aigroup-workflow 2.2.1 → 2.2.2

package/skills/backend/fullstack-guardian/references/deliverables-checklist.md

@@ -1,354 +1,354 @@
-# Deliverables Checklist
-
-## Code Deliverables
-
-### Backend Files
-- [ ] API endpoint implementations
-- [ ] Database models and schemas
-- [ ] Validation schemas (Zod/Pydantic)
-- [ ] Business logic services
-- [ ] Middleware (auth, error handling, logging)
-- [ ] Database migrations with rollback
-- [ ] Environment configuration files
-- [ ] Docker/container configuration
-
-### Frontend Files
-- [ ] Component files with TypeScript interfaces
-- [ ] Custom hooks for data fetching
-- [ ] State management setup (Redux/Zustand/Context)
-- [ ] API client/service layer
-- [ ] Form components with validation
-- [ ] Error boundary components
-- [ ] Routing configuration
-- [ ] Style files (CSS/SCSS/styled-components)
-
-### Shared/Integration Files
-- [ ] Shared TypeScript types package
-- [ ] Shared validation schemas
-- [ ] API contract definitions
-- [ ] Utility functions used across stack
-- [ ] Configuration types
-- [ ] Constants and enums
-
-## Testing Deliverables
-
-### Unit Tests
-```typescript
-// Backend: Service layer tests
-describe('UserService', () => {
-  it('should create user with hashed password', async () => {
-    const user = await userService.create({
-      email: 'test@example.com',
-      password: 'SecurePass123!',
-    });
-    expect(user.password).not.toBe('SecurePass123!');
-    expect(user.email).toBe('test@example.com');
-  });
-});
-
-// Frontend: Component tests
-describe('UserForm', () => {
-  it('should validate email format', async () => {
-    render(<UserForm onSubmit={jest.fn()} />);
-    await userEvent.type(screen.getByLabelText('Email'), 'invalid');
-    await userEvent.click(screen.getByText('Submit'));
-    expect(screen.getByText(/invalid email/i)).toBeInTheDocument();
-  });
-});
-```
-
-### Integration Tests
-```typescript
-// API endpoint tests
-describe('POST /api/users', () => {
-  it('should create user and return 201', async () => {
-    const response = await request(app)
-      .post('/api/users')
-      .send({ email: 'new@example.com', password: 'Pass123!' });
-
-    expect(response.status).toBe(201);
-    expect(response.body).toHaveProperty('id');
-    expect(response.body.email).toBe('new@example.com');
-  });
-
-  it('should return 422 for duplicate email', async () => {
-    await createUser({ email: 'existing@example.com' });
-
-    const response = await request(app)
-      .post('/api/users')
-      .send({ email: 'existing@example.com', password: 'Pass123!' });
-
-    expect(response.status).toBe(422);
-    expect(response.body.error.code).toBe('DUPLICATE_EMAIL');
-  });
-});
-```
-
-### E2E Tests
-```typescript
-// Playwright test
-test('complete user registration flow', async ({ page }) => {
-  await page.goto('/register');
-  await page.fill('[name="email"]', 'newuser@example.com');
-  await page.fill('[name="password"]', 'SecurePass123!');
-  await page.click('button[type="submit"]');
-
-  await expect(page).toHaveURL('/dashboard');
-  await expect(page.locator('[data-testid="welcome-message"]'))
-    .toContainText('Welcome');
-});
-```
-
-### Test Coverage Requirements
-- [ ] Unit tests: >80% coverage
-- [ ] Integration tests: All critical paths
-- [ ] E2E tests: Main user journeys
-- [ ] Performance tests: Load/stress scenarios
-- [ ] Security tests: OWASP Top 10 validation
-
-## Documentation Deliverables
-
-### Technical Documentation
-```markdown
-# Feature: User Management API
-
-## Overview
-Complete CRUD API for user management with authentication and authorization.
-
-## Endpoints
-
-### Create User
-POST /api/v1/users
-
-Request:
-{
-  "email": "user@example.com",
-  "name": "John Doe",
-  "password": "SecurePass123!"
-}
-
-Response (201):
-{
-  "id": "usr_abc123",
-  "email": "user@example.com",
-  "name": "John Doe",
-  "createdAt": "2025-01-15T10:00:00Z"
-}
-
-### Authentication
-All endpoints except POST /users require Bearer token:
-Authorization: Bearer <jwt_token>
-
-### Error Responses
-422 Validation Error:
-{
-  "error": {
-    "code": "VALIDATION_ERROR",
-    "message": "Invalid input",
-    "details": { "email": ["Must be valid email"] }
-  }
-}
-```
-
-### Component Documentation
-```typescript
-/**
- * UserProfileForm - Editable user profile form with validation
- *
- * @example
- * <UserProfileForm
- *   initialData={currentUser}
- *   onSubmit={handleUpdate}
- *   onCancel={() => router.back()}
- * />
- *
- * @param initialData - User data to pre-populate form
- * @param onSubmit - Callback when form is submitted with valid data
- * @param onCancel - Optional callback when user cancels editing
- */
-export function UserProfileForm({
-  initialData,
-  onSubmit,
-  onCancel
-}: UserProfileFormProps) {
-  // Component implementation
-}
-```
-
-### README Updates
-- [ ] Installation instructions
-- [ ] Environment variable configuration
-- [ ] Development setup steps
-- [ ] Build and deployment commands
-- [ ] Testing instructions
-- [ ] Troubleshooting guide
-
-### Storybook Documentation (Frontend)
-```typescript
-// UserCard.stories.tsx
-export default {
-  title: 'Components/UserCard',
-  component: UserCard,
-} as Meta;
-
-export const Default: Story = {
-  args: {
-    user: {
-      name: 'John Doe',
-      email: 'john@example.com',
-      avatar: 'https://example.com/avatar.jpg',
-    },
-  },
-};
-
-export const Loading: Story = {
-  args: { isLoading: true },
-};
-
-export const WithLongName: Story = {
-  args: {
-    user: {
-      name: 'Johnathan Alexander Wellington III',
-      email: 'johnathan@example.com',
-    },
-  },
-};
-```
-
-## Performance Deliverables
-
-### Metrics Report
-```markdown
-## Performance Metrics
-
-### Backend API
-- Average response time: 45ms
-- P95 response time: 120ms
-- P99 response time: 250ms
-- Throughput: 1000 req/s
-- Error rate: 0.02%
-
-### Frontend Bundle
-- Initial bundle size: 245 KB (gzipped)
-- Largest chunk: 180 KB
-- Time to Interactive: 1.2s
-- Lighthouse score: 95/100
-
-### Database Queries
-- Average query time: 15ms
-- Slowest query: 85ms (user search)
-- Index usage: 98%
-- Connection pool utilization: 60%
-```
-
-### Bundle Analysis
-- [ ] Webpack/Vite bundle analysis report
-- [ ] Lighthouse performance audit
-- [ ] Core Web Vitals measurements
-- [ ] Bundle size comparison (before/after)
-
-## Security Deliverables
-
-### Security Checklist
-- [ ] Input validation on all endpoints
-- [ ] Output sanitization (XSS prevention)
-- [ ] SQL injection prevention (parameterized queries)
-- [ ] CSRF protection enabled
-- [ ] Rate limiting configured
-- [ ] Authentication required where needed
-- [ ] Authorization checks implemented
-- [ ] Sensitive data excluded from responses
-- [ ] Secrets in environment variables
-- [ ] HTTPS enforced in production
-- [ ] Security headers configured (CSP, HSTS, etc.)
-
-### Security Audit Report
-```markdown
-## Security Review
-
-### Authentication
-- JWT with RS256 algorithm
-- 15-minute access tokens
-- 7-day refresh tokens
-- Secure cookie storage
-
-### Authorization
-- Role-based access control (RBAC)
-- Resource ownership validation
-- Permission checks on all mutations
-
-### Data Protection
-- Passwords hashed with bcrypt (12 rounds)
-- Sensitive data encrypted at rest
-- PII excluded from logs
-- Rate limiting: 100 req/15min per IP
-```
-
-## Deployment Deliverables
-
-### Configuration Files
-- [ ] `Dockerfile` with multi-stage build
-- [ ] `docker-compose.yml` for local dev
-- [ ] CI/CD pipeline configuration
-- [ ] Environment-specific configs
-- [ ] Database migration scripts
-- [ ] Health check endpoints
-- [ ] Kubernetes manifests (if applicable)
-
-### Deployment Guide
-```markdown
-## Deployment Steps
-
-### Prerequisites
-- Node.js 18+
-- PostgreSQL 15+
-- Redis 7+
-
-### Environment Variables
-DATABASE_URL=postgresql://user:pass@host:5432/dbname
-REDIS_URL=redis://localhost:6379
-JWT_SECRET=<generate-secure-secret>
-API_PORT=3000
-
-### Build & Deploy
-npm run build
-npm run migrate
-npm run start:prod
-
-### Health Check
-GET /api/health
-Expected: { "status": "ok", "database": "connected" }
-```
-
-## Handoff Checklist
-
-### Before Handoff
-- [ ] All tests passing
-- [ ] Code reviewed and approved
-- [ ] Documentation complete
-- [ ] Performance validated
-- [ ] Security reviewed
-- [ ] Deployed to staging
-- [ ] E2E tests pass in staging
-- [ ] Accessibility audit complete
-
-### Handoff Package
-- [ ] Links to merged PRs
-- [ ] Deployment instructions
-- [ ] Database migration notes
-- [ ] Known issues/limitations
-- [ ] Monitoring dashboard URLs
-- [ ] Rollback procedure
-- [ ] Support contact information
-
-## Quick Reference
-
-| Category | Key Deliverables | Coverage Target |
-|----------|-----------------|-----------------|
-| Backend | API, models, migrations | 80% test coverage |
-| Frontend | Components, hooks, routes | 85% test coverage |
-| Tests | Unit, integration, E2E | All critical paths |
-| Docs | API, components, setup | Complete |
-| Performance | Metrics, bundle analysis | <200ms P95 API, <2s TTI |
-| Security | Audit, OWASP validation | All vulnerabilities addressed |
-| Deployment | Docker, CI/CD, guides | Zero-downtime capable |
+# Deliverables Checklist
+
+## Code Deliverables
+
+### Backend Files
+- [ ] API endpoint implementations
+- [ ] Database models and schemas
+- [ ] Validation schemas (Zod/Pydantic)
+- [ ] Business logic services
+- [ ] Middleware (auth, error handling, logging)
+- [ ] Database migrations with rollback
+- [ ] Environment configuration files
+- [ ] Docker/container configuration
+
+### Frontend Files
+- [ ] Component files with TypeScript interfaces
+- [ ] Custom hooks for data fetching
+- [ ] State management setup (Redux/Zustand/Context)
+- [ ] API client/service layer
+- [ ] Form components with validation
+- [ ] Error boundary components
+- [ ] Routing configuration
+- [ ] Style files (CSS/SCSS/styled-components)
+
+### Shared/Integration Files
+- [ ] Shared TypeScript types package
+- [ ] Shared validation schemas
+- [ ] API contract definitions
+- [ ] Utility functions used across stack
+- [ ] Configuration types
+- [ ] Constants and enums
+
+## Testing Deliverables
+
+### Unit Tests
+```typescript
+// Backend: Service layer tests
+describe('UserService', () => {
+  it('should create user with hashed password', async () => {
+    const user = await userService.create({
+      email: 'test@example.com',
+      password: 'SecurePass123!',
+    });
+    expect(user.password).not.toBe('SecurePass123!');
+    expect(user.email).toBe('test@example.com');
+  });
+});
+
+// Frontend: Component tests
+describe('UserForm', () => {
+  it('should validate email format', async () => {
+    render(<UserForm onSubmit={jest.fn()} />);
+    await userEvent.type(screen.getByLabelText('Email'), 'invalid');
+    await userEvent.click(screen.getByText('Submit'));
+    expect(screen.getByText(/invalid email/i)).toBeInTheDocument();
+  });
+});
+```
+
+### Integration Tests
+```typescript
+// API endpoint tests
+describe('POST /api/users', () => {
+  it('should create user and return 201', async () => {
+    const response = await request(app)
+      .post('/api/users')
+      .send({ email: 'new@example.com', password: 'Pass123!' });
+
+    expect(response.status).toBe(201);
+    expect(response.body).toHaveProperty('id');
+    expect(response.body.email).toBe('new@example.com');
+  });
+
+  it('should return 422 for duplicate email', async () => {
+    await createUser({ email: 'existing@example.com' });
+
+    const response = await request(app)
+      .post('/api/users')
+      .send({ email: 'existing@example.com', password: 'Pass123!' });
+
+    expect(response.status).toBe(422);
+    expect(response.body.error.code).toBe('DUPLICATE_EMAIL');
+  });
+});
+```
+
+### E2E Tests
+```typescript
+// Playwright test
+test('complete user registration flow', async ({ page }) => {
+  await page.goto('/register');
+  await page.fill('[name="email"]', 'newuser@example.com');
+  await page.fill('[name="password"]', 'SecurePass123!');
+  await page.click('button[type="submit"]');
+
+  await expect(page).toHaveURL('/dashboard');
+  await expect(page.locator('[data-testid="welcome-message"]'))
+    .toContainText('Welcome');
+});
+```
+
+### Test Coverage Requirements
+- [ ] Unit tests: >80% coverage
+- [ ] Integration tests: All critical paths
+- [ ] E2E tests: Main user journeys
+- [ ] Performance tests: Load/stress scenarios
+- [ ] Security tests: OWASP Top 10 validation
+
+## Documentation Deliverables
+
+### Technical Documentation
+```markdown
+# Feature: User Management API
+
+## Overview
+Complete CRUD API for user management with authentication and authorization.
+
+## Endpoints
+
+### Create User
+POST /api/v1/users
+
+Request:
+{
+  "email": "user@example.com",
+  "name": "John Doe",
+  "password": "SecurePass123!"
+}
+
+Response (201):
+{
+  "id": "usr_abc123",
+  "email": "user@example.com",
+  "name": "John Doe",
+  "createdAt": "2025-01-15T10:00:00Z"
+}
+
+### Authentication
+All endpoints except POST /users require Bearer token:
+Authorization: Bearer <jwt_token>
+
+### Error Responses
+422 Validation Error:
+{
+  "error": {
+    "code": "VALIDATION_ERROR",
+    "message": "Invalid input",
+    "details": { "email": ["Must be valid email"] }
+  }
+}
+```
+
+### Component Documentation
+```typescript
+/**
+ * UserProfileForm - Editable user profile form with validation
+ *
+ * @example
+ * <UserProfileForm
+ *   initialData={currentUser}
+ *   onSubmit={handleUpdate}
+ *   onCancel={() => router.back()}
+ * />
+ *
+ * @param initialData - User data to pre-populate form
+ * @param onSubmit - Callback when form is submitted with valid data
+ * @param onCancel - Optional callback when user cancels editing
+ */
+export function UserProfileForm({
+  initialData,
+  onSubmit,
+  onCancel
+}: UserProfileFormProps) {
+  // Component implementation
+}
+```
+
+### README Updates
+- [ ] Installation instructions
+- [ ] Environment variable configuration
+- [ ] Development setup steps
+- [ ] Build and deployment commands
+- [ ] Testing instructions
+- [ ] Troubleshooting guide
+
+### Storybook Documentation (Frontend)
+```typescript
+// UserCard.stories.tsx
+export default {
+  title: 'Components/UserCard',
+  component: UserCard,
+} as Meta;
+
+export const Default: Story = {
+  args: {
+    user: {
+      name: 'John Doe',
+      email: 'john@example.com',
+      avatar: 'https://example.com/avatar.jpg',
+    },
+  },
+};
+
+export const Loading: Story = {
+  args: { isLoading: true },
+};
+
+export const WithLongName: Story = {
+  args: {
+    user: {
+      name: 'Johnathan Alexander Wellington III',
+      email: 'johnathan@example.com',
+    },
+  },
+};
+```
+
+## Performance Deliverables
+
+### Metrics Report
+```markdown
+## Performance Metrics
+
+### Backend API
+- Average response time: 45ms
+- P95 response time: 120ms
+- P99 response time: 250ms
+- Throughput: 1000 req/s
+- Error rate: 0.02%
+
+### Frontend Bundle
+- Initial bundle size: 245 KB (gzipped)
+- Largest chunk: 180 KB
+- Time to Interactive: 1.2s
+- Lighthouse score: 95/100
+
+### Database Queries
+- Average query time: 15ms
+- Slowest query: 85ms (user search)
+- Index usage: 98%
+- Connection pool utilization: 60%
+```
+
+### Bundle Analysis
+- [ ] Webpack/Vite bundle analysis report
+- [ ] Lighthouse performance audit
+- [ ] Core Web Vitals measurements
+- [ ] Bundle size comparison (before/after)
+
+## Security Deliverables
+
+### Security Checklist
+- [ ] Input validation on all endpoints
+- [ ] Output sanitization (XSS prevention)
+- [ ] SQL injection prevention (parameterized queries)
+- [ ] CSRF protection enabled
+- [ ] Rate limiting configured
+- [ ] Authentication required where needed
+- [ ] Authorization checks implemented
+- [ ] Sensitive data excluded from responses
+- [ ] Secrets in environment variables
+- [ ] HTTPS enforced in production
+- [ ] Security headers configured (CSP, HSTS, etc.)
+
+### Security Audit Report
+```markdown
+## Security Review
+
+### Authentication
+- JWT with RS256 algorithm
+- 15-minute access tokens
+- 7-day refresh tokens
+- Secure cookie storage
+
+### Authorization
+- Role-based access control (RBAC)
+- Resource ownership validation
+- Permission checks on all mutations
+
+### Data Protection
+- Passwords hashed with bcrypt (12 rounds)
+- Sensitive data encrypted at rest
+- PII excluded from logs
+- Rate limiting: 100 req/15min per IP
+```
+
+## Deployment Deliverables
+
+### Configuration Files
+- [ ] `Dockerfile` with multi-stage build
+- [ ] `docker-compose.yml` for local dev
+- [ ] CI/CD pipeline configuration
+- [ ] Environment-specific configs
+- [ ] Database migration scripts
+- [ ] Health check endpoints
+- [ ] Kubernetes manifests (if applicable)
+
+### Deployment Guide
+```markdown
+## Deployment Steps
+
+### Prerequisites
+- Node.js 18+
+- PostgreSQL 15+
+- Redis 7+
+
+### Environment Variables
+DATABASE_URL=postgresql://user:pass@host:5432/dbname
+REDIS_URL=redis://localhost:6379
+JWT_SECRET=<generate-secure-secret>
+API_PORT=3000
+
+### Build & Deploy
+npm run build
+npm run migrate
+npm run start:prod
+
+### Health Check
+GET /api/health
+Expected: { "status": "ok", "database": "connected" }
+```
+
+## Handoff Checklist
+
+### Before Handoff
+- [ ] All tests passing
+- [ ] Code reviewed and approved
+- [ ] Documentation complete
+- [ ] Performance validated
+- [ ] Security reviewed
+- [ ] Deployed to staging
+- [ ] E2E tests pass in staging
+- [ ] Accessibility audit complete
+
+### Handoff Package
+- [ ] Links to merged PRs
+- [ ] Deployment instructions
+- [ ] Database migration notes
+- [ ] Known issues/limitations
+- [ ] Monitoring dashboard URLs
+- [ ] Rollback procedure
+- [ ] Support contact information
+
+## Quick Reference
+
+| Category | Key Deliverables | Coverage Target |
+|----------|-----------------|-----------------|
+| Backend | API, models, migrations | 80% test coverage |
+| Frontend | Components, hooks, routes | 85% test coverage |
+| Tests | Unit, integration, E2E | All critical paths |
+| Docs | API, components, setup | Complete |
+| Performance | Metrics, bundle analysis | <200ms P95 API, <2s TTI |
+| Security | Audit, OWASP validation | All vulnerabilities addressed |
+| Deployment | Docker, CI/CD, guides | Zero-downtime capable |