# AUTH-004 (Revised)

Sprint: Sprint 2 — Authentication & Authorization

Task: AUTH-004 (Continuation)

This prompt resumes AUTH-004 after resolving the documented conflict recorded in:

- docs/ai/memory/33_AUTH004_conflict.md

This is a continuation of AUTH-004.

It is NOT a new task.

Do NOT begin AUTH-003.

---

## Mandatory Reading

Before continuing implementation, review:

### Governance

- AI.md v1.1
- AI_DEVELOPMENT_SYSTEM.md
- WORKFLOW.md
- PROJECT.md

### Architecture

- DBP_v1.1
- ADR v1.0
- MASTER_IMPLEMENTATION_BACKLOG_v1.1

### Sprint Documents

- SPRINT2_PLANNING.md
- SPRINT2_EXECUTION_GUIDE.md
- SPRINT2_PROMPT_LIBRARY.md

### Previous Prompt

- docs/ai/prompts/41_AUTH004.md

### Conflict Record

- docs/ai/memory/33_AUTH004_conflict.md

---

# Conflict Resolution

The previously reported conflict has been reviewed.

Decision:

The example shown in the Router.php docblock using:

RoleMiddleware:couple

is considered an illustrative documentation example only.

It is NOT part of the executable framework contract.

Sprint 0 MiddlewarePipeline remains frozen.

AUTH-004 SHALL NOT:

- modify MiddlewarePipeline.php
- introduce parameter parsing
- support colon-suffixed middleware
- introduce constructor injection into middleware
- redesign the routing system

This clarification is implementation guidance only.

It is NOT a kernel change.

It is NOT an architectural redesign.

---

# Implementation Rules

Continue AUTH-004.

Reuse all completed work.

Do not restart the task.

Only modify files required by AUTH-004.

Do not modify:

- app/core/MiddlewarePipeline.php
- app/core/Router.php
- any Sprint 0 kernel file

Do not introduce:

- CoupleRoleMiddleware
- CrewRoleMiddleware
- AdminRoleMiddleware

Do not create undocumented middleware.

---

# RoleMiddleware

Implement RoleMiddleware using ONLY capabilities already supported by the framework.

Do NOT infer new framework behaviour.

Do NOT implement parameterized middleware.

Do NOT parse:

RoleMiddleware:couple

The Router docblock example is non-normative.

If role validation cannot be completed without extending the frozen kernel:

STOP.

Report the remaining gap.

Do not guess.

---

# Scope

Continue ONLY AUTH-004.

No AUTH-003 work.

No password reset.

No remember-me.

No API authentication.

No architecture improvements.

No framework redesign.

---

# Validation

Before finalizing verify:

✓ MiddlewarePipeline unchanged.

✓ Router unchanged.

✓ Sprint 0 kernel unchanged.

✓ No undocumented middleware created.

✓ No constructor injection added.

✓ No colon-parameter parsing added.

✓ AUTH-004 Files Expected satisfied.

✓ Acceptance Criteria satisfied where supported by the frozen framework.

---

# Documentation

If this clarification results in a documentation mismatch:

Document it.

Do NOT silently change architecture.

Do NOT silently extend the kernel.

Future support for parameterized middleware shall be considered only through an approved Design Revision Pack.

---

If any NEW conflict is discovered:

STOP.

Explain.

Wait for approval.

---

After implementation provide

1. Updated Implementation Summary

2. Files Created

3. Files Modified

4. Conflict Resolution Verification

5. Acceptance Criteria Verification

6. Security Checklist Verification

7. Definition of Done

8. Proposed Git Commit Message
(do NOT execute)

9. Documentation Deviations
(if any)

10. Dependency Verification

AUTH-004 ends after implementation.

Do NOT continue to AUTH-003.

Wait for approval.