Initial commit

docs/work/epics/dsr-consent-and-cookie-banner/11-documentation/_story.md

@@ -0,0 +1,55 @@
+---
+id: 11-documentation
+epic: dsr-consent-and-cookie-banner
+title: Documentation — DSR guide, consent guide, glossary, CLAUDE.md
+type: technical-story
+status: done
+feature: core-shared
+depends-on:
+  [
+    07-core-api-router-composition,
+    09-cookie-consent-banner,
+    10-auth-signup-migration,
+  ]
+blocks: []
+created: 2026-05-19T12:00:00Z
+updated: 2026-05-19T22:09:30.310Z
+---
+
+## Goal
+
+Write the consumer-facing documentation for DSR and consent, update the glossary with new terms, and update CLAUDE.md and conformance-quickref with the new manifest field and rule count.
+
+## Why
+
+Story 15 in the PRD: a DPO should be able to answer "what data do we hold + how does a subject act on it" by reading `compliance/data-map.yml` (Epic A) and the DSR endpoint mapping (this epic) without reading code. The documentation also serves AI agents scaffolding new features that need consent gates or DSR wiring.
+
+## Done when
+
+- `docs/guides/dsr.md` exists and covers: interfaces, tRPC procedure → GDPR article mapping, route wiring for consumers, multi-subject handling, soft vs cascade-hard delete semantics, `DeletionCertificate` format, Art. 15/16/17/18/20 compliance notes.
+- `docs/guides/consent.md` exists and covers: `requiresConsent` manifest field + brand + runtime check pattern, `IConsent.grant` + audit trail, anonymous → authenticated migration flow, cookie versioning policy (`_v` field, migration-on-read), SSR-safe banner loading pattern, CNIL/EDPB equal-prominence requirement.
+- `docs/compliance/subject-linkage.example.md` documents the `custom.subject` declaration pattern with a worked example of a multi-subject collection (e.g., a support ticket with submitter + assignee), providing the anchor for downstream consumers adding PII-holding collections.
+- `docs/glossary.md` gains entries for: `SubjectLink`, `DeletionCertificate`, `UserConsentState`, `ConsentChecked` (brand).
+- `CLAUDE.md` reflects: conformance rule count 11 → 12, new manifest field `requiresConsent: ConsentCategory[]` in the Key Conventions section, updated brand composition order (`withSpan → withCapture → withAudit → withAnalytics → withConsent → factory(deps)`).
+- `docs/guides/conformance-quickref.md` reflects the new rule + manifest field.
+- `pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff` all pass.
+
+## In scope
+
+- `docs/guides/dsr.md` (new file).
+- `docs/guides/consent.md` (new file).
+- `docs/compliance/subject-linkage.example.md` (new file).
+- `docs/glossary.md` — four new entries.
+- `CLAUDE.md` — rule count + manifest field + brand composition order.
+- `docs/guides/conformance-quickref.md` — rule + manifest field.
+
+## Out of scope
+
+- Pre-launch compliance checklist + fill-in templates (Epic D).
+- REST endpoint documentation (Epic D).
+- Cross-region transfer documentation / Schrems II / TIA (Epic D).
+- Per-framework router auto-wiring docs (out of scope per PRD).
+
+## Tasks
+
+- [x] Write `docs/guides/dsr.md` + `docs/guides/consent.md` + `docs/compliance/subject-linkage.example.md` + update `docs/glossary.md` with `SubjectLink`, `DeletionCertificate`, `UserConsentState`, `ConsentChecked` entries + update `CLAUDE.md` (rule count 11 → 12, `requiresConsent` manifest field, updated brand composition order) + update `docs/guides/conformance-quickref.md`; all gates pass.