Current Task

INIT-010 — Session Management & CSRF Protection

Mandatory References (read before writing any code):

- AI.md (Sections 21–27 — operational rules)
- PROJECT.md
- WORKFLOW.md
- IMPLEMENTATION_ROADMAP.md
- Sprint 0 Execution Plan
- DBP
- ADR
- MIB — locate INIT-010 and read "Files Expected"
- TCS

Review the implementation of:

- INIT-001
- INIT-002
- INIT-005
- INIT-003
- INIT-004
- INIT-006
- INIT-007
- INIT-008
- INIT-009
- INIT-012

before making any changes.

Review the project memory:

.ai/memory/

to understand previous implementation decisions and architectural reasoning.

---

Requirements

Implement ONLY Task INIT-010.

Do NOT implement any part of INIT-011 or later tasks.

The implementation must follow the approved architecture exactly.

Implement ONLY the session infrastructure and CSRF protection explicitly defined in the documentation.

Expected responsibilities include ONLY:

- Session initialization
- Session configuration
- Session lifecycle management
- CSRF token generation
- CSRF token validation
- Session helper methods
- Integration with Bootstrap and Middleware Pipeline where documented

Nothing else.

---

Scope Restrictions

Create ONLY the files listed under
INIT-010 → "Files Expected".

Every created file MUST map directly to a Files Expected entry.

If implementation requires another file:

STOP.

Explain:

- why it is required
- which document requires it
- why it is not listed under Files Expected

Wait for approval.

---

Forbidden Implementations

Do NOT implement:

- Login
- Logout
- Authentication
- Authorization
- Remember Me
- User Session Management
- Role Management
- Permission Management
- OAuth
- JWT
- API Token Authentication
- Cookie Encryption
- Flash Message Business Logic
- Session Database Driver
- Redis Session Driver
- File Upload Security
- Password Validation

Do NOT create:

- AuthService
- AuthMiddleware
- UserSession
- LoginController
- LogoutController

Do NOT implement any Sprint 1 functionality.

---

Security Rules

Implement ONLY the CSRF mechanism defined in the documentation.

Do NOT invent additional security mechanisms.

Do NOT implement:

- CSP
- HSTS
- Rate Limiting
- XSS Filters
- SQL Firewall
- CAPTCHA

unless explicitly listed in the MIB.

---

Architecture Rules

- Native PHP 7.4 only.
- Framework-agnostic implementation.
- PSR-4 compatible.
- Keep Session independent from Controllers.
- Keep Session independent from Database.
- Keep Session independent from Business Logic.
- Keep CSRF independent from Authentication.
- No Dependency Injection container.
- No Reflection.
- No ORM.
- No business logic.

---

Documentation Rules

Documentation examples are illustrative only.

Do NOT implement documentation examples.

Only implement artifacts explicitly listed under:

- Files Expected
- Acceptance Criteria

---

Conflict Rules

If documentation conflicts are found:

STOP.

Reference the conflicting documents.

Explain the conflict.

Wait for approval.

---

Git Rules

Do NOT execute:

- git add
- git commit
- git push
- git merge
- git checkout
- git tag

Prepare a commit message suggestion only.

---

Completion Report

After implementation provide:

1. Implementation Summary
2. Files Created (verify each against MIB)
3. Files Modified
4. Acceptance Criteria Verification
5. Definition of Done Checklist
6. Proposed Git Commit Message (do NOT execute)
7. Documentation Deviations (if any)

Implementation ends after INIT-010.

Do NOT continue to INIT-011.

Wait for approval.