Current Task

AUTH-002 — Logout and Session Destruction

Sprint:

Sprint 2 — Authentication & Authorization

This task implements ONLY AUTH-002.

Do NOT implement AUTH-003.

Do NOT implement AUTH-004.

---

Mandatory Reading

Before writing any code, review:

Governance

- AI.md v1.1
- AI_DEVELOPMENT_SYSTEM.md
- WORKFLOW.md
- PROJECT.md

Architecture

- DBP_v1.1
- ADR v1.0
- MASTER_IMPLEMENTATION_BACKLOG_v1.1

Sprint Documents

- SPRINT2_PLANNING.md
- SPRINT2_EXECUTION_GUIDE.md
- SPRINT2_PROMPT_LIBRARY.md

Previous Task

- AUTH-001 Implementation
- docs/ai/memory/31_auth001.md

Review every dependency before implementation.

---

Dependency Verification

Verify:

- AUTH-001 approved
- AUTH-001 committed
- AUTH-001 pushed
- Working tree clean
- Sprint 0 kernel unchanged
- Sprint 1 utilities unchanged

If any dependency is incomplete:

STOP.

Explain.

Wait for approval.

---

Scope

Implement ONLY AUTH-002.

Exactly as documented in:

- MASTER_IMPLEMENTATION_BACKLOG_v1.1
- DBP_v1.1
- SPRINT2_PLANNING.md

No additional features.

No refactoring.

No optimization.

No architecture changes.

---

Expected Behaviour

Implement a secure logout flow.

The implementation must:

- destroy the authenticated session
- remove all authentication session values
- invalidate the PHP session
- remove the session cookie
- regenerate a clean anonymous session
- redirect to /login
- display an appropriate flash message

Logout must use:

POST /logout

GET logout is NOT permitted.

---

Files

Create ONLY the files listed for AUTH-002.

Modify ONLY the files listed for AUTH-002.

If additional files appear necessary:

STOP.

Explain.

Wait for approval.

---

Rules

- Native PHP 7.4 only
- PSR-4 compatible
- Thin Controller
- No business logic in Controller
- No SQL outside Model
- No new helpers
- No new middleware
- No BaseController modification
- No Session core modification
- No kernel modification
- No undocumented routes
- No placeholder code
- No TODO
- No debug code

Respect the frozen framework.

---

Security Checklist

Verify:

✓ Logout only accepts POST

✓ CSRF protection applied

✓ Session::destroy()

✓ Session cookie removed

✓ Session regenerated (anonymous)

✓ Flash success message

✓ Logger::info()

✓ No credential leakage

✓ Redirect to /login

✓ No browser cache of authenticated session

---

Conflict Rules

If documentation conflicts are discovered:

STOP.

Reference the conflicting documents.

Explain the conflict.

Wait for approval.

Do not guess.

---

Do NOT execute

- git add
- git commit
- git push
- git merge
- git checkout
- git tag

---

After implementation provide

1. Implementation Summary

2. Files Created

3. Files Modified

4. Acceptance Criteria Verification

5. Security Checklist Verification

6. Definition of Done Checklist

7. Proposed Git Commit Message
(do NOT execute)

8. Documentation Deviations
(if any)

9. Dependency Verification

AUTH-002 ends after implementation.

Do NOT continue to AUTH-003.

Wait for approval.