agentic-dev/docs/work/epics/dsr-consent-and-cookie-banner/11-documentation/_story.md

id, epic, title, type, status, feature, depends-on, blocks, created, updated

id	epic	title	type	status	feature	depends-on	blocks	created	updated
11-documentation	dsr-consent-and-cookie-banner	Documentation — DSR guide, consent guide, glossary, CLAUDE.md	technical-story	done	core-shared	07-core-api-router-composition 09-cookie-consent-banner 10-auth-signup-migration		2026-05-19T12:00:00Z	2026-05-19T22:09:30.310Z

Goal

Write the consumer-facing documentation for DSR and consent, update the glossary with new terms, and update CLAUDE.md and conformance-quickref with the new manifest field and rule count.

Why

Story 15 in the PRD: a DPO should be able to answer "what data do we hold + how does a subject act on it" by reading compliance/data-map.yml (Epic A) and the DSR endpoint mapping (this epic) without reading code. The documentation also serves AI agents scaffolding new features that need consent gates or DSR wiring.

Done when

• docs/guides/dsr.md exists and covers: interfaces, tRPC procedure → GDPR article mapping, route wiring for consumers, multi-subject handling, soft vs cascade-hard delete semantics, DeletionCertificate format, Art. 15/16/17/18/20 compliance notes.
• docs/guides/consent.md exists and covers: requiresConsent manifest field + brand + runtime check pattern, IConsent.grant + audit trail, anonymous → authenticated migration flow, cookie versioning policy (_v field, migration-on-read), SSR-safe banner loading pattern, CNIL/EDPB equal-prominence requirement.
• docs/compliance/subject-linkage.example.md documents the custom.subject declaration pattern with a worked example of a multi-subject collection (e.g., a support ticket with submitter + assignee), providing the anchor for downstream consumers adding PII-holding collections.
• docs/glossary.md gains entries for: SubjectLink, DeletionCertificate, UserConsentState, ConsentChecked (brand).
• CLAUDE.md reflects: conformance rule count 11 → 12, new manifest field requiresConsent: ConsentCategory[] in the Key Conventions section, updated brand composition order (withSpan → withCapture → withAudit → withAnalytics → withConsent → factory(deps)).
• docs/guides/conformance-quickref.md reflects the new rule + manifest field.
• pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff all pass.

In scope

• docs/guides/dsr.md (new file).
• docs/guides/consent.md (new file).
• docs/compliance/subject-linkage.example.md (new file).
• docs/glossary.md — four new entries.
• CLAUDE.md — rule count + manifest field + brand composition order.
• docs/guides/conformance-quickref.md — rule + manifest field.

Out of scope

• Pre-launch compliance checklist + fill-in templates (Epic D).
• REST endpoint documentation (Epic D).
• Cross-region transfer documentation / Schrems II / TIA (Epic D).
• Per-framework router auto-wiring docs (out of scope per PRD).

Tasks

• Write docs/guides/dsr.md + docs/guides/consent.md + docs/compliance/subject-linkage.example.md + update docs/glossary.md with SubjectLink, DeletionCertificate, UserConsentState, ConsentChecked entries + update CLAUDE.md (rule count 11 → 12, requiresConsent manifest field, updated brand composition order) + update docs/guides/conformance-quickref.md; all gates pass.