Current Task

INIT-009 — Middleware Pipeline

Mandatory References (read before writing any code):

- AI.md (Sections 21–27 — operational rules)
- PROJECT.md
- WORKFLOW.md
- IMPLEMENTATION_ROADMAP.md
- Sprint 0 Execution Plan
- DBP
- ADR
- MIB — locate INIT-009 and read "Files Expected"
- TCS

Review the implementation of:

- INIT-001
- INIT-002
- INIT-005
- INIT-003
- INIT-004
- INIT-006
- INIT-007
- INIT-008
- INIT-012 (Validation)

before making any changes.

Review the project memory:

.ai/memory/

to understand previous implementation decisions and architectural reasoning.

---

Requirements

Implement ONLY Task INIT-009.

Do NOT implement any part of INIT-010 or later tasks.

The Middleware Pipeline must follow the approved architecture exactly.

Implement ONLY the middleware infrastructure explicitly defined in the documentation.

Expected responsibilities include ONLY:

- Middleware pipeline execution
- Middleware chaining
- Route middleware execution
- Early response termination support
- Integration with the Router created in INIT-007

Nothing else.

---

Scope Restrictions

Implement ONLY the files listed under
INIT-009 → "Files Expected".

Every created file MUST map directly to one of those entries.

If you determine that another file is required:

STOP.

Explain:

- why it is required
- which document requires it
- why it is not listed under Files Expected

Wait for approval.

---

Forbidden Implementations

Do NOT create:

- AuthMiddleware
- RoleMiddleware
- WorkspaceMiddleware
- GuestMiddleware
- CSRFMiddleware
- LoggingMiddleware
- MaintenanceMiddleware
- Any concrete middleware class
- Any example middleware
- Any placeholder middleware
- Any stub middleware

Do NOT create:

- MiddlewareInterface
- AbstractMiddleware
- BaseMiddleware

unless they are explicitly listed in the MIB.

Do NOT define middleware contracts on your own.

If the middleware pipeline cannot be implemented without introducing a contract:

STOP.

Explain why.

Wait for approval.

---

Documentation Rules

Documentation examples are illustrative only.

Do NOT implement documentation examples.

Do NOT infer future Sprint implementations.

Do NOT implement anything because it "will probably be needed later".

Only implement artifacts explicitly listed under:

- Files Expected
- Acceptance Criteria

---

Architecture Rules

- Native PHP 7.4 only.
- Framework-agnostic implementation.
- PSR-4 compatible.
- Keep Middleware independent from Controllers.
- Keep Middleware independent from Models.
- Keep Middleware independent from Services.
- Keep Middleware independent from Database.
- Keep Middleware independent from Session.
- Keep Middleware independent from Authentication.
- No Dependency Injection container.
- No Reflection.
- No business logic.
- No authentication.
- No authorization.
- No CSRF validation.
- No rate limiting.
- No request logging middleware.
- No response middleware.

---

Conflict Rules

If documentation conflicts are found:

STOP.

Reference the conflicting documents.

Explain the conflict.

Wait for approval.

---

Git Rules

Do NOT execute:

- git add
- git commit
- git push
- git merge
- git checkout
- git tag

Prepare a commit message suggestion only.

---

Completion Report

After implementation provide:

1. Implementation Summary
2. Files Created (verify each against MIB)
3. Files Modified
4. Acceptance Criteria Verification
5. Definition of Done Checklist
6. Proposed Git Commit Message (do NOT execute)
7. Documentation Deviations (if any)

Implementation ends after INIT-009.

Do NOT continue to INIT-010.

Wait for approval.