Current Task

Create

SPRINT2_EXECUTION_GUIDE.md

This is an execution guide.

This is NOT an implementation task.

Do NOT modify source code.

Do NOT modify governance.

Do NOT modify architecture.

Do NOT modify planning.

Do NOT create implementation prompts.

Do NOT begin Sprint 2 implementation.

---

Mandatory Reading

Review before writing.

Governance

- AI.md v1.1
- AI_DEVELOPMENT_SYSTEM.md
- WORKFLOW.md
- PROJECT.md

Architecture

- DBP_v1.1
- ADR v1.0
- MASTER_IMPLEMENTATION_BACKLOG_v1.1

Sprint Documents

- SPRINT1_EXECUTION_GUIDE.md
- SPRINT1_ARCHITECTURE_REVIEW.md
- SPRINT2_PLANNING.md

Review implementation memories if required.

---

Purpose

Create the official execution guide for Sprint 2.

This guide defines HOW Sprint 2 implementation must be executed.

It does NOT redefine governance.

It does NOT redefine architecture.

It inherits all Sprint 1 execution rules.

Only Sprint 2-specific execution guidance should be added.

---

Document Scope

The guide should include at minimum:

# Sprint Overview

- Sprint Objective
- Sprint Scope
- Deliverables

---

# Sprint Lifecycle

For every implementation task:

Planning

↓

Prompt

↓

Implementation

↓

Implementation Report

↓

Approval

↓

Git Commit

↓

Memory

↓

Next Task

Emphasize that every task must finish completely before the next begins.

---

# Dependency Rules

Execution always follows dependency order.

Never numeric order.

No task begins before all prerequisite tasks are:

- approved
- committed
- pushed

---

# Working Tree Rules

Before implementation:

- git status clean
- expected modified files only
- no unrelated changes

Before commit:

- verify Files Expected
- verify Files Modified
- verify acceptance criteria
- verify PHP syntax
- verify documentation deviations
- verify dependency checklist

---

# Sprint 2 Security Rules

Authentication

Authorization

Password Hashing

Session Regeneration

Session Timeout

CSRF

Role Validation

Output Escaping

Logging

Error Handling

These are mandatory verification points for every AUTH task.

---

# Middleware Rules

Document the intended middleware order.

Example:

CsrfMiddleware

↓

AuthMiddleware

↓

RoleMiddleware

↓

Controller

Clarify that middleware execution follows MiddlewarePipeline.

---

# Database Rules

No schema changes.

No undocumented tables.

No undocumented columns.

Respect PDD.

---

# Testing Strategy

Every task must include:

- Static verification
- PHP syntax validation
- Acceptance Criteria verification
- Dependency verification

Where practical:

- Manual browser verification
- CLI verification

---

# Completion Rules

Every task ends with:

Implementation Report

Human Approval

Git Commit

Memory Creation

Prompt Archive

No automatic continuation.

---

# Sprint Exit Criteria

Sprint 2 completes only when:

All AUTH tasks complete.

Architecture remains unchanged.

Kernel remains frozen.

No undocumented files exist.

Documentation synchronized if required.

Architecture Review completed.

---

Rules

This guide must inherit Sprint 1 governance.

Do NOT duplicate governance already defined in AI.md or AI_DEVELOPMENT_SYSTEM.md.

Reference those documents where appropriate.

Keep Sprint 2-specific guidance only.

---

Output

Produce

SPRINT2_EXECUTION_GUIDE.md

Then provide:

1.

Execution Workflow Summary

2.

Security Workflow Summary

3.

Dependency Workflow Summary

4.

Completion Workflow Summary

5.

Sprint Exit Criteria

6.

Editorial Improvements Recommended

Do NOT create implementation prompts.

Wait for approval.