---
id: 11-documentation
epic: dsr-consent-and-cookie-banner
title: Documentation — DSR guide, consent guide, glossary, CLAUDE.md
type: technical-story
status: done
feature: core-shared
depends-on:
  [
    07-core-api-router-composition,
    09-cookie-consent-banner,
    10-auth-signup-migration,
  ]
blocks: []
created: 2026-05-19T12:00:00Z
updated: 2026-05-19T22:09:30.310Z
---

## Goal

Write the consumer-facing documentation for DSR and consent, update the glossary with new terms, and update CLAUDE.md and conformance-quickref with the new manifest field and rule count.

## Why

Story 15 in the PRD: a DPO should be able to answer "what data do we hold + how does a subject act on it" by reading `compliance/data-map.yml` (Epic A) and the DSR endpoint mapping (this epic) without reading code. The documentation also serves AI agents scaffolding new features that need consent gates or DSR wiring.

## Done when

- `docs/guides/dsr.md` exists and covers: interfaces, tRPC procedure → GDPR article mapping, route wiring for consumers, multi-subject handling, soft vs cascade-hard delete semantics, `DeletionCertificate` format, Art. 15/16/17/18/20 compliance notes.
- `docs/guides/consent.md` exists and covers: `requiresConsent` manifest field + brand + runtime check pattern, `IConsent.grant` + audit trail, anonymous → authenticated migration flow, cookie versioning policy (`_v` field, migration-on-read), SSR-safe banner loading pattern, CNIL/EDPB equal-prominence requirement.
- `docs/compliance/subject-linkage.example.md` documents the `custom.subject` declaration pattern with a worked example of a multi-subject collection (e.g., a support ticket with submitter + assignee), providing the anchor for downstream consumers adding PII-holding collections.
- `docs/glossary.md` gains entries for: `SubjectLink`, `DeletionCertificate`, `UserConsentState`, `ConsentChecked` (brand).
- `CLAUDE.md` reflects: conformance rule count 11 → 12, new manifest field `requiresConsent: ConsentCategory[]` in the Key Conventions section, updated brand composition order (`withSpan → withCapture → withAudit → withAnalytics → withConsent → factory(deps)`).
- `docs/guides/conformance-quickref.md` reflects the new rule + manifest field.
- `pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff` all pass.

## In scope

- `docs/guides/dsr.md` (new file).
- `docs/guides/consent.md` (new file).
- `docs/compliance/subject-linkage.example.md` (new file).
- `docs/glossary.md` — four new entries.
- `CLAUDE.md` — rule count + manifest field + brand composition order.
- `docs/guides/conformance-quickref.md` — rule + manifest field.

## Out of scope

- Pre-launch compliance checklist + fill-in templates (Epic D).
- REST endpoint documentation (Epic D).
- Cross-region transfer documentation / Schrems II / TIA (Epic D).
- Per-framework router auto-wiring docs (out of scope per PRD).

## Tasks

- [x] Write `docs/guides/dsr.md` + `docs/guides/consent.md` + `docs/compliance/subject-linkage.example.md` + update `docs/glossary.md` with `SubjectLink`, `DeletionCertificate`, `UserConsentState`, `ConsentChecked` entries + update `CLAUDE.md` (rule count 11 → 12, `requiresConsent` manifest field, updated brand composition order) + update `docs/guides/conformance-quickref.md`; all gates pass.