Add reads field to UseCaseManifest, update CLAUDE.md with Q0-Q3 rules,
add ./reader subpath to AGENTS.md exports table, and cascade reader
conventions through conformance quickref, adding-a-feature guide, and
scaffolding guide. Moves gen reader from deferred to planned.
Introduce readers as a fourth cross-feature mechanism alongside events,
jobs, and realtime. Readers solve synchronous domain queries across
verticals (e.g. permission checks) where Payload relationTo gives raw
data but the answer requires business-rule evaluation by the owning
feature.
- Define rules Q0-Q3 (query-only, contract public, read-only, no cycles)
- Reader wraps existing use cases via ReadOnly<F> brand enforcement
- Lives under integrations/readers/ with ./reader export subpath
- Manifest reads: ["auth"] field for conformance gate visibility
- Update glossary with Reader, reads, ReadOnly<F> terms
Bring docs/architecture/ in line with the current repo:
- feature-conformance-explainer.html: drop the "proposed / not yet
implemented" framing — the system is shipped. Four enforcement points
become five (adds `pnpm fallow` as the whole-codebase audit). Manifest
playground shows `coverage`, `analyticsEvents`, `rateLimit`,
`requiresConsent`. Milestone / anchor / open-question sections kept
but marked historical.
- agent-first-workflow-and-conformance.md: four → five enforcement
layers; layer table gains the Fallow row.
- di-explainer.html: bind-production sample rewritten to show
wireUseCase() + assertFeatureConformance() + the full wrapper stack
(span → capture → audit? → analytics? → consent? → rateLimit?).
- data-flow-explainer.html: same bind-production refresh for the
data-flow narrative.
- audit-and-compliance-explainer.html: AuditAction enum 6 → 10 values
(CONSENT_GRANT / WITHDRAW / RESTRICT / UNRESTRICT);
BindProductionContext example gains analytics, consentFactory,
rateLimit.
- vertical-feature-spec.md: §5 layout lists the 8 optional cores plus
core-testing; §9.5 hedges the turbo.json snippet against the live
file; §10.4 drops the dated "360 tests" metric for the ADR-020
coverage architecture; §11 gains a historical lead-in pointing at
docs/decisions/ as the canonical 25-ADR set.
Align the architecture docs with the current repo:
- Boundary matrix: feature may depend on core, feature, tooling — a
feature may import another feature's public exports. overview.md,
dependency-flow.md, and vertical-feature-spec.md all said the stale
`feature -> core, tooling`.
- Optional-core lists completed with core-analytics, core-consent,
core-dsr; tooling list completed with core-testing.
- Package count corrected to the accurate 19-package breakdown.
- BindContext table gained analytics, consentFactory, rateLimit.
Deeper drift (the HTML explainers, vertical-feature-spec §5/§9.5/§11)
is tracked in the local .tmp/ working note, not yet addressed.
turbo.json's boundary config already allows `feature -> feature`, and
the cross-feature event system depends on it — a consumer must import
the publisher's event contract from `@repo/<publisher>`. But the ESLint
boundaries config, ADR-010, and AGENTS.md still declared
`feature -> [core, tooling]`, contradicting turbo.json and the shipped
code (marketing-pages imports @repo/auth).
Align all three to turbo.json: a feature may import another feature's
published public exports. Internals stay sealed by the `exports` map,
and cross-feature behaviour still flows through IEventBus.
The Socket supply-chain filter (ADR-023) was added after the initial
library-trace backfill, leaving the 36 traces dated 2026-05-14 without
the socketRisk filter-results field the trace schema now expects.
Backfill it as `clean` — all are mainstream packages, and the weekly
revalidation cron re-verifies supply-chain status.
The root devDependency carried a "*" wildcard, and ADR-019 documented a
nonexistent ^2.73.0 pin — the package's installed version is 0.5.10.
Pin to ^0.5.10 and correct ADR-019 to match.
The implemented IAnalytics refined the signature ADR-024 sketched:
events are attributed to the user set by identify() (the standard SDK
model) rather than passed per track() call, the attribute parameter is
named `attributes` consistently, and AnalyticsUser stays id-only with
traits riding identify()'s second argument. The code is the more
idiomatic contract and docs/guides/analytics.md already matched it —
update the ADR's interface block, manifest example, and PII-boundary
section to describe what shipped.
Add a "Policy templates" section to docs/compliance/README.md explaining
the docs/compliance/templates/ directory, the copy-to-compliance/ workflow,
the [FILL IN:] placeholder convention, and the verification one-liner.
Add four glossary entries: fill-in template, [FILL IN:] marker,
pre-launch compliance checklist, and compliance overview.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Maps all 22 DPA/GDPR playbook sections to their covering ADR, guide,
template, or epic in this template. Restates ADR-025's four explicit
deferrals (RBAC, MFA, breach-detection, GDPR Art. 22) and documents
consumer/infra-scope items (EU region, TLS, MDM, legal instruments).
Includes a full reference index linking every compliance guide, ADR,
template, and epic.
Fix broken forward reference to compliance-overview.md (story 05 output)
by replacing the hyperlink with plain text annotated as forthcoming.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Two-column table covering all 22 playbook sections organised by 13
groups (Infrastructure, Data, Application, Secrets, Sub-Processors,
Logging, Breach, DSR, Backup, SDLC, Workforce, Legal, Documentation).
Every "Shipped by template" row names a runnable verification command.
Consumer and infra responsibilities are explicitly labelled. ADR-025
deferrals (GDPR Art. 22, MFA/lockout, breach-detection patterns) are
called out inline. Links outward to compliance-overview.md, all seven
policy templates, audit-and-compliance.md, operator-checklist.md, and
ADR-025.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Five skeleton templates for docs/compliance/templates/. Each has YAML
frontmatter (status: template, playbook-section), a "not code-enforced"
banner, and [FILL IN:] markers throughout. password-policy banner cites
ADR-025 §Deferred items by number (MFA + password policy + lockout
deferral). Cross-template relative links all resolve.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ADR-024: analytics backend is consumer-chosen; operator must decide
whether to wire a vendor and, if so, run /evaluate-library first
(ADR-022 gate applies). Documents IAnalytics wiring, flush() shutdown
hook, and optional React provider.
ADR-025: compliance directory setup — generate and commit compliance/
YAML files as audit evidence; verify drift gate in pre-commit + CI;
schedule retention purge job per custom.retention; hand-author
compliance/sub-processors.manual.yml for non-npm vendors.
All existing ADR-022/023 content preserved unchanged.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Generated 1 epic + 6 stories under docs/work/epics/ from the approved
PRD docs/work/prds/compliance-docs-scaffolds.prd.md. Stories cover
landing + refreshing operator-checklist.md, the seven fill-in policy
templates, the pre-launch compliance checklist, the compliance-overview
hub, and doc wiring (CLAUDE.md, README, glossary). Final epic of
ADR-025. Ready for `pnpm work dispatch --execute`.
Amends release-please.yml with conditional steps that run only when
release-please cuts a release:
- checkout + pnpm install to give @cyclonedx/cyclonedx-npm the full
resolved workspace graph
- pnpm dlx @cyclonedx/cyclonedx-npm generates a CycloneDX 1.6 JSON SBOM
named sbom-<tag>.cdx.json; --ignore-npm-errors is required because
npm ls exits non-zero for dev-deps-of-dev-deps pnpm correctly elides
- softprops/action-gh-release@<SHA> (v3.0.0, Renovate-managed) attaches
the file to the GitHub release as a downloadable asset
Adds ADR-023 §9 amendment documenting the step shape, rationale for
pnpm dlx (avoids lockfile per ADR-022), --ignore-npm-errors behaviour,
SHA pinning per ADR-023 §1, and the extended failure-mode table.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Implementation seed for ADR-025 Epic D, the final epic: seven fill-in
policy templates under docs/compliance/templates/ (2 anchored, 5
skeleton with not-code-enforced banner), a two-column pre-launch
compliance checklist mapping playbook obligations to template
mechanisms, a compliance-overview.md hub, and a landed + refreshed
operator-checklist.md. Pure docs — no code, no conformance changes.
Status: approved — ready for pnpm work decompose.
