Danijel Martinek
ef9cfd243e
Implementation seed for ADR-025 Epic C: six security headers middleware with nonce-based CSP in core-shared/security (Next + TanStack adapters), fourth conformance channel for rate-limit in core-shared/rate-limit (IRateLimit + RateLimited brand + multi-budget manifest field + no-undeclared-rate-limit ESLint rule), CycloneDX SBOM step in release-please.yml. auth.signIn backfilled as canonical rate-limit reference. ADR-023 amendment for SBOM captured. Status: approved — ready for pnpm work decompose.
docs/work — the local task system
Filesystem-backed Epic/Story/Task hierarchy used by AI agents and humans alike.
See docs/architecture/agent-first-workflow-and-conformance.md for the full
design. Until the work-system-v1 epic ships orchestration tooling, this
folder is human-driven — agents read the files for context, humans flip
checkboxes.
Layout
prds/<date>-<slug>.prd.md— source PRDs<epic-slug>/_epic.md— one folder per epic<epic-slug>/<story-slug>/_story.md— one folder per story<epic-slug>/<story-slug>/<task-slug>.task.md— one file per task_templates/— copy-paste templates (added in work-system-v1)_state.json— derived index (added in work-system-v1)
PRD lifecycle
PRD status frontmatter field: draft → in-review → approved → shipped.
- draft → in-review — author flips when ready for review (manual)
- in-review → approved — human reviewer flips on acceptance (manual)
- approved → shipped — auto-flipped by
pnpm work prd-ship <prd-id>when the seed epic finishes. The state-builder surfaces this signal under_state.json→needs_prd_ship[]so the orchestrator (or a reviewer running the sandcastle workflow) can act on it.
The decomposer refuses to run on draft PRDs. Once approved, the seed epic is generated; once the epic completes, the PRD is automatically flipped to shipped along with its commit list.