commit

docs/standards/task-contract-template.md

@@ -0,0 +1,148 @@
+# Task Contract Template
+
+Use this template for every future task before implementation starts.
+
+The contract exists to force review-first execution, foundation reuse, and explicit scope control.
+
+---
+
+## Task Information
+
+- Task ID:
+- Title:
+- Owner:
+- Requested by:
+- Date:
+- Related ticket / plan:
+
+## Objective
+
+- Describe the business outcome, not just the code change.
+
+## Business Context
+
+- Relevant domain background:
+- Why this task exists now:
+- Related ADRs:
+- Related business docs:
+
+## Required Skills & Context
+
+- `AGENTS.md`
+- `docs/standards/task-catalog.md`
+- `docs/standards/project-foundations.md`
+- `docs/standards/architecture-rules.md`
+- `docs/standards/ui-ux-rules.md`
+- `docs/standards/task-review-checklist.md`
+- Relevant `docs/adr/**`
+- Relevant `docs/business/**`
+- Relevant `docs/security/**`
+- Existing feature and API references:
+- Historical task documents reviewed:
+
+## Architecture Constraints
+
+- Frontend constraints:
+- Backend constraints:
+- Security constraints:
+- Reuse constraints:
+- Forbidden patterns:
+
+## Reuse Existing Foundations
+
+- Foundations reviewed:
+- Existing services to extend:
+- Existing APIs to extend:
+- Existing query/mutation patterns to reuse:
+- Existing UI shells/components to reuse:
+- Existing audit patterns to reuse:
+- Why a new foundation is not required:
+
+## Data Model Changes
+
+- Schema changes required:
+- Existing tables impacted:
+- Migration required:
+- Explicit non-changes:
+
+## API Requirements
+
+- Route handlers involved:
+- Request/response contracts:
+- Service layer functions:
+- Validation rules:
+- Existing APIs reused or extended:
+
+## UI Requirements
+
+- Routes / screens:
+- Page shell pattern:
+- Form / table / filter patterns:
+- Terminology requirements:
+- Empty / loading / error states:
+
+## Report / Export Rules
+
+- Report foundation reviewed:
+- Shared filters reused:
+- Dataset layer reused:
+- Export path reused:
+- Revenue/pricing visibility rule:
+
+## Permission Requirements
+
+- Required permissions:
+- Scope enforcement requirements:
+- Resolved access helper to use:
+- Server-side protection points:
+
+## Audit Requirements
+
+- Entity type:
+- Actions:
+- Required payload:
+- Existing audit naming reused:
+
+## Scope
+
+- In scope:
+
+## Explicit Non-Scope
+
+- Out of scope:
+
+## Security Verification Matrix
+
+| Scenario | Expected access | Enforcement point |
+| --- | --- | --- |
+| Admin |  |  |
+| Scoped user |  |  |
+| Unauthorized user |  |  |
+| Pricing-restricted user |  |  |
+
+## Deliverables
+
+- Documentation deliverables:
+- Code deliverables:
+- Verification deliverables:
+
+## Verification
+
+- Typecheck:
+- Lint:
+- Targeted tests:
+- Manual scenarios:
+
+## Documentation
+
+- Docs to update:
+- ADR needed:
+- Task implementation note:
+
+## Definition of Done
+
+- Review completed before implementation
+- Existing foundations reused or extension rationale documented
+- Security and audit requirements verified
+- Documentation updated
+- Verification evidence recorded