Current Task

CORE-002

Implement ONLY the task defined as CORE-002 in the Master Implementation Backlog v1.1.

This is an implementation task.

Follow the frozen governance and execution methodology established during Sprint 0.

---

Mandatory Reading

Before making any code changes, review:

- AI.md v1.1
- AI_DEVELOPMENT_SYSTEM.md v1.0
- SPRINT1_EXECUTION_GUIDE.md
- MASTER_IMPLEMENTATION_BACKLOG_v1.1
- DBP_v1.1
- PROJECT.md
- WORKFLOW.md

Review prerequisite implementation memories:

- 20_core001.md

Review prerequisite implementation responses only if additional implementation detail is required.

---

Repository Review

Review the current repository.

Review:

- app/core/Csrf.php
- app/core/Session.php
- app/core/MiddlewareInterface.php
- app/core/MiddlewarePipeline.php
- app/core/ErrorHandler.php
- app/core/Request.php

Verify that CORE-001 has been approved and committed.

---

Scope

Implement ONLY CORE-002.

Expected objective:

Implement the framework CSRF middleware that integrates the existing Sprint 0 CSRF infrastructure into the middleware pipeline.

The middleware must:

- implement App\Core\MiddlewareInterface
- validate CSRF tokens for protected HTTP methods
- bypass safe HTTP methods as documented
- delegate forbidden requests to the existing ErrorHandler
- remain completely independent from Controllers, Models and Services

Do NOT implement authentication.

Do NOT implement authorization.

Do NOT implement session timeout.

Do NOT implement business middleware.

Do NOT modify frozen Sprint 0 architecture.

---

Rules

Follow:

- AI.md
- AI_DEVELOPMENT_SYSTEM.md
- SPRINT1_EXECUTION_GUIDE.md

Files Expected governs scope.

If implementation requires undocumented files:

STOP.

Explain why.

Wait for approval.

If documentation conflicts exist:

STOP.

Reference the conflicting documents.

Wait for approval.

---

Do NOT execute

- git add
- git commit
- git push
- git tag
- git merge
- git checkout

---

Required Output

Return only:

1. Implementation Summary

2. Files Created
(verify against Files Expected)

3. Files Modified

4. Acceptance Criteria Verification

5. Definition of Done Checklist

6. Proposed Git Commit Message
(do NOT execute)

7. Documentation Deviations

8. Dependency Verification

Confirm that:

- CORE-001 dependency is satisfied.
- Sprint 0 framework remains frozen.
- Governance remains unchanged.
- MiddlewareInterface is correctly implemented.

Implementation ends after CORE-002.

Wait for approval.