Signed-off-by:` line matching the commit author. Skip the check for PRs from the same repo and for bot authors (`dependabot[bot]`, `cursor[bot]`). Follow the repo's existing convention of validating required inputs before use.
+  - Files: `.github/workflows/dco.yml` (new) or `.github/workflows/repo-policies.yml`
+  - Depends on: Task 2.1
+  - Acceptance: the job's condition explicitly excludes same-repo PRs and the named bots; the workflow parses as valid YAML (`bunx yaml-lint` or equivalent).
+
+## Phase 3: Changelog
+
+- [x] **Task 3.1**: Create the root `CHANGELOG.md` and backfill releases
+  - Description: Create `CHANGELOG.md` in Keep-a-Changelog format with an `## [Unreleased]` section at the top, then one section per released version, newest first. Source the content from `gh release list --limit 40` and `gh release view <tag>` for each release from 0.20.0 to the current version. Group each entry under `Added` / `Changed` / `Fixed` / `Deprecated` / `Removed`. Include a header note that all `@terreno/*` packages are versioned in lockstep and a link to `docs/implementationPlans/oss-launch-program.md` is **not** needed here. Do not invent entries — if a release has no notes, write `- No published release notes.` under that version.
+  - Files: `CHANGELOG.md` (new)
+  - Depends on: none
+  - Acceptance: every version tag returned by `gh release list` between 0.20.0 and current has a section; no section is empty; the file states the lockstep versioning rule.
+
+- [x] **Task 3.2**: Reduce `api/CHANGELOG.md` to a pointer
+  - Description: Replace the contents of `api/CHANGELOG.md` with a short note that the changelog moved to the repo root, linking `../CHANGELOG.md`. Preserve the historical entries by moving them into the corresponding root `CHANGELOG.md` sections first if they contain detail the GitHub releases lack.
+  - Files: `api/CHANGELOG.md`, `CHANGELOG.md`
+  - Depends on: Task 3.1
+  - Acceptance: `api/CHANGELOG.md` is under 10 lines and links to the root changelog; no historical detail was lost.
+
+- [x] **Task 3.3**: Make changelog updates part of the release process
+  - Description: Edit `.rulesync/skills/release/SKILL.md` to add a required step: before tagging, move `## [Unreleased]` content into a new version section in the root `CHANGELOG.md` with today's date (via Luxon-formatted ISO date), and confirm the section is non-empty. Then run `bun run rules` to regenerate the mirrored skill files under `.cursor/`, `.claude/`, `.devin/`, `.github/`, and `.agents/`.
+  - Files: `.rulesync/skills/release/SKILL.md`, plus generated mirrors
+  - Depends on: Task 3.1
+  - Acceptance: `bun run rules:check` exits 0 (no uncommitted diff after regeneration); the release skill mentions `CHANGELOG.md` as a required pre-tag step.
+
+## Phase 4: GitHub templates
+
+- [x] **Task 4.1**: Add issue forms
+  - Description: Create three GitHub issue forms. `bug_report.yml`: fields for affected package (dropdown listing all published `@terreno/*` packages plus `docs`, `examples`, `mcp`), version, platform (dropdown: iOS / Android / Web / Backend / N/A), reproduction steps (required textarea), expected vs actual, and a checkbox confirming the reporter searched existing issues. `feature_request.yml`: problem statement (required), proposed solution, alternatives considered, and a checkbox asking whether the requester is willing to open a PR. `docs_issue.yml`: page URL, what is wrong or missing, and suggested fix. Add `config.yml` with `blank_issues_enabled: false` and contact links to Discussions (Q&A and Ideas categories) and `SECURITY.md`.
+  - Files: `.github/ISSUE_TEMPLATE/bug_report.yml`, `.github/ISSUE_TEMPLATE/feature_request.yml`, `.github/ISSUE_TEMPLATE/docs_issue.yml`, `.github/ISSUE_TEMPLATE/config.yml` (all new)
+  - Depends on: Task 2.3
+  - Acceptance: all four files parse as valid YAML; the package dropdown in `bug_report.yml` matches the packages published by `publish-on-tag.yml`; `config.yml` disables blank issues.
+
+- [x] **Task 4.2**: Add a PR template
+  - Description: Create `.github/PULL_REQUEST_TEMPLATE.md` with sections: Summary; Related IP or issue; Type of change (checkboxes); Testing performed (with a reminder that frontend changes require screenshots or video per `AGENTS.md`); Checklist (tests added, `bun run lint` passes, `bun run compile` passes, docs updated, changelog `Unreleased` entry added for user-facing changes, DCO signed off). Keep it short enough that contributors actually fill it in — under 40 lines.
+  - Files: `.github/PULL_REQUEST_TEMPLATE.md` (new)
+  - Depends on: Task 2.1, Task 3.1
+  - Acceptance: template is under 40 lines; references the changelog and the frontend-verification requirement.
+
+- [x] **Task 4.3**: Add `CODEOWNERS`
+  - Description: Create `.github/CODEOWNERS` mapping each package directory to its owning team or maintainer, plus a catch-all root owner. Use GitHub team handles if they exist; otherwise use individual maintainer usernames. Include entries for `docs/`, `.github/`, `.rulesync/`, and `terraform/`.
+  - Files: `.github/CODEOWNERS` (new)
+  - Depends on: none
+  - Acceptance: every top-level package directory has an owner; the file has a catch-all `*` line; GitHub's CODEOWNERS validation (visible in repo settings) reports no errors.
+
+- [x] **Task 4.4**: Document required repository settings
+  - Description: Add a short section to `CONTRIBUTING.md` (or a new `docs/explanation/repository-settings.md` if it exceeds 30 lines) listing the GitHub settings a maintainer must enable manually because they cannot be committed: Discussions enabled with the categories from [`public-roadmap-github.md`](../implementationPlans/public-roadmap-github.md), private vulnerability reporting enabled, branch protection on `master` requiring the CI checks, "Allow squash merging" only, and auto-delete of merged branches.
+  - Files: `CONTRIBUTING.md` or `docs/explanation/repository-settings.md`
+  - Depends on: Task 2.1
+  - Acceptance: the list names each setting and where to find it in the GitHub UI; no setting is described as already enabled unless verified.
+
+- [x] **Task 4.5**: Append the governance section to `README.md`
+  - Description: Add a `## License` section and a `## Contributing` section near the end of `README.md`, plus a license badge next to the existing npm badges. Link `LICENSE`, `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`, and `SECURITY.md`. Do not modify any other README content — positioning changes belong to a different IP.
+  - Files: `README.md`
+  - Depends on: Task 1.1, Task 2.1, Task 2.2, Task 2.3
+  - Acceptance: `git diff README.md` shows only additions (badge line plus two new sections); all four links resolve to files that exist.