Current Task

AUTH-001 — Unified Authentication

Sprint:

Sprint 2 — Authentication & Authorization

This task implements ONLY AUTH-001.

Do NOT implement AUTH-002.

Do NOT implement AUTH-003.

Do NOT implement AUTH-004.

---

Mandatory Reading

Before writing any code, review:

Governance

- AI.md v1.1
- AI_DEVELOPMENT_SYSTEM.md
- WORKFLOW.md
- PROJECT.md

Architecture

- DBP_v1.1
- ADR v1.0
- MASTER_IMPLEMENTATION_BACKLOG_v1.1

Sprint Documents

- SPRINT2_PLANNING.md
- SPRINT2_EXECUTION_GUIDE.md
- SPRINT2_PROMPT_LIBRARY.md

Review all required memory files from Sprint 0 and Sprint 1 that affect authentication.

---

Dependency Verification

Before implementation verify:

- Sprint 0 is complete.
- Sprint 1 is complete.
- Sprint 2 Planning is FINAL.
- Sprint 2 Execution Guide is FINAL.
- Sprint 2 Prompt Library is FINAL.
- AUTH-001 has no incomplete prerequisite tasks.
- Working tree is clean.
- Parent framework remains frozen.

If any dependency is not satisfied:

STOP.

Explain.

Wait for approval.

---

Scope

Implement ONLY AUTH-001.

Exactly as defined in:

- MASTER_IMPLEMENTATION_BACKLOG_v1.1
- DBP_v1.1
- SPRINT2_PLANNING.md

Do not extend the scope.

Do not redesign authentication.

Do not modify architecture.

---

Files

Create ONLY the files listed for AUTH-001.

Modify ONLY the files listed for AUTH-001.

If implementation requires additional files not listed in the planning or MIB:

STOP.

Explain why.

Wait for approval.

---

Rules

- Native PHP 7.4 only.
- Framework-agnostic.
- PSR-4 compatible.
- Thin Controller.
- Business logic belongs in Service.
- Database access belongs in Model.
- No duplicated logic.
- No Reflection.
- No Dependency Injection container.
- No TODO.
- No placeholder implementations.
- No debug code.
- No undocumented helper.
- No undocumented middleware.
- No undocumented routes.

Respect the frozen kernel.

Modify app/core only if AUTH-001 explicitly permits it.

Otherwise:

Do not touch app/core.

---

Security Checklist

Verify implementation includes, where applicable:

- password_hash()
- password_verify()
- Session::regenerate(true)
- escape_html()
- CsrfMiddleware on POST routes
- Logger::info()
- Logger::warning()
- Logger::error()
- ErrorHandler integration
- FlashMessage usage
- Secure redirect flow

Do not log credentials.

Do not expose exceptions.

---

Conflict Rules

If documentation conflicts are discovered:

STOP.

Reference the conflicting documents.

Explain the conflict.

Wait for approval.

Do not guess.

---

Do NOT execute

- git add
- git commit
- git push
- git merge
- git checkout
- git tag

---

After implementation provide

1. Implementation Summary

2. Files Created
(verify against MIB and Sprint 2 Planning)

3. Files Modified

4. Acceptance Criteria Verification

5. Security Checklist Verification

6. Definition of Done Checklist

7. Proposed Git Commit Message
(do NOT execute)

8. Documentation Deviations
(if any)

9. Dependency Verification

Implementation ends after AUTH-001.

Do NOT continue to AUTH-002.

Wait for approval.