In progress

2025-11-03 20:02:41 +01:00
parent cbc040621f
commit 32a25b3b35
10 changed files with 6500 additions and 1 deletions
--- a/reports/2025-11-03-Day-6-Executive-Summary.md
+++ b/reports/2025-11-03-Day-6-Executive-Summary.md
@@ -0,0 +1,313 @@
+# ColaFlow Day 6 Executive Summary
+
+**Date**: 2025-11-03
+**Prepared By**: Product Manager Agent
+**Target Audience**: Development Team, Stakeholders
+**Status**: Ready for Implementation
+
+---
+
+## TL;DR (60-Second Summary)
+
+**Recommendation**: Implement **Role Management API** on Day 6
+
+**Why**: Completes tenant user management loop, enables self-service user onboarding, and provides foundation for project-level roles and MCP integration.
+
+**Scope**: 4 API endpoints, 15+ integration tests, 6-8 hours development time
+
+**Risk**: LOW (builds on existing RBAC system from Day 5)
+
+**Value**: HIGH (critical for multi-tenant SaaS operations)
+
+---
+
+## Decision Summary
+
+### Day 6 Priority Ranking
+
+| Rank | Feature | Time | Priority | Recommendation |
+|------|---------|------|----------|----------------|
+| **1st** | **Role Management API** | **6-8h** | **P0** | **✅ IMPLEMENT DAY 6** |
+| 2nd | Email Verification | 8-10h | P1 | Defer to Day 7 |
+| 3rd | Password Reset | 6-8h | P1 | Defer to Day 7 |
+| 4th | Project-Level Roles | 10-12h | P1 | Defer to Day 8 |
+| 5th | User Invitations | 10-12h | P1 | Defer to Day 8-9 |
+
+### Why Role Management API Won
+
+✅ **Immediate Business Value**: Tenant admins can manage users (critical for SaaS)
+✅ **Technical Readiness**: RBAC system already complete (Day 5)
+✅ **Low Risk**: No database migrations, no new architecture
+✅ **Realistic Scope**: 6-8 hours fits Day 6 budget
+✅ **Foundation**: Prepares for project roles (Day 8) and MCP (M2)
+
+---
+
+## Day 6 Deliverables
+
+### API Endpoints (4 total)
+
+1. **POST /api/tenants/{tenantId}/users/{userId}/role**
+   - Assign or update user role
+   - Authorization: TenantOwner or TenantAdmin
+   - Security: Cannot assign TenantOwner unless requester is TenantOwner
+
+2. **DELETE /api/tenants/{tenantId}/users/{userId}/role**
+   - Remove user from tenant
+   - Authorization: TenantOwner or TenantAdmin
+   - Security: Cannot remove last TenantOwner
+
+3. **GET /api/tenants/{tenantId}/users**
+   - List all users with roles
+   - Pagination, filtering, search
+   - Authorization: TenantMember or higher
+
+4. **GET /api/tenants/{tenantId}/roles**
+   - List available roles
+   - Shows which roles requester can assign
+   - Authorization: TenantMember or higher
+
+### Security Features
+
+- ✅ Role-based authorization policies
+- ✅ Privilege escalation prevention
+- ✅ Cross-tenant access protection
+- ✅ Audit logging (who, what, when)
+- ✅ Business rule enforcement (last owner protection, self-modification prevention)
+
+### Test Coverage
+
+- **15+ Integration Tests**: Full API endpoint coverage
+- **Edge Cases**: Unauthorized access, privilege escalation, cross-tenant
+- **Security Tests**: Token validation, role verification
+- **Business Rules**: Last owner, self-modification, invalid roles
+
+---
+
+## User Stories (Top 3)
+
+**US-1: Assign Role to User**
+> As a TenantOwner, I want to assign a role to a user in my tenant, so that I can control their access level to resources.
+
+**US-2: Update User Role**
+> As a TenantOwner, I want to change a user's role, so that I can adjust their permissions as their responsibilities change.
+
+**US-3: Remove User from Tenant**
+> As a TenantOwner, I want to remove a user from my tenant, so that I can revoke their access when they leave the organization.
+
+---
+
+## Technical Architecture
+
+### Database Schema
+
+**Table**: `identity.user_tenant_roles` (Already exists from Day 5 ✅)
+
+**No migrations required** - just add API layer
+
+**Existing Repository Methods**:
+- GetByUserAndTenantAsync ✅
+- GetByTenantAsync ✅
+- AddAsync ✅
+- UpdateAsync ✅
+- DeleteAsync ✅
+
+**New Method Needed**:
+- CountByTenantAndRoleAsync (to check if last TenantOwner)
+
+### Authorization Rules
+
+| Requester | Can Assign | Cannot Assign | Special Rules |
+|-----------|-----------|---------------|---------------|
+| TenantOwner | All roles | - | Full control |
+| TenantAdmin | Member, Guest | Owner, Admin | Limited control |
+| Others | None | All | No access |
+
+**Global Rules**:
+- Cannot modify own role
+- Cannot remove last TenantOwner
+- Cannot access other tenants
+
+---
+
+## Day 6 Timeline
+
+**Total Time**: 6-8 hours
+
+### Morning (4 hours)
+- **09:00-10:00**: Design review + repository method
+- **10:00-12:00**: Application layer (commands, queries, handlers)
+- **12:00-13:00**: Lunch
+
+### Afternoon (4 hours)
+- **13:00-15:00**: API controller + manual testing
+- **15:00-17:00**: Integration tests (15+ tests)
+- **17:00-18:00**: Documentation + code review
+
+### End of Day
+- ✅ 4 API endpoints working
+- ✅ 15+ tests passing (100%)
+- ✅ Documentation updated
+- ✅ Code reviewed
+- ✅ Deployed to development
+
+---
+
+## Days 7-10 Preview
+
+| Day | Feature | Value | Dependency |
+|-----|---------|-------|------------|
+| **7** | Email Service + Verification + Password Reset | Security + UX | None |
+| **8** | Project-Level Roles + Audit Logging | Critical for M1 | Day 6 |
+| **9** | Multi-Tenant Projects Update | M1.1 Complete | Day 8 |
+| **10** | Sprint Management + Kanban | M1.1 Polish | Day 9 |
+
+**After Day 10**: M1.1 milestone 100% complete, ready for M2 MCP integration
+
+---
+
+## Risk Assessment
+
+### Day 6 Risks: LOW
+
+| Risk | Probability | Impact | Mitigation |
+|------|------------|--------|------------|
+| Complex authorization | MEDIUM | MEDIUM | Reuse Day 5 policies |
+| Edge case bugs | MEDIUM | LOW | 15+ tests cover all scenarios |
+| Security vulnerabilities | LOW | HIGH | Thorough security testing |
+| Performance issues | LOW | LOW | Indexed queries, no N+1 |
+
+**Overall Confidence**: HIGH (95%+ success probability)
+
+---
+
+## Success Metrics
+
+### Day 6 Success Criteria
+
+- ✅ All 4 API endpoints functional
+- ✅ 100% integration test pass rate
+- ✅ Zero security vulnerabilities
+- ✅ API response time < 200ms (p95)
+- ✅ Documentation complete
+- ✅ Code reviewed and approved
+
+### Business KPIs
+
+- **Development Time**: ≤ 8 hours
+- **Test Coverage**: ≥ 85%
+- **Bug Count**: 0 critical, ≤ 2 minor
+- **User Value**: Complete tenant management loop
+
+---
+
+## Why Not Other Options?
+
+### Email Verification (Option 2) - Deferred to Day 7
+
+**Reasons**:
+- ❌ Requires email service setup (adds complexity)
+- ❌ 8-10 hours (exceeds Day 6 budget)
+- ❌ Not critical for MVP (can launch without)
+- ✅ Better combined with Password Reset on Day 7
+
+### Password Reset (Option 3) - Deferred to Day 7
+
+**Reasons**:
+- ❌ Needs email service (same as Option 2)
+- ✅ Better implemented together with Email Verification
+- ✅ Day 7 has full email infrastructure
+
+### Project-Level Roles (Option 4) - Deferred to Day 8
+
+**Reasons**:
+- ❌ High complexity (10-12 hours)
+- ❌ Requires architectural decisions (role inheritance)
+- ❌ Depends on Projects module (not yet multi-tenant)
+- ✅ Better after tenant roles are stable
+
+### User Invitations (Option 5) - Deferred to Day 8-9
+
+**Reasons**:
+- ❌ Requires email service
+- ❌ 10-12 hours (too much for Day 6)
+- ❌ Complex workflow (invitation → email → acceptance)
+- ✅ Better after email service is ready
+
+---
+
+## Strategic Value
+
+### Immediate Value (Day 6)
+
+1. **Self-Service User Management**: Tenant admins manage their own users
+2. **Reduced Support Burden**: No need to manually assign roles
+3. **Enterprise Readiness**: Team collaboration enabled
+4. **Security Foundation**: Fine-grained access control
+
+### Long-Term Value (M1-M2)
+
+1. **Project-Level Roles** (Day 8): Build on tenant role patterns
+2. **MCP Integration** (M2): AI agents use same role system
+3. **Audit Compliance**: Role changes tracked for compliance
+4. **Scalability**: Foundation for 1000+ user organizations
+
+---
+
+## Next Steps
+
+### Immediate Actions (Today)
+
+1. ✅ Review and approve planning documents
+2. ✅ Assign to backend agent for implementation
+3. ✅ Begin Day 6 development (6-8 hours)
+
+### Daily Actions (Days 7-10)
+
+1. Daily progress check-ins (end of day)
+2. Code reviews before merging
+3. Integration tests before deployment
+4. Documentation updates
+
+### Post-Day 10
+
+1. M1.1 milestone complete review
+2. M2 MCP integration planning
+3. Sprint retrospective
+4. Customer value delivery
+
+---
+
+## Appendix: Detailed Documents
+
+**Full planning documents available**:
+1. `2025-11-03-Day-6-Planning-Document.md` (22,000 words)
+   - Complete requirements
+   - API design
+   - Database schema
+   - Test plan
+   - Implementation guide
+
+2. `2025-11-03-Day-7-10-Roadmap.md` (5,000 words)
+   - Days 7-10 feature breakdown
+   - Timeline and dependencies
+   - Risk management
+   - Success metrics
+
+---
+
+## Approval
+
+**Planning Status**: ✅ Complete
+**Ready for Implementation**: ✅ Yes
+**Risk Level**: ✅ LOW
+**Expected Completion**: ✅ Day 6 (6-8 hours)
+
+**Recommended Action**: Proceed with Role Management API implementation
+
+---
+
+**Prepared By**: Product Manager Agent
+**Date**: 2025-11-03
+**Version**: 1.0
+**Status**: Ready for Approval
--- a/reports/2025-11-03-Day-6-Planning-Document.md
+++ b/reports/2025-11-03-Day-6-Planning-Document.md
--- a/reports/2025-11-03-Day-6-Priority-Matrix.md
+++ b/reports/2025-11-03-Day-6-Priority-Matrix.md
@@ -0,0 +1,285 @@
+# ColaFlow Day 6 Priority Matrix
+
+**Date**: 2025-11-03
+**Prepared By**: Product Manager Agent
+**Purpose**: Visual comparison of Day 6 candidate features
+
+---
+
+## Priority Matrix: All Options Compared
+
+| # | Feature | Time | Complexity | Business Value | MCP Readiness | Risk | Dependencies | Ready? | Recommendation |
+|---|---------|------|------------|----------------|---------------|------|--------------|--------|----------------|
+| **1** | **Role Management API** | **6-8h** | **MEDIUM** | **HIGH** | **MEDIUM** | **LOW** | **Day 5 RBAC ✅** | **✅ YES** | **✅ IMPLEMENT DAY 6** |
+| 2 | Email Verification | 8-10h | MEDIUM | MEDIUM | LOW | MEDIUM | Email Service ❌ | ⏸️ NO | Defer to Day 7 |
+| 3 | Password Reset | 6-8h | MEDIUM | MEDIUM | LOW | MEDIUM | Email Service ❌ | ⏸️ NO | Defer to Day 7 |
+| 4 | Project-Level Roles | 10-12h | HIGH | HIGH | HIGH | HIGH | Projects Module ❌ | ⏸️ NO | Defer to Day 8 |
+| 5 | User Invitations | 10-12h | HIGH | HIGH | MEDIUM | MEDIUM | Email + UI ❌ | ⏸️ NO | Defer to Day 8-9 |
+
+---
+
+## Detailed Scoring Matrix
+
+### 1. Role Management API (WINNER ✅)
+
+| Criteria | Score | Justification |
+|----------|-------|---------------|
+| **Business Value** | 9/10 | Completes tenant management loop, critical for SaaS |
+| **Technical Readiness** | 10/10 | RBAC system complete, no migrations needed |
+| **Time Feasibility** | 9/10 | 6-8 hours fits Day 6 perfectly |
+| **MCP Preparation** | 7/10 | Establishes role patterns for AI agents |
+| **Risk Level** | 9/10 | Low risk (builds on existing infrastructure) |
+| **User Impact** | 9/10 | Enables self-service user management |
+| **Dependencies Met** | 10/10 | All dependencies satisfied ✅ |
+| **Test Complexity** | 8/10 | 15 tests, well-defined scenarios |
+| **Documentation** | 9/10 | Clear API design, easy to document |
+| **Strategic Fit** | 9/10 | Foundation for Days 8-10 |
+| **TOTAL** | **89/100** | **HIGHEST SCORE** |
+
+**Verdict**: ✅ **IMPLEMENT DAY 6**
+
+---
+
+### 2. Email Verification
+
+| Criteria | Score | Justification |
+|----------|-------|---------------|
+| **Business Value** | 6/10 | Improves security, reduces spam |
+| **Technical Readiness** | 5/10 | Needs email service integration |
+| **Time Feasibility** | 6/10 | 8-10 hours (exceeds Day 6 budget) |
+| **MCP Preparation** | 3/10 | Low relevance for MCP |
+| **Risk Level** | 6/10 | Email delivery issues, rate limiting |
+| **User Impact** | 7/10 | Standard security feature |
+| **Dependencies Met** | 3/10 | Email service NOT configured ❌ |
+| **Test Complexity** | 6/10 | Email delivery testing complex |
+| **Documentation** | 7/10 | Standard flow, easy to document |
+| **Strategic Fit** | 7/10 | Better combined with Password Reset |
+| **TOTAL** | **56/100** | **2nd Place** |
+
+**Verdict**: ⏸️ **DEFER TO DAY 7** (combine with Password Reset)
+
+---
+
+### 3. Password Reset
+
+| Criteria | Score | Justification |
+|----------|-------|---------------|
+| **Business Value** | 7/10 | Essential UX feature, reduces support |
+| **Technical Readiness** | 5/10 | Needs email service integration |
+| **Time Feasibility** | 7/10 | 6-8 hours (if email service ready) |
+| **MCP Preparation** | 2/10 | No relevance for MCP |
+| **Risk Level** | 6/10 | Token security, rate limiting |
+| **User Impact** | 8/10 | High user value (self-service) |
+| **Dependencies Met** | 3/10 | Email service NOT configured ❌ |
+| **Test Complexity** | 7/10 | Token expiration, security tests |
+| **Documentation** | 8/10 | Standard flow, well-understood |
+| **Strategic Fit** | 7/10 | Better combined with Email Verification |
+| **TOTAL** | **60/100** | **3rd Place** |
+
+**Verdict**: ⏸️ **DEFER TO DAY 7** (implement with Email Verification)
+
+---
+
+### 4. Project-Level Roles
+
+| Criteria | Score | Justification |
+|----------|-------|---------------|
+| **Business Value** | 9/10 | Critical for M1 core project module |
+| **Technical Readiness** | 5/10 | Needs architectural decisions |
+| **Time Feasibility** | 4/10 | 10-12 hours (exceeds Day 6 budget) |
+| **MCP Preparation** | 9/10 | Essential for MCP project operations |
+| **Risk Level** | 5/10 | High complexity (role inheritance) |
+| **User Impact** | 9/10 | Fine-grained project access control |
+| **Dependencies Met** | 6/10 | Needs Projects module multi-tenant ❌ |
+| **Test Complexity** | 5/10 | Complex (25+ tests, inheritance logic) |
+| **Documentation** | 6/10 | Complex role inheritance rules |
+| **Strategic Fit** | 8/10 | Foundation for M1 completion |
+| **TOTAL** | **66/100** | **4th Place** |
+
+**Verdict**: ⏸️ **DEFER TO DAY 8** (after tenant roles stable)
+
+---
+
+### 5. User Invitations
+
+| Criteria | Score | Justification |
+|----------|-------|---------------|
+| **Business Value** | 8/10 | Improves team collaboration |
+| **Technical Readiness** | 4/10 | Needs email + invitation workflow |
+| **Time Feasibility** | 4/10 | 10-12 hours (too much for Day 6) |
+| **MCP Preparation** | 5/10 | AI can suggest invitations (future) |
+| **Risk Level** | 6/10 | Complex workflow, state management |
+| **User Impact** | 8/10 | Essential for team onboarding |
+| **Dependencies Met** | 3/10 | Email service + UI needed ❌ |
+| **Test Complexity** | 5/10 | Workflow tests, expiration, resend |
+| **Documentation** | 7/10 | Standard invitation flow |
+| **Strategic Fit** | 7/10 | Better after email + roles stable |
+| **TOTAL** | **57/100** | **5th Place** |
+
+**Verdict**: ⏸️ **DEFER TO DAY 8-9** (after email service ready)
+
+---
+
+## Decision Matrix: Why Role Management API?
+
+### Technical Readiness (CRITICAL)
+
+| Feature | Database Schema | Email Service | Projects Module | RBAC System | Status |
+|---------|----------------|---------------|-----------------|-------------|--------|
+| **Role Management** | **✅ EXISTS** | **N/A** | **N/A** | **✅ COMPLETE** | **✅ READY** |
+| Email Verification | Needs table | ❌ NOT READY | N/A | N/A | ⏸️ BLOCKED |
+| Password Reset | Needs table | ❌ NOT READY | N/A | N/A | ⏸️ BLOCKED |
+| Project Roles | Needs table | N/A | ❌ NOT READY | ✅ COMPLETE | ⏸️ BLOCKED |
+| User Invitations | Needs table | ❌ NOT READY | N/A | ✅ COMPLETE | ⏸️ BLOCKED |
+
+**Conclusion**: Only Role Management API has all dependencies satisfied ✅
+
+---
+
+### Time Feasibility (CRITICAL)
+
+| Feature | Estimated Time | Day 6 Budget | Buffer | Fits Day 6? |
+|---------|---------------|--------------|--------|-------------|
+| **Role Management** | **6-8 hours** | **8 hours** | **0-2 hours** | **✅ YES** |
+| Email Verification | 8-10 hours | 8 hours | -2 hours | ❌ NO |
+| Password Reset | 6-8 hours | 8 hours | 0-2 hours | ⚠️ MAYBE (if email ready) |
+| Project Roles | 10-12 hours | 8 hours | -4 hours | ❌ NO |
+| User Invitations | 10-12 hours | 8 hours | -4 hours | ❌ NO |
+
+**Conclusion**: Only Role Management fits 8-hour Day 6 budget ✅
+
+---
+
+### Business Value vs. Complexity (CRITICAL)
+
+```
+High Value, Low Complexity = IMPLEMENT FIRST ✅
+High Value, High Complexity = DEFER (need more time)
+Low Value, Low Complexity = OPTIONAL
+Low Value, High Complexity = SKIP
+
+          HIGH VALUE
+              │
+              │  [4] Project Roles  [5] Invitations
+              │       (Defer)           (Defer)
+              │
+              │  [1] Role Mgmt ✅
+              │      (WINNER)
+              │
+              │  [2] Email Verify  [3] Password Reset
+              │       (Defer)           (Defer)
+              │
+              │
+    LOW COMPLEXITY ──────────────────── HIGH COMPLEXITY
+```
+
+**Conclusion**: Role Management is High Value + Medium Complexity = Best choice ✅
+
+---
+
+### Strategic Fit: Days 6-10 Pipeline
+
+**Day 6 → Day 8 → Day 9 → Day 10 Critical Path**:
+
+```
+Day 6: Role Management API ✅
+  │
+  ├─ Establishes role assignment patterns
+  ├─ Tests authorization policies
+  ├─ Validates RBAC system
+  │
+  ↓
+Day 8: Project-Level Roles
+  │
+  ├─ Reuses Day 6 patterns
+  ├─ Extends to project scope
+  ├─ Prepares for M1 Projects
+  │
+  ↓
+Day 9: Multi-Tenant Projects
+  │
+  ├─ Uses project roles from Day 8
+  ├─ Completes M1.1 core features
+  │
+  ↓
+Day 10: Sprint Management
+  │
+  ├─ Finalizes M1.1 milestone
+  │
+  ↓
+M1.1 COMPLETE ✅
+```
+
+**Day 7 (Parallel Track)**: Email Service + Verification + Password Reset
+- Independent of critical path
+- Can be implemented in parallel
+- No blockers for Days 8-10
+
+**Conclusion**: Day 6 Role Management is critical for Days 8-10 success ✅
+
+---
+
+## Risk vs. Value Quadrant
+
+```
+   HIGH RISK
+       │
+       │    [4] Project Roles
+       │    (Defer to Day 8)
+       │
+       │    [5] Invitations
+       │    (Defer to Day 8-9)
+       │
+       │
+───────┼───────────────────────
+       │
+       │    [2] Email Verify
+       │    [3] Password Reset
+       │    (Defer to Day 7)
+       │
+       │    [1] Role Mgmt ✅
+       │    (WINNER)
+       │
+   LOW RISK
+```
+
+**Conclusion**: Role Management is Low Risk + High Value = Safest choice ✅
+
+---
+
+## Final Recommendation Matrix
+
+| Feature | Score | Readiness | Time Fit | Risk | Strategic | Verdict |
+|---------|-------|-----------|----------|------|-----------|---------|
+| **Role Management** | **89/100** | **✅ READY** | **✅ 6-8h** | **✅ LOW** | **✅ CRITICAL** | **✅ IMPLEMENT DAY 6** |
+| Email Verification | 56/100 | ❌ Blocked | ❌ 8-10h | ⚠️ MEDIUM | ⚠️ MEDIUM | Defer to Day 7 |
+| Password Reset | 60/100 | ❌ Blocked | ✅ 6-8h | ⚠️ MEDIUM | ⚠️ MEDIUM | Defer to Day 7 |
+| Project Roles | 66/100 | ❌ Blocked | ❌ 10-12h | ❌ HIGH | ✅ CRITICAL | Defer to Day 8 |
+| User Invitations | 57/100 | ❌ Blocked | ❌ 10-12h | ⚠️ MEDIUM | ⚠️ MEDIUM | Defer to Day 8-9 |
+
+---
+
+## Conclusion
+
+**Day 6 Winner**: **Role Management API** 🏆
+
+**Reasons**:
+1. ✅ **Highest Score**: 89/100 (13 points ahead of 2nd place)
+2. ✅ **Only Ready Feature**: All dependencies satisfied
+3. ✅ **Perfect Time Fit**: 6-8 hours matches Day 6 budget
+4. ✅ **Lowest Risk**: Builds on existing RBAC system
+5. ✅ **Strategic Critical**: Required for Days 8-10 success
+
+**Action**: Proceed with Role Management API implementation
+
+**Next Reviews**:
+- Day 7: Email Service + Verification + Password Reset
+- Day 8: Project-Level Roles + Audit Logging
+- Day 9-10: M1.1 completion
+
+---
+
+**Prepared By**: Product Manager Agent
+**Date**: 2025-11-03
+**Version**: 1.0
+**Status**: Final Recommendation
--- a/reports/2025-11-03-Day-7-10-Roadmap.md
+++ b/reports/2025-11-03-Day-7-10-Roadmap.md
@@ -0,0 +1,549 @@
+# ColaFlow Days 7-10 Roadmap
+
+**Date**: 2025-11-03
+**Prepared By**: Product Manager Agent
+**Sprint**: M1 Sprint 2 - Enterprise-Grade Multi-Tenancy & SSO
+**Status**: Planning Complete
+
+---
+
+## Overview
+
+This roadmap outlines Days 7-10 of the 10-day sprint, building on the foundation established in Days 1-6 (Authentication, RBAC, Role Management).
+
+**Strategic Goal**: Complete M1.1 core features and prepare for M2 MCP integration.
+
+---
+
+## Day 7: Email Service + Verification + Password Reset
+
+**Duration**: 8 hours
+**Priority**: P1 (High - Security and UX)
+**Dependencies**: None (independent feature)
+
+### Objectives
+
+1. Integrate email service (SendGrid or SMTP)
+2. Implement email verification flow
+3. Implement password reset flow
+4. Create email templates
+5. Add rate limiting for security
+
+### Deliverables
+
+**Backend**:
+- Email service abstraction (`IEmailService`)
+- SendGrid implementation (primary)
+- SMTP fallback implementation
+- Email verification tokens (24-hour expiration)
+- Password reset tokens (1-hour expiration)
+- Rate limiting (max 5 verification emails/hour, max 3 reset emails/hour)
+
+**API Endpoints**:
+1. `POST /api/auth/verify-email` - Verify email with token
+2. `POST /api/auth/resend-verification` - Resend verification email
+3. `POST /api/auth/forgot-password` - Request password reset
+4. `POST /api/auth/reset-password` - Reset password with token
+
+**Database**:
+- Add `email_verified` column to `identity.users`
+- Add `email_verified_at` column
+- Create `email_verification_tokens` table
+- Create `password_reset_tokens` table
+
+**Email Templates**:
+- Welcome + verification email
+- Password reset email
+- Password changed confirmation email
+
+**Tests**:
+- 20+ integration tests
+- Email delivery verification (use test inbox)
+- Token expiration tests
+- Rate limiting tests
+
+### Success Criteria
+
+- ✅ Emails sent successfully (99% delivery rate)
+- ✅ Verification flow completes in < 30 seconds
+- ✅ Password reset flow completes in < 30 seconds
+- ✅ Rate limiting prevents abuse
+- ✅ 100% test coverage
+
+---
+
+## Day 8: Project-Level Roles + Audit Logging
+
+**Duration**: 8 hours
+**Priority**: P0 (Critical - Required for M1 Projects module)
+**Dependencies**: Day 6 (Role Management API)
+
+### Objectives
+
+1. Design and implement project-level role system
+2. Implement role inheritance logic
+3. Create authorization policies for project operations
+4. Implement comprehensive audit logging
+5. Prepare for M1.1 Projects CRUD
+
+### Deliverables
+
+**Domain Layer**:
+- `ProjectRole` enum (ProjectOwner, ProjectManager, ProjectMember, ProjectGuest)
+- `UserProjectRole` entity
+- `IUserProjectRoleRepository` interface
+- Role inheritance rules:
+  - TenantOwner → ProjectOwner (all projects)
+  - TenantAdmin → ProjectManager (all projects)
+  - Project-specific roles override tenant defaults
+
+**Database**:
+```sql
+CREATE TABLE projects.user_project_roles (
+    id UUID PRIMARY KEY,
+    user_id UUID NOT NULL,
+    project_id UUID NOT NULL,
+    role VARCHAR(50) NOT NULL,
+    assigned_at TIMESTAMP NOT NULL,
+    assigned_by_user_id UUID NULL,
+    UNIQUE(user_id, project_id)
+);
+```
+
+**Authorization Policies**:
+- `RequireProjectOwner` - Full control over project
+- `RequireProjectManager` - Manage tasks and team
+- `RequireProjectMember` - Create and update tasks
+- `RequireProjectAccess` - Read-only access
+
+**Audit Logging**:
+```sql
+CREATE TABLE audit.audit_logs (
+    id UUID PRIMARY KEY,
+    tenant_id UUID NOT NULL,
+    user_id UUID NOT NULL,
+    action VARCHAR(100) NOT NULL,
+    entity_type VARCHAR(50) NOT NULL,
+    entity_id UUID NULL,
+    old_value JSONB NULL,
+    new_value JSONB NULL,
+    ip_address VARCHAR(50) NULL,
+    user_agent VARCHAR(500) NULL,
+    timestamp TIMESTAMP NOT NULL DEFAULT NOW()
+);
+```
+
+**API Endpoints**:
+1. `POST /api/projects/{projectId}/members` - Add member to project
+2. `PUT /api/projects/{projectId}/members/{userId}/role` - Update member role
+3. `DELETE /api/projects/{projectId}/members/{userId}` - Remove member
+4. `GET /api/projects/{projectId}/members` - List project members
+5. `GET /api/audit/logs` - Query audit logs (TenantOwner only)
+
+**Tests**:
+- 25+ integration tests
+- Role inheritance tests
+- Authorization policy tests
+- Audit log verification
+
+### Success Criteria
+
+- ✅ Role inheritance works correctly
+- ✅ All API operations logged
+- ✅ Authorization policies enforce project-level permissions
+- ✅ 100% test coverage
+
+---
+
+## Day 9: M1 Core Projects Module - Multi-Tenant Update
+
+**Duration**: 8 hours
+**Priority**: P0 (Critical - M1.1 core feature)
+**Dependencies**: Day 8 (Project-level roles)
+
+### Objectives
+
+1. Update existing Projects module for multi-tenancy
+2. Add project-level authorization
+3. Integrate project roles
+4. Complete Epics, Stories, Tasks multi-tenant update
+5. Test full workflow (register → create project → manage tasks)
+
+### Deliverables
+
+**Database Migration**:
+- Add `tenant_id` column to `projects.projects`
+- Add `tenant_id` column to `projects.epics`
+- Add `tenant_id` column to `projects.stories`
+- Add `tenant_id` column to `projects.tasks`
+- Update foreign keys
+- Add EF Core global query filters
+
+**Application Layer Updates**:
+- Update all commands to include tenant context
+- Add project role validation
+- Update queries to filter by tenant
+
+**API Updates**:
+- Protect all endpoints with project-level authorization
+- Example: `[Authorize(Policy = "RequireProjectMember")]`
+- Add tenant validation middleware
+
+**Tests**:
+- 30+ integration tests
+- Cross-tenant isolation tests
+- Project role authorization tests
+- Full workflow tests (E2E)
+
+### Success Criteria
+
+- ✅ All Projects/Epics/Stories/Tasks isolated by tenant
+- ✅ Project-level authorization works
+- ✅ No cross-tenant data leakage
+- ✅ 100% test coverage
+- ✅ Full E2E workflow passes
+
+---
+
+## Day 10: Kanban Workflow + Sprint Management
+
+**Duration**: 8 hours
+**Priority**: P1 (High - M1.1 core feature)
+**Dependencies**: Day 9 (Projects module updated)
+
+### Objectives
+
+1. Implement Sprint management
+2. Enhance Kanban board with sprint support
+3. Add sprint burndown chart data
+4. Implement sprint velocity tracking
+5. Complete M1.1 core features
+
+### Deliverables
+
+**Domain Layer**:
+- `Sprint` entity
+- `SprintId` value object
+- Sprint status (Planning, Active, Completed)
+- Sprint business rules (start/end dates, task capacity)
+
+**Database**:
+```sql
+CREATE TABLE projects.sprints (
+    id UUID PRIMARY KEY,
+    project_id UUID NOT NULL,
+    tenant_id UUID NOT NULL,
+    name VARCHAR(100) NOT NULL,
+    goal TEXT NULL,
+    start_date DATE NOT NULL,
+    end_date DATE NOT NULL,
+    status VARCHAR(20) NOT NULL,
+    created_at TIMESTAMP NOT NULL,
+    FOREIGN KEY (project_id) REFERENCES projects.projects(id)
+);
+
+ALTER TABLE projects.tasks
+ADD COLUMN sprint_id UUID NULL,
+ADD CONSTRAINT fk_tasks_sprints FOREIGN KEY (sprint_id) REFERENCES projects.sprints(id);
+```
+
+**API Endpoints**:
+1. `POST /api/projects/{projectId}/sprints` - Create sprint
+2. `PUT /api/projects/{projectId}/sprints/{sprintId}` - Update sprint
+3. `DELETE /api/projects/{projectId}/sprints/{sprintId}` - Delete sprint
+4. `POST /api/projects/{projectId}/sprints/{sprintId}/start` - Start sprint
+5. `POST /api/projects/{projectId}/sprints/{sprintId}/complete` - Complete sprint
+6. `GET /api/projects/{projectId}/sprints` - List sprints
+7. `GET /api/projects/{projectId}/sprints/{sprintId}/burndown` - Burndown data
+8. `POST /api/projects/{projectId}/tasks/{taskId}/assign-to-sprint` - Add task to sprint
+
+**Analytics**:
+- Sprint burndown chart data (remaining story points per day)
+- Sprint velocity (completed story points per sprint)
+- Sprint completion percentage
+- Team capacity utilization
+
+**Tests**:
+- 20+ integration tests
+- Sprint workflow tests
+- Burndown calculation tests
+- Velocity tracking tests
+
+### Success Criteria
+
+- ✅ Full sprint lifecycle works (create → start → complete)
+- ✅ Tasks can be assigned to sprints
+- ✅ Burndown chart data accurate
+- ✅ Velocity tracking functional
+- ✅ 100% test coverage
+- ✅ **M1.1 COMPLETE**
+
+---
+
+## Summary Timeline
+
+| Day | Feature | Priority | Hours | Dependencies | Risk |
+|-----|---------|----------|-------|--------------|------|
+| **6** | Role Management API | P0 | 6-8 | Day 5 RBAC | LOW |
+| **7** | Email Service + Verification + Password Reset | P1 | 8 | None | MEDIUM |
+| **8** | Project-Level Roles + Audit Logging | P0 | 8 | Day 6 | MEDIUM |
+| **9** | Projects Multi-Tenant Update | P0 | 8 | Day 8 | MEDIUM |
+| **10** | Kanban Workflow + Sprint Management | P1 | 8 | Day 9 | LOW |
+
+**Total Days**: 5 days (Days 6-10)
+**Total Hours**: 38-40 hours
+**Critical Path**: Day 6 → Day 8 → Day 9 → Day 10
+
+---
+
+## Milestone Completion Status
+
+### M1.1 - Core Project Module (Days 1-10)
+
+**Progress**: 83% → 100% (after Day 10)
+
+**Completed** (Days 1-5):
+- ✅ Domain layer (Projects, Epics, Stories, Tasks)
+- ✅ Infrastructure layer (EF Core, PostgreSQL)
+- ✅ Application layer (CQRS commands/queries)
+- ✅ API layer (RESTful endpoints)
+- ✅ Unit tests (96.98% coverage)
+- ✅ JWT authentication
+- ✅ Refresh token mechanism
+- ✅ RBAC system (5 tenant roles)
+
+**Remaining** (Days 6-10):
+- [ ] Role Management API (Day 6)
+- [ ] Email verification (Day 7)
+- [ ] Project-level roles (Day 8)
+- [ ] Multi-tenant Projects update (Day 9)
+- [ ] Sprint management (Day 10)
+
+**After Day 10**:
+- ✅ M1.1 **100% COMPLETE**
+- ✅ Ready for M1.2 (SSO Integration)
+- ✅ Ready for M2 (MCP Server)
+
+---
+
+## Days 11-12: M2 MCP Server Foundation (Optional Extension)
+
+**Duration**: 16 hours (2 days)
+**Priority**: P0 (Critical for M2 milestone)
+**Dependencies**: Days 6-10 complete
+
+### Objectives
+
+1. Design MCP authentication architecture
+2. Implement MCP token generation
+3. Create preview and approval workflow
+4. Implement basic MCP resources
+5. Implement basic MCP tools
+
+### High-Level Deliverables
+
+**MCP Authentication**:
+- MCP token format: `mcp_<tenant_slug>_<random_32_chars>`
+- Token scopes: read, create, update, delete, execute
+- Token expiration: 90 days (configurable)
+- Token revocation
+
+**Database**:
+```sql
+CREATE TABLE identity.mcp_tokens (
+    id UUID PRIMARY KEY,
+    tenant_id UUID NOT NULL,
+    token_hash VARCHAR(500) NOT NULL UNIQUE,
+    name VARCHAR(100) NOT NULL,
+    scopes JSONB NOT NULL,
+    expires_at TIMESTAMP NOT NULL,
+    created_by_user_id UUID NOT NULL,
+    created_at TIMESTAMP NOT NULL,
+    last_used_at TIMESTAMP NULL
+);
+```
+
+**Preview System**:
+```sql
+CREATE TABLE mcp.previews (
+    id UUID PRIMARY KEY,
+    tenant_id UUID NOT NULL,
+    mcp_token_id UUID NOT NULL,
+    operation VARCHAR(100) NOT NULL,
+    entity_type VARCHAR(50) NOT NULL,
+    entity_id UUID NULL,
+    diff JSONB NOT NULL,
+    status VARCHAR(20) NOT NULL, -- Pending, Approved, Rejected
+    created_at TIMESTAMP NOT NULL,
+    reviewed_by_user_id UUID NULL,
+    reviewed_at TIMESTAMP NULL
+);
+```
+
+**MCP Resources** (Read-only):
+- `projects.search` - Search projects
+- `projects.get` - Get project details
+- `tasks.list` - List tasks
+- `tasks.get` - Get task details
+- `reports.daily` - Daily progress report
+
+**MCP Tools** (Write with preview):
+- `create_task` - Create task (requires approval)
+- `update_task_status` - Update task status (requires approval)
+- `add_comment` - Add comment to task (auto-approved)
+- `assign_task` - Assign task to user (requires approval)
+
+**API Endpoints**:
+1. `POST /api/mcp/tokens` - Generate MCP token
+2. `GET /api/mcp/tokens` - List tokens
+3. `DELETE /api/mcp/tokens/{tokenId}` - Revoke token
+4. `POST /api/mcp/preview` - Create preview for approval
+5. `POST /api/mcp/preview/{previewId}/approve` - Approve preview
+6. `POST /api/mcp/preview/{previewId}/reject` - Reject preview
+7. `GET /api/mcp/resources/{resourceId}` - MCP resource endpoint
+8. `POST /api/mcp/tools/{toolName}` - MCP tool endpoint
+
+**Tests**:
+- 40+ integration tests
+- MCP authentication tests
+- Preview workflow tests
+- Resource access tests
+- Tool execution tests
+
+### Success Criteria
+
+- ✅ MCP tokens generated and validated
+- ✅ Preview workflow works (create → approve/reject → execute)
+- ✅ All MCP resources accessible
+- ✅ All MCP tools functional
+- ✅ 100% test coverage
+- ✅ **M2.1 Foundation COMPLETE**
+
+---
+
+## Risk Management
+
+### High-Risk Items
+
+| Risk | Impact | Probability | Mitigation |
+|------|--------|-------------|------------|
+| Day 8 complexity (project roles) | HIGH | MEDIUM | Start simple, iterate later |
+| Email service delays (Day 7) | MEDIUM | MEDIUM | Use SMTP fallback |
+| Scope creep (Days 11-12) | HIGH | HIGH | Strictly time-box, defer to Sprint 3 |
+| Cross-tenant bugs (Day 9) | HIGH | LOW | Comprehensive integration tests |
+
+### Mitigation Strategies
+
+1. **Daily check-ins**: Review progress at end of each day
+2. **Time-boxing**: Strictly limit each day to 8 hours
+3. **Test-first approach**: Write tests before implementation
+4. **Code reviews**: Backend agent reviews all code
+5. **Incremental delivery**: Deploy after each day
+
+---
+
+## Success Metrics
+
+### Sprint Success Criteria (Days 6-10)
+
+- ✅ All deliverables completed on time
+- ✅ Zero critical bugs in production
+- ✅ 100% test coverage maintained
+- ✅ M1.1 milestone 100% complete
+- ✅ Ready for M2 MCP integration
+
+### Quality Metrics
+
+- **Test Coverage**: ≥ 85% (current: 96.98%)
+- **API Response Time**: < 200ms (p95)
+- **Bug Density**: ≤ 0.5 bugs per feature
+- **Code Quality**: No SonarQube violations
+- **Documentation**: 100% API endpoints documented
+
+### Business Metrics
+
+- **Feature Completion Rate**: 100% (no deferred features)
+- **Development Velocity**: 5 features in 5 days
+- **Time to Market**: M1.1 completed in 10 days (on schedule)
+- **Customer Value**: Complete authentication + authorization + role management
+
+---
+
+## Recommendations
+
+### Immediate Actions (Day 6)
+
+1. ✅ Approve Day 6 planning document
+2. ✅ Assign Role Management API to backend agent
+3. ✅ Begin implementation (6-8 hours)
+4. ✅ Deploy to development environment
+
+### Medium-Term Actions (Days 7-10)
+
+1. Review and approve each day's plan before starting
+2. Daily progress check-ins
+3. Continuous integration testing
+4. Code reviews after each feature
+
+### Long-Term Actions (M2)
+
+1. Plan M2 MCP integration (16-hour sprint)
+2. Design AI agent interaction patterns
+3. Implement preview and approval workflow
+4. Test ChatGPT/Claude integration
+
+---
+
+## Alternative Scenarios
+
+### Scenario 1: Days 11-12 Deferred
+
+**If** scope exceeds 10 days:
+- **Action**: Defer MCP foundation to Sprint 3
+- **Impact**: Delays M2 milestone by 1-2 weeks
+- **Mitigation**: Focus on M1.1 completion first
+
+### Scenario 2: Email Service Issues (Day 7)
+
+**If** SendGrid integration fails:
+- **Action**: Use SMTP fallback (Gmail or local SMTP)
+- **Impact**: Slower email delivery, no analytics
+- **Mitigation**: Implement SendGrid in Sprint 3
+
+### Scenario 3: Project Roles Too Complex (Day 8)
+
+**If** role inheritance exceeds 8 hours:
+- **Action**: Simplify to basic project roles (no inheritance)
+- **Impact**: TenantOwner must be explicitly added to projects
+- **Mitigation**: Add inheritance in Sprint 3
+
+---
+
+## Conclusion
+
+**Days 7-10 Roadmap**: Comprehensive plan to complete M1.1 milestone
+
+**Key Milestones**:
+- Day 7: Email infrastructure
+- Day 8: Project-level authorization
+- Day 9: Multi-tenant Projects
+- Day 10: Sprint management
+- **M1.1 100% COMPLETE**
+
+**Next Sprint** (M1.2 - Optional):
+- Days 11-12: MCP Server foundation
+- M2 milestone kickoff
+
+**Strategic Value**:
+- Complete authentication/authorization stack
+- Enable multi-tenant SaaS operations
+- Prepare for AI/MCP integration
+- Deliver enterprise-grade features
+
+---
+
+**Document Status**: ✅ Planning Complete - Ready for Execution
+
+**Prepared By**: Product Manager Agent
+**Date**: 2025-11-03
+**Version**: 1.0