devendra-skill-package 1.0.2

package/.github/skills/code-test-coverage-analyzer/assets/output-file-contracts.md

@@ -0,0 +1,651 @@
+# Output File Contracts — Project Requirements Compliance Auditor
+
+This document defines the mandatory content, structure, and quality standards for each of the
+15 output files. All files are generated inside the `{Q5}/` output folder at the project root.
+
+Every file must:
+- Use GitHub-flavored Markdown
+- Contain no placeholder text (`[TODO]`, `[TBD]`, `[N/A]`)
+- Contain no emojis
+- Include a header with: Audit Date, Project Root, Platform, Skill Version: 3.0.0, and the file's purpose
+- Be generated in this sequence (see §Global File Rules §Generation Order for rationale):
+  **Phase 1**: Files 02–11 (detail files, generated in any order within this phase)
+  **Phase 2**: File 12 (extra implementation — references detail file findings)
+  **Phase 3**: File 13 (scorecard — aggregates all detail file scores)
+  **Phase 4**: File 01 (executive summary — derived from scorecard; must be generated LAST of the numbered files)
+  **Phase 5**: Files 14–15 (recommendations and security — reference scorecard and detail files)
+
+---
+
+## File 01 — 01_EXECUTIVE_SUMMARY.md
+
+**Contract**: Single-page executive overview. Non-technical readers must understand the health of the project from this file alone.
+
+**Required Sections** (in order):
+1. `# Executive Summary` — project name, audit date, project root, platform
+2. `## Overall Compliance Score` — the weighted score as a large ASCII visual (see format below)
+3. `## Risk Score` — one of: CRITICAL | HIGH | MEDIUM | LOW | MINIMAL with color-equivalent markdown bold
+4. `## Production Readiness` — one of: NOT READY | NEEDS WORK | CONDITIONAL | READY with rationale (1–2 sentences)
+5. `## Coverage at a Glance` — summary table:
+   ```
+   | Dimension              | Total | Implemented | Partial | Missing | Coverage % |
+   |------------------------|-------|-------------|---------|---------|------------|
+   | BRD Requirements       |       |             |         |         |            |
+   | User Stories           |       |             |         |         |            |
+   | Acceptance Criteria    |       |             |         |         |            |
+   | Test Cases (Pass)      |       |             |         |         |            |
+   | Validations            |       |             |         |         |            |
+   | APIs                   |       |             |         |         |            |
+   | UI Screens             |       |             |         |         |            |
+   | Business Logic Rules   |       |             |         |         |            |
+   | Navigation Flows       |       |             |         |         |            |
+   ```
+6. `## Critical Issues` — top 5 missing/incorrect items with BRD-ID or TC-ID
+7. `## Key Risks` — 3–5 bullet points
+8. `## Immediate Action Items` — 3–5 bullet points
+9. `## Input Documents Audited` — table listing Q1, Q2, Q3 with requirement counts
+
+**Score Visual Format**:
+```
+Overall Compliance: 73%
+[====================>                   ] 73/100
+```
+
+**Allowed empty values**: None. All cells must be filled.
+
+---
+
+## File 02 — 02_BRD_COMPLIANCE.md
+
+**Contract**: Complete requirement-by-requirement BRD audit.
+
+**Required Sections**:
+1. `# BRD Compliance Report`
+2. `## Summary` — counts table: Total | IMPLEMENTED | PARTIALLY_IMPLEMENTED | MISSING | INCORRECT | EXTRA | NOT_VERIFIED | CONFLICTED | SCOPED_OUT
+3. `## Coverage Chart` — ASCII bar chart by category (see §Global Bar Chart Format)
+4. `## Detailed Compliance — {Category Name}` (one section per BRD category)
+5. `## Requirement Conflicts` — if any CONFLICTED items were detected during Step 2D, add this table:
+   | CONFLICT-ID | Entity | Source 1 | Value 1 | Source 2 | Value 2 | Contradiction Summary | Resolution Status |
+   If no conflicts detected, write "No requirement conflicts detected."
+6. `## Deferred / Out of Scope` — list all SCOPED_OUT requirements (from Q8). If Q8 was empty: "None — all requirements in scope."
+
+**Requirement Row Format** (table per category):
+```
+| BRD-ID | Priority | Requirement | Status | Coverage | Evidence | Issues | Recommendation |
+```
+
+**Rules**:
+- Every BRD requirement must appear in exactly one category section
+- Status must be one of the defined status values (all caps)
+- Evidence must include file path and function/class name (or "None — not found")
+- Issues column: empty string if IMPLEMENTED, otherwise specific gap description
+- Recommendation column: empty string if IMPLEMENTED, otherwise actionable fix
+
+**Sorting within each category**: MISSING first, then INCORRECT, then CONFLICTED, then PARTIALLY_IMPLEMENTED, then IMPLEMENTED
+
+---
+
+## File 03 — 03_USER_STORY_COMPLIANCE.md
+
+**Contract**: Story-by-story verification with per-acceptance-criterion breakdown.
+
+**Required Sections**:
+1. `# User Story Compliance Report`
+2. `## Summary` — Total stories | Fully Satisfied | Partially Satisfied | Not Satisfied | Not Verifiable
+3. `## Story {US-ID} — {Story Title}` (one section per story)
+
+**Per-Story Block**:
+```markdown
+### Story US-XXX — {Story Title}
+**Role**: As a {role}
+**Goal**: I want to {goal}
+**Value**: So that {value}
+**Overall Status**: FULLY_SATISFIED | PARTIALLY_SATISFIED | NOT_SATISFIED | NOT_VERIFIABLE
+
+#### Acceptance Criteria
+| AC-ID | Criterion | Status | Evidence | Issues |
+|-------|-----------|--------|----------|--------|
+
+#### Business Flow Verification
+| Aspect | Required | Implemented | Status | Evidence |
+|--------|----------|-------------|--------|----------|
+| Screen | | | | |
+| API | | | | |
+| Validation | | | | |
+| Navigation | | | | |
+| Error Handling | | | | |
+| Loading State | | | | |
+
+#### Missing Elements
+{bullet list of what is missing, or "None — fully implemented"}
+
+#### Recommendation
+{specific action needed, or "No action required"}
+```
+
+**Rules**:
+- Every AC must be assessed individually
+- Evidence must reference the source file
+- Missing Elements must be specific, not vague
+
+---
+
+## File 04 — 04_TEST_CASE_COMPLIANCE.md
+
+**Contract**: Every test case logically executed against the implementation.
+
+**Required Sections**:
+1. `# Test Case Compliance Report`
+2. `## Summary` — Total | PASS | PARTIAL_PASS | FAIL | NOT_IMPLEMENTED | BLOCKED | UNKNOWN
+3. `## Pass Rate` — ASCII bar chart
+4. `## Critical Failures` — list of FAIL and NOT_IMPLEMENTED TCs with one-line reason each
+5. `## Detailed Results — {TC-ID}` — one section per test case
+
+**Per-Test-Case Format**:
+```markdown
+### TC-XXX — {Scenario Name}
+**Type**: {Functional | Validation | Navigation | API | Business Logic | Edge Case | Negative}
+**Related Story**: {US-ID or "None"}
+**Related BRD**: {BRD-ID or "None"}
+**Verdict**: PASS | PARTIAL_PASS | FAIL | NOT_IMPLEMENTED | BLOCKED | UNKNOWN
+
+#### Test Steps vs Implementation
+| Step | Action | Expected | Actual Implementation | Status |
+|------|--------|----------|-----------------------|--------|
+
+#### Evidence
+- Files: {list of files read as evidence}
+- Functions: {function names if applicable}
+
+#### Reason
+{Why this verdict was given — specific, not vague}
+
+#### Recommendation
+{What needs to be done to make this test pass, or "No action required"}
+```
+
+**Rules**:
+- Never check for test file existence — check for feature implementation
+- "Actual Implementation" must describe what the code does, not what the file is named
+- BLOCKED tests must name the blocking dependency
+
+**Sorting**: FAIL and NOT_IMPLEMENTED first, then BLOCKED, then PARTIAL_PASS, then UNKNOWN, then PASS last
+
+---
+
+## File 05 — 05_VALIDATION_ANALYSIS.md
+
+**Contract**: Field-by-field, rule-by-rule validation audit with exact message comparison.
+
+**Required Sections**:
+1. `# Validation Analysis Report`
+2. `## Summary` — Total required validations | Implemented | Missing | Message Mismatches
+3. `## Validation Coverage by Screen` — table: Screen | Fields Required | Fields Validated | Coverage %
+4. `## Detailed Validation Audit` — per-field analysis
+
+**Per-Field Format**:
+```markdown
+#### Field: {fieldName} on {ScreenName}
+| Aspect | Required (from BRD/Story) | Implemented (from code) | Match |
+|--------|--------------------------|------------------------|-------|
+| Rule | {e.g., required, min:10} | {actual rule found} | MATCH / MISMATCH / MISSING |
+| Error Message | {exact required text} | {exact implemented text} | EXACT / SIMILAR / MISMATCH / MISSING |
+| Trigger | {onChange / onBlur / onSubmit} | {from code} | MATCH / MISMATCH |
+| File | — | {file path} | — |
+```
+
+5. `## Validation Message Mismatch Summary` — table of all mismatches:
+   | Field | Screen | Required Message | Implemented Message | Severity |
+6. `## Missing Validations` — list of fields that have no validation
+7. `## Extra Validations` — list of validations with no requirement reference
+8. `## Server-Side Validation` — table of API error codes and how they are displayed
+
+**Rules**:
+- Required messages must be copied verbatim from BRD/Stories
+- Implemented messages must be resolved from code (not from keys — resolve the actual string)
+- Message comparison is case-sensitive and space-sensitive
+- "SIMILAR" means same intent, different wording (still a mismatch, flag for review)
+
+---
+
+## File 06 — 06_UI_ANALYSIS.md
+
+**Contract**: Screen-by-screen AND component-by-component UI element comparison.
+Components must be audited separately because they contain text labels, placeholder text,
+error messages, and conditional rendering that are prescribed by requirements.
+
+**Required Sections**:
+1. `# UI Analysis Report`
+2. `## Summary` — Total required screens | Implemented | Missing | Partial | Coverage %
+3. `## Screen: {ScreenName}` — one section per required screen
+4. `## Component Audit` — one sub-section per relevant shared component
+5. `## Missing Screens` — screens required but not found
+6. `## Extra Screens` — screens found with no requirement reference
+7. `## Conditional UI Analysis` — all conditional rendering across screens AND components
+8. `## Shared Component Compliance` — components that must match required text/behavior
+
+**Per-Screen Format**:
+```markdown
+### Screen: {ScreenName}
+**Required by**: {BRD-ID, US-ID}
+**Implemented**: YES | NO | PARTIAL
+**File Path**: {path or "Not found"}
+
+#### UI Elements Audit
+| Element | Type | Required | Implemented | Source (Screen or Component) | Status | Evidence |
+|---------|------|----------|-------------|------------------------------|--------|----------|
+
+#### Text/Label Audit
+| Element | Required Text | Implemented Text | Source File | Match |
+|---------|---------------|-----------------|-------------|-------|
+
+#### States
+| State | Required | Implemented | Evidence |
+|-------|----------|-------------|----------|
+| Loading | | | |
+| Empty | | | |
+| Error | | | |
+| Success | | | |
+
+#### Issues
+{bullet list or "None"}
+```
+
+**Per-Component Format** (for shared components referenced in screens):
+```markdown
+### Component: {ComponentName}
+**Used by screens**: {list of screens from Component Inventory}
+**Required by**: {BRD-ID, US-ID that prescribe this component's behavior}
+**File Path**: {path}
+
+#### Props / Behavior Audit
+| Prop / Behavior | Required | Implemented | Match |
+|-----------------|----------|-------------|-------|
+| Label text | | | |
+| Placeholder text | | | |
+| Error message | | | |
+| Required indicator | | | |
+| Disabled behavior | | | |
+
+#### Issues
+{bullet list or "None"}
+```
+
+Note on Source column: When a UI element is rendered by a shared component rather than directly
+in the screen file, record the component file path as the evidence source.
+
+---
+
+## File 07 — 07_API_ANALYSIS.md
+
+**Contract**: API-by-API requirement vs implementation comparison.
+
+**Required Sections**:
+1. `# API Analysis Report`
+2. `## Summary` — Required APIs | Implemented | Missing | Method Mismatch | Auth Issues
+3. `## API Coverage Matrix` — master table:
+   | API | Method | Endpoint | Required By | Implemented | Auth | Error Handling | Status |
+4. `## Missing APIs` — required but not found, with BRD/Story reference
+5. `## Extra APIs` — implemented but not referenced in requirements
+6. `## API Detail — {API name or endpoint}` — one section per API with issues:
+
+**Per-API Detail** (only for non-PASS APIs):
+```markdown
+### API: {method} {endpoint}
+**Required by**: {BRD-ID / US-ID}
+**Status**: {status}
+**Implementation File**: {file path}
+
+#### Requirement vs Implementation
+| Aspect | Required | Implemented | Match |
+|--------|----------|-------------|-------|
+| Method | | | |
+| Endpoint | | | |
+| Auth Header | | | |
+| Request Payload | | | |
+| Response Mapping | | | |
+| Error Codes Handled | | | |
+| Retry Logic | | | |
+| Timeout | | | |
+
+#### Issues
+{specific issues}
+#### Recommendation
+{specific fix}
+```
+
+---
+
+## File 08 — 08_BUSINESS_LOGIC_ANALYSIS.md
+
+**Contract**: Rule-by-rule business logic verification.
+
+**Required Sections**:
+1. `# Business Logic Analysis Report`
+2. `## Summary` — Total rules required | Implemented | Partial | Missing | Incorrect
+3. `## Business Rule: {BRD-ID}` — one section per business rule
+
+**Per-Rule Format**:
+```markdown
+### Rule: {BRD-ID} — {Rule Name}
+**Type**: Condition | Calculation | Threshold | Eligibility | State Machine | Date Rule
+**Status**: IMPLEMENTED | PARTIALLY_IMPLEMENTED | MISSING | INCORRECT
+
+#### Requirement
+{exact text from BRD}
+
+#### Implementation Evidence
+- **File**: {path}
+- **Function**: {name}
+- **Code Excerpt**:
+  ```{language}
+  {max 8 lines of relevant code}
+  ```
+
+#### Issues
+{what is wrong or missing, or "None"}
+
+#### Recommendation
+{what to fix, or "No action required"}
+```
+
+4. `## Calculation Verification` — for every required calculation:
+   | Calc | Required Formula | Implemented Formula | Match | Worked Example | Status |
+
+   **Worked Example column**: Values MUST come from existing test files in the repository, example
+   values from BRD/User Story documents, or example values in source code comments. If no source
+   example exists, write "No source example found — manual verification required."
+   Do NOT invent input values. Fabricated examples create a false impression of verified correctness.
+5. `## Missing Business Rules` — list
+6. `## Extra Business Logic` — list with file references
+
+---
+
+## File 09 — 09_NAVIGATION_ANALYSIS.md
+
+**Contract**: Flow-by-flow navigation audit.
+
+**Required Sections**:
+1. `# Navigation Analysis Report`
+2. `## Summary` — Required flows | Implemented | Missing | Incorrect
+3. `## Navigation Flow Matrix` — master table:
+   | Flow ID | From Screen | To Screen | Trigger | Parameters | Auth Required | Status |
+4. `## Missing Navigation Flows`
+5. `## Extra Navigation` — flows in code with no requirement reference
+6. `## Deep Link Analysis` (if applicable):
+   | Route | Pattern | Implemented | Status |
+7. `## Back Navigation Analysis`:
+   | Screen | Back Behavior Required | Implemented | Match |
+8. `## Auth Guard Analysis`:
+   | Screen/Flow | Guard Required | Guard Implemented | Match |
+
+---
+
+## File 10 — 10_TRACEABILITY_MATRIX.md
+
+**Contract**: Complete end-to-end requirement traceability.
+
+**Required Sections**:
+1. `# Requirements Traceability Matrix`
+2. `## Master Traceability Table`:
+   | BRD-ID | BRD Requirement (short) | Story-IDs | AC-IDs | TC-IDs | Implementation Files | Status |
+3. `## Traceability Score` — % of BRD requirements with complete chain
+4. `## Orphan Analysis`:
+   - `### BRD Requirements with No User Story` — list with BRD-ID and requirement text
+   - `### BRD Requirements with No Test Case` — list
+   - `### User Stories with No BRD Reference` — list with US-ID
+   - `### Test Cases with No Story Reference` — list with TC-ID
+   - `### Test Cases with No BRD Reference` — list
+5. `## Implementation Gap Map` — requirements where implementation file is "None"
+
+**Rules**:
+- Every BRD requirement must appear in the master table
+- Story-IDs, AC-IDs, TC-IDs must list ALL related IDs (comma-separated)
+- Implementation Files must list actual file paths (not folder names)
+
+---
+
+## File 11 — 11_MISSING_FEATURES.md
+
+**Contract**: Complete catalog of what was required but not implemented.
+
+**Required Sections**:
+1. `# Missing Features Report`
+2. `## Summary` — Total missing items by category
+3. `## Priority 1 — Critical Blockers` (missing items that break core flows)
+4. `## Priority 2 — High Impact` (missing items that break important features)
+5. `## Priority 3 — Medium Impact` (missing items that degrade experience)
+6. `## Priority 4 — Low Impact` (missing items that are cosmetic or minor)
+
+**Per Missing Item Format**:
+```markdown
+### MISS-{n} — {Feature Name}
+**Type**: Screen | API | Validation | Business Rule | Navigation | Calculation | UI Element
+**Required by**: {BRD-ID}, {US-ID}, {TC-IDs that will fail}
+**Description**: {what was supposed to be implemented}
+**Impact**: {what breaks without this}
+**Estimated Effort**: High | Medium | Low
+**Dependencies**: {what this feature needs first, or "None"}
+**Recommendation**: {specific implementation guidance}
+```
+
+---
+
+## File 12 — 12_EXTRA_IMPLEMENTATION.md
+
+**Contract**: Catalog of what is implemented but was never requested.
+
+**Required Sections**:
+1. `# Extra Implementation Report`
+2. `## Summary` — Total extra items by type
+3. `## Extra Screens`
+4. `## Extra APIs`
+5. `## Extra Business Logic`
+6. `## Extra Validations`
+7. `## Extra Navigation Flows`
+8. `## Dead Code / Unused Components`
+
+**Per Item Format**:
+```markdown
+### EXTRA-{n} — {Item Name}
+**Type**: {type}
+**File**: {path}
+**Description**: {what this extra item does}
+**Assessment**: Intentional | Leftover | Speculative
+**Risk**: {potential risk if kept, e.g., security surface, maintenance burden}
+**Recommendation**: Keep | Remove | Document as requirement | Defer
+```
+
+**If no extra items found**: state "No extra implementation detected" in each section.
+
+---
+
+## File 13 — 13_COMPLIANCE_SCORECARD.md
+
+**Contract**: Visual, scannable compliance scorecard.
+
+**Required Sections**:
+1. `# Compliance Scorecard`
+2. `## Overall Score` — large ASCII visual
+3. `## Dimension Scorecard`:
+   ```
+   | Dimension              | Required | Implemented | Missing | Score | Grade |
+   |------------------------|----------|-------------|---------|-------|-------|
+   | BRD Requirements       |          |             |         |  XX%  |  A-F  |
+   | User Stories           |          |             |         |  XX%  |       |
+   | Acceptance Criteria    |          |             |         |  XX%  |       |
+   | Test Cases             |          |             |         |  XX%  |       |
+   | Validations            |          |             |         |  XX%  |       |
+   | APIs                   |          |             |         |  XX%  |       |
+   | UI Screens             |          |             |         |  XX%  |       |
+   | Business Logic         |          |             |         |  XX%  |       |
+   | Navigation             |          |             |         |  XX%  |       |
+   ```
+4. `## ASCII Bar Charts` — one horizontal bar per dimension (use §Global Bar Chart Format)
+5. `## Benchmark Comparison`:
+   | Threshold | Required Score | Actual Score | Result |
+6. `## Grade Scale` — use the grade scale from `assets/coverage-calculation-rules.md` (the
+   authoritative source). Do not use a different grade table. Reference the file; do not copy it.
+7. `## Score Calculation` — show the weighted formula with actual numbers. Use weight values from
+   `assets/coverage-calculation-rules.md`. If Q9 was set, apply the matching weight preset.
+
+---
+
+## File 14 — 14_FINAL_RECOMMENDATIONS.md
+
+**Contract**: Decision document and action plan. Last file generated.
+
+**Required Sections**:
+1. `# Final Recommendations`
+2. `## Audit Decision`
+   - Headline: `RECOMMENDED DECISION: SHIP | CONDITIONAL SHIP | DO NOT SHIP`
+   - Rationale: 2–4 sentences explaining the decision
+3. `## Prioritized Action Plan`
+
+**Action Item Format** (Priority 1 = must fix first):
+```markdown
+### Priority 1 — Blockers (Must Fix Before Any Release)
+| # | Action | Related IDs | Effort | Owner Hint |
+|---|--------|-------------|--------|------------|
+```
+Repeat for Priority 2, 3, 4.
+
+4. `## Sprint Plan Suggestion`
+
+   Sprint groupings use T-shirt size complexity estimates (S/M/L/XL) based on measurable signals
+   from the audit — number of missing files, missing validation count, missing API count, and
+   business rule complexity. These are complexity groupings, not velocity estimates.
+
+   | Sprint | Group | Items | Complexity |
+   |--------|-------|-------|------------|
+   | Sprint 1 | XL items (multi-file blockers, missing core screens, missing APIs) | {list} | XL |
+   | Sprint 2 | L items (partially implemented features, validation gaps) | {list} | L |
+   | Sprint 3 | M items (message mismatches, minor UI gaps) | {list} | M |
+   | Backlog | S items (cosmetic, low-impact, deferred) | {list} | S |
+
+   Do NOT use story points. Do NOT estimate sprint capacity.
+5. `## Risk Register`
+   | # | Risk | Likelihood | Impact | Mitigation |
+6. `## Technical Debt Identified`
+   - List of tech debt items found during audit (not requirement gaps, but code quality observations)
+7. `## Process Recommendations`
+   - What gaps in the requirements-to-implementation handoff process caused these misses?
+   - 3–5 specific process improvements
+8. `## Team Recommendations`
+   - Areas needing additional knowledge transfer
+   - Areas needing additional QA focus
+9. `## Audit Metadata`
+   - Files scanned count
+   - Requirements audited count
+   - Audit generated by: Claude Code — Project Requirements Compliance Auditor
+
+---
+
+## Global File Rules
+
+1. Every file must begin with a header block:
+   ```markdown
+   # {Title}
+   Generated by: Project Requirements Compliance Auditor v3.0.0
+   Audit Date: {date}
+   Project: {Q4}
+   Platform: {Q6}
+   ```
+2. All tables must have proper column alignment
+3. All code excerpts must use fenced code blocks with language identifier
+4. No file may reference another file's data without that data having been independently computed
+5. Files 14 and 15 must be generated last and may reference data from files 01–13
+
+### §Generation Order
+
+Generate files in this exact sequence to ensure data dependencies are met:
+
+**Phase 1** — Detail files (generate in any order within this phase):
+Files 02, 03, 04, 05, 06, 07, 08, 09, 10, 11
+
+**Phase 2** — Extra implementation:
+File 12 (references categories built in Phase 1)
+
+**Phase 3** — Scorecard (aggregates Phase 1 + Phase 2 scores):
+File 13
+
+**Phase 4** — Executive Summary (derived from scorecard):
+File 01 (MUST be generated AFTER File 13 — it contains the overall score pulled from File 13)
+
+**Phase 5** — Recommendations and Security:
+Files 14 and 15 (reference scorecard and detail files)
+
+**Rationale**: File 01 requires the weighted overall score, risk level, and dimension summary
+which can only be computed after all detail files are complete. Generating File 01 first produces
+an empty shell with no real numbers.
+
+### §Global Bar Chart Format
+
+All ASCII bars across ALL output files use this single specification:
+- Width: 40 characters
+- Each `=` represents 2.5%
+- Format: `[{bar}>{ spaces}] {percentage}%`
+- Example (67.5%): `[==========================>             ] 67.5%`
+
+Do NOT use any other width or scale. This ensures bars are comparable across reports.
+
+---
+
+## File 15 — 15_SECURITY_ANALYSIS.md
+
+**Contract**: Dedicated security compliance audit. Generated in Phase 5 (after File 13).
+
+**When to generate**: Always — for all platforms and project types. Security gaps must be reported
+even if no dedicated security requirements exist in the BRD (flag absence of security requirements
+as a finding in §Missing Security Requirements).
+
+**Required Sections**:
+1. `# Security Analysis Report`
+2. `## Summary` — Security findings by severity: CRITICAL | HIGH | MEDIUM | LOW | INFORMATIONAL
+3. `## Encryption Compliance`
+   - Table: Data Element | Required Encryption (from BRD) | Implemented | Algorithm | Key Management | Status
+   - Verify: is encryption applied to data at rest AND in transit as required?
+   - Evidence: cite interceptor file, encryption utility, or key derivation module
+
+4. `## Authentication & Token Security`
+   - Table: Token Type | Storage Location | Expiry | Refresh Logic | Revocation | Status
+   - Check: access tokens, refresh tokens, session tokens
+   - Verify: tokens not stored in AsyncStorage/localStorage without encryption
+   - Verify: token expiry is enforced in code (not just declared in BRD)
+   - Verify: refresh logic handles token expiry gracefully
+
+5. `## PIN / Password Security`
+   - Lockout mechanism: Required (from BRD) | Implemented | Threshold | Lockout duration
+   - PIN complexity: Required | Implemented
+   - PIN change flow: Required | Implemented
+   - Biometric fallback: Required | Implemented
+
+6. `## Session Management`
+   - Session timeout: Required (from BRD) | Implemented | Evidence
+   - Background app lock: Required | Implemented
+   - Logout behavior: clears all tokens, local cache, navigation stack
+
+7. `## Error Message Safety`
+   - Table: Error Scenario | Displayed Message | Contains Sensitive Info | Safe |
+   - Flag any error messages that expose stack traces, internal paths, or system details
+
+8. `## SSL / Certificate Pinning`
+   - Status: Required by BRD | Implemented | Scope (which domains)
+   - Evidence: certificate pinning config or network security config file
+
+9. `## Sensitive Data Logging`
+   - Grep for: console.log, Log.d, print, NSLog, debugPrint near field names like PIN, password, token, OTP
+   - Table: File | Line Pattern | Data Exposed | Severity
+
+10. `## Missing Security Requirements`
+    - List BRD security requirements that have no implementation
+    - List security concerns that exist in the implementation but have no BRD requirement coverage
+      (e.g., token stored unencrypted but BRD never mentioned encryption — flag as EXTRA RISK)
+
+11. `## Security Recommendations` — ordered by severity, most critical first
+
+**Rules**:
+- Cite file path and function for every finding
+- Do not mark a security control IMPLEMENTED without reading the implementation
+- "Encryption is used" based on package name alone is MEDIUM confidence — read the actual usage
+- CRITICAL findings in this file should also appear in File 01 §Critical Issues