Task Management App

🏗️ @arch responds with a scoring matrix:

## /agile-explore-brainstorm — Results

### Problem Statement
Full-stack task management app with auth, REST API,
relational DB, and web frontend. Constraints: testable,
deployable, JWT auth.

### Scoring Matrix

| Approach               | Feasibility | Maintainability | Performance | Risk | Total |
|------------------------|------------|-----------------|-------------|------|-------|
| Express + PostgreSQL   | 9/10       | 9/10            | 8/10        | 8/10 | 34    |
| + Vanilla HTML/CSS/JS  |            |                 |             |      |       |
| Fastify + PostgreSQL   | 8/10       | 8/10            | 9/10        | 7/10 | 32    |
| + React SPA            |            |                 |             |      |       |
| Django + PostgreSQL     | 8/10       | 9/10            | 7/10        | 8/10 | 32    |
| + Django Templates     |            |                 |             |      |       |
| Go + PostgreSQL        | 7/10       | 9/10            | 10/10       | 6/10 | 32    |
| + HTMX                 |            |                 |             |      |       |

### Recommendation
Express + PostgreSQL + Vanilla frontend scores highest.
Simple stack, easy to test, no build step for frontend.

### What Would Change This
- If you need rich interactivity → React SPA
- If you prefer Python → Django
- If performance is critical → Go + HTMX

💬 "Set up the Express + PostgreSQL project with a vanilla
   frontend, bcrypt for passwords, and JWT for auth.
   Then run /agile-setup-init."

→ @dev scaffolds: package.json, src/, public/, db/migrations/
→ /agile-setup-init scans and populates memory files

### Detected Stack
- Language: JavaScript (Node.js 20)
- Framework: Express 4.x
- Database: PostgreSQL 16
- Frontend: Vanilla HTML/CSS/JS (in public/)
- Auth: bcrypt + jsonwebtoken
- Test Framework: Jest + Supertest
- Package Manager: npm

/agile-setup-onboard    → Generates coding rules
/agile-setup-health     → ✅ All checks pass

📋 @po responds:

## /agile-story-create — Story Created

### Story US-001
**As a** new user,
**I want** to register with email and password,
**so that** I can create an account and start managing tasks.

### Acceptance Criteria

**AC-1: Happy path — register with valid credentials**
- **Given** the API is running
- **When** I send POST /auth/register with
  {"email": "alice@example.com", "password": "securepass123"}
- **Then** I receive 201 with user ID and email (no password
  in response)

**AC-2: Edge case — duplicate email**
- **Given** alice@example.com already exists
- **When** I send POST /auth/register with the same email
- **Then** I receive 409 with "email already registered"

**AC-3: Error case — weak password**
- **Given** the API is running
- **When** I send POST /auth/register with
  {"email": "bob@example.com", "password": "123"}
- **Then** I receive 400 with "password must be at least
  8 characters"

### INVEST Check: ✅ All pass
### Estimate: 3 points
> Added to: .memory/backlog/product.md

📋 @po responds:

### Story US-002 (3 pts)
**As a** registered user,
**I want** to log in with my email and password and receive
a JWT token,
**so that** I can authenticate subsequent API requests.

### Acceptance Criteria
- AC-1: Valid login returns 200 + JWT token
- AC-2: Wrong password returns 401 "invalid credentials"
- AC-3: Non-existent email returns 401 "invalid credentials"
  (same message — no email enumeration)

### INVEST Check: ✅ All pass
> Added to: .memory/backlog/product.md

📋 @po responds:

### Story US-003 (13 pts) ⚠️ TOO LARGE
**As a** logged-in user,
**I want** to create, list, update, and delete tasks,
**so that** I can manage my work.

### INVEST Check
| Criterion   | Status |
|-------------|--------|
| Independent | ✅     |
| Negotiable  | ✅     |
| Valuable    | ✅     |
| Estimable   | ✅     |
| Small       | ❌ 13 pts exceeds 8 pt limit |
| Testable    | ✅     |

⚠️ Recommendation: Split this story. 13 points covers
4 distinct operations — too much for one story.

📋 @po responds:

## /agile-story-split — Results

### Original: US-003 (13 pts) — RETIRED

### Split Strategy: workflow-steps
Each sub-story covers one workflow step that delivers
value independently.

---

### US-003a: Create task (3 pts)
**As a** logged-in user,
**I want** to create a new task with title and description,
**so that** I can track work I need to do.

**Acceptance Criteria:**
- AC-1: POST /tasks with valid JWT creates task → 201
- AC-2: Task is linked to authenticated user
- AC-3: Missing title → 400
- AC-4: No JWT → 401

**INVEST Check:**
| I | N | V | E | S | T |
|---|---|---|---|---|---|
| ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |

---

### US-003b: List and filter tasks (2 pts)
**As a** logged-in user,
**I want** to list my tasks and filter by status,
**so that** I can focus on what matters now.

**Acceptance Criteria:**
- AC-1: GET /tasks returns only MY tasks → 200
- AC-2: GET /tasks?status=done filters correctly
- AC-3: No JWT → 401

**INVEST Check:**
| I | N | V | E | S | T |
|---|---|---|---|---|---|
| ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |

---

### US-003c: Update and delete tasks (3 pts)
**As a** logged-in user,
**I want** to update a task's status and delete tasks,
**so that** I can track progress and clean up.

**Acceptance Criteria:**
- AC-1: PUT /tasks/:id updates status → 200
- AC-2: DELETE /tasks/:id removes task → 204
- AC-3: Updating/deleting another user's task → 403
- AC-4: Task not found → 404

**INVEST Check:**
| I | N | V | E | S | T |
|---|---|---|---|---|---|
| ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |

---

### Split Summary
| Story  | Points | Status     |
|--------|--------|------------|
| US-003 | 13     | ❌ Retired |
| US-003a| 3      | ✅ Ready   |
| US-003b| 2      | ✅ Ready   |
| US-003c| 3      | ✅ Ready   |
| Total  | 8      | (was 13)   |

Splitting also refined the estimates — total dropped from
13 to 8 because the uncertainty was in the combined scope.

## /agile-story-estimate — Results

| Story   | Title                 | Points |
|---------|-----------------------|--------|
| US-001  | User registration     | 3      |
| US-002  | Login + JWT           | 3      |
| US-003a | Create task           | 3      |
| US-003b | List and filter tasks | 2      |
| US-003c | Update and delete     | 3      |

**Total backlog**: 14 points

🔄 @sm facilitates:

## Sprint Planning Output

### Sprint 1 Goal
"Deliver user registration, login, and full task CRUD
behind authentication"

### Sprint Backlog
| Story   | Title                 | Points | Priority |
|---------|-----------------------|--------|----------|
| US-001  | User registration     | 3      | P1       |
| US-002  | Login + JWT           | 3      | P1       |
| US-003a | Create task           | 3      | P1       |
| US-003b | List and filter tasks | 2      | P2       |
| US-003c | Update and delete     | 3      | P2       |

### Capacity Check
- Team velocity (first sprint): 14 points (aggressive)
- Committed this sprint: 14 points
- Capacity utilization: 100%

### Risks
- First sprint — no historical velocity
- Auth stories must complete before task stories can
  be tested end-to-end

🗄️ @dba responds:

## Database Schema Design

### Table: users
| Column        | Type          | Constraints                     |
|---------------|---------------|---------------------------------|
| id            | SERIAL        | PRIMARY KEY                     |
| email         | VARCHAR(255)  | UNIQUE, NOT NULL                |
| password_hash | VARCHAR(255)  | NOT NULL                        |
| created_at    | TIMESTAMPTZ   | NOT NULL DEFAULT NOW()          |

### Table: tasks
| Column      | Type          | Constraints                       |
|-------------|---------------|-----------------------------------|
| id          | SERIAL        | PRIMARY KEY                       |
| user_id     | INTEGER       | NOT NULL, FK → users(id) ON DELETE CASCADE |
| title       | VARCHAR(255)  | NOT NULL                          |
| description | TEXT          | NULLABLE                          |
| status      | VARCHAR(20)   | NOT NULL DEFAULT 'pending'        |
|             |               | CHECK (status IN ('pending',      |
|             |               |   'in-progress', 'done'))         |
| created_at  | TIMESTAMPTZ   | NOT NULL DEFAULT NOW()            |

### Indexes
- users(email) — UNIQUE index (implicit from constraint)
- tasks(user_id) — speeds up "list my tasks" queries
- tasks(user_id, status) — composite for filtered queries

### Migration: UP (001_create_users_and_tasks.sql)
CREATE TABLE users (
  id SERIAL PRIMARY KEY,
  email VARCHAR(255) UNIQUE NOT NULL,
  password_hash VARCHAR(255) NOT NULL,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE TABLE tasks (
  id SERIAL PRIMARY KEY,
  user_id INTEGER NOT NULL
    REFERENCES users(id) ON DELETE CASCADE,
  title VARCHAR(255) NOT NULL,
  description TEXT,
  status VARCHAR(20) NOT NULL DEFAULT 'pending'
    CHECK (status IN ('pending','in-progress','done')),
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE INDEX idx_tasks_user_id ON tasks(user_id);
CREATE INDEX idx_tasks_user_status
  ON tasks(user_id, status);

### Migration: DOWN
DROP TABLE IF EXISTS tasks;
DROP TABLE IF EXISTS users;

### Validation
| Check                  | Status |
|------------------------|--------|
| Reversibility (down)   | ✅ Clean drop in correct order    |
| Data types             | ✅ VARCHAR for bounded, TEXT for unbounded |
| Naming conventions     | ✅ snake_case, singular table names |
| Foreign keys           | ✅ ON DELETE CASCADE — tasks removed with user |
| Indexes                | ✅ Covers primary query patterns   |
| Password storage       | ✅ Column is password_hash, not password |

⌨️ @dev: Branch created
- Branch: feature/US-001-user-registration
- From: develop (up to date)
- Linked to: US-001

👨‍💻 @lead: Implementation Plan for US-001

Phase 1: Run migration
- Execute 001_create_users_and_tasks.sql

Phase 2: Auth middleware
- JWT verification middleware for protected routes

Phase 3: Registration endpoint
- POST /auth/register route
- Hash password with bcrypt (cost 12)
- Check email uniqueness (handle DB constraint error)
- Return 201 with user ID + email (never return hash)

Phase 4: Validation
- Email format validation
- Password length check (min 8)
- Return 400 with specific error messages

Confidence: 9/10

🔴 RED — Write failing test for AC-1

// test/auth.test.js
test('POST /auth/register creates user', async () => {
  const res = await request(app)
    .post('/auth/register')
    .send({ email: 'alice@example.com',
            password: 'securepass123' });

  expect(res.status).toBe(201);
  expect(res.body).toHaveProperty('id');
  expect(res.body.email).toBe('alice@example.com');
  expect(res.body).not.toHaveProperty('password');
  expect(res.body).not.toHaveProperty('password_hash');
});

// Result: ❌ FAIL — route doesn't exist yet

🟢 GREEN — Write minimum code to pass

// src/routes/auth.js
router.post('/register', async (req, res) => {
  const { email, password } = req.body;
  const hash = await bcrypt.hash(password, 12);
  const result = await db.query(
    'INSERT INTO users (email, password_hash) VALUES ($1, $2) RETURNING id, email',
    [email, hash]
  );
  res.status(201).json(result.rows[0]);
});

// Result: ✅ PASS

🔵 REFACTOR — Extract to service layer

// Extract bcrypt + DB logic to UserService
// Tests still pass ✅

/agile-code-ci           → ✅ All green (8/8 tests pass)
/agile-code-commit       → feat(auth): add user registration endpoint
/agile-code-pr           → PR created
/agile-code-pr-review    → ✅ Approved (Score: 9/10)
  (🔵 S3: consider adding email format validation with regex)
/agile-code-merge        → Squash merged to develop
/agile-story-dod         → ✅ DONE (coverage 91%)
/agile-story-accept      → ✅ ACCEPTED (3 points)

US-002: Login + JWT (3 pts)

/agile-code-branch feature US-002 login-jwt
/agile-story-plan US-002
/agile-code-tdd US-002
  🔴 Test: POST /auth/login with valid creds → 200 + token → ❌
  🟢 Implement: compare bcrypt hash, sign JWT → ✅
  🔴 Test: Wrong password → 401 "invalid credentials" → ❌
  🟢 Add check → ✅
  🔴 Test: Non-existent email → 401 (same message) → ❌
  🟢 Add check (no email enumeration) → ✅
/agile-code-ci           → ✅ All green (14/14 tests)
/agile-code-commit       → feat(auth): add login endpoint with JWT
/agile-code-pr           → PR created
/agile-code-pr-review    → ✅ Approved (Score: 8/10)
  (🟡 S2: JWT secret should come from env var, not hardcoded)
/agile-code-merge        → Squash merged to develop
/agile-story-dod         → ✅ DONE
/agile-story-accept      → ✅ ACCEPTED (3 points)

US-003a: Create task (3 pts)

/agile-code-branch feature US-003a create-task
/agile-story-plan US-003a
/agile-code-tdd US-003a
  🔴 Test: POST /tasks with JWT creates task → ❌
  🟢 Implement route + JWT middleware → ✅
  🔴 Test: Task linked to authenticated user → ❌
  🟢 Extract user_id from JWT payload → ✅
  🔴 Test: No JWT → 401 → ❌
  🟢 Auth middleware rejects → ✅

🗄️ @dba reviews the task creation query:

🗄️ @dba: Query Review
  ✅ Parameterized query ($1, $2, $3) — no SQL injection
  ✅ user_id from JWT, not from request body
  ✅ RETURNING clause avoids extra SELECT

/agile-code-ci           → ✅ All green (20/20 tests)
/agile-code-commit       → feat(tasks): add create task endpoint
/agile-code-pr           → PR created
/agile-code-pr-review    → ✅ Approved
/agile-code-merge        → Squash merged to develop
/agile-story-dod         → ✅ DONE
/agile-story-accept      → ✅ ACCEPTED (3 points)

US-003b: List and filter tasks (2 pts)

/agile-code-branch feature US-003b list-filter-tasks
/agile-story-plan US-003b
/agile-code-tdd US-003b
  🔴 Test: GET /tasks returns only MY tasks → ❌
  🟢 WHERE user_id = $1 → ✅
  🔴 Test: GET /tasks?status=done filters → ❌
  🟢 Add optional WHERE clause → ✅
/agile-code-ci           → ✅ All green
/agile-code-commit       → feat(tasks): add list and filter endpoints
/agile-code-pr           → PR created
/agile-code-pr-review    → ✅ Approved
/agile-code-merge        → Squash merged to develop
/agile-story-dod         → ✅ DONE
/agile-story-accept      → ✅ ACCEPTED (2 points)

US-003c: Update and delete tasks (3 pts)

/agile-code-branch feature US-003c update-delete-tasks
/agile-story-plan US-003c
/agile-code-tdd US-003c
  🔴 Test: PUT /tasks/:id updates status → ❌
  🟢 Implement update handler → ✅
  🔴 Test: DELETE /tasks/:id removes task → ❌
  🟢 Implement delete handler → ✅
  🔴 Test: Update another user's task → 403 → ❌
  🟢 Add ownership check → ✅
  🔴 Test: Task not found → 404 → ❌
  🟢 Add not-found check → ✅
/agile-code-ci           → ✅ All green (32/32 tests)
/agile-code-commit       → feat(tasks): add update and delete endpoints
/agile-code-pr           → PR created
/agile-code-pr-review    → ✅ Approved
  (🟡 S2: extract ownership check to reusable middleware)
/agile-code-merge        → Squash merged to develop
/agile-story-dod         → ✅ DONE
/agile-story-accept      → ✅ ACCEPTED (3 points)

🔄 @sm: Daily Standup — Sprint 1, Day 3

### Progress
- ✅ US-001 (Registration) — ACCEPTED
- ✅ US-002 (Login + JWT) — ACCEPTED
- 🔄 US-003a (Create task) — IN PROGRESS (TDD phase)
- 📋 US-003b (List/filter) — TODO
- 📋 US-003c (Update/delete) — TODO

### Burndown
Day 1: 14 pts remaining
Day 2: 8 pts remaining (US-001 + US-002 done)
Day 3: 5 pts remaining (US-003a almost done)

### Blockers: None

🔄 @sm responds:

## /agile-sprint-status — Sprint 1 Dashboard

### Sprint Health
| Metric            | Value          | Status |
|-------------------|----------------|--------|
| Sprint Goal       | Auth + CRUD API| 🟢     |
| Days Elapsed      | 3 / 5         |        |
| Points Completed  | 9 / 14        | 🟢     |
| Points Remaining  | 5              |        |
| Stories Done       | 3 / 5         |        |
| Burndown Trend    | On track       | 🟢     |

### Story Status
| Story   | Title              | Pts | Status      |
|---------|--------------------|-----|-------------|
| US-001  | Registration       | 3   | ✅ Accepted  |
| US-002  | Login + JWT        | 3   | ✅ Accepted  |
| US-003a | Create task        | 3   | ✅ Accepted  |
| US-003b | List/filter tasks  | 2   | 🔄 In Progress |
| US-003c | Update/delete      | 3   | 📋 Todo      |

### Risks
- None — on track to complete all stories

## Sprint 1 Review

### Sprint Goal: "Auth + Task CRUD API"
### Sprint Goal Met: ✅ Yes

| Story   | Title              | Pts | Status      |
|---------|--------------------|-----|-------------|
| US-001  | Registration       | 3   | ✅ Accepted  |
| US-002  | Login + JWT        | 3   | ✅ Accepted  |
| US-003a | Create task        | 3   | ✅ Accepted  |
| US-003b | List/filter tasks  | 2   | ✅ Accepted  |
| US-003c | Update/delete      | 3   | ✅ Accepted  |

### Velocity
- Committed: 14 points
- Completed: 14 points (100%)
- First sprint — this becomes the baseline

### Demo Summary (⌨️ @dev)
- Registration: POST /auth/register → 201
- Login: POST /auth/login → 200 + JWT
- Create task: POST /tasks (with JWT) → 201
- List tasks: GET /tasks?status=pending → 200
- Update: PUT /tasks/1 → 200
- Delete: DELETE /tasks/1 → 204
- All endpoints require auth except register/login

## Sprint 1 Retrospective

### What Went Well
- Story splitting reduced US-003 from 13 to 8 pts
- @dba schema design prevented migration issues
- TDD caught the email enumeration issue early (US-002)

### What To Improve
- No frontend yet — users can't interact without curl
- JWT secret was hardcoded (caught in PR review)
- No security review done yet

### Action Items
| Action                        | Owner  | Due       |
|-------------------------------|--------|-----------|
| Move JWT secret to env var    | @dev   | Sprint 2  |
| Build frontend                | @dev   | Sprint 2  |
| Security review before ship   | @sec   | Sprint 2  |

🔄 @sm: Learnings captured
  → Saved to: .memory/episodic/learnings.md
  - Sprint 1 velocity: 14 points
  - Story splitting effectiveness: 13 pts → 8 pts (3 stories)
  - @dba schema-first approach saved rework
  - Action items tracked for Sprint 2

📋 @po + 👨‍💻 @lead + 🏗️ @arch respond:

## /agile-sprint-refine — Refinement Session

### 📋 @po presents upcoming stories:
Three stories are candidates for Sprint 2:
1. Auth UI (login + registration forms)
2. Task dashboard (list, filter, create, edit, delete)
3. Security review (auth, data handling, dependencies)

### 👨‍💻 @lead assesses feasibility:
| Story      | Feasibility | Concerns                     |
|------------|-------------|------------------------------|
| Auth UI    | 🟢 High     | Straightforward forms        |
| Dashboard  | 🟢 High     | More complex but well-scoped |
| Security   | 🟢 High     | Review + fix, not new code   |

### 🏗️ @arch checks architecture impact:
- Auth UI: No backend changes — consumes existing API
- Dashboard: No backend changes — consumes existing API
- Security: May require backend fixes (depends on
  findings)
- Frontend files go in public/ — no build step needed

### Refinement Outcome
| Story      | Previous Status | New Status  |
|------------|-----------------|-------------|
| Auth UI    | Unrefined       | ✅ Ready    |
| Dashboard  | Unrefined       | ✅ Ready    |
| Security   | Unrefined       | ✅ Ready    |

All 3 stories are Ready for Sprint 2 planning.

📋 @po: Story US-004 created (5 pts)
**As a** user,
**I want** a login and registration page that is accessible
and works on mobile,
**so that** I can use the app from any device.

Acceptance Criteria:
- AC-1: Registration form with email, password, confirm password
- AC-2: Login form with email, password
- AC-3: Form validation with visible error messages
- AC-4: WCAG AA compliant (contrast, labels, focus)
- AC-5: Works on screens 320px and above

📋 @po: Story US-005 created (5 pts)
**As a** logged-in user,
**I want** a task dashboard where I can see, filter, create,
edit, and delete tasks,
**so that** I can manage my work visually.

Acceptance Criteria:
- AC-1: Dashboard shows all user's tasks
- AC-2: Filter dropdown for status (all, pending, in-progress, done)
- AC-3: "New Task" button opens create form
- AC-4: Edit button on each task
- AC-5: Delete button with confirmation
- AC-6: Responsive layout (mobile → desktop)

📋 @po: Story US-006 created (3 pts)
**As a** product owner,
**I want** a security review of auth, data handling, and
dependencies,
**so that** we can ship with confidence.

Acceptance Criteria:
- AC-1: Dependency scan — no critical CVEs
- AC-2: Auth code reviewed — no credential leaks
- AC-3: All S0/S1 findings fixed and re-verified

🔄 @sm facilitates:

## Sprint 2 Planning

### Sprint 2 Goal
"Deliver usable frontend with auth UI, task dashboard,
and pass security review"

### Sprint Backlog
| Story  | Title              | Pts | Priority |
|--------|--------------------|-----|----------|
| US-004 | Auth UI            | 5   | P1       |
| US-005 | Task dashboard     | 5   | P1       |
| US-006 | Security review    | 3   | P1       |

### Capacity Check
- Historical velocity (Sprint 1): 14 points
- Committed this sprint: 13 points
- Capacity utilization: 93%
- Buffer for security fixes: ✅ Available

⌨️ @dev: Branch created
- Branch: feature/US-004-auth-ui
- From: develop (up to date)
- Linked to: US-004

👨‍💻 @lead + 🎨 @ux: Implementation Plan for US-004

Phase 1: HTML structure
- Semantic HTML: form, fieldset, label, input
- Registration form + login form (two pages or tabs)

Phase 2: CSS styling
- Mobile-first responsive design
- WCAG AA color contrast (4.5:1 minimum)
- Focus-visible styles for keyboard nav

Phase 3: JavaScript
- Form validation with aria-describedby for errors
- Fetch API calls to /auth/register and /auth/login
- Store JWT in memory (not localStorage — XSS risk)
- Redirect to dashboard on success

Phase 4: Accessibility
- All inputs have associated labels
- Error messages linked with aria-describedby
- Focus management on form submission errors

Confidence: 8/10

🎨 @ux: Accessibility Review — US-004

## Accessibility Audit Report

### WCAG AA Compliance Checklist
| #  | Criterion                  | Status | Detail                          |
|----|----------------------------|--------|---------------------------------|
| 1  | Color contrast (text)      | ✅     | 7.2:1 ratio (exceeds 4.5:1)    |
| 2  | Color contrast (UI)        | ✅     | 4.8:1 ratio (exceeds 3:1)      |
| 3  | Keyboard navigation        | ✅     | Tab order: email → password →   |
|    |                            |        | confirm → submit. Logical flow. |
| 4  | Focus indicator visible    | ✅     | 3px solid outline on :focus-    |
|    |                            |        | visible                         |
| 5  | Screen reader              | ✅     | All inputs have <label for="">  |
|    |                            |        | Error messages use aria-        |
|    |                            |        | describedby + role="alert"      |
| 6  | Semantic HTML              | ✅     | <form>, <fieldset>, <legend>,   |
|    |                            |        | <label>, <button type="submit"> |
| 7  | Form labels                | ✅     | Every input has explicit label  |
| 8  | Error messages             | ✅     | Inline, visible, linked to     |
|    |                            |        | input via aria-describedby      |
| 9  | Focus management           | ✅     | On error: focus moves to first |
|    |                            |        | invalid field                   |
| 10 | No reliance on color alone | ✅     | Errors use icon + text + color  |

### Responsive Verification
| Breakpoint | Layout         | Status |
|------------|----------------|--------|
| 320px      | Single column  | ✅     |
| 768px      | Single column  | ✅     |
| 1024px     | Centered card  | ✅     |
| 1280px     | Centered card  | ✅     |
| 1920px     | Centered card  | ✅     |

### Overall Score: 10/10 — WCAG AA Compliant
No accessibility issues found.

/agile-code-ci           → ✅ All green
/agile-code-commit       → feat(ui): add accessible auth pages
/agile-code-pr           → PR created
/agile-code-pr-review    → ✅ Approved (Score: 9/10)
  👨‍💻 @lead: Clean semantic HTML, good separation
  🎨 @ux: Accessibility checklist passed
/agile-code-merge        → Squash merged to develop
/agile-story-dod         → ✅ DONE
/agile-story-accept      → ✅ ACCEPTED (5 points)

US-005: Task Dashboard (5 pts)

/agile-code-branch feature US-005 task-dashboard
/agile-story-plan US-005
/agile-code-tdd US-005
  🔴 Test: Dashboard renders task list → ❌
  🟢 Implement fetch + render → ✅
  🔴 Test: Filter dropdown filters tasks → ❌
  🟢 Add filter logic → ✅
  🔴 Test: Create task form submits → ❌
  🟢 Add create form + API call → ✅
  🔴 Test: Delete button removes task → ❌
  🟢 Add delete with confirmation → ✅

🎨 @ux: Accessibility Review — US-005

### WCAG AA Compliance Checklist
| Criterion              | Status | Detail                        |
|------------------------|--------|-------------------------------|
| Color contrast         | ✅     | All text meets 4.5:1          |
| Keyboard navigation    | ✅     | Tab through tasks, filter,    |
|                        |        | action buttons                |
| Screen reader          | ✅     | Task list uses role="list",   |
|                        |        | status changes announced      |
|                        |        | via aria-live="polite"        |
| Delete confirmation    | ✅     | Dialog uses role="alertdialog"|
|                        |        | focus trapped inside          |
| Filter dropdown        | ✅     | <select> with <label>         |

### Responsive Verification
| 320px | 768px | 1024px | 1280px | 1920px |
|-------|-------|--------|--------|--------|
| ✅    | ✅    | ✅     | ✅     | ✅     |

Score: 10/10 — Accessible

/agile-code-ci           → ✅ All green
/agile-code-commit       → feat(ui): add task dashboard with filters
/agile-code-pr           → PR created
/agile-code-pr-review    → ✅ Approved
/agile-code-merge        → Squash merged to develop
/agile-story-dod         → ✅ DONE
/agile-story-accept      → ✅ ACCEPTED (5 points)

⌨️ @dev: Branch created
- Branch: feature/US-006-security-review
- From: develop (up to date)
- Linked to: US-006

🛡️ @sec responds:

## /agile-security-scan — Dependency Audit

### Scan Summary
- Packages scanned: 147
- Direct dependencies: 12
- Transitive dependencies: 135

### Findings
| #  | Package        | Severity | CVE            | Finding                    | Fix                   |
|----|----------------|----------|----------------|----------------------------|-----------------------|
| 1  | lodash@4.17.20 | 🔴 HIGH  | CVE-2021-23337 | Prototype pollution via    | Upgrade to ≥4.17.21  |
|    |                |          |                | template function          |                       |
| 2  | express@4.18.1 | 🟡 MED   | CVE-2024-29041 | Path traversal in static   | Upgrade to ≥4.19.2   |
|    |                |          |                | file serving               |                       |

### Recommended Actions
1. npm audit fix (resolves both)
2. Add npm audit to CI pipeline
3. Pin major versions in package.json

### Post-Fix Verification
After fix: 0 vulnerabilities found ✅

🛡️ @sec responds:

## /agile-security-review — Code Audit

### Scope
Files reviewed: src/routes/auth.js, src/middleware/jwt.js,
src/services/UserService.js, public/js/auth.js

### Findings

| #  | Severity | File                    | Line | Finding                                | Recommendation                           |
|----|----------|-------------------------|------|----------------------------------------|------------------------------------------|
| 1  | 🔴 S0    | src/routes/auth.js      | 14   | Password stored as plain text in        | MUST use bcrypt.hash() before INSERT.    |
|    |          |                         |      | development seed script                 | Remove seed script or hash seed          |
|    |          |                         |      |                                        | passwords.                               |
| 2  | 🟡 S2    | src/routes/auth.js      | 28   | No rate limiting on POST /auth/login   | Add express-rate-limit: max 5            |
|    |          |                         |      |                                        | attempts per 15 minutes per IP.          |
| 3  | 🟡 S2    | src/middleware/jwt.js    | 7    | JWT expiry set to 30 days              | Reduce to 1 hour with refresh token,     |
|    |          |                         |      |                                        | or 24 hours without.                     |
| 4  | 🔵 S3    | public/js/auth.js       | 22   | JWT stored in localStorage             | Store in httpOnly cookie or memory       |
|    |          |                         |      |                                        | only. localStorage is XSS-accessible.   |

### Severity Summary
| Severity | Count | Action Required          |
|----------|-------|--------------------------|
| 🔴 S0   | 1     | MUST fix before release  |
| 🟡 S2   | 2     | SHOULD fix this sprint   |
| 🔵 S3   | 1     | COULD fix (improvement)  |

### Verdict: ❌ BLOCKED — 1 S0 finding must be resolved

⌨️ @dev fixes with TDD:
  🔴 Test: seed users have bcrypt-hashed passwords → ❌
  🟢 Update seed script to use bcrypt.hash() → ✅
  🔴 Test: seed users can log in → ❌
  🟢 Verify login works with hashed seed passwords → ✅

Also fixes S2 findings:
  - Added express-rate-limit to login endpoint
  - Reduced JWT expiry to 24 hours

🛡️ @sec: Re-review Results

| # | Previous Finding         | Status           |
|---|--------------------------|------------------|
| 1 | 🔴 S0: Plain text passwords | ✅ FIXED — bcrypt |
| 2 | 🟡 S2: No rate limiting     | ✅ FIXED — 5/15min|
| 3 | 🟡 S2: JWT 30-day expiry    | ✅ FIXED — 24 hrs |
| 4 | 🔵 S3: localStorage JWT     | ⏳ Deferred      |

### Verdict: ✅ PASSED — No S0/S1 findings remain
S3 finding accepted as known risk for v1.0.0.

/agile-code-ci           → ✅ All green
/agile-code-commit       → fix(security): hash seed passwords,
                           add rate limiting, reduce JWT expiry
/agile-code-pr           → PR created
/agile-code-pr-review    → ✅ Approved
  🛡️ @sec: Security review passed
  👨‍💻 @lead: Code quality good
/agile-code-merge        → Squash merged to develop
/agile-story-dod         → ✅ DONE
/agile-story-accept      → ✅ ACCEPTED (3 points)

🔄 @sm: Sprint 2 Dashboard
- Sprint Goal Met: ✅ Yes
- Points Completed: 13/13 (100%)
- All 3 stories accepted

## Sprint 2 Review

### Sprint Goal: "Frontend + Security Review"
### Sprint Goal Met: ✅ Yes

| Story  | Title              | Pts | Status      |
|--------|--------------------|-----|-------------|
| US-004 | Auth UI            | 5   | ✅ Accepted  |
| US-005 | Task dashboard     | 5   | ✅ Accepted  |
| US-006 | Security review    | 3   | ✅ Accepted  |

### Velocity
- Sprint 1: 14 points
- Sprint 2: 13 points
- Average: 13.5 points/sprint

## Sprint 2 Retrospective

### What Went Well
- @ux caught accessibility issues during planning (not after)
- @sec found the plain text password flaw before release
- Story refinement made Sprint 2 planning fast

### What To Improve
- Should run /agile-security-scan earlier (Sprint 1)
- localStorage JWT deferred — needs follow-up

### Action Items
| Action                          | Owner | Due     |
|---------------------------------|-------|---------|
| Move JWT to httpOnly cookie     | @dev  | v1.1.0  |
| Add /agile-security-scan to CI  | @devops| v1.1.0 |

🔄 @sm: Learnings captured
  → Saved to: .memory/episodic/learnings.md
  - Sprint 2 velocity: 13 points
  - @sec caught S0 flaw — validates security review step
  - @ux accessibility-first approach works better than
    retrofitting
  - Average velocity: 13.5 pts/sprint

## Changelog: v1.0.0 — 2026-04-04

### Added
- POST /auth/register — user registration with
  validation (US-001)
- POST /auth/login — JWT authentication (US-002)
- POST /tasks — create task (US-003a)
- GET /tasks — list tasks with status filter (US-003b)
- PUT /tasks/:id — update task status (US-003c)
- DELETE /tasks/:id — delete task (US-003c)
- Login and registration UI — accessible, responsive
  (US-004)
- Task dashboard UI — filter, create, edit, delete
  (US-005)

### Security
- Dependency audit — 0 vulnerabilities (US-006)
- Password hashing with bcrypt (cost 12)
- Rate limiting on login endpoint (5/15min)
- JWT expiry reduced to 24 hours

🚀 @devops: Release v1.0.0
  Branch: release/v1.0.0 from develop
  CI: ✅ Green (all 48 tests pass)
  Merged to main ✅
  Tagged: v1.0.0 ✅
  Back-merged to develop ✅

🚀 @devops: Deployed v1.0.0
  Database migration: ✅ Applied
  API health check: ✅ /health → 200
  Frontend served: ✅ Static files at /
  Smoke tests: ✅ Register → Login → Create task → List → Done