create-wakii-stack 0.0.0-stage → 0.1.1

package/stack-template/docs/superpowers/mindmaps/ui-redesign.wakii

@@ -0,0 +1,116 @@
+{
+  "wakiiMindmap": 1,
+  "meta": {
+    "story": "VU-53",
+    "generator": "story-workflow CREATE",
+    "generatedAt": "2026-10-13T23:05:00+07:00",
+    "dest": "story-vu53-ui-redesign",
+    "worktreeModel": "story-hub"
+  },
+  "nodes": [
+    {
+      "id": "epic",
+      "kind": "epic",
+      "title": "UI/UX Redesign — shell + remotes + fe-shared design system",
+      "summary": "Design lại toàn bộ UI micro-frontend demo: design system fe-shared (tokens + base + primitives) + restyle shell/tasks/activity + đóng UX gaps bằng API hiện có. Spec: docs/superpowers/specs/2026-10-13-ui-redesign.md (rev 3 — spec-critic GO, plan-critic GO). Linear: VU-53."
+    },
+    {
+      "id": "sf-1",
+      "kind": "sf",
+      "title": "Design direction + design-system nền móng",
+      "tier": 0,
+      "design": "mock-prototype",
+      "summary": "Phase 1/3 — shippable: nền móng đứng cạnh UI cũ (không phá hiện trạng). DESIGN GATE ĐÃ XONG ngay lúc CREATE (front-load, kit 8b): user chọn hướng B Linear-referenced dark 2026-10-13 — hand-off docs/superpowers/designs/ui-redesign-direction.md (tokens + component props API đầy đủ), gate record direction-approved.md — SF-1 KHÔNG còn designer phase, implement thẳng theo hand-off. Việc còn lại: fe-shared src/styles (tokens+base @layer) + src/ui primitives (Badge/EmptyState/Skeleton/Spinner theo props API hand-off); rspack css rule ×3 + react/jsx-runtime shared ×3 + spike duplicate-react chạy SỚM (fallback class-only); cssFilename contenthash; standalone :4001/:4002 import base+tokens; tests primitives ở shell/tests. Demo: standalone 2 remote có baseline style + trang demo primitives khớp hand-off. Context pack: docs/superpowers/contexts/ui-redesign/sf-1.md",
+      "linear": "VU-54"
+    },
+    {
+      "id": "sf-2",
+      "kind": "sf",
+      "title": "Shell — layout, login, nav, remote fallback",
+      "tier": 1,
+      "summary": "Phase 2/3 — shippable: shell restyle theo hand-off SF-1 (không gate mock riêng — direction đã user-duyệt). Layout container + header; NavBar active state (aria-current) + responsive ≤768px + user chip; HomePage dashboard + quick links + demo hints; LoginPage card (behavior + error messages giữ); RemoteSlot Suspense fallback = Skeleton + error fallback giữ text contract; styles.css rewrite scoped. Demo: login → nav active → dashboard → kill remote thấy fallback đẹp. Context pack: docs/superpowers/contexts/ui-redesign/sf-2.md",
+      "linear": "VU-55"
+    },
+    {
+      "id": "sf-3",
+      "kind": "sf",
+      "title": "Remote tasks — TasksPage redesign + UX gaps",
+      "tier": 1,
+      "summary": "Phase 2/3 — shippable: tasks UI mới đầy đủ hành vi API sẵn có. Tách TaskForm/TaskList/TaskItem/StatusSelect; card responsive + StatusBadge primitive (giữ 'Gán thất bại' role=status); per-item busy; edit inline title/description (PATCH); delete + confirm (DELETE); assignee UUID rút gọn + createdAt; 'Tải thêm' (limit+offset) + filter status (?status=); skeleton/empty primitives; api.ts mở rộng đúng tasks.yaml. Demo: CRUD + filter + pagination trên UI mới; saga 4b badge nhận diện. Context pack: docs/superpowers/contexts/ui-redesign/sf-3.md",
+      "linear": "VU-56"
+    },
+    {
+      "id": "sf-4",
+      "kind": "sf",
+      "title": "Remote activity — ActivityPage redesign",
+      "tier": 1,
+      "summary": "Phase 2/3 — shippable: activity UI mới. Stats grid responsive (aria-label giữ); feed timeline nhóm ngày + item card (badge action primitive + userName/taskTitle + time vi-VN); refresh busy state; skeleton feed/stats độc lập (giữ Promise.allSettled); EmptyState hướng dẫn sang Tasks; scoped css theo kiến trúc đích. Demo: thao tác ở Tasks → Activity phản ánh đúng badge từng action. Context pack: docs/superpowers/contexts/ui-redesign/sf-4.md",
+      "linear": "VU-57"
+    },
+    {
+      "id": "sf-5",
+      "kind": "sf",
+      "title": "Convergence — browser walkthrough + docs + security",
+      "tier": 2,
+      "summary": "Phase 3/3 — shippable: hội tụ + chứng minh. Rule 0 browser walkthrough compose :8080 đủ 8 acceptance epic (login → Tasks CRUD → Activity Kafka → saga 4b badge → re-assign bob → kill remote fallback → standalone có style) + responsive 375px; full suite 3 package test+typecheck+build xanh, lockfile không đổi, e2e smoke vẫn PASS; docs sync (walkthrough 4/4b, READMEs); security pass 0 P0/P1; scaffold sanity verify-only; improvements-log. Demo: NGƯỜI xác nhận walkthrough PASS trên UI mới (human gate cuối). Context pack: docs/superpowers/contexts/ui-redesign/sf-5.md",
+      "linear": "VU-58"
+    }
+  ],
+  "edges": [
+    {
+      "from": "epic",
+      "to": "sf-1",
+      "rel": "contains"
+    },
+    {
+      "from": "epic",
+      "to": "sf-2",
+      "rel": "contains"
+    },
+    {
+      "from": "epic",
+      "to": "sf-3",
+      "rel": "contains"
+    },
+    {
+      "from": "epic",
+      "to": "sf-4",
+      "rel": "contains"
+    },
+    {
+      "from": "epic",
+      "to": "sf-5",
+      "rel": "contains"
+    },
+    {
+      "from": "sf-2",
+      "to": "sf-1",
+      "rel": "depends-on"
+    },
+    {
+      "from": "sf-3",
+      "to": "sf-1",
+      "rel": "depends-on"
+    },
+    {
+      "from": "sf-4",
+      "to": "sf-1",
+      "rel": "depends-on"
+    },
+    {
+      "from": "sf-5",
+      "to": "sf-2",
+      "rel": "depends-on"
+    },
+    {
+      "from": "sf-5",
+      "to": "sf-3",
+      "rel": "depends-on"
+    },
+    {
+      "from": "sf-5",
+      "to": "sf-4",
+      "rel": "depends-on"
+    }
+  ]
+}

package/stack-template/docs/superpowers/mindmaps/vu53-cinematic-experience.wakii

@@ -0,0 +1,32 @@
+{
+  "wakiiMindmap": 1,
+  "meta": { "story": "VU-53-CIN", "generator": "story-workflow CREATE", "generatedAt": "2026-10-19T00:05:00+07:00", "dest": "story-vu53-cin-experience", "worktreeModel": "story-hub" },
+  "nodes": [
+    { "id": "epic", "kind": "epic", "title": "Cinematic Experience — redesign chuẩn story-workflow (ref experience.staratlas.com)" },
+    { "id": "sf-1", "kind": "sf", "title": "Design Contract + Mood Engine (nền tảng)", "tier": 0, "design": "figma", "linear": "", "summary": "Phase 1/4 — shippable: EXPERIENCE-DESIGN contract dùng được độc lập (typography scale REF-SPEC, palette 5 mood, spacing, motion vocabulary) + scroll-mood engine + Avatar/Getty ảnh graded chuẩn hoá. Demo: story mood-engine riêng render 5 mood đúng số đo." },
+    { "id": "sf-2", "kind": "sf", "title": "Hero + Starfield + Trailer Gate", "tier": 1, "design": "figma", "linear": "", "summary": "Hero ref-fidility: section NỀN SÁNG chữ navy (REF-SPEC đo), ALL-CAPS display tracking 2.4, numbered header 01-05, canvas starfield theme-aware (bông tuyết light khi dark), trailer Modal. Demo: hero story standalone giống ref-hero.png ở 1280+375." },
+    { "id": "sf-3", "kind": "sf", "title": "Chapter Shell + Side-nav Progress", "tier": 1, "design": "figma", "linear": "", "summary": "ChapterShell component (label mono CHƯƠNG 0X 11px/700 tracking 2.64 + ALL-CAPS title ~29px/300 + copy punchy 2 dòng + parallax nền gần-fixed speed 0.08/strength 280) + Anchor side-nav sticky single-source aria-current (fix overlap vĩnh viễn bằng cấu trúc). Demo: 1 chương generic + nav chạy scroll-spy đúng 5 mục." },
+    { "id": "sf-4", "kind": "sf", "title": "Ch1 Deep Focus + Ch2 Living Docs", "tier": 2, "design": "figma", "linear": "", "summary": "2 chương nội dung theo ChapterShell: CountUp 62.210 + split-text reveal + 3 feature card mask-reveal clip-path. Demo: 2 chương render đúng contract, measure transform + clip-path đổi theo scroll." },
+    { "id": "sf-5", "kind": "sf", "title": "Ch3 Velocity + Ch4 Ship 3D", "tier": 2, "design": "figma", "linear": "", "summary": "Ch3 workflow-cards chọn được (mood accent) + Ch4 sticky-pinned 200vh tích hợp ScrollFlythrough Scene3D (three.js peer-dep, fallback node) — chương 3D thật của website. Demo: scroll ch4 → camera bay quanh tàu, fps>=50 paste số." },
+    { "id": "sf-6", "kind": "sf", "title": "Ch5 Future + Sun Journey + End CTA", "tier": 2, "design": "figma", "linear": "", "summary": "Band 4 CountUp + sun-journey arc dawn->night (đã verify) làm chuyển cảnh sang End CTA glow + footer numbered + social Icon. Demo: cụm cuối hoàn chỉnh + night mode đẹp." },
+    { "id": "sf-7", "kind": "sf", "title": "Convergence + QA full", "tier": 3, "linear": "", "summary": "Phase 4/4: ghép index Trải Nghiệm hoàn chỉnh + responsive 4bp (375/768/1280/1440) + contrast số >=4.5:1 mọi chương 2 mode + reduced-motion + performance (fps, will-change đúng) + evidence pack + deploy alias. Demo: story chính chạy end-to-end giống ref nhất có thể, mọi số liệu paste." }
+  ],
+  "edges": [
+    { "from": "epic", "to": "sf-1", "rel": "contains" },
+    { "from": "epic", "to": "sf-2", "rel": "contains" },
+    { "from": "epic", "to": "sf-3", "rel": "contains" },
+    { "from": "epic", "to": "sf-4", "rel": "contains" },
+    { "from": "epic", "to": "sf-5", "rel": "contains" },
+    { "from": "epic", "to": "sf-6", "rel": "contains" },
+    { "from": "epic", "to": "sf-7", "rel": "contains" },
+    { "from": "sf-2", "to": "sf-1", "rel": "depends-on" },
+    { "from": "sf-3", "to": "sf-1", "rel": "depends-on" },
+    { "from": "sf-4", "to": "sf-3", "rel": "depends-on" },
+    { "from": "sf-5", "to": "sf-3", "rel": "depends-on" },
+    { "from": "sf-6", "to": "sf-3", "rel": "depends-on" },
+    { "from": "sf-7", "to": "sf-4", "rel": "depends-on" },
+    { "from": "sf-7", "to": "sf-5", "rel": "depends-on" },
+    { "from": "sf-7", "to": "sf-6", "rel": "depends-on" },
+    { "from": "sf-7", "to": "sf-2", "rel": "depends-on" }
+  ]
+}

package/stack-template/docs/superpowers/plans/2026-10-12-sf-1-contracts-platform-plan.md

@@ -0,0 +1,44 @@
+# Plan — SF-1 Contracts & Platform Foundation (FI-64)
+
+> Story FI-62 · spec: `docs/superpowers/specs/2026-10-12-boilerplate-microservice-mfe.md` rev 3 · slice: `docs/superpowers/contexts/sf-1.md`
+> Worktree: `__STACK_ORG__/sf-1-contracts-platform` (fork từ `__STACK_ORG__/story-fi62-micro-boilerplate`) · merge target: nhánh story (coordinator merge)
+> Tier: Full (16 tasks) · Ràng buộc: dev machine KHÔNG Docker — verify docker qua CI; Java/Go không local
+
+## Key design decisions (contract-level — các SF sau fork từ đây)
+
+1. **Gateway pass-through, không rewrite prefix**: mọi service mount route dưới `/api/<svc>/...` khớp chính xác `servers.url` trong OpenAPI spec. nginx chỉ proxy + chặn thiếu-token (401) cho `/api/tasks|users|activity`; `/api/auth`, `/`, `/remotes/*` mở.
+2. **auth-mock = Fastify (Node 22)** — chạy native được trên dev machine (browser-verify swagger UI local), Dockerfile multi-stage cho CI/boot-smoke.
+3. **Spike MF** tại `frontend/spike/{host,remote}` — build + chạy thật trên Rspack, pin version = version đã test thật (ghi vào `frontend/shared/package.json` + `frontend/spike/README.md`).
+4. **Port table** (conventions + compose + README khớp nhau): gateway 8080, shell 3000, remote-tasks 4001, remote-activity 4002, node-svc 3001, spring-svc 8081, go-svc 8082, auth-mock 8090, postgres 5432.
+5. **Canonical DDL**: schema `tasks`, bảng `tasks` — `assignee_id`/`created_by` là uuid KHÔNG FK chéo schema (users thuộc schema `users` của spring-svc; validate qua REST).
+6. **Readonly grant**: `ALTER DEFAULT PRIVILEGES FOR ROLE node_svc IN SCHEMA tasks GRANT SELECT ON TABLES TO go_readonly` — hiệu lực cho bảng sinh sau bởi migration SF-2.
+7. **Users fixture**: `{id, email, roles}` — auth-mock đọc runtime; spring seed (SF-3) đọc cùng file. Login mock: email + dev password qua env `AUTH_MOCK_DEV_PASSWORD` (default ghi rõ trong token-contract, mock-only).
+8. **CI**: active cho contracts + auth-mock (spectral, schemathesis scaffold, gitleaks, compose config, boot-smoke auth-mock); CI per-service để TEMPLATE cho SF-2/3/4 (chưa bật — services chưa có code).
+
+## Tasks
+
+- [x] Task 1 — Repo hygiene: `.gitignore` (node_modules, .env, dist, target, build…), `.gitattributes` (`* text=auto eol=lf`), `.editorconfig`
+- [x] Task 2 — pnpm workspace root: `pnpm-workspace.yaml` (globs `frontend/*`, `frontend/spike/*`, `services/node-svc`), root `package.json`, `packageManager` pin
+- [x] Task 3 — `contracts/openapi/tasks.yaml`: Task schema khớp canonical DDL; CRUD `/api/tasks`; error envelope responses
+- [x] Task 4 — `contracts/openapi/users.yaml`: `/api/users` + `/api/teams` (spring-svc surface, đủ cho node-svc validate user)
+- [x] Task 5 — `contracts/openapi/activity.yaml`: `POST /api/activity/events` (taskId, userId, action, timestamp) + feed response CHỨA user-display fields (userName, taskTitle) + stats
+- [x] Task 6 — `contracts/openapi/auth.yaml`: `/api/auth/login`, discovery stub, fixture users list; `.spectral.yaml` ruleset
+- [x] Task 7 — `contracts/db/tasks-schema.sql` canonical DDL (schema `tasks`, indexes, comment lý do không FK chéo schema)
+- [x] Task 8 — `contracts/auth/users.json` fixture + `contracts/auth/token-contract.md` (HS256, claims sub/email/roles, TTL 8h, secret phân phối, enforcement 2 lớp)
+- [x] Task 9 — `platform/conventions/`: dockerfile-pattern.md, healthcheck.md, logging.md (JSON shape), error-envelope.md, ports.md (port table), configuration.md (env-var rule), cors.md (dev-profile rule), gateway-routing.md (routing table + remote registry)
+- [x] Task 10 — `platform/docker-compose.yml` PRE-SEED 6 services (postgres, auth-mock, gateway, node-svc, spring-svc, go-svc) + `platform/.env.example` inventory ĐẦY ĐỦ + `platform/postgres/init/01-schemas.sql` (schemas + per-service roles + `ALTER DEFAULT PRIVILEGES`)
+- [x] Task 11 — `platform/gateway/nginx/`: nginx.conf theo routing table + JWT presence check (`/api/tasks|users|activity` thiếu Authorization → 401)
+- [x] Task 12 — `platform/auth-mock/`: Fastify service đọc users fixture, cấp JWT theo token contract, `/healthz` `/readyz`, swagger UI `/docs`, discovery stub, disclaimer NOT-FOR-PRODUCTION, tests (node:test), Dockerfile multi-stage
+- [x] Task 13 — `frontend/shared/`: api client wrapper (đính JWT + decode error envelope), token storage, MF bootstrap helper, package.json pin versions; `frontend/spike/`: host + remote hello-world trên Rspack + @module-federation/enhanced — CHẠY THẬT local, ghi kết quả pin
+- [x] Task 14 — Services khung rỗng: `services/node-svc|spring-svc|go-svc/.gitkeep` + README-placeholder (SF-2/3/4 điền impl); KHÔNG code impl
+- [x] Task 15 — CI: `.github/workflows/contracts.yml` (spectral + compose config + gitleaks + boot-smoke auth-mock + schemathesis scaffold) + `.github/workflows/services-ci-template.yml` (template path-filtered + boot-smoke cho SF-2/3/4)
+- [x] Task 16 — README.md: Mermaid kiến trúc thật khớp cây thư mục + cách chạy từng phần + port table
+
+## Verification (exit criteria)
+
+1. CI xanh trên nhánh `__STACK_ORG__/sf-1-contracts-platform`: spectral pass, compose config validate, gitleaks pass, boot-smoke auth-mock xanh, schemathesis scaffold chạy.
+2. Từng dòng ACCEPTANCE trong `docs/superpowers/contexts/sf-1.md` kiểm riêng (Phase 5).
+3. auth-mock: chạy native local → curl login nhận JWT decode đúng claims + TTL 8h; swagger UI mở được bằng mắt (browser verify).
+4. Spike MF: host load remote hello-world thật (evidence: build output + screenshot/log).
+5. Code-reviewer độc lập trên diff SF → APPROVED (comment Linear có VERDICT APPROVED + CHECKLIST-4Q).
+6. `~/.claude/bin/story-verify sf-1` không FAIL/VIOLATION.

package/stack-template/docs/superpowers/plans/2026-10-12-sf-3-spring-svc-impact.md

@@ -0,0 +1,69 @@
+# Phase 0 — Impact Analysis — SF-3 spring-svc (FI-71)
+
+> Story FI-62 · spec rev 3 · slice: `docs/superpowers/contexts/sf-3.md` · worktree `__STACK_ORG__/sf-3-spring-svc`
+> Tier: Full (9 tasks). Chạy autonomous theo brief — decisions đã chốt ở epic, không hỏi lại.
+
+## 1. Problem framing
+
+spring-svc chưa tồn tại (chỉ README placeholder từ SF-1) → acceptance epic #2 (node-svc validate
+assignee qua REST) gãy ở integration, acceptance #4 (service tự verify JWT) không chứng minh được.
+spring-svc là **source-of-truth users/teams**: seed PHẢI khớp `contracts/auth/users.json` 100%
+vì auth-mock (SF-1) đọc cùng fixture — lệch id = login user A nhưng validate user id không tồn tại.
+
+Constraints chốt: dev machine KHÔNG Docker + KHÔNG JDK (đã probe: `java`, `docker`, `mvn` đều vắng)
+→ mọi build/test/docker verify **qua CI**; KHÔNG sửa compose/contracts/conventions; KHÔNG Keycloak.
+
+## 2. Touch map
+
+```
+services/spring-svc/**                        [SỞ HỮU — tạo mới: pom.xml, mvnw, src/**, Dockerfile, .dockerignore, README]
+.github/workflows/services-spring-svc.yml     [TẠO MỚI — copy từ .github/workflow-templates/services-ci.yml.example]
+docs/superpowers/evidence/sf-3/**             [TẠO MỚI — evidence convention B1+]
+platform/docker-compose.yml                   [READ-ONLY — entry pre-seed: SPRING_DATASOURCE_*, JWT_SECRET, USERS_FIXTURE_PATH]
+platform/conventions/*, contracts/**          [READ-ONLY]
+platform/.env.example                         [READ-ONLY]
+```
+
+Drift-guard duy nhất phát sinh: snapshot `contracts/openapi/users.yaml` phải nằm trong Docker
+build context (context = `services/spring-svc` — compose `build: ../services/spring-svc` không
+thấy `contracts/`). Snapshot commit tại `services/spring-svc/src/main/resources/openapi/users.yaml`
+(bit-identical) + CI diff-guard chặn drift. Đây là file SF-3 sở hữu, KHÔNG đụng contracts/.
+
+## 3. Second-order effects (multi-dimension)
+
+| Dimension | Assessment | Risk/gap |
+|-----------|-----------|----------|
+| Functional | CRUD users/teams khớp users.yaml; seed 3 fixture users | Seed lệch id → acceptance #2 gãy; assert trong test là bắt buộc |
+| Technical/architecture | Spring Boot 3 Web MVC + Flyway + Spring Data JPA; mount `/api/users`, `/api/teams`; healthz/readyz naked | Role `spring_svc` có `search_path=users` (init script) → Hibernate resolve đúng schema mà không đụng JDBC URL |
+| Data | Schema `users`: users, teams, team_members; id UUID cố định từ fixture | Flyway Java migration đọc `USERS_FIXTURE_PATH` (env, compose mount sẵn) — đọc file thật = khớp 100% theo cấu trúc, không hardcode |
+| Performance | CRUD demo-scale; limit/offset list users | Không hot path; bỏ qua tối ưu |
+| Security | JWT HS256 service-side: signature + exp + iss, mọi route trừ healthz/readyz/swagger-docs | Secret từ env `JWT_SECRET` (compose inject); fail-fast khi thiếu; KHÔNG log token |
+| Backward-compat | Greenfield — không consumer hiện hữu ngoài contract | node-svc (SF-2) ghép sau: GET /users/{id} 404 → UNPROCESSABLE |
+| UX | Swagger UI qua host port 8081 | Gateway chỉ route `/api/users/*` có presence-check → swagger KHÔNG truy cập được qua :8080 (giới hạn gateway SF-1, không phải bug SF-3) |
+| Maintenance | mvnw wrapper committed; codegen maven plugin types-only | Local không JDK → mvnw không chạy native; toolchain-in-Docker trong CI là đường chính (đúng brief) |
+| Operational | /healthz liveness + /readyz (Flyway xong + DB query thật); logback LogstashEncoder JSON shape conventions/03; error envelope conventions/04 | Compose entry spring-svc KHÔNG có block `healthcheck` (pre-seed SF-1) → FLAG (mention) cho coordinator, SF-3 không tự sửa |
+| Business | Bước bắt buộc Phase 1 checkpoint | Trễ SF-3 → SF-7 convergence trễ |
+
+**Skips có chủ đích**: Performance (demo boilerplate, không SLA), Business (tier position đã chốt ở epic).
+
+## 4. Alternatives (design forks)
+
+- **A. Seed bằng SQL tĩnh hardcode id**: nhanh nhưng lệch fixture khi fixture đổi — vi phạm "đọc cùng file". LOẠI.
+- **B. Flyway Java migration đọc `USERS_FIXTURE_PATH` runtime (CHỌN)**: đọc file thật qua mount compose; id khớp theo cấu trúc; test assert DB == fixture. Trade-off: Java migration phức tạp hơn SQL — chấp nhận vì đúng chữ spec.
+- **C. App-level runner (CommandLineRunner) seed**: seed ngoài Flyway = mất idempotent-versioning, /readyz không gate được "seed xong". LOẠI.
+- **JWT verify: jjwt + filter tự viết (CHỌN) vs spring-security-oauth2-resource-server**: 1 secret HS256 + 3 claims — resource server kéo cả security filter chain + config magic; filter ~80 dòng kiểm soát rõ, envelope 401 đúng conventions/04 dễ map. Trade-off ghi ADR trong README (điểm cắm OIDC: đổi filter sang JWKS sau).
+
+## 5. Risks / unknowns
+
+| Risk | Mitigation |
+|------|-----------|
+| Không build/test local được (không JDK, không Docker) | Vòng verify = push + watch `gh run watch` (gh auth OK); chi phí mỗi vòng ~5-8 phút → viết test cẩn thận trước, gom commit hợp lý |
+| Flyway Java migration + Hibernate schema resolution trên role search_path | Đã verify init script: `ALTER ROLE spring_svc SET search_path = users` + GRANT USAGE, CREATE |
+| Snapshot users.yaml drift với contracts/ | CI job thêm bước `diff` 2 file — fail nếu lệch |
+| H2 compat cho @SpringBootTest | Tránh rủi ro: CI build-test job dùng **postgres service container** thật (GitHub Actions `services:`); không phụ thuộc H2 |
+| mvnw binary trên Windows | CI chạy Linux; mvnw là shell script chuẩn — không cần .cmd cho CI (kèm luôn mvnw.cmd cho dev có JDK) |
+
+## Verdict
+
+GO — scope khớp context pack, không gap cần hỏi lại epic. Direction B+jjwt (mục 4) là lựa chọn
+duy nhất khớp nguyên văn spec slice (seed ĐỌC file fixture; codegen qua maven plugin).

package/stack-template/docs/superpowers/plans/2026-10-12-sf-3-spring-svc-plan.md

@@ -0,0 +1,27 @@
+# Plan — SF-3 spring-svc — user API (FI-71)
+
+> Story FI-62 · spec slice: `docs/superpowers/specs/2026-10-12-sf-3-spring-svc-design.md` · impact: `2026-10-12-sf-3-spring-svc-impact.md` · context: `docs/superpowers/contexts/sf-3.md`
+> Worktree: `__STACK_ORG__/sf-3-spring-svc` (fork từ dest `__STACK_ORG__/story-fi62-micro-boilerplate`) — KHÔNG merge dest, coordinator merge.
+> Tier: Full (9 tasks) · Verify: CI-only (dev machine không Docker/JDK) · Commit: atomic per task, `feat(sf-3): …`
+> Ghi chú verify: Exit "green (CI)" của T1-T8 là **back-verified ở run đầu của T9** (workflow tồn tại từ T9) — không watch-CI per-task ở T1-T8. README T8 thêm ADR: mirror /api/users/healthz là pattern conventions/02 (như auth-mock), probe dùng naked.
+
+## Tasks
+
+- [ ] Task 1 — Scaffold: `pom.xml` (Boot 3.5.x Web MVC, Java 21, validation/actuator/data-jpa/flyway+pg/jjwt 0.12/logstash-logback-encoder/springdoc; openapi-generator-maven-plugin spring `interfaceOnly useSpringBoot3` trên snapshot), mvnw wrapper 3.3.x script-only, `application.yml` env fail-fast, snapshot `src/main/resources/openapi/users.yaml` **BIT-IDENTICAL — không thêm comment/header** (provenance ghi README). Exit: codegen + compile green (CI).
+- [ ] Task 2 — `V1__init.sql` (users/teams/team_members — uuid PK, roles text[], snake_case) + entities + Spring Data repos; `ddl-auto: none`. Exit: context boot + repo green trên CI postgres.
+- [ ] Task 3 — `V2__SeedUsers.java` BaseJavaMigration đọc `USERS_FIXTURE_PATH` (Jackson `FAIL_ON_UNKNOWN_PROPERTIES=false` — fixture có `$comment` + JDBC `createArrayOf`), fail-fast thiếu/sai file; **SeedMatchIntegrationTest** — DB == `contracts/auth/users.json` 100% (id/email/displayName/roles); test không transactional. Exit: THE seed exit criterion green.
+- [ ] Task 4 — `JwtVerifier` (jjwt HS256 UTF-8 secret, exp, iss=`auth-mock`) + `JwtAuthFilter` (skip `/healthz`,`/readyz`,`/actuator/**`,`/v3/api-docs/**`,`/swagger-ui/**` + mọi OPTIONS preflight; fail → 401 envelope `UNAUTHORIZED` + requestId). Tests: valid/expired/garbage/missing/wrong-iss + OPTIONS. Exit: 401 TỪ SERVICE green.
+- [ ] Task 5 — Users API **FINAL path table** (contract-resolved: `/api/users/users`, `/api/users/users/{userId}`): list(limit/offset, @Validated 400 ngoài [1,100])/POST(201; **thiếu roles → default ["user"] server-side**; 409 CONFLICT)/GET(200,404)/PATCH(200; 400 body rỗng); `@RestControllerAdvice` envelope (VALIDATION_ERROR/NOT_FOUND/CONFLICT/INTERNAL) + echo `X-Request-Id` + MDC. Tests MockMvc **@Transactional (rollback)**. Exit: users tests green.
+- [ ] Task 6 — Teams API (final paths `/api/users/teams`, `/api/users/teams/{teamId}`): list/POST(name+memberIds, **dedupe trước insert**)/GET kèm memberIds/404. Tests (@Transactional). Exit: teams tests green.
+- [ ] Task 7 — Health/log/CORS: `/healthz` `{"status":"ok"}` naked (hand-written; generated getHealthz mirror); `/readyz` DB thật (503 envelope); actuator liveness probes; logback `LogstashEncoder` (`ts`,`msg`,customFields `service=spring-svc`, MDC requestId, LOG_LEVEL env, **level lowercase qua custom `LowercaseLevelJsonProvider`**); CORS `@Profile("dev")` đọc `CORS_DEV_ORIGIN`. Tests shape. Exit: green.
+- [ ] Task 8 — Swagger (springdoc host-port 8081; api-docs chứa đúng FINAL path table) + Dockerfile multi-stage conventions/01 + `.dockerignore` + README standalone (chạy CI/toolchain, env table, API, ADR: JWT filter tự viết + snapshot bit-identical + fixture evolution V3 + email case-sensitivity). Exit: docker-build pass CI.
+- [ ] Task 9 — CI: `.github/workflows/services-spring-svc.yml` — build-test (mvnw verify + postgres service container **env ĐỦ 4 DB password** + init mount + `USERS_FIXTURE_PATH` + datasource test spring_svc@localhost:5432), docker-build, boot-smoke (compose up postgres+auth-mock+spring-svc+gateway → naked healthz/readyz → login → GET `/api/users/users/{aliceId}` 200 → direct :8081 no-token/garbage → 401), drift-guard diff; **path-filter thêm `contracts/openapi/users.yaml`**; evidence `docs/superpowers/evidence/sf-3/test-run.txt`. Exit: CI 4/4 green.
+
+## Verification (exit criteria — checklist ACCEPTANCE sf-3.md)
+
+1. CI xanh (build-test + docker-build + boot-smoke + drift-guard) — runs trên `__STACK_ORG__/sf-3-spring-svc`.
+2. Từng dòng ACCEPTANCE `docs/superpowers/contexts/sf-3.md` kiểm riêng (Phase 5 verifier).
+3. Rule 0: swagger UI + web port — browser verify khi khả thi; không khả thi (no Docker/JDK local) → CI curl evidence + khai báo trung thực trong evidence + nhờ user nhìn thêm.
+4. Code-reviewer độc lập APPROVED (rolling theo nhóm task 1-3 / 4-7 / 8-9; comment Linear VERDICT + CHECKLIST-4Q).
+5. `~/.claude/bin/story-verify sf-3` sạch; evidence convention B1+ (hash + `tdd:` line).
+6. KHÔNG set Linear Done; KHÔNG merge dest; report DONE qua orchestration message + comment FI-71.

package/stack-template/docs/superpowers/plans/2026-10-12-sf-4-go-svc-plan.md

@@ -0,0 +1,99 @@
+# Plan: SF-4 go-svc — activity API (Go 1.24 + chi)
+Date: 2026-10-12 | Linear: FI-72 | Worktree: sf-4-go-svc (branch `__STACK_ORG__/sf-4-go-svc`)
+Spec: epic `docs/superpowers/specs/2026-10-12-boilerplate-microservice-mfe.md` rev 3 §SF-4 + context pack `docs/superpowers/contexts/sf-4.md`
+> Rev 2 — sau plan-critic (FIX-P0-FIRST): P0-1 boot-smoke apply canonical DDL bằng role node_svc + negative readyz check; P0-2 compose pre-seed DATABASE_URL sai credentials (platform defect SF-1 — FLAG, không tự sửa; CI dùng override file do SF-4 sở hữu). P1: DAG edge T5←T4; swagger docs auth-exempt + curl boot-smoke; schemathesis kèm JWT (login auth-mock); CI build-test từ T1 (compile feedback sớm); go.sum strategy.
+
+## 0. Root cause analysis (WHY)
+
+### Root cause
+Epic acceptance #3 ("activity phản ánh task vừa tạo") chưa có service nào sở hữu activity: node-svc mutate task nhưng không nơi nào ghi nhận event, và stats phải đọc data do service KHÁC sở hữu (schema `tasks` của node-svc) — cần chứng minh multi-repo convention hoạt động xuyên DB permission boundary (readonly role).
+
+### Current state (before feature)
+`services/go-svc/` chỉ có README placeholder. Compose entry `go-svc` đã pre-seed (SF-1) — build fail đến khi có code. Postgres init đã tạo sẵn schema `activity` + role `go_svc` (owner) + `go_readonly` (SELECT qua ALTER DEFAULT PRIVILEGES FOR ROLE node_svc).
+
+### Expected outcome
+POST /activity/events nhận event fire-and-forget từ node-svc → feed hiển thị kèm user-display fields (userName, taskTitle) → stats phản ánh đúng rows `tasks` (seed bằng owner role). CI xanh: build + test + docker build + boot-smoke.
+
+### Constraints & hardships
+- Dev machine KHÔNG Docker, KHÔNG Go toolchain → mọi verify (go test, docker build, boot-smoke) qua CI.
+- KHÔNG sửa compose/contracts/conventions; KHÔNG migrate schema `tasks`; KHÔNG message broker.
+- go_readonly CHỈ có SELECT schema `tasks` — userName phải resolve qua spring-svc REST (init script chốt).
+- ALTER DEFAULT PRIVILEGES chỉ hiệu lực cho bảng do `node_svc` tạo → test seed phải chạy DDL bằng role `node_svc`, không phải superuser.
+
+### High-level strategy
+Single Go module `services/go-svc`, chi router, layering: `cmd/server` → `internal/{config,logging,auth,store,api}`. Migration SQL embedded, chạy lúc boot. Test strategy: unit (httptest, không DB) local-nếu-có / chắc chắn CI; integration (đụng Postgres) chạy trong CI job với postgres service container; contract (schemathesis) trong boot-smoke job. Execute inline (Go tests chỉ CI-bound — dispatch subagent không thêm khả năng verify), review rolling theo nhóm.
+
+## 1. Problem (intent)
+Dev copy boilerplate cần service Go mẫu hoàn chỉnh: nhận event, serve feed/stats đúng contract `contracts/openapi/activity.yaml`, tự verify JWT, chứng minh readonly-read hoạt động — không phải tự nghĩ lại từ đầu.
+
+## 2. Scope
+- **In scope**: scaffold go-svc; feed/stats/events endpoints; migration schema `activity`; JWT verify; healthcheck; slog JSON; error envelope; CORS dev; tests (unit + integration readonly-exit + contract); Dockerfile multi-stage distroless; boot-smoke CI job; swagger-ui static serve spec; README standalone.
+- **Out of scope**: node/spring/FE impl; schema `tasks` migration; compose/contracts/conventions sửa; message broker; k8s; UI thật (SF-6).
+- **Success criteria (observable, từ context pack ACCEPTANCE)**:
+  1. Swagger-ui go-svc mở được; POST event → event hiện trong feed.
+  2. Stats đúng rows seeded bằng owner role `node_svc` (canonical DDL).
+  3. Negative: không có readonly grant → query tasks fail rõ ràng (503 `DEPENDENCY_DOWN` envelope).
+  4. Token sai/hết hạn → 401 từ go-svc (không phụ thuộc gateway).
+  5. CI xanh: build-test (go vet + unit + integration với postgres) + docker-build + boot-smoke (up + health + migration xong + schemathesis).
+
+## 3. Touch map
+- **Modify/create**: `services/go-svc/**` (SỞ HỮU — module, cmd, internal, test, Dockerfile, README); `.github/workflows/services-go-svc.yml` (tạo từ template); `docs/superpowers/evidence/sf-4-go-svc/test-run.txt`.
+- **Consumers/regression**: node-svc (SF-2 — POST /events contract), FE remote activity (SF-6 — feed/stats shape), SF-7 smoke.
+- **Shared surfaces (READ-ONLY)**: `contracts/openapi/activity.yaml`, `contracts/db/tasks-schema.sql`, `platform/docker-compose.yml` (entry pre-seed env: PORT, DATABASE_URL, DATABASE_READONLY_URL, JWT_SECRET, SPRING_SVC_URL, CORS_DEV_ORIGIN, LOG_LEVEL), `platform/conventions/*`, `platform/postgres/init/01-init.sh`.
+
+## 4. Design
+- **Approach A (chọn)**: swagger-ui-dist vendored + `go:embed` + bản copy spec `internal/api/openapi/activity.yaml` (sync-check test). Offline hoàn toàn, distroless-compatible. Alternative B (CDN html) dismissed: phụ thuộc internet lúc demo, lệch "static serve".
+- **userName resolution**: resolve lúc ingest + lúc đọc, best-effort: spring-svc `GET /api/users/{userId}` (display name), timeout ngắn (2s), cache in-memory TTL; khi spring down → trả `""` (degraded trung thực, không bịa placeholder — ADR ghi README). taskTitle: `SELECT title FROM tasks.tasks WHERE id=$1` bằng readonly connection; bảng chưa có → `""`.
+- **Stats**: 2 query readonly: `COUNT(*)` + `GROUP BY status` trên `tasks.tasks`; `recentEvents` = COUNT events 24h qua (schema activity, owner conn). tasks unreadable (permission/bảng chưa có) → 503 `DEPENDENCY_DOWN` envelope.
+- **JWT**: `golang-jwt/jwt/v5`, HS256, verify signature + `exp` + `iss=auth-mock`; fail → 401 `UNAUTHORIZED` envelope.
+- **Migration**: embedded SQL (`schema activity` đã có từ init — migration tạo `activity.events`: id uuid app-generated, task_id, user_id, action CHECK enum, event_ts timestamptz, user_name, task_title, created_at). Idempotent runner (migrations table + applied tracking).
+- **Fire-and-forget ingest**: validate payload theo ActivityEventInput (uuid, action enum 3 giá trị, RFC3339 timestamp) → persist inline → 202 `{"accepted":true}`. node-side không retry là trách nhiệm node-svc.
+- **Edge cases**: event trùng (re-push) → chấp nhận (idempotent-friendly: không dedupe — node không retry nên trùng hiếm; log info); limit clamp 1..100; offset ≥0; spring timeout; tasks table missing; readyz = migration xong + SELECT probe tasks (fail → 503).
+- **Non-functional**: port 8082 env `PORT`; healthcheck naked `/healthz`+`/readyz` ngoài prefix `/api/activity`; request slog JSON (ts/level/service/msg/requestId); requestId từ `X-Request-Id`; CORS `rs/cors` đọc `CORS_DEV_ORIGIN` (rỗng = deny-by-default); non-root distroless.
+
+## 5. Implementation outline
+
+### Tasks (ordered — DAG)
+| # | Task | Deps |
+|---|------|------|
+| T1 | Scaffold: go.mod 1.24 (chi v5.3.2, golang-jwt v5.3.1, rs/cors), cmd/server, internal/config (env fail-fast), slog JSON logging, chi router (prefix `/api/activity` + naked health), requestId + error-envelope + CORS middleware, `/healthz`, Dockerfile distroless (conventions/01; `COPY go.mod go.sum*` + `go mod download` tự sinh go.sum in-image — dev không có Go), **+ CI workflow tối thiểu (build-test: setup-go + vet + test) cho compile feedback ngay từ commit đầu** | — |
+| T2 | JWT middleware (golang-jwt/jwt/v5 HS256: sig+exp+iss) + 401 envelope + unit tests (missing/bad-sig/expired/wrong-iss/valid) | T1 |
+| T3 | Embedded migration runner + `activity.events` table (app uuid v4, CHECK action enum) + `/readyz` (migration xong + readonly SELECT probe tasks → 503 envelope khi fail) + unit tests | T1 |
+| T4 | POST `/events`: validation theo activity.yaml + persist + 202 EventAccepted; display-field resolver (spring REST client timeout 2s + cache TTL; taskTitle readonly lookup) + unit tests (httptest fake spring) | T2, T3 |
+| T5 | GET `/feed` (limit/offset clamp, mới nhất trước, total) + GET `/stats` (COUNT + GROUP BY status readonly + recentEvents 24h; 503 DEPENDENCY_DOWN khi tasks unreadable) + repository layer + unit tests — **tiêu thụ resolver interface từ T4** | T3, T4 |
+| T6 | Swagger-ui: vendored swagger-ui-dist (go:embed, Apache-2.0 license note) + spec copy `internal/api/openapi/activity.yaml` + sync-check test vs contracts + serve `/api/activity/docs` + `/api/activity/openapi.yaml` — **auth-exempt (tiền lệ auth-mock `/api/auth/docs` mở)** | T1 |
+| T7 | Integration tests (CI postgres service): readonly-exit criterion — apply canonical DDL + seed bằng role `node_svc` → stats đúng (assert `tableowner='node_svc'`); REVOKE SELECT → 503 → re-grant; POST event → feed chứa event; 401 paths | T4, T5 |
+| T8 | CI workflow `.github/workflows/services-go-svc.yml`: build-test (setup-go 1.24 + postgres service + go vet/test), docker-build, boot-smoke — **(P0-1) apply `contracts/db/tasks-schema.sql` bằng role `node_svc` (`docker compose exec -T postgres psql -U node_svc`) + seed trước khi boot go-svc; negative check: boot trước DDL → readyz 503 (chứng minh probe thật) → apply DDL → readyz 200**; **(P0-2) dùng compose override file `services/go-svc/ci.compose.override.yml` (SF-4 sở hữu) sửa DATABASE_URL=`go_svc:` / DATABASE_READONLY_URL=`go_readonly:` — KHÔNG đụng platform/docker-compose.yml, FLAG SF-1 fix gốc**; curl `/healthz`+`/readyz` + migration xong + POST event→feed + curl `/api/activity/docs`+`/openapi.yaml` 200; schemathesis activity.yaml **kèm JWT** (login auth-mock :8090 direct, header Authorization; venv deterministic + base-url kèm prefix `/api/activity` — 2 bài học SF-1 contracts.yml); path-filter thêm `platform/postgres/init/**`; optional: curl gateway :8080/api/activity → 401 envelope | T6, T7 |
+| T9 | README standalone (chạy native, env, contract links, ADR degraded userName) + evidence `test-run.txt` (CI run URL + hash) + push + CI xanh | T8 |
+
+### File structure (mới)
+```
+services/go-svc/
+├── cmd/server/main.go
+├── internal/
+│   ├── config/config.go
+│   ├── logging/logging.go
+│   ├── auth/jwt.go
+│   ├── store/{migrate.go,migrations/0001_events.sql,events.go,readback.go}
+│   ├── resolve/resolver.go        (spring REST + cache)
+│   ├── api/{router.go,middleware.go,health.go,events.go,feed.go,stats.go,
+│   │        envelope.go,openapi/activity.yaml,openapi_test.go}
+│   └── swagger/{index.html,dist/... (vendored),swagger.go}
+├── test/integration/…            (build tag integration — chạy CI)
+├── Dockerfile
+├── .dockerignore
+└── README.md
+.github/workflows/services-go-svc.yml
+```
+
+### Testing strategy
+- Unit (go test, không DB): config fail-fast, jwt middleware, validation, envelope, resolver (httptest fake spring), feed/stats handlers với sqlmock-free fake store.
+- Integration (CI, postgres service container + init script): readonly-exit criterion (seed `node_svc` → stats đúng; REVOKE → 503), ingest→feed roundtrip, 401.
+- Contract (CI boot-smoke): schemathesis `contracts/openapi/activity.yaml` (pattern SF-1).
+- Docker: CI docker-build + boot-smoke compose up thật.
+
+## 6. Risks & unknowns
+- **Must verify**: go_readonly grant hiệu lực qua bảng do node_svc tạo (CI test T7 chứng minh); schemathesis hoạt động với activity.yaml kèm JWT (SF-1 precedent auth.yaml + contracts.yml lessons).
+- **Resolved during planning**: (1) swagger-ui-dist 5.17.14 tải OK từ npm registry (verified); (2) spring display-name field = `User.displayName` (users.yaml required) — no longer unverified; (3) go.sum không sinh được local → Dockerfile `go mod download` tự sinh in-image + CI `go mod tidy` (lệch nhỏ conventions/01 template, ghi chú README).
+- **FLAG đã post (P0-2)**: compose pre-seed `DATABASE_URL`/`DATABASE_READONLY_URL` dùng user `${POSTGRES_USER}` + password per-role → auth fail chắc chắn (affects SF-2 node-svc cùng pattern). SF-4 không tự sửa compose (boundary) — dùng override file `services/go-svc/ci.compose.override.yml` cho CI của mình + REQUIREMENT-GAP comment epic FI-62 để SF-1/coordinator fix gốc.
+- Go/docker không có local: mọi red-green loop qua CI push — build-test job chạy từ T1 để compile feedback sớm; budget CI runs cẩn thận.

package/stack-template/docs/superpowers/plans/2026-10-12-sf-5-fe-shell-plan.md

@@ -0,0 +1,64 @@
+# Plan: SF-5 FE shell — MF host (Rspack)
+Date: 2026-10-12 | Linear: FI-73 | Worktree: __STACK_ORG__/sf-5-fe-shell | Story: FI-62
+
+## 0. Root cause analysis (WHY)
+
+### Root cause
+Boilerplate epic cần FE entry-point: shell là MF host duy nhất — remotes (SF-6) không tự đứng, load vào host. Không có host = epic acceptance #1 (mở shell → login → nav + 2 remote render) không thể demo.
+
+### Current state (before feature)
+SF-1 đã merge: `frontend/shared` (api-client, token-storage, mf-bootstrap), spike MF đã test pin versions (evidence PNG), compose PRE-SEED khung (FE entries CHƯA có — gap flag), gateway routing `/` → `shell:3000` (502 đến khi shell tồn tại).
+
+### Expected outcome
+`frontend/shell/` chạy dev native :3000 → login fixture user qua gateway `/api/auth/login` → nav + layout; route `/tasks` `/activity` hiện fallback remote-down (SF-5 standalone, remote chưa có); vitest pass (focus + skip-link + login); CI xanh (build + tests + boot-smoke).
+
+### Constraints & hardships
+- fe-shared/catalog/compose/contracts READ-ONLY — thiếu gì = FLAG, không tự sửa.
+- Không Docker trên dev machine — verify docker qua CI.
+- Pin matrix bắt buộc: react 19.3.0, rspack 1.7.12, mf-enhanced 0.21.6 (nâng cấp = re-spike).
+- SF-6 chạy SONG SONG — không cướp `pnpm-lock.yaml` semantics (commit bình thường, coordinator resolve).
+
+### High-level strategy
+Scaffold host từ pattern spike đã test (async boundary `import('./bootstrap')`, automatic JSX runtime), đóng gói remote loading qua `loadRemoteModule` + error boundary, routing react-router với lazy remote slots. Không design system — UI tối giản sạch.
+
+## 1. Problem
+Dev team copy boilerplate cần shell demo được login + nav ngay khi mở — không có shell thì toàn bộ FE demo epic sập từ cửa vào.
+
+## 2. Scope
+- **In scope:** scaffold `frontend/shell/` (Rspack + MF host + React 19 + TS + pnpm); re-validation spike + fe-shared fit-check (task đầu); catalog singleton deps; routing + layout + nav (`/`, `/tasks`, `/activity`); login qua fe-shared; a11y baseline CÓ TEST (route focus + skip link); error boundary + fallback remote-down; vitest + testing-library; Dockerfile nginx static; boot-smoke CI job; README; compose entry gap → FLAG (không tự sửa).
+- **Out of scope:** implement remote apps (SF-6); sửa fe-shared/catalog/compose/contracts; design system phức tạp; docker local; i18n.
+- **Success criteria (observable):** ACCEPTANCE trong `docs/superpowers/contexts/sf-5.md` — từng dòng verify + BROWSER VERIFY Rule 0 (login thật fixture user + nav + fallback remote-down, screenshot bằng chứng).
+
+## 3. Touch map
+- **Tạo:** `frontend/shell/**` (src, rspack.config.mjs, package.json, tsconfig, index.html, Dockerfile, nginx.conf, README.md, vitest config + tests), `.github/workflows/shell.yml`, evidence `docs/superpowers/evidence/sf-5-fe-shell/`.
+- **READ-ONLY:** `frontend/shared/**`, `pnpm-workspace.yaml`, `platform/docker-compose.yml`, `platform/conventions/*`, `platform/.env.example`, `contracts/**`.
+- **Shared-regen:** `pnpm-lock.yaml` (cả SF-6).
+- **Consumers:** SF-6 (remotes load vào host này), gateway `/` route, CI pipeline.
+
+## 4. Design
+- **Approach:** host = Rspack + `ModuleFederationPlugin` (name `shell`), entry async boundary (`index.tsx` → `import('./bootstrap')` — bài học spike RUNTIME-006 loadShareSync), remote slots lazy-load qua `loadRemoteModule` (fe-shared) + React error boundary per route, remote URLs inject build-time qua DefinePlugin (`__REMOTE_URLS__`), fallback prod `/remotes/<name>/remoteEntry.js` (fe-shared `resolveRemoteUrl` đã handle).
+- **Alternatives dismissed:** (A) hardcode remote URL — vi phạm conventions/08 rule 1; (B) static import remote — mất runtime fallback remote-down; (C) Vite-MF — epic chốt Rspack, KHÔNG trộn bundler.
+- **Edge cases:** remote down giữa session (error boundary + retry button); token hết hạn (fe-shared `isExpired` → clear + redirect login); login sai (error envelope decode → hiện lỗi); refresh trang giữ login (localStorage persist).
+- **Non-functional:** a11y (route focus management + skip link — CÓ TEST vitest); security (JWT không verify phía FE — chỉ decode claims hiển thị, verify là việc BE); perf (singleton react qua catalog + shared config MF).
+
+## 5. Implementation outline
+- **File structure:** `frontend/shell/src/` (index.tsx, bootstrap.tsx, App.tsx, routes, components/{Layout,NavBar,LoginPage,RemoteSlot,ErrorBoundary}), `frontend/shell/tests/`, config files root của `frontend/shell/`.
+- **Testing strategy:** vitest + @testing-library/react — unit (login flow mocked api, token lưu), a11y (route focus + skip link), error boundary (remote reject → fallback UI). Boot-smoke = CI (static serve + 200). BROWSER VERIFY Rule 0 = walkthrough thật bằng mắt + screenshot.
+
+### Tasks (9 — ordered, DAG)
+| # | Task | Deps |
+|---|------|------|
+| 1 | Re-validation spike + fe-shared fit-check (pin còn đúng? export đủ dùng? lệch = FLAG ngay) | — |
+| 2 | Scaffold `frontend/shell/` — Rspack + MF host + React 19 + TS + catalog singletons, chạy được hello shell :3000 | 1 |
+| 3 | Routing + layout + nav (`/`, `/tasks`, `/activity`) + route focus + skip link; tạo sẵn route `/login` stub + Layout mount (chống đụng file với T4); **kèm a11y vitest riêng (route focus + skip link)** | 2 |
+| 4 | **Chỉ `LoginPage.tsx` + login vitest riêng** (mocked api + token persist); dev API base = env `API_BASE_URL` default `http://localhost:8090` (auth-mock trực tiếp — native không có gateway, conventions/05 rule 3 + CORS 07: auth-mock luôn mở dev origin); prod = same-origin `""` qua gateway `/api/auth/login` | 2 |
+| 5 | Remote slots + error boundary + fallback remote-down + retry; **kèm error-boundary vitest riêng** | 3 |
+| 6 | Suite-green toàn bộ + 1 integration test cross-cutting (login → nav → remote-down fallback) | 3,4,5 |
+| 7 | Dockerfile (nginx static) + nginx.conf + README `frontend/shell/` | 2 |
+| 8 | CI `shell.yml` — build + tests + boot-smoke static (up + 200) | 6,7 |
+| 9 | BROWSER VERIFY Rule 0 walkthrough + screenshot evidence + ACCEPTANCE line-by-line + verifier. Tiền tố walkthrough: start auth-mock native :8090 (fixture user + dev password). DONE report phải chứa FLAG: compose thiếu entry `shell` (claim pre-seed sai) — owner: coordinator/SF-7; SF-5 không đụng compose | 8 |
+
+## 6. Risks & unknowns
+- **Must verify (Task 1):** pin versions còn cài được; fe-shared export đủ (ApiClient, tokenStorage, readClaims, isExpired, loadRemoteModule, resolveRemoteUrl, REMOTE_NAMES) cho mọi nhu cầu shell.
+- **Gap đã phát hiện (Phase 0):** compose CHƯA có entry `shell` (comment compose nói pre-seed riêng, context pack nói đã pre-seed) → FLAG coordinator, KHÔNG tự sửa. Boot-smoke CI không phụ thuộc compose (serve static trực tiếp).
+- **Unverified assumption:** auth-mock contract `/api/auth/login` request/response shape — đọc `contracts/openapi/auth.yaml` trước khi code Task 4.

package/stack-template/docs/superpowers/plans/2026-10-12-sf-6-fe-remotes-plan.md

@@ -0,0 +1,83 @@
+# Plan: SF-6 FE remotes — tasks + activity (FI-74)
+Date: 2026-10-12 | Linear: FI-74 | Worktree: __STACK_ORG__/sf-6-fe-remotes | Story: FI-62
+Spec slice: docs/superpowers/specs/2026-10-12-boilerplate-microservice-mfe.md rev 3 §SF-6 | Context pack: docs/superpowers/contexts/sf-6.md
+
+## 0. Root cause analysis (WHY)
+
+### Root cause
+Shell (SF-5) đã merge với 2 remote slots trống (`RemoteSlot` load registry `tasks`/`activity`). BE thật đã có (node-svc/spring-svc/go-svc Done). Epic acceptance #1/#2/#3 (remote render → tạo task qua node-svc → feed phản ánh qua go-svc) chết ở chỗ: KHÔNG có remote app nào để fill slot.
+
+### Current state (before feature)
+- Shell :3000 expose `/tasks` `/activity` qua `RemoteSlot name={tasks|activity} exposedModule={./TasksPage|./ActivityPage}` + error boundary remote-down (evidence sf-5: `04-tasks-remote-down.png`).
+- fe-shared (READ-ONLY): `ApiClient` (JWT + envelope decode), `tokenStorage`, `resolveRemoteUrl`, `loadRemoteModule`, `REMOTE_NAMES`.
+- Compose PRE-SEED: entry `shell` có (SF-5 gap-answer), **remote-tasks/remote-activity CHƯA có** — BRIEF ủy quyền SF-6 tự thêm đúng 2 entry.
+- Conventions: port table (4001/4002), registry (expose `./TasksPage`/`./ActivityPage`), CORS dev, error envelope, Dockerfile pattern.
+- Catalog: react 19.3.0 / react-dom 19.3.0 / react-router ^7.9.0 / mf-enhanced 0.21.6 / rspack 1.7.12.
+
+### Expected outcome
+2 remote chạy dev native :4001/:4002, load vào shell qua slot; `/tasks` CRUD qua `/api/tasks` (node-svc thật, JWT, validate user qua spring thật); `/activity` feed + stats qua `/api/activity` (go-svc thật); vitest pass cả 2; CI xanh (build + test + boot-smoke: up + 200 + fetch được remoteEntry.js); compose có 2 entry remote.
+
+### Constraints & hardships
+- READ-ONLY: shell/fe-shared/catalog/compose (trừ 2 entry remote)/contracts/conventions — đụng khác = FLAG.
+- KHÔNG Docker trên dev machine — verify docker qua CI; local demo native.
+- KHÔNG thêm remote thứ 3.
+- Pin matrix bắt buộc (nâng cấp = re-spike): react 19.3.0, rspack 1.7.12, mf-enhanced 0.21.6.
+- Rule 0 BROWSER VERIFY: tự thấy login → tạo task (node-svc thật) → feed phản ánh (go-svc thật) — screenshot làm bằng chứng, KHÔNG tự kết luận từ DOM query.
+- Linear rate-limited (39 ops queue) — sync qua linear-rate-limit runner, flush khi hết limit.
+
+### High-level strategy
+Clone pattern đã-test (spike remote + shell config) × 2 remote apps; UI tối giản (list + form + inline error, cùng class shell dùng); API layer mỏng bọc fe-shared ApiClient; singleton qua catalog:; tests vitest + testing-library mirror shell suite; Dockerfile/nginx/CI mirror shell.
+
+## 1. Problem
+Dev team copy boilerplate cần chứng minh micro-frontend + microservice chạy xuyên được: remote render trong host và gọi service thật qua gateway — không có remote thì epic chỉ là host trống.
+
+## 2. Scope
+- **In scope:** scaffold `frontend/remotes/tasks/` + `frontend/remotes/activity/` (Rspack + MF REMOTE + React 19 + TS, catalog: refs); tasks remote: list + tạo/sửa qua `/api/tasks` + JWT + error envelope → inline error; activity remote: feed + stats qua `/api/activity`, render userName/taskTitle từ response; shared singletons đúng MF 2.0; vitest per remote (component + api mocked); Dockerfile nginx static + nginx.conf + README standalone ×2; boot-smoke CI per remote; compose điền 2 entry pre-seed (gap-answer); BROWSER VERIFY Rule 0 e2e thật + evidence.
+- **Out of scope:** service-side (SF-2/3/4 Done); sửa shell/fe-shared/catalog/contracts/conventions; remote thứ 3; docker local; i18n; OIDC thật.
+- **Success criteria:** từng dòng ACCEPTANCE trong `docs/superpowers/contexts/sf-6.md` verify được + browser flow e2e thật có screenshot + TESTER REVIEW ĐỘC LẬP materialize `/tmp/story/fi62/code-reviewer-sf-6-fe-remotes.md` (VERDICT: APPROVED) + `story-verify sf-6` sạch B1-B3.
+
+## 3. Touch map
+- **Tạo (SỞ HỮU):** `frontend/remotes/tasks/**`, `frontend/remotes/activity/**`, `.github/workflows/remotes-tasks.yml`, `.github/workflows/remotes-activity.yml`, evidence `docs/superpowers/evidence/sf-6-fe-remotes/`.
+- **Đụng có chủ (gap-answer ủy quyền BRIEF):** `platform/docker-compose.yml` — CHỈ thêm 2 entry `remote-tasks`/`remote-activity` (mirror entry `shell`: context repo root, healthcheck wget static).
+- **READ-ONLY:** `frontend/shell/**`, `frontend/shared/**`, `pnpm-workspace.yaml`, `contracts/**`, `platform/conventions/*`, `platform/.env.example`, `platform/gateway/**`.
+- **Shared-regen:** `pnpm-lock.yaml` (chung SF-5 — commit bình thường, coordinator resolve khi merge).
+- **Consumers:** shell slots (registry :4001/:4002, expose names), gateway `/remotes/<name>/` route, CI, SF-7 e2e smoke.
+
+## 4. Design
+- **Approach:** mỗi remote = app Rspack + `ModuleFederationPlugin` (name `tasks`/`activity`, `filename: remoteEntry.js`, `exposes: {'./TasksPage'|'./ActivityPage'}`), `shared: {react, react-dom singleton}` với deps `catalog:`; standalone `index.html` + entry (dev mở trực tiếp :4001/:4002 debug được); page component nhận API base qua DefinePlugin `__API_BASE_URL__` (dev native: `http://localhost:3001`|`:8082`; prod: `''` same-origin qua gateway) — mirror shell `src/api.ts`; UI: list + form + inline error, tái dùng class `error-banner` phong cách shell; `publicPath` tuyệt đối dev (`http://localhost:4001/` — bài học spike) , prod relative `/remotes/<name>/`. **Remotes KHÔNG import react-router** (shell chỉ share react/react-dom — remote cần router hook thì phải thêm vào shared, tránh trùng instance; cả 2 trang đều không cần routing nội bộ).
+- **Alternatives dismissed:** (A) hardcode URL API — vi phạm conventions/06; (B) 1 app 2 expose — phá registry/port table/boot-smoke per remote; (C) remote tự quản token — trùng tokenStorage, remote render trong shell nên cùng origin localStorage; (D) fetch raw thay fe-shared ApiClient — mất envelope decode + JWT, vi phạm spec slice mục 3.
+- **Edge cases:** task title rỗng/>200 (client-side chặn + server 400 envelope → inline); node-svc 503 (spring down khi validate) → error message từ envelope; feed rỗng → empty state; stats lỗi → inline error, feed vẫn render; remote dev server đứng một mình (standalone index.html báo "chạy trong shell"); 1 remote down trong shell → error boundary shell-side + remote kia vẫn chạy (walkthrough test).
+- **Non-functional:** a11y (label form, role=alert cho error — mirror shell); security (JWT không verify FE; không secret mới; title escape qua React mặc định); perf (singleton react, lazy remote từ shell-side); maintenance (2 remote cùng pattern, README standalone copy kèm fe-shared).
+
+## 5. Implementation outline
+- **File structure:** `frontend/remotes/<name>/` = `src/{index.tsx (standalone entry), bootstrap.tsx, api.ts, <Name>Page.tsx, components/*}`, `tests/*`, `rspack.config.mjs`, `package.json`, `tsconfig.json`, `index.html`, `vitest.config.ts`, `Dockerfile`, `nginx.conf`, `README.md`.
+- **Testing strategy:** vitest + @testing-library/react mirror shell — mock fe-shared ApiClient (component test) + assert api call shape (api layer test); boot-smoke = CI docker (up + 200 + remoteEntry.js fetch). BROWSER VERIFY Rule 0 = walkthrough thật + screenshot.
+
+### Tasks (10 — ordered, DAG)
+| # | Task | Deps |
+|---|------|------|
+| 1 | Fit-check + probes: fe-shared exports đủ cho remote; đọc conventions 04/06/07 + shell nginx/Dockerfile pattern; **probe workspace-glob gap** (empirical: `pnpm m ls` sau scaffold thử nghiệm) → nếu gap thật: REQUIREMENT-GAP comment FI-62 + gap-answer 1 dòng globs (FLAG coordinator duyệt, không đụng catalog); **probe ĐỦ toolchain e2e (plan-critic P0-1): Postgres :5432 + `java`/JDK 21 (spring-svc mvnw) + `go` (go-svc) + node dev-scripts node-svc/auth-mock** — thiếu → cài portable user-local (~/Tools/sf6-e2e, không admin, xoá-là-sạch) + ghi escalation nếu vẫn thiếu | — |
+| 2 | Scaffold `frontend/remotes/tasks/` — Rspack + MF remote + catalog singletons + standalone entry; dev :4001 hello page chạy được; workspace membership xanh | 1 |
+| 3 | Tasks feature: api layer (list/create/update qua fe-shared ApiClient) + TasksPage UI (list + tạo + sửa status) + inline error envelope | 2 |
+| 4 | Vitest `frontend/remotes/tasks` — component (mocked api) + api call shape | 3 |
+| 5 | Scaffold `frontend/remotes/activity/` + api layer (feed/stats) + ActivityPage UI (feed render userName/taskTitle + stats tiles) | 2 |
+| 6 | Vitest `frontend/remotes/activity` — component (mocked api) + api call shape | 5 |
+| 7 | Dockerfile ×2 (nginx static, context repo root) + nginx.conf ×2 + README standalone ×2 | 4,6 |
+| 8 | CI `remotes-tasks.yml` + `remotes-activity.yml` — typecheck + vitest + build + boot-smoke (up + 200 + fetch remoteEntry.js) | 7 |
+| 9 | Compose: thêm ĐÚNG 2 entry `remote-tasks`/`remote-activity` (mirror `shell`, healthcheck wget static) — gap-answer BRIEF ủy quyền | 7 |
+| 10 | E2E BROWSER VERIFY Rule 0: start native (postgres + auth-mock + node-svc + spring + go-svc + shell + 2 remotes) → login → tạo task → feed/stats phản ánh → remote-down case; screenshot evidence + ACCEPTANCE line-by-line + test-run.txt; TESTER REVIEW ĐỘC LẬP (code-reviewer → OUTBOX `/tmp/story/fi62/code-reviewer-sf-6-fe-remotes.md`) | 3,5,8,9 |
+
+## 6. Risks & unknowns
+- **[plan-critic P0-2 — GIẢI QUYẾT] Mâu thuẫn "qua gateway" vs native:** spec-slice mục 2 nói "native không cần CORS mở (dev proxy)" + ACCEPTANCE nói "qua gateway", NHƯNG conventions/07:5-7 + shell precedent (`API_BASE_URL` dev = service trực tiếp) + BRIEF.md:8 đều chốt native = gọi thẳng service port với CORS dev mở; gateway nginx KHÔNG chạy native được (không Docker). **Interpretation ghi REQUIREMENT-GAP FI-62:** e2e native của SF-6 đi thẳng service theo conventions/07; chân "qua gateway" do CI compose + SF-7 e2e smoke bảo chứng. KHÔNG tự sửa spec/conventions.
+- **Workspace glob gap (Phase 0, plan-critic P1):** `frontend/remotes/*` KHÔNG có trong globs → `catalog:` protocol cần membership nên gap này là binary. Giải pháp gap-answer: thêm đúng 1 dòng globs (KHÔNG đụng catalog) + FLAG coordinator duyệt — nếu coordinator từ chối → toàn bộ singleton strategy phải rework, báo dừng.
+- **Toolchain e2e (plan-critic P0-1):** máy KHÔNG có Java/Go/Postgres/Docker. Node-svc fail-closed 503 khi spring down → Rule 0 bắt buộc spring thật. Giải pháp: portable toolchain user-local `~/Tools/sf6-e2e/` (Temurin JDK 21 + Go 1.24 + Postgres 16 binaries — không admin, xoá-là-sạch); spring chạy qua `mvnw` (tự tải Maven); escalation nếu mvnw/JDK lệch version spring-svc yêu cầu → REQUIREMENT-GAP.
+- **shell Dockerfile ảnh hưởng ở MERGE (coordinator):** lockfile mới có 2 importer `frontend/remotes/*` → Dockerfile shell (COPY từng package.json importer) cần thêm 2 dòng COPY khi merge — FLAG trong REQUIREMENT-GAP, SF-6 KHÔNG tự sửa.
+- **Lockfile xung đột SF-5:** dự liệu sẵn — commit bình thường.
+- **Assumption phải verify bằng đọc:** nginx.conf shell pattern (SPA fallback cho `/remotes/<name>/` static), 07-cors.md (CORS_DEV_ORIGIN set đúng khi start service native), Dockerfile-pattern conventions.
+
+### T10 preflight checklist (plan-critic P1 — bắt buộc trước khi start e2e)
+1. `CORS_DEV_ORIGIN=http://localhost:3000,http://localhost:4001,http://localhost:4002` trên node-svc + go-svc (+ spring).
+2. **CÙNG MỘT `JWT_SECRET`** cho auth-mock + node-svc + spring-svc + go-svc (services tự verify — lệch secret = 401 toàn bộ).
+3. Postgres roles/passwords đúng `.env.example` + init script SF-1 chạy trước migration.
+4. Thứ tự boot: postgres → spring → node-svc → go-svc → auth-mock → shell → 2 remotes.
+5. CI/boot-smoke exit criteria = structural mirror `shell.yml` (CI xanh quan sát ở story-level sau push — không Docker local).