# INVEETAIRE
## SPRINT 2 PROMPT LIBRARY

| Field | Value |
|-------|-------|
| Document Type | Prompt Library |
| Sprint | Sprint 2 — Authentication & Authorization |
| Version | 1.0 (Final) |
| Status | Active |
| Based On | AI.md v1.1 · AI_DEVELOPMENT_SYSTEM.md v1.0 · SPRINT2_PLANNING.md · SPRINT2_EXECUTION_GUIDE.md |

---

## 1. Reusable Prompt Templates

This section contains the official templates to be copied and completed for each operational phase in Sprint 2.

---

### Template 1: Pre-Implementation Prompt
This template is used by the Human Approver to request verification of the workspace state before code changes begin.

```markdown
# TASK: SPRINT 2 PRE-IMPLEMENTATION CHECKPOINT

You are an AI developer preparing to implement a task in Sprint 2 of Inveetaire. Before writing any code, modifying any files, or creating new resources, you must verify the state of the repository.

## 1. Mandatory Reading
Please read and understand the following documents:
- AI.md v1.1 (Governance)
- AI_DEVELOPMENT_SYSTEM.md (AI Guidelines)
- WORKFLOW.md (Development process)
- SPRINT2_PLANNING.md (Sprint plan)
- SPRINT2_EXECUTION_GUIDE.md (Execution rules)

## 2. Verification Tasks
Verify the following and report findings in detail:
1. **Working Tree Cleanliness:** Is `git status` completely clean?
2. **Prerequisites Verification:** 
   - Are the database tables (`users`, `roles`, `sessions`) migrated and present in MariaDB?
   - Are the environment keys (`SESSION_TIMEOUT_*`, `SESSION_INACTIVITY_TIMEOUT`) populated in the `.env` file?
3. **Previous Tasks:** Are all Sprint 1 tasks committed and merged? Are there any uncommitted files in `app/core/`?
4. **Tooling Check:** Is the Tailwind CLI and compile engine functioning?

## 3. Output
Provide a Pre-Implementation Report outlining the status of the checklist.
**Do NOT modify any code. Do NOT create implementation prompts. Wait for approval.**
```

---

### Template 2: Task Implementation Prompt
This template is used to initiate the implementation of a single task (e.g., `AUTH-001`). Copy this template and populate the bracketed values.

```markdown
# TASK IMPLEMENTATION: [TASK_ID] — [TASK_TITLE]

You are an AI coding assistant. You must execute exactly one task in Sprint 2 of Inveetaire. Do not proceed to any other task after this is finished.

## 1. Mandatory Reading
Read the following prior to implementation:
- AI.md v1.1
- SPRINT2_PLANNING.md
- SPRINT2_EXECUTION_GUIDE.md
- `.ai/memory/` files of parent tasks

## 2. Dependency Review
* **Prerequisites:** All parent tasks of [TASK_ID] (specifically [PREREQUISITE_TASKS]) must be committed.
* **Kernel State:** The core classes in `app/core/` are frozen and must not be altered (except where explicitly allowed by `Session.php` in AUTH-004).

## 3. Scope of Work
[DETAILED_SCOPE_OF_THE_TASK]

## 4. Implementation Rules
1. **One Task Only:** Implement only the scope in this prompt. No automatic continuation.
2. **File Boundaries:** Do not create or edit any files outside of the "Files Expected" and "Files Modified" lists.
3. **Strict Syntax:** Execute `php -l` on every new and modified file to verify syntax before finishing.
4. **Git Lock:** Do not run `git commit`, `git add`, or `git push`.
5. **No Placeholders:** All code must be complete. Do not leave "TODO" blocks or stubs.

## 5. File Inventory
* **Files Expected [NEW]:**
  [LIST_OF_NEW_FILES]
* **Files Modified:**
  [LIST_OF_MODIFIED_FILES]

## 6. Acceptance Criteria
[LIST_OF_ACCEPTANCE_CRITERIA_FROM_PLANNING]

## 7. Security Checklist
Verify that:
* [ ] Sensitive passwords are never logged or stored in plain text.
* [ ] Inputs are sanitized and output is wrapped in `escape_html()`.
* [ ] Session IDs are regenerated via `Session::regenerate(true)` on login.
* [ ] CSRF validation guards are active on all POST requests.
* [ ] Exceptions do not leak database connection details.

## 8. Output Requirements
Provide a report summarizing:
1. Files created and modified.
2. Acceptance criteria results.
3. Errors caught and resolved.
4. Confirmation that syntax check passed.
**Do NOT begin the next task. Wait for Human Approval.**
```

---

### Template 3: Implementation Review Prompt
This template is used to review a completed task's implementation.

```markdown
# TASK REVIEW: [TASK_ID]

You are a security and code quality reviewer. Perform a static review of the implementation files created or modified for [TASK_ID].

## 1. Reference Documents
- SPRINT2_PLANNING.md
- SPRINT2_EXECUTION_GUIDE.md
- Implementation files for [TASK_ID]

## 2. Review Checklist
Verify the following points:
1. **Scope Limit:** Were any files modified or created outside the approved task files?
2. **Acceptance Criteria:** Does the code fulfill all specific acceptance criteria of [TASK_ID]?
3. **Security Constraints:** 
   - Is output HTML properly escaped with `escape_html()`?
   - Are bcrypt hashes verified with `password_verify`?
   - Is CSRF middleware linked on POST paths?
4. **PHP Syntax:** Run syntax validation check.
5. **Architectural Deviations:** Are there any deviations from the Development Blueprint (DBP)?

## 3. Output
Produce the **Official Implementation Report** listing verification statuses, syntax validation outcome, security checks, and a recommendation to **Approve & Commit** or **Reject**.
```

---

### Template 4: Architecture Review Prompt
This template is executed at the end of Sprint 2 to evaluate architectural validity before planning Sprint 3.

```markdown
# ARCHITECTURE REVIEW: SPRINT 2

You are a Principal Architect. Review the complete implementation of Sprint 2 (Authentication & Authorization).

## 1. Objective
Assess the architectural integrity of Inveetaire after the completion of all Sprint 2 tasks (`AUTH-001` through `AUTH-004`).

## 2. Verification Criteria
Analyze the workspace and verify:
1. **Kernel Immutability:** Confirm that no files under `app/core/` were modified, with the exception of the approved timeout additions in `Session.php`.
2. **Database Integrity:** Confirm that the MariaDB schema matches PDD v1.0 exactly and that no migrations modified tables without a registered ADR.
3. **Module Isolation:** Confirm that module communication follows services and not direct model calls.
4. **Security Compliance:** Assess session boundaries, cookie flags, and CSRF coverage.

## 3. Evaluation Output
Produce the **Sprint 2 Architecture Review**. Your report must determine objectively:
- Whether the architecture remains valid.
- Whether the governance remains valid.
- Whether a Design Revision Pack (DRP) is required.
**Do not automatically assume a DRP is necessary unless a structural deviation is discovered.**
```

---

### Template 5: Planning Review Prompt
This template is a reusable editorial review tool for future sprint planning documents.

```markdown
# EDITORIAL REVIEW: [SPRINT_NAME] PLANNING DOCUMENT

You are an editor. Perform an editorial and consistency review of the draft planning document: [PLANNING_DOCUMENT_PATH].

## 1. Verification Checklist
Verify and correct:
1. **Route Name Consistency:** Ensure endpoints consistently use public vs portal patterns (e.g. `/login` vs `/app/login`).
2. **File References:** Check that all files listed under "Modified" actually exist in the current repository. Document any missing files or directories.
3. **Formatting & Numbering:** Verify section numbering, task numbering, and cross-references.
4. **Grammar & Terminology:** Ensure clean, professional terminology matches the Project Glossary and ADR.

## 2. Output
Provide:
1. Summary of editorial improvements.
2. Inconsistencies or non-existent files discovered.
3. Final status confirmation (e.g. Ready for Execution Guide).
```

---

### Template 6: Execution Guide Review Prompt
This template is a reusable editorial review tool for future execution guides.

```markdown
# EDITORIAL REVIEW: [SPRINT_NAME] EXECUTION GUIDE

You are an editor. Perform an editorial review of the draft execution guide: [EXECUTION_GUIDE_PATH].

## 1. Verification Checklist
Verify and correct:
1. **Rule Adherence:** Ensure the guide inherits governance rules from AI.md and does not create conflicting directives.
2. **Step Synchronization:** Ensure task steps match the approved dependencies and execution sequences from the corresponding Planning Document.
3. **Security Standards:** Confirm the guide lists concrete verification steps for the sprint's specific security rules (e.g., sanitization, encryption).
4. **Style Alignment:** Ensure style, tables, and workflow flowcharts match previous execution guide formats.

## 2. Output
Provide a summary of corrected inconsistencies and confirm whether the guide is ready for release.
```

---

### Template 7: Document Synchronization Prompt
This template is used when an approved Design Revision Pack (DRP) needs to be merged back into the core documentation files.

```markdown
# DOCUMENT SYNCHRONIZATION: [DRP_VERSION]

You are a technical writer. Update the core project documentation to incorporate the architectural changes approved in [DRP_FILE_PATH].

## 1. Scope of Work
Update the following documents to align with the changes in the DRP:
- `docs/ai/AI.md`
- `docs/02-architecture/DBP_v1.1.md`
- `docs/02-architecture/MASTER_IMPLEMENTATION_BACKLOG_v1.1.md`
- `docs/ai/WORKFLOW.md`
- `docs/PROJECT.md`

## 2. Rules
1. **Strict Copy:** Copy only the specific text blocks approved in the DRP.
2. **No Extrapolation:** Do not invent secondary changes or update other files without explicit human authorization.
3. **Changelog Update:** Add the DRP reference details to the revision history of each modified document.

## 3. Output
Provide a summary of the lines and files synchronized, along with a diff of the edits.
```

---

## 2. Prompt Implementation Workflow

Every prompt in this library must enforce the following developer rules:
1. **One Task Only:** The implementing agent works on one task per session. Automatic transitions between tasks are strictly disabled.
2. **Prerequisites Committed:** A task cannot start until all prerequisites are committed and pushed by the Human developer.
3. **Files Expected Boundaries:** The agent must only edit/create files explicitly defined within the task boundary.
4. **Git Operations Prohibited:** Git commands (`git add`, `git commit`, `git push`) must only be executed by the Human Developer, never the AI agent.
5. **No Placeholders:** AI agents must write complete, functional code without using `// TODO` or code placeholders.