# INVEETAIRE
## SPRINT 3 PROMPT LIBRARY

| Field | Value |
|-------|-------|
| Document Type | Prompt Library |
| Sprint | Sprint 3 — Workspace Module & Tenant Isolation |
| Version | 1.0 (Final) |
| Status | Active |
| Based On | AI.md v1.1 · AI_DEVELOPMENT_SYSTEM.md v1.0 · WORKFLOW.md · SPRINT3_PLANNING.md · SPRINT3_EXECUTION_GUIDE.md |

---

## 1. Reusable Prompt Templates

This section contains the official templates to be copied and completed for each operational phase in Sprint 3.

---

### Template 1: Pre-Implementation Prompt
*This template is used by the Human Approver to request verification of the workspace state before code changes begin.*

```markdown
# TASK: SPRINT 3 PRE-IMPLEMENTATION CHECKPOINT

You are an AI developer preparing to implement a task in Sprint 3 of Inveetaire. Before writing any code, modifying any files, or creating new resources, you must verify the state of the repository.

## 1. Mandatory Reading
Please read and understand the following documents:
- AI.md v1.1 (Governance)
- AI_DEVELOPMENT_SYSTEM.md (AI Guidelines)
- WORKFLOW.md (Development process)
- SPRINT3_PLANNING.md (Sprint plan)
- SPRINT3_EXECUTION_GUIDE.md (Execution rules)

## 2. Verification Tasks
Verify the following and report findings in detail:
1. **Working Tree Cleanliness:** Is `git status` completely clean?
2. **Prerequisites Verification:** 
   - Are the parent commits of all previous sprints fully merged?
   - Are the database tables (e.g. workspaces, users, sessions) migrated and present in MariaDB?
3. **Workspace Boundary & Tenancy Assumptions:** Confirm no cross-workspace access or assumptions exist.
4. **Frozen Kernel & Utilities:** Ensure all files in `app/core/` are untouched and verified frozen.
5. **Expected Files Mapping:** Confirm the target file inventory for the upcoming task aligns exactly with the planning document.

## 3. Output
Provide a Pre-Implementation Report outlining the status of the checklist.
**Do NOT modify any code. Do NOT create implementation prompts. Wait for approval.**
```

---

### Template 2: Workspace Implementation Prompt
*This template is used to initiate the implementation of a single task (e.g., WorkspaceMiddleware, WS-001, WS-002, WS-003). Copy this template and populate the bracketed values.*

```markdown
# TASK IMPLEMENTATION: [TASK_ID] — [TASK_TITLE]

You are an AI coding assistant. You must execute exactly one task in Sprint 3 of Inveetaire. Do not proceed to any other task after this is finished.

## 1. Mandatory Reading
Read the following prior to implementation:
- AI.md v1.1
- SPRINT3_PLANNING.md
- SPRINT3_EXECUTION_GUIDE.md
- Implementation memories of parent tasks under `docs/ai/memory/`

## 2. Dependency Review
* **Prerequisites:** All parent tasks of [TASK_ID] (specifically [PREREQUISITE_TASKS]) must be committed.
* **Kernel State:** The core classes in `app/core/` and the framework kernel are frozen and must not be altered.

## 3. Scope of Work
[DETAILED_SCOPE_OF_THE_TASK]

## 4. Implementation Rules
1. **One Task Only:** Implement only the scope in this prompt. No automatic continuation.
2. **File Boundaries:** Do not create or edit any files outside of the "Files Expected" and "Files Modified" lists.
3. **Strict Syntax:** Execute `php -l` on every new and modified file to verify syntax before finishing.
4. **Git Lock:** Do not run `git commit`, `git add`, or `git push`.
5. **No Placeholders:** All code must be complete. Do not leave "TODO" blocks or stubs.

## 5. File Inventory
* **Files Expected [NEW]:**
  [LIST_OF_NEW_FILES]
* **Files Modified:**
  [LIST_OF_MODIFIED_FILES]

## 6. Acceptance Criteria
[LIST_OF_ACCEPTANCE_CRITERIA_FROM_PLANNING]

## 7. Security Checklist
Verify that:
* [ ] **CSP:** Active CSP header is defined inside `public/.htaccess`.
* [ ] **Rate Limiting:** IP/email lockout limits active on `/forgot-password` in `AuthService`.
* [ ] **Workspace Isolation:** Every tenant query includes a parameterized `workspace_id` constraint.
* [ ] **Cross-Workspace Data Leakage Prevention:** Verify that under no circumstances can data from one workspace leak to another.
* [ ] **SQL Parameterization:** No SQL string concatenation. All database calls use PDO parameters.
* [ ] **Transactions:** Provisioning task uses PDO transactional boundaries (`beginTransaction`, `commit`, `rollBack`).
* [ ] **Audit Logging:** Phase transitions and provisioning are logged in the `audit_logs` table.
* [ ] **escape_html():** All dynamic variable outputs in views are wrapped in `escape_html()`.
* [ ] **Logger:** Exceptions and authentication rate lockouts logged securely without raw user data leaks.
* [ ] **Flash Messages:** Session flash messages pull atomically on first read.
* [ ] **Middleware:** Couple and Crew routes are protected by `App\Middleware\WorkspaceMiddleware`.
* [ ] **Session Integrity:** Expiry check is run on every page load; archived or deactivated workspaces invalidate active sessions immediately.

## 8. Output Requirements
Provide a report summarizing:
1. Files created and modified.
2. Acceptance criteria results.
3. Errors caught and resolved.
4. Confirmation that syntax check passed.
**Do NOT begin the next task. Wait for Human Approval.**
```

---

### Template 3: Implementation Review Prompt
*This template is used to review a completed task's implementation.*

```markdown
# TASK REVIEW: [TASK_ID]

You are a security and code quality reviewer. Perform a static review of the implementation files created or modified for [TASK_ID].

## 1. Reference Documents
- SPRINT3_PLANNING.md
- SPRINT3_EXECUTION_GUIDE.md
- Implementation files for [TASK_ID]

## 2. Review Checklist
Verify the following points:
1. **Scope Limit:** Were any files modified or created outside the approved task files?
2. **Acceptance Criteria:** Does the code fulfill all specific acceptance criteria of [TASK_ID]?
3. **Security Constraints & Workspace Isolation:** 
   - Is output HTML properly escaped with `escape_html()`?
   - Is workspace isolation enforced on every query (`WHERE workspace_id = :workspace_id`)?
   - Are there any possibilities of cross-workspace data leakage or boundary validation bypasses?
4. **PHP Syntax:** Verify that `php -l` runs successfully with zero errors.
5. **Architectural Deviations:** Confirm no deviations from the Development Blueprint (DBP).

## 3. Output
Produce the **Official Implementation Report** listing verification statuses, syntax validation outcome, security checks, and a recommendation to **Approve & Commit** or **Reject**.
```

---

### Template 4: Architecture Review Prompt
*This template is executed at the end of Sprint 3 to evaluate architectural validity before planning Sprint 4.*

```markdown
# ARCHITECTURE REVIEW: SPRINT 3

You are a Principal Architect. Review the complete implementation of Sprint 3 (Workspace Module & Tenant Isolation).

## 1. Objective
Assess the architectural integrity of Inveetaire after the completion of all Sprint 3 tasks (`WorkspaceMiddleware`, `WS-001`, `WS-002`, `WS-003`).

## 2. Verification Criteria
Analyze the workspace and verify:
1. **Tenant Isolation Boundary:** Verify that all database reads, writes, updates, and deletes are strictly isolated by workspace ID and that no cross-workspace access is possible.
2. **Middleware Architecture:** Confirm that `App\Middleware\WorkspaceMiddleware` correctly validates workspace access boundaries and remains completely stateless.
3. **Service Layer Separation:** Ensure controllers remain thin, models contain only parameterized SQL, and services coordinate all business workflows.
4. **Transaction Ownership:** Verify that `WorkspaceService` owns database transaction boundaries (`beginTransaction`, `commit`, `rollBack`) and that nested transactions are not present.
5. **Audit Integrity:** Confirm that lifecycle phase transitions and workspace provisioning records write proper audit trails to `audit_logs`.
6. **Technical Debt & DRP Review:** Assess if any undocumented architectural assumptions were introduced and evaluate if a Design Revision Pack (DRP) is required.

## 3. Evaluation Output
Produce the **Sprint 3 Architecture Review** document (`SPRINT3_ARCHITECTURE_REVIEW.md`). Your report must determine objectively:
- Whether the architecture remains valid.
- Whether the tenant isolation rules are intact.
- Whether a DRP is required.
```

---

### Template 5: Planning Review Prompt
*This template is a reusable editorial review tool for future sprint planning documents.*

```markdown
# EDITORIAL REVIEW: [SPRINT_NAME] PLANNING DOCUMENT

You are an editor. Perform an editorial and consistency review of the draft planning document: [PLANNING_DOCUMENT_PATH].

## 1. Verification Checklist
Verify and correct:
1. **Planning Consistency:** Ensure tasks and goals align with the Master Implementation Backlog (MIB) and DBP.
2. **Dependency Order & Sequencing:** Ensure the execution order strictly resolves dependencies.
3. **File Paths:** Check that all directories, expected files, and modified files are documented using exact, correct paths.
4. **Middleware Naming:** Verify that all middleware references use their fully-qualified class names.
5. **Governance Alignment:** Confirm that no governance parameters (e.g. session boundaries, kernel freeze) are bypassed.

## 2. Output
Provide:
1. Summary of editorial improvements.
2. Cross-reference or consistency corrections.
3. Final status confirmation (e.g. Ready for Execution Guide).
```

---

### Template 6: Execution Guide Review Prompt
*This template is a reusable editorial review tool for future execution guides.*

```markdown
# EDITORIAL REVIEW: [SPRINT_NAME] EXECUTION GUIDE

You are an editor. Perform an editorial review of the draft execution guide: [EXECUTION_GUIDE_PATH].

## 1. Verification Checklist
Verify and correct:
1. **Workflow Lifecycle:** Confirm the guide outlines all lifecycle gates (Planning to Sprint Close) without shortcuts.
2. **Security & Boundary Scopes:** Ensure concrete verification checklists cover all security parameters (CSP, session, isolation).
3. **Quality Gates:** Verify quality checklists (scope boundaries, expected files, kernel freeze).
4. **Dependency Rules:** Verify that task sequencing rules are clearly set.
5. **Style Consistency:** Match headers, flowchart formatting, and editorial style to previous guides.

## 2. Output
Provide a summary of corrected inconsistencies and confirm whether the guide is ready for release.
```

---

### Template 7: Prompt Library Review Prompt
*This template is a reusable editorial review tool for future prompt libraries.*

```markdown
# EDITORIAL REVIEW: [SPRINT_NAME] PROMPT LIBRARY

You are an editor. Perform an editorial review of the draft prompt library: [PROMPT_LIBRARY_PATH].

## 1. Verification Checklist
Verify and correct:
1. **Template Consistency:** Ensure templates remain reusable, implementation-independent, and sprint-oriented.
2. **Governance Alignment:** Confirm that AI restrictions, git locks, and cold-start guidelines are present in every template.
3. **Duplicate Prompts:** Verify no duplicate prompt definitions or redundant templates exist.
4. **Terminology & Numbering:** Ensure numbering, headings, and cross-references are correct.

## 2. Output
Provide a summary of corrected inconsistencies and confirm whether the library is ready for release.
```

---

### Template 8: Document Synchronization Prompt
*This template is used when an approved Design Revision Pack (DRP) needs to be merged back into the core documentation files. Reusable across all sprints.*

```markdown
# DOCUMENT SYNCHRONIZATION: [DRP_VERSION]

You are a technical writer. Update the core project documentation to incorporate the architectural changes approved in [DRP_FILE_PATH].

## 1. Scope of Work
Update the following documents to align with the changes in the DRP:
- `docs/ai/AI.md`
- `docs/02-architecture/DBP_v1.1.md`
- `docs/02-architecture/MASTER_IMPLEMENTATION_BACKLOG_v1.1.md`
- `docs/04-governance/AI_DEVELOPMENT_SYSTEM.md`
- `docs/02-architecture/[SPRINT_NAME]_PLANNING.md`

## 2. Rules
1. **Strict Copy:** Copy only the specific text blocks approved in the DRP. Never synchronize before DRP approval.
2. **No Extrapolation:** Do not invent secondary changes or update other files without explicit human authorization.
3. **Changelog Update:** Add the DRP reference details to the revision history of each modified document.

## 3. Output
Provide a summary of the lines and files synchronized, along with a diff of the edits.
```

---

## 2. Prompt Implementation Workflow

Every prompt in this library must enforce the following developer rules:
1. **One Task Only:** The implementing agent works on one task per session. Automatic transitions between tasks are strictly disabled.
2. **Prerequisites Committed:** A task cannot start until all prerequisites are committed and pushed by the Human developer.
3. **Files Expected Boundaries:** The agent must only edit/create files explicitly defined within the task boundary.
4. **Git Operations Prohibited:** Git commands (`git add`, `git commit`, `git push`) must only be executed by the Human Developer, never the AI agent.
5. **No Placeholders:** AI agents must write complete, functional code without using `// TODO` or code placeholders.

---

## 3. Conflict Resolution Protocol

If any document conflicts (e.g. MIB vs. DBP, or Task Prompt vs. Planning) are discovered:
1. **STOP** all coding activities immediately.
2. **Identify** the conflicting files and line numbers.
3. **Explain** the conflict details and propose options to the Human Approver.
4. **Wait** for approval before proceeding.
5. Never modify the frozen framework kernel without approval. All approved Sprint 2 architectural clarifications must be reused; do not reopen resolved conflicts.