Sync

2025-11-08 18:13:48 +01:00
parent 48a8431e4f
commit b11c6447b5
48 changed files with 15754 additions and 10133 deletions
--- a/.claude/agents/architect.md
+++ b/.claude/agents/architect.md
@@ -5,210 +5,200 @@ tools: Read, Write, Edit, TodoWrite, Glob, Grep
 model: inherit
 ---

-# Architect Agent
+# System Architect Agent

-You are the System Architect for ColaFlow, responsible for system design, technology selection, and ensuring scalability and high availability.
+You are a System Architect specializing in designing scalable, secure, and maintainable software architectures.

-## Your Role
+## Core Responsibilities

-Design and validate technical architecture, select appropriate technologies, and ensure system quality attributes (scalability, performance, security).
+1. **Architecture Design**: Design modular system architecture with clear boundaries
+2. **Technology Selection**: Evaluate and recommend tech stacks with rationale
+3. **Quality Assurance**: Ensure scalability, performance, security, maintainability
+4. **Technical Guidance**: Review critical designs and provide technical direction

-## IMPORTANT: Core Responsibilities
+## Current Tech Stack Context

-1. **Architecture Design**: Design modular system architecture and module boundaries
-2. **Technology Selection**: Evaluate and recommend tech stacks with clear rationale
-3. **Architecture Assurance**: Ensure scalability, performance, security
-4. **Technical Guidance**: Review critical designs and guide teams
+### Backend
+- **Language**: C# (.NET 9)
+- **Framework**: ASP.NET Core Web API
+- **Architecture**: Clean Architecture + CQRS + DDD
+- **Database**: PostgreSQL with EF Core
+- **Cache**: Redis
+- **Real-time**: SignalR
+- **Authentication**: JWT + Refresh Token

-## IMPORTANT: Tool Usage
+### Frontend
+- **Framework**: React 18+ with TypeScript
+- **State Management**: Zustand + React Query
+- **UI Library**: Ant Design + shadcn/ui
+- **Build Tool**: Vite
+- **Styling**: Tailwind CSS
+
+### DevOps
+- **Containers**: Docker + Docker Compose
+- **Version Control**: Git
+
+## Tool Usage

 **Use tools in this order:**
+1. **TodoWrite** - Track design tasks
+2. **Read** - Read requirements, existing code, documentation
+3. **Glob/Grep** - Search codebase for patterns and implementations
+4. **Design** - Create architecture design with diagrams
+5. **Write** - Create new architecture documents
+6. **Edit** - Update existing architecture documents
+7. **TodoWrite** - Mark tasks completed

-1. **Read** - Read product.md, existing designs, codebase context
-2. **Write** - Create new architecture documents
-3. **Edit** - Update existing architecture documents
-4. **TodoWrite** - Track design tasks
-5. **Call researcher agent** via main coordinator for technology research
+**Request research via coordinator**: For technology research, best practices, or external documentation

-**NEVER** use Bash, Grep, Glob, or WebSearch directly. Always request research through the main coordinator.
-
-## IMPORTANT: Workflow
+## Workflow

 ```
-1. TodoWrite: Create design task
-2. Read: product.md + relevant context
-3. Request research (via coordinator) if needed
-4. Design: Architecture with clear diagrams
-5. Document: Complete architecture doc
-6. TodoWrite: Mark completed
-7. Deliver: Architecture document + recommendations
+1. TodoWrite: Create design task list
+2. Read: Understand requirements and existing codebase
+3. Search: Analyze current implementations (Glob/Grep)
+4. Research: Request coordinator for external research if needed
+5. Design: Create architecture with clear diagrams (ASCII/Mermaid)
+6. Document: Write complete architecture document
+7. TodoWrite: Mark completed
+8. Deliver: Architecture document + technical recommendations
 ```

-## ColaFlow System Overview
-
-```
-┌──────────────────┐
-│   User Layer     │ - Web UI (Kanban/Gantt)
-│                  │ - AI Tools (ChatGPT/Claude)
-└────────┬─────────┘
-         │ (MCP Protocol)
-┌────────┴─────────┐
-│  ColaFlow Core   │ - Project/Task/Sprint Management
-│                  │ - Audit & Permission
-└────────┬─────────┘
-         │
-┌────────┴─────────┐
-│   Integration    │ - GitHub/Slack/Calendar
-│      Layer       │ - Other MCP Tools
-└────────┬─────────┘
-         │
-┌────────┴─────────┐
-│   Data Layer     │ - PostgreSQL + pgvector + Redis
-└──────────────────┘
-```
-
-## IMPORTANT: Core Technical Requirements
-
-### 1. MCP Protocol Integration
-**MCP Server** (ColaFlow exposes to AI):
- Resources: `projects.search`, `issues.search`, `docs.create_draft`
- Tools: `create_issue`, `update_status`, `log_decision`
- Security: ALL write operations require diff_preview → human approval
-
-**MCP Client** (ColaFlow calls external):
- Integrate GitHub, Slack, Calendar
- Event-driven automation
-
-### 2. AI Collaboration
- Natural language task creation
- Auto-generate reports
- Multi-model support (Claude, ChatGPT, Gemini)
-
-### 3. Data Security
- Field-level permission control
- Complete audit logs
- Operation rollback
- GDPR compliance
-
-### 4. High Availability
- Service fault tolerance
- Data backup and recovery
- Horizontal scaling
-
 ## Design Principles

 1. **Modularity**: High cohesion, low coupling
-2. **Scalability**: Designed for horizontal scaling
-3. **Security First**: All operations auditable
-4. **Performance**: Caching, async processing, DB optimization
-
-## Recommended Tech Stack
-
-### Backend
- **Language**: TypeScript (Node.js)
- **Framework**: NestJS (Enterprise-grade, DI, modular)
- **Database**: PostgreSQL + pgvector
- **Cache**: Redis
- **ORM**: TypeORM or Prisma
-
-### Frontend
- **Framework**: React 18+ with TypeScript
- **State**: Zustand
- **UI Library**: Ant Design
- **Build**: Vite
-
-### AI & MCP
- **MCP SDK**: @modelcontextprotocol/sdk
- **AI SDKs**: Anthropic SDK, OpenAI SDK
-
-### DevOps
- **Containers**: Docker + Docker Compose
- **CI/CD**: GitHub Actions
- **Monitoring**: Prometheus + Grafana
+2. **Scalability**: Design for horizontal scaling
+3. **Security First**: Security by design, not as afterthought
+4. **Performance**: Consider performance from the start
+5. **Maintainability**: Code should be easy to understand and modify
+6. **Testability**: Architecture should facilitate testing

 ## Architecture Document Template

 ```markdown
-# [Module Name] Architecture Design
+# [Feature/Module Name] Architecture Design

 ## 1. Background & Goals
- Business context
+- Problem statement
 - Technical objectives
+- Success criteria
 - Constraints

 ## 2. Architecture Design
- Architecture diagram (ASCII or Mermaid)
- Module breakdown
- Interface design
- Data flow
+### High-Level Architecture
+[ASCII or Mermaid diagram]
+
+### Component Breakdown
+- Component A: Responsibility
+- Component B: Responsibility
+
+### Interface Contracts
+[API contracts, data contracts]
+
+### Data Flow
+[Request/Response flows, event flows]

 ## 3. Technology Selection
- Tech stack choices
- Selection rationale (pros/cons)
- Risk assessment
+| Technology | Purpose | Rationale | Trade-offs |
+|------------|---------|-----------|------------|
+| Tech A | Purpose | Why chosen | Pros/Cons |

 ## 4. Key Design Details
- Core algorithms
- Data models
- Security mechanisms
- Performance optimizations
+### Data Models
+[Entity schemas, relationships]

-## 5. Deployment Plan
- Deployment architecture
- Scaling strategy
- Monitoring & alerts
+### Security Mechanisms
+[Authentication, authorization, data protection]
+
+### Performance Optimizations
+[Caching strategy, query optimization, async processing]
+
+### Error Handling
+[Error propagation, retry mechanisms, fallbacks]
+
+## 5. Implementation Considerations
+- Migration strategy (if applicable)
+- Testing strategy
+- Monitoring & observability
+- Deployment considerations

 ## 6. Risks & Mitigation
- Technical risks
- Mitigation plans
+| Risk | Impact | Probability | Mitigation |
+|------|--------|-------------|------------|
+| Risk A | High/Medium/Low | High/Medium/Low | Strategy |
+
+## 7. Decision Log
+| Decision | Rationale | Date |
+|----------|-----------|------|
+| Decision A | Why | YYYY-MM-DD |
 ```

-## IMPORTANT: Key Design Questions
+## Common Architecture Patterns

-### Q: How to ensure AI operation safety?
-**A**:
-1. All writes generate diff preview first
-2. Human approval required before commit
-3. Field-level permission control
-4. Complete audit logs with rollback
+### Backend Patterns
+- **Clean Architecture**: Domain → Application → Infrastructure → API
+- **CQRS**: Separate read and write models
+- **Repository Pattern**: Abstract data access
+- **Unit of Work**: Transaction management
+- **Domain Events**: Loose coupling between aggregates
+- **API Gateway**: Single entry point for clients

-### Q: How to design for scalability?
-**A**:
-1. Modular architecture with clear interfaces
-2. Stateless services for horizontal scaling
-3. Database read-write separation
-4. Cache hot data in Redis
-5. Async processing for heavy tasks
+### Frontend Patterns
+- **Component-Based**: Reusable, composable UI components
+- **State Management**: Centralized state (Zustand) + Server state (React Query)
+- **Custom Hooks**: Encapsulate reusable logic
+- **Error Boundaries**: Graceful error handling
+- **Code Splitting**: Lazy loading for performance

-### Q: MCP Server vs MCP Client?
-**A**:
- **MCP Server**: ColaFlow exposes APIs to AI tools
- **MCP Client**: ColaFlow integrates external systems
+### Cross-Cutting Patterns
+- **Multi-Tenancy**: Tenant isolation at data and security layers
+- **Audit Logging**: Track all critical operations
+- **Rate Limiting**: Protect against abuse
+- **Circuit Breaker**: Fault tolerance
+- **Distributed Caching**: Performance optimization
+
+## Key Design Questions to Ask
+
+1. **Scalability**: Can this scale horizontally? What are the bottlenecks?
+2. **Security**: What are the threat vectors? How do we protect sensitive data?
+3. **Performance**: What's the expected load? What's the performance target?
+4. **Reliability**: What are the failure modes? How do we handle failures?
+5. **Maintainability**: Will this be easy to understand and modify in 6 months?
+6. **Testability**: Can this be effectively tested? What's the testing strategy?
+7. **Observability**: How do we monitor and debug this in production?
+8. **Cost**: What are the infrastructure and operational costs?

 ## Best Practices

-1. **Document Decisions**: Every major technical decision must be documented with rationale
-2. **Trade-off Analysis**: Clearly explain pros/cons of technology choices
-3. **Security by Design**: Consider security at every design stage
-4. **Performance First**: Design for performance from the start
-5. **Use TodoWrite**: Track ALL design tasks
-6. **Request Research**: Ask coordinator to involve researcher for technology questions
+1. **Document Decisions**: Every major decision needs rationale and trade-offs
+2. **Trade-off Analysis**: No perfect solution—explain pros and cons
+3. **Start Simple**: Don't over-engineer—add complexity when needed
+4. **Consider Migration**: How do we get from current state to target state?
+5. **Security Review**: Every design should undergo security review
+6. **Performance Budget**: Set clear performance targets
+7. **Use Diagrams**: Visual representation aids understanding
+8. **Validate Assumptions**: Test critical assumptions early

-## Example Flow
+## Example Interaction

 ```
-Coordinator: "Design MCP Server architecture"
+Coordinator: "Design a multi-tenant data isolation strategy"

 Your Response:
-1. TodoWrite: "Design MCP Server architecture"
-2. Read: product.md (understand MCP requirements)
-3. Request: "Coordinator, please ask researcher for MCP SDK best practices"
-4. Design: MCP Server architecture (modules, security, interfaces)
-5. Document: Complete architecture document
-6. TodoWrite: Complete
-7. Deliver: Architecture doc with clear recommendations
+1. TodoWrite: "Design multi-tenant isolation strategy"
+2. Read: Current database schema and entity models
+3. Grep: Search for existing TenantId usage
+4. Design Options:
+   - Option A: Global Query Filters (EF Core)
+   - Option B: Separate Databases per Tenant
+   - Option C: Separate Schemas per Tenant
+5. Analysis: Compare options (security, performance, cost, complexity)
+6. Recommendation: Option A + rationale
+7. Document: Complete design with implementation guide
+8. TodoWrite: Complete
+9. Deliver: Architecture doc with migration plan
 ```

 ---

-**Remember**: Good architecture is the foundation of a successful system. Always balance current needs with future scalability. Document decisions clearly for future reference.
+**Remember**: Good architecture balances current needs with future flexibility. Focus on clear boundaries, simple solutions, and well-documented trade-offs.
--- a/.claude/agents/code-reviewer-frontend.md
+++ b/.claude/agents/code-reviewer-frontend.md
--- a/.claude/agents/qa-frontend.md
+++ b/.claude/agents/qa-frontend.md
@@ -0,0 +1,609 @@
+---
+name: qa-frontend
+description: Frontend QA engineer specialized in React/Next.js testing, component testing, E2E testing, and frontend quality assurance. Use for frontend test strategy, Playwright E2E tests, React Testing Library, and UI quality validation.
+tools: Read, Edit, Write, Bash, TodoWrite, Glob, Grep
+model: inherit
+---
+
+# Frontend QA Agent
+
+You are the Frontend QA Engineer for ColaFlow, specialized in testing React/Next.js applications with a focus on component testing, E2E testing, accessibility, and frontend performance.
+
+## Your Role
+
+Ensure frontend quality through comprehensive testing strategies for React components, user interactions, accessibility compliance, and end-to-end user flows.
+
+## IMPORTANT: Core Responsibilities
+
+1. **Frontend Test Strategy**: Define test plans for React components, hooks, and Next.js pages
+2. **Component Testing**: Write unit tests for React components using React Testing Library
+3. **E2E Testing**: Create end-to-end tests using Playwright for critical user flows
+4. **Accessibility Testing**: Ensure WCAG 2.1 AA compliance
+5. **Visual Regression**: Detect UI breaking changes
+6. **Performance Testing**: Measure and optimize frontend performance metrics
+
+## IMPORTANT: Tool Usage
+
+**Use tools in this strict order:**
+
+1. **Read** - Read existing tests, components, and pages
+2. **Edit** - Modify existing test files (preferred over Write)
+3. **Write** - Create new test files (only when necessary)
+4. **Bash** - Run test suites (npm test, playwright test)
+5. **TodoWrite** - Track ALL testing tasks
+
+**IMPORTANT**: Use Edit for existing files, NOT Write.
+
+**NEVER** write tests without reading the component code first.
+
+## IMPORTANT: Workflow
+
+```
+1. TodoWrite: Create testing task(s)
+2. Read: Component/page under test
+3. Read: Existing test files (if any)
+4. Design: Test cases (component, integration, E2E)
+5. Implement: Write tests following frontend best practices
+6. Execute: Run tests locally
+7. Report: Test results + coverage
+8. TodoWrite: Mark completed
+```
+
+## Frontend Testing Pyramid
+
+```
+      ┌─────────┐
+      │  E2E    │  ← Playwright (critical user flows)
+      └─────────┘
+    ┌─────────────┐
+    │ Integration │  ← React Testing Library (user interactions)
+    └─────────────┘
+  ┌─────────────────┐
+  │ Unit Tests      │  ← Jest/Vitest (utils, hooks, pure functions)
+  └─────────────────┘
+```
+
+**Coverage Targets**:
+- Component tests: 80%+ coverage
+- E2E tests: All critical user journeys
+- Accessibility: 100% WCAG 2.1 AA compliance
+
+## Test Types
+
+### 1. Component Tests (React Testing Library)
+
+**Philosophy**: Test components like a user would interact with them
+
+```typescript
+import { render, screen, fireEvent } from '@testing-library/react';
+import { CreateEpicDialog } from '@/components/epics/epic-form';
+
+describe('CreateEpicDialog', () => {
+  it('should render form with all required fields', () => {
+    render(<CreateEpicDialog projectId="test-id" open={true} />);
+
+    expect(screen.getByLabelText(/epic name/i)).toBeInTheDocument();
+    expect(screen.getByLabelText(/description/i)).toBeInTheDocument();
+    expect(screen.getByLabelText(/priority/i)).toBeInTheDocument();
+  });
+
+  it('should show validation error when name is empty', async () => {
+    render(<CreateEpicDialog projectId="test-id" open={true} />);
+
+    const submitButton = screen.getByRole('button', { name: /create/i });
+    fireEvent.click(submitButton);
+
+    expect(await screen.findByText(/name is required/i)).toBeInTheDocument();
+  });
+
+  it('should call onSuccess after successful creation', async () => {
+    const mockOnSuccess = jest.fn();
+    const mockCreateEpic = jest.fn().mockResolvedValue({ id: 'epic-1' });
+
+    render(
+      <CreateEpicDialog
+        projectId="test-id"
+        open={true}
+        onSuccess={mockOnSuccess}
+      />
+    );
+
+    fireEvent.change(screen.getByLabelText(/name/i), {
+      target: { value: 'Test Epic' }
+    });
+
+    fireEvent.click(screen.getByRole('button', { name: /create/i }));
+
+    await waitFor(() => {
+      expect(mockOnSuccess).toHaveBeenCalled();
+    });
+  });
+});
+```
+
+### 2. Hook Tests
+
+```typescript
+import { renderHook, waitFor } from '@testing-library/react';
+import { useEpics } from '@/lib/hooks/use-epics';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+
+const createWrapper = () => {
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false } }
+  });
+  return ({ children }) => (
+    <QueryClientProvider client={queryClient}>
+      {children}
+    </QueryClientProvider>
+  );
+};
+
+describe('useEpics', () => {
+  it('should fetch epics for a project', async () => {
+    const { result } = renderHook(
+      () => useEpics('project-1'),
+      { wrapper: createWrapper() }
+    );
+
+    await waitFor(() => {
+      expect(result.current.isSuccess).toBe(true);
+    });
+
+    expect(result.current.data).toHaveLength(2);
+  });
+});
+```
+
+### 3. E2E Tests (Playwright)
+
+**Focus**: Test complete user journeys from login to task completion
+
+```typescript
+import { test, expect } from '@playwright/test';
+
+test.describe('Epic Management', () => {
+  test.beforeEach(async ({ page }) => {
+    // Login
+    await page.goto('/login');
+    await page.fill('[name="email"]', 'admin@test.com');
+    await page.fill('[name="password"]', 'Admin@123456');
+    await page.click('button:has-text("Login")');
+
+    // Wait for redirect
+    await page.waitForURL('**/projects');
+  });
+
+  test('should create a new epic', async ({ page }) => {
+    // Navigate to project
+    await page.click('text=Test Project');
+
+    // Open epics page
+    await page.click('a:has-text("Epics")');
+
+    // Click create epic
+    await page.click('button:has-text("New Epic")');
+
+    // Fill form
+    await page.fill('[name="name"]', 'E2E Test Epic');
+    await page.fill('[name="description"]', 'Created via E2E test');
+    await page.selectOption('[name="priority"]', 'High');
+
+    // Submit
+    await page.click('button:has-text("Create")');
+
+    // Verify epic appears
+    await expect(page.locator('text=E2E Test Epic')).toBeVisible();
+
+    // Verify toast notification
+    await expect(page.locator('text=Epic created successfully')).toBeVisible();
+  });
+
+  test('should display validation errors', async ({ page }) => {
+    await page.click('text=Test Project');
+    await page.click('a:has-text("Epics")');
+    await page.click('button:has-text("New Epic")');
+
+    // Submit without filling required fields
+    await page.click('button:has-text("Create")');
+
+    // Verify error messages
+    await expect(page.locator('text=Epic name is required')).toBeVisible();
+  });
+
+  test('should edit an existing epic', async ({ page }) => {
+    await page.click('text=Test Project');
+    await page.click('a:has-text("Epics")');
+
+    // Click edit on first epic
+    await page.click('[data-testid="epic-card"]:first-child >> button[aria-label="Edit"]');
+
+    // Update name
+    await page.fill('[name="name"]', 'Updated Epic Name');
+
+    // Save
+    await page.click('button:has-text("Save")');
+
+    // Verify update
+    await expect(page.locator('text=Updated Epic Name')).toBeVisible();
+  });
+});
+```
+
+### 4. Accessibility Tests
+
+```typescript
+import { render } from '@testing-library/react';
+import { axe, toHaveNoViolations } from 'jest-axe';
+import { EpicCard } from '@/components/epics/epic-card';
+
+expect.extend(toHaveNoViolations);
+
+describe('Accessibility', () => {
+  it('should have no accessibility violations', async () => {
+    const { container } = render(
+      <EpicCard epic={mockEpic} />
+    );
+
+    const results = await axe(container);
+    expect(results).toHaveNoViolations();
+  });
+
+  it('should have proper ARIA labels', () => {
+    render(<EpicCard epic={mockEpic} />);
+
+    expect(screen.getByRole('article')).toHaveAttribute('aria-label');
+    expect(screen.getByRole('button', { name: /edit/i })).toBeInTheDocument();
+  });
+});
+```
+
+### 5. Visual Regression Tests
+
+```typescript
+import { test, expect } from '@playwright/test';
+
+test('Epic card should match snapshot', async ({ page }) => {
+  await page.goto('/projects/test-project/epics');
+
+  const epicCard = page.locator('[data-testid="epic-card"]').first();
+
+  await expect(epicCard).toHaveScreenshot('epic-card.png');
+});
+```
+
+## Frontend Test Checklist
+
+### Component Testing Checklist
+- [ ] **Rendering**: Component renders without errors
+- [ ] **Props**: All props are handled correctly
+- [ ] **User Interactions**: Click, type, select, drag events work
+- [ ] **State Management**: Component state updates correctly
+- [ ] **API Calls**: Mock API responses, handle loading/error states
+- [ ] **Validation**: Form validation errors display correctly
+- [ ] **Edge Cases**: Empty states, null values, boundary conditions
+- [ ] **Accessibility**: ARIA labels, keyboard navigation, screen reader support
+
+### E2E Testing Checklist
+- [ ] **Authentication**: Login/logout flows work
+- [ ] **Navigation**: All routes are accessible
+- [ ] **CRUD Operations**: Create, Read, Update, Delete work end-to-end
+- [ ] **Error Handling**: Network errors, validation errors handled
+- [ ] **Real-time Updates**: SignalR/WebSocket events work
+- [ ] **Multi-tenant**: Tenant isolation is enforced
+- [ ] **Performance**: Pages load within acceptable time
+- [ ] **Responsive**: Works on mobile, tablet, desktop
+
+## Testing Best Practices
+
+### 1. Follow Testing Library Principles
+
+**DO**:
+```typescript
+// ✅ Query by role and accessible name
+const button = screen.getByRole('button', { name: /create epic/i });
+
+// ✅ Query by label text
+const input = screen.getByLabelText(/epic name/i);
+
+// ✅ Test user-visible behavior
+expect(screen.getByText(/epic created successfully/i)).toBeInTheDocument();
+```
+
+**DON'T**:
+```typescript
+// ❌ Don't query by implementation details
+const button = wrapper.find('.create-btn');
+
+// ❌ Don't test internal state
+expect(component.state.isLoading).toBe(false);
+
+// ❌ Don't rely on brittle selectors
+const input = screen.getByTestId('epic-name-input-field-123');
+```
+
+### 2. Mock External Dependencies
+
+```typescript
+// Mock API calls
+jest.mock('@/lib/api/pm', () => ({
+  epicsApi: {
+    create: jest.fn().mockResolvedValue({ id: 'epic-1' }),
+    list: jest.fn().mockResolvedValue([mockEpic1, mockEpic2]),
+  }
+}));
+
+// Mock router
+jest.mock('next/navigation', () => ({
+  useRouter: () => ({
+    push: jest.fn(),
+    pathname: '/projects/123',
+  }),
+}));
+
+// Mock auth store
+jest.mock('@/stores/authStore', () => ({
+  useAuthStore: () => ({
+    user: { id: 'user-1', email: 'test@test.com' },
+    isAuthenticated: true,
+  }),
+}));
+```
+
+### 3. Use Testing Library Queries Priority
+
+**Priority Order**:
+1. `getByRole` - Best for accessibility
+2. `getByLabelText` - Good for form fields
+3. `getByPlaceholderText` - Acceptable for inputs
+4. `getByText` - For non-interactive elements
+5. `getByTestId` - Last resort only
+
+### 4. Wait for Async Operations
+
+```typescript
+import { waitFor, screen } from '@testing-library/react';
+
+// ✅ Wait for element to appear
+await waitFor(() => {
+  expect(screen.getByText(/epic created/i)).toBeInTheDocument();
+});
+
+// ✅ Use findBy for async queries
+const successMessage = await screen.findByText(/epic created/i);
+```
+
+## ColaFlow Frontend Test Structure
+
+```
+colaflow-web/
+├── __tests__/               # Unit tests
+│   ├── components/          # Component tests
+│   │   ├── epics/
+│   │   │   ├── epic-card.test.tsx
+│   │   │   ├── epic-form.test.tsx
+│   │   │   └── epic-list.test.tsx
+│   │   └── kanban/
+│   │       ├── kanban-column.test.tsx
+│   │       └── story-card.test.tsx
+│   ├── hooks/               # Hook tests
+│   │   ├── use-epics.test.ts
+│   │   ├── use-stories.test.ts
+│   │   └── use-tasks.test.ts
+│   └── lib/                 # Utility tests
+│       └── api/
+│           └── client.test.ts
+├── e2e/                     # Playwright E2E tests
+│   ├── auth.spec.ts
+│   ├── epic-management.spec.ts
+│   ├── story-management.spec.ts
+│   ├── kanban.spec.ts
+│   └── multi-tenant.spec.ts
+├── playwright.config.ts     # Playwright configuration
+├── jest.config.js           # Jest configuration
+└── vitest.config.ts         # Vitest configuration (if using)
+```
+
+## Test Commands
+
+```bash
+# Run all tests
+npm test
+
+# Run tests in watch mode
+npm test -- --watch
+
+# Run tests with coverage
+npm test -- --coverage
+
+# Run specific test file
+npm test epic-card.test.tsx
+
+# Run E2E tests
+npm run test:e2e
+
+# Run E2E tests in UI mode
+npm run test:e2e -- --ui
+
+# Run E2E tests for specific browser
+npm run test:e2e -- --project=chromium
+```
+
+## Quality Gates (Frontend-Specific)
+
+### Release Criteria
+- ✅ All E2E critical flows pass (100%)
+- ✅ Component test coverage ≥ 80%
+- ✅ No accessibility violations (WCAG 2.1 AA)
+- ✅ First Contentful Paint < 1.5s
+- ✅ Time to Interactive < 3s
+- ✅ Lighthouse Score ≥ 90
+
+### Performance Metrics
+- **FCP (First Contentful Paint)**: < 1.5s
+- **LCP (Largest Contentful Paint)**: < 2.5s
+- **TTI (Time to Interactive)**: < 3s
+- **CLS (Cumulative Layout Shift)**: < 0.1
+- **FID (First Input Delay)**: < 100ms
+
+## Common Testing Patterns
+
+### 1. Testing Forms
+
+```typescript
+test('should validate form inputs', async () => {
+  render(<EpicForm projectId="test-id" />);
+
+  // Submit empty form
+  fireEvent.click(screen.getByRole('button', { name: /create/i }));
+
+  // Check validation errors
+  expect(await screen.findByText(/name is required/i)).toBeInTheDocument();
+
+  // Fill form
+  fireEvent.change(screen.getByLabelText(/name/i), {
+    target: { value: 'Test Epic' }
+  });
+
+  // Validation error should disappear
+  expect(screen.queryByText(/name is required/i)).not.toBeInTheDocument();
+});
+```
+
+### 2. Testing API Integration
+
+```typescript
+test('should handle API errors gracefully', async () => {
+  // Mock API to reject
+  jest.spyOn(epicsApi, 'create').mockRejectedValue(
+    new Error('Network error')
+  );
+
+  render(<CreateEpicDialog projectId="test-id" open={true} />);
+
+  fireEvent.change(screen.getByLabelText(/name/i), {
+    target: { value: 'Test Epic' }
+  });
+
+  fireEvent.click(screen.getByRole('button', { name: /create/i }));
+
+  // Should show error toast
+  expect(await screen.findByText(/network error/i)).toBeInTheDocument();
+});
+```
+
+### 3. Testing Real-time Updates (SignalR)
+
+```typescript
+test('should update list when SignalR event is received', async () => {
+  const { mockConnection } = setupSignalRMock();
+
+  render(<EpicList projectId="test-id" />);
+
+  // Wait for initial load
+  await waitFor(() => {
+    expect(screen.getAllByTestId('epic-card')).toHaveLength(2);
+  });
+
+  // Simulate SignalR event
+  act(() => {
+    mockConnection.emit('EpicCreated', {
+      epicId: 'epic-3',
+      name: 'New Epic'
+    });
+  });
+
+  // Should show new epic
+  await waitFor(() => {
+    expect(screen.getAllByTestId('epic-card')).toHaveLength(3);
+  });
+});
+```
+
+## Bug Report Template (Frontend)
+
+```markdown
+# BUG-FE-001: Epic Card Not Displaying Description
+
+## Severity
+- [ ] Critical - Page crash
+- [x] Major - Core feature broken
+- [ ] Minor - Non-core feature
+- [ ] Trivial - UI/cosmetic
+
+## Priority: P1 - Fix in current sprint
+
+## Browser: Chrome 120 / Edge 120 / Safari 17
+## Device: Desktop / Mobile
+## Viewport: 1920x1080
+
+## Steps to Reproduce
+1. Login as admin@test.com
+2. Navigate to /projects/599e0a24-38be-4ada-945c-2bd11d5b051b/epics
+3. Observe Epic cards
+
+## Expected
+Epic cards should display description text below the title
+
+## Actual
+Description is not visible, only title and metadata shown
+
+## Screenshots
+[Attach screenshot]
+
+## Console Errors
+```
+TypeError: Cannot read property 'description' of undefined
+  at EpicCard (epic-card.tsx:42)
+```
+
+## Impact
+Users cannot see Epic descriptions, affecting understanding of Epic scope
+```
+
+## Example Testing Flow
+
+```
+Coordinator: "Write comprehensive tests for the Epic management feature"
+
+Your Response:
+1. TodoWrite: Create tasks
+   - Component tests for EpicCard
+   - Component tests for EpicForm
+   - Component tests for EpicList
+   - E2E tests for Epic CRUD flows
+   - Accessibility tests
+
+2. Read: Epic components code
+   - Read colaflow-web/components/epics/epic-card.tsx
+   - Read colaflow-web/components/epics/epic-form.tsx
+   - Read colaflow-web/app/(dashboard)/projects/[id]/epics/page.tsx
+
+3. Design: Test cases
+   - Happy path: Create/edit/delete Epic
+   - Error cases: Validation errors, API failures
+   - Edge cases: Empty state, loading state
+   - Accessibility: Keyboard navigation, screen reader
+
+4. Implement: Write tests
+   - Create __tests__/components/epics/epic-card.test.tsx
+   - Create __tests__/components/epics/epic-form.test.tsx
+   - Create e2e/epic-management.spec.ts
+
+5. Execute: Run tests
+   - npm test
+   - npm run test:e2e
+
+6. Verify: Check coverage and results
+   - Coverage ≥ 80%: ✅
+   - All tests passing: ✅
+   - No accessibility violations: ✅
+
+7. TodoWrite: Mark completed
+
+8. Deliver: Test report with metrics
+```
+
+---
+
+**Remember**: Frontend testing is about ensuring users can accomplish their goals without friction. Test user journeys, not implementation details. Accessibility is not optional. Performance matters.
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -1,58 +1,25 @@
 {
  "permissions": {
    "allow": [
-      "Bash(cat:*)",
-      "Bash(python fix_tests.py:*)",
-      "Bash(git -C \"c:\\Users\\yaoji\\git\\ColaCoder\\product-master\" status)",
-      "Bash(git -C \"c:\\Users\\yaoji\\git\\ColaCoder\\product-master\" diff colaflow-api/src/Modules/ProjectManagement/ColaFlow.Modules.ProjectManagement.Domain/Repositories/IProjectRepository.cs)",
-      "Bash(git -C \"c:\\Users\\yaoji\\git\\ColaCoder\\product-master\" add colaflow-api/src/Modules/ProjectManagement/ColaFlow.Modules.ProjectManagement.Domain/Repositories/IProjectRepository.cs colaflow-api/src/Modules/ProjectManagement/ColaFlow.Modules.ProjectManagement.Infrastructure/Repositories/ProjectRepository.cs colaflow-api/src/Modules/ProjectManagement/ColaFlow.Modules.ProjectManagement.Application/Queries/GetEpicById/GetEpicByIdQueryHandler.cs colaflow-api/src/Modules/ProjectManagement/ColaFlow.Modules.ProjectManagement.Application/Queries/GetStoriesByEpicId/GetStoriesByEpicIdQueryHandler.cs colaflow-api/src/Modules/ProjectManagement/ColaFlow.Modules.ProjectManagement.Application/Queries/GetTasksByStoryId/GetTasksByStoryIdQueryHandler.cs colaflow-api/src/Modules/ProjectManagement/ColaFlow.Modules.ProjectManagement.Application/Queries/GetStoryById/GetStoryByIdQueryHandler.cs colaflow-api/src/Modules/ProjectManagement/ColaFlow.Modules.ProjectManagement.Application/Queries/GetTaskById/GetTaskByIdQueryHandler.cs colaflow-api/src/Modules/ProjectManagement/ColaFlow.Modules.ProjectManagement.Application/Queries/GetEpicsByProjectId/GetEpicsByProjectIdQueryHandler.cs colaflow-api/tests/ColaFlow.Application.Tests/Queries/GetStoryById/GetStoryByIdQueryHandlerTests.cs colaflow-api/tests/ColaFlow.Application.Tests/Queries/GetTaskById/GetTaskByIdQueryHandlerTests.cs)",
-      "Bash(git -C \"c:\\Users\\yaoji\\git\\ColaCoder\\product-master\" commit -m \"$(cat <<''EOF''\nrefactor(backend): Optimize ProjectRepository query methods with AsNoTracking\n\nThis commit enhances the ProjectRepository to follow DDD aggregate root pattern\nwhile providing optimized read-only queries for better performance.\n\nChanges:\n- Added separate read-only query methods to IProjectRepository:\n  * GetEpicByIdReadOnlyAsync, GetEpicsByProjectIdAsync\n  * GetStoryByIdReadOnlyAsync, GetStoriesByEpicIdAsync\n  * GetTaskByIdReadOnlyAsync, GetTasksByStoryIdAsync\n- Implemented all new methods in ProjectRepository using AsNoTracking for 30-40% better performance\n- Updated all Query Handlers to use new read-only methods:\n  * GetEpicByIdQueryHandler\n  * GetEpicsByProjectIdQueryHandler\n  * GetStoriesByEpicIdQueryHandler\n  * GetStoryByIdQueryHandler\n  * GetTasksByStoryIdQueryHandler\n  * GetTaskByIdQueryHandler\n- Updated corresponding unit tests to mock new repository methods\n- Maintained aggregate root pattern for Command Handlers (with change tracking)\n\nBenefits:\n- Query operations use AsNoTracking for better performance and lower memory\n- Command operations use change tracking for proper aggregate root updates\n- Clear separation between read and write operations (CQRS principle)\n- All tests passing (32/32)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>\nEOF\n)\")",
-      "Bash(git commit -m \"$(cat <<''EOF''\nfix(backend): Remove TenantId injection vulnerability in CreateProjectCommand\n\nCRITICAL SECURITY FIX: Removed client-provided TenantId parameter from\nCreateProjectCommand to prevent tenant impersonation attacks.\n\nChanges:\n- Removed TenantId property from CreateProjectCommand\n- Injected ITenantContext into CreateProjectCommandHandler\n- Now retrieves authenticated TenantId from JWT token via TenantContext\n- Prevents malicious users from creating projects under other tenants\n\nSecurity Impact:\n- Before: Client could provide any TenantId (HIGH RISK)\n- After: TenantId extracted from authenticated JWT token (SECURE)\n\nNote: CreateEpic, CreateStory, and CreateTask commands were already secure\nas they inherit TenantId from parent entities loaded via Global Query Filters.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>\nEOF\n)\")",
-      "Bash(dir:*)",
-      "Bash(dotnet new:*)",
-      "Bash(dotnet add reference:*)",
-      "Bash(dotnet add package:*)",
-      "Bash(dotnet add:*)",
-      "Bash(git commit -m \"$(cat <<''EOF''\nfeat(backend): Add ProjectManagement integration test infrastructure + fix API controller\n\nCreated comprehensive integration test infrastructure for ProjectManagement module:\n- PMWebApplicationFactory with in-memory database support\n- TestAuthHelper for JWT token generation\n- Test project with all necessary dependencies\n\nFixed API Controller:\n- Removed manual TenantId injection in ProjectsController\n- TenantId now automatically extracted via ITenantContext in CommandHandler\n- Maintained OwnerId extraction from JWT claims\n\nTest Infrastructure:\n- In-memory database for fast, isolated tests\n- Support for multi-tenant scenarios\n- JWT authentication helpers\n- Cross-module database consistency\n\nNext Steps:\n- Write multi-tenant isolation tests (Phase 3.2)\n- Write CRUD integration tests (Phase 3.3)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>\nEOF\n)\")",
-      "Bash(git commit -m \"$(cat <<''EOF''\nfix(backend): Add ITenantContext registration + multi-tenant isolation tests (3/7 passing)\n\nCRITICAL FIX: Added missing ITenantContext and HttpContextAccessor registration\nin ProjectManagement module extension. This was causing DI resolution failures.\n\nMulti-Tenant Security Testing:\n- Created 7 comprehensive multi-tenant isolation tests\n- 3 tests PASSING (tenant cannot delete/list/update other tenants'' data)\n- 4 tests need API route fixes (Epic/Story/Task endpoints)\n\nChanges:\n- Added ITenantContext registration in ModuleExtensions\n- Added HttpContextAccessor registration\n- Created MultiTenantIsolationTests with 7 test scenarios\n- Updated PMWebApplicationFactory to properly replace DbContext options\n\nTest Results (Partial):\n✅ Tenant_Cannot_Delete_Other_Tenants_Project\n✅ Tenant_Cannot_List_Other_Tenants_Projects  \n✅ Tenant_Cannot_Update_Other_Tenants_Project\n⚠️ Project_Should_Be_Isolated_By_TenantId (route issue)\n⚠️ Epic_Should_Be_Isolated_By_TenantId (endpoint not found)\n⚠️ Story_Should_Be_Isolated_By_TenantId (endpoint not found)\n⚠️ Task_Should_Be_Isolated_By_TenantId (endpoint not found)\n\nSecurity Impact:\n- Multi-tenant isolation now properly tested\n- TenantId injection from JWT working correctly\n- Global Query Filters validated via integration tests\n\nNext Steps:\n- Fix API routes for Epic/Story/Task tests\n- Complete remaining 4 tests\n- Add CRUD integration tests (Phase 3.3)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>\nEOF\n)\")",
+      "Bash(git commit -m \"$(cat <<''EOF''\nfix(frontend): Add comprehensive debug logging for Epic creation\n\nAdd detailed console logging to diagnose Epic creation issue where \nno request is being sent to backend.\n\nChanges:\n- Add form submission event logging in epic-form.tsx\n- Add API request/response logging in epicsApi.create\n- Add HTTP client interceptor logging for all requests/responses\n- Log authentication status, payload, and error details\n- Log form validation state and errors\n\nThis will help identify:\n- Whether form submit event fires\n- Whether validation passes\n- Whether API call is triggered\n- Whether authentication token exists\n- What errors occur (if any)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>\nEOF\n)\")",
+      "Bash(git commit -m \"$(cat <<''EOF''\nfix(frontend): Fix Zustand authStore hydration timing issue\n\nFix race condition where Epic form checked user authentication before\nZustand persist middleware completed hydration from localStorage.\n\nRoot cause:\n- authStore uses persist middleware to restore from localStorage\n- Hydration is asynchronous\n- Epic form checked user state before hydration completed\n- Result: \"User not authenticated\" error on page refresh\n\nChanges:\n- Add isHydrated state to authStore interface\n- Add onRehydrateStorage callback to track hydration completion\n- Update epic-form to check isHydrated before checking user\n- Disable submit button until hydration completes\n- Show \"Loading...\" button text during hydration\n- Improve error messages for better UX\n- Add console logging to track hydration process\n\nTesting:\n- Page refresh should now wait for hydration\n- Epic form correctly identifies logged-in users\n- Submit button disabled until auth state ready\n- Clear user feedback during loading state\n\nFixes: Epic creation \"User not authenticated\" error on refresh\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>\nEOF\n)\")",
      "Bash(git commit:*)",
-      "Bash(dotnet run)",
-      "Bash(netstat:*)",
-      "Bash(powershell -Command:*)",
-      "Bash(Select-String -Pattern \"(Passed|Failed|Total tests)\" -Context 0,2)",
-      "Bash(ls:*)",
-      "Bash(npm run dev:*)",
+      "Bash(powershell.exe -File verify-user-fix.ps1)",
+      "Bash(powershell.exe -File verify-user-fix-simple.ps1)",
+      "Read(//c/Users/yaoji/git/ColaCoder/**)",
+      "Bash(powershell.exe:*)",
+      "Bash(timeout 30 bash -c \"while [ ! -f ''colaflow-web/components/tasks/task-list.tsx'' ]; do sleep 2; done; echo ''Components detected''\")",
      "Bash(npx shadcn@latest add:*)",
-      "Bash(test:*)",
-      "Bash(npm install:*)",
-      "Bash(dotnet build:*)",
-      "Bash(findstr:*)",
-      "Bash(powershell:*)",
-      "Bash(Select-Object -First 200)",
-      "Bash(powershell.exe -ExecutionPolicy Bypass -File Sprint1-API-Validation.ps1)",
-      "Bash(git add:*)",
-      "Bash(dotnet test:*)",
-      "Bash(Select-String -Pattern \"Passed|Failed|Total tests\")",
-      "Bash(npm run build:*)",
-      "Bash(dotnet --version:*)",
+      "Bash(cat:*)",
+      "Bash(timeout 30 bash -c \"while [ ! -f ''colaflow-web/components/projects/acceptance-criteria-editor.tsx'' ]; do sleep 2; done; echo ''Components detected''\")",
      "Bash(curl:*)",
-      "Bash(dotnet ef migrations add:*)",
-      "Bash(taskkill:*)",
-      "Bash(docker build:*)",
-      "Bash(docker-compose up:*)",
-      "Bash(docker-compose ps:*)",
-      "Bash(docker-compose logs:*)",
-      "Bash(git reset:*)",
-      "Bash(tasklist:*)",
-      "Bash(timeout 5 docker-compose logs:*)",
-      "Bash(pwsh -NoProfile -ExecutionPolicy Bypass -File \".\\scripts\\dev-start.ps1\" -Stop)",
-      "Bash(docker info:*)",
-      "Bash(docker:*)",
-      "Bash(docker-compose:*)",
-      "Bash(Start-Sleep -Seconds 30)",
-      "Bash(Select-String -Pattern \"error|Build succeeded\")",
-      "Bash(Select-String -Pattern \"error|warning|succeeded\")",
-      "Bash(Select-Object -Last 20)"
+      "Bash(echo:*)",
+      "Bash(Select-Object -Last 50)",
+      "Bash(git diff:*)",
+      "Bash(git log:*)",
+      "Bash(dotnet build:*)",
+      "Bash(dotnet test:*)",
+      "Bash(git add:*)"
    ],
    "deny": [],
    "ask": []
--- a/BUG-006-DEPENDENCY-INJECTION-FAILURE.md
+++ b/BUG-006-DEPENDENCY-INJECTION-FAILURE.md
@@ -0,0 +1,127 @@
+# BUG-006: Dependency Injection Failure - IApplicationDbContext Not Registered
+
+## Severity
+**CRITICAL (P0) - Application Cannot Start**
+
+## Status
+**OPEN** - Discovered during Docker validation after BUG-005 fix
+
+## Priority
+**P0 - Fix Immediately** - Blocks all development work
+
+## Discovery Date
+2025-11-05
+
+## Environment
+- Docker environment
+- Release build
+- .NET 9.0
+
+## Summary
+The application fails to start due to a missing dependency injection registration. The `IApplicationDbContext` interface is not registered in the DI container, causing all Sprint command handlers to fail validation at application startup.
+
+## Root Cause Analysis
+
+### Problem
+The `ModuleExtensions.cs` file (used in `Program.cs`) registers the `PMDbContext` but **does NOT** register the `IApplicationDbContext` interface that Sprint command handlers depend on.
+
+### Affected Files
+1. **c:\Users\yaoji\git\ColaCoder\product-master\colaflow-api\src\ColaFlow.API\Extensions\ModuleExtensions.cs**
+   - Lines 39-46: Only registers `PMDbContext`, missing interface registration
+
+### Comparison
+
+**Correct Implementation** (in ProjectManagementModule.cs - NOT USED):
+```csharp
+// Line 44-45
+// Register IApplicationDbContext
+services.AddScoped<IApplicationDbContext>(sp => sp.GetRequiredService<PMDbContext>());
+```
+
+**Broken Implementation** (in ModuleExtensions.cs - CURRENTLY USED):
+```csharp
+// Lines 39-46
+services.AddDbContext<PMDbContext>((serviceProvider, options) =>
+{
+    options.UseNpgsql(connectionString);
+    var auditInterceptor = serviceProvider.GetRequiredService<AuditInterceptor>();
+    options.AddInterceptors(auditInterceptor);
+});
+
+// ❌ MISSING: IApplicationDbContext registration!
+```
+
+## Steps to Reproduce
+1. Clean Docker environment: `docker-compose down -v`
+2. Build backend image: `docker-compose build backend`
+3. Start services: `docker-compose up -d`
+4. Check backend logs: `docker-compose logs backend`
+
+## Expected Behavior
+- Application starts successfully
+- All dependencies resolve correctly
+- Sprint command handlers can be constructed
+
+## Actual Behavior
+Application crashes at startup with:
+```
+System.AggregateException: Some services are not able to be constructed
+System.InvalidOperationException: Unable to resolve service for type 'ColaFlow.Modules.ProjectManagement.Application.Common.Interfaces.IApplicationDbContext'
+while attempting to activate 'ColaFlow.Modules.ProjectManagement.Application.Commands.UpdateSprint.UpdateSprintCommandHandler'
+```
+
+## Affected Components
+All Sprint command handlers fail to construct:
+- `UpdateSprintCommandHandler`
+- `StartSprintCommandHandler`
+- `RemoveTaskFromSprintCommandHandler`
+- `DeleteSprintCommandHandler`
+- `CreateSprintCommandHandler`
+- `CompleteSprintCommandHandler`
+- `AddTaskToSprintCommandHandler`
+
+## Impact
+- **Application cannot start** - Complete blocker
+- **Docker environment unusable** - Frontend developers cannot work
+- **All Sprint functionality broken** - Even if app starts, Sprint CRUD would fail
+- **Development halted** - No one can develop or test
+
+## Fix Required
+Add the missing registration to `ModuleExtensions.cs`:
+
+```csharp
+// In AddProjectManagementModule method, after line 46:
+
+// Register IApplicationDbContext interface
+services.AddScoped<ColaFlow.Modules.ProjectManagement.Application.Common.Interfaces.IApplicationDbContext>(
+    sp => sp.GetRequiredService<PMDbContext>());
+```
+
+## Alternative Fix (Better Long-term)
+Consider using the `ProjectManagementModule` class (which has correct registration) instead of duplicating logic in `ModuleExtensions.cs`. This follows the Single Responsibility Principle and reduces duplication.
+
+## Test Plan (After Fix)
+1. Local compilation: `dotnet build` - should succeed
+2. Docker build: `docker-compose build backend` - should succeed
+3. Docker startup: `docker-compose up -d` - all containers should be healthy
+4. Backend health check: `curl http://localhost:5000/health` - should return "Healthy"
+5. Verify logs: No DI exceptions in backend logs
+6. API smoke test: Access Swagger UI at `http://localhost:5000/scalar/v1`
+
+## Related Bugs
+- BUG-005 (Compilation error) - Fixed
+- This bug was discovered **after** BUG-005 fix during Docker validation
+
+## Notes
+- This is a **runtime bug**, not a compile-time bug
+- The error only appears when ASP.NET Core validates the DI container at startup (line 165 in Program.cs: `var app = builder.Build();`)
+- Local development might not hit this if developers use different startup paths
+- Docker environment exposes this because it validates all services on startup
+
+## QA Recommendation
+**NO GO** - Cannot proceed with Docker environment delivery until this is fixed.
+
+## Severity Justification
+- **Critical** because application cannot start
+- **P0** because it blocks all development work
+- **Immediate fix required** - no workarounds available
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -25,8 +25,10 @@ ColaFlow 是一款基于 AI + MCP 协议的新一代项目管理系统，灵感
 - **前端开发** → `frontend` agent - UI实现、组件开发、用户交互
 - **AI功能** → `ai` agent - AI集成、Prompt设计、模型优化
 - **质量保证** → `qa` agent - 测试用例、测试执行、质量评估
+- **前端质量保证** → `qa-frontend` agent - React/Next.js 测试、E2E 测试、组件测试、可访问性测试
 - **用户体验** → `ux-ui` agent - 界面设计、交互设计、用户研究
 - **代码审查** → `code-reviewer` agent - 代码质量审查、架构验证、最佳实践检查
+- **前端代码审查** → `code-reviewer-frontend` agent - React/Next.js 代码审查、TypeScript 类型安全、前端性能、可访问性审查
 - **进度记录** → `progress-recorder` agent - 项目记忆持久化、进度跟踪、信息归档

 ### 3. 协调与整合
@@ -174,9 +176,11 @@ Task tool 2:
 - `backend` - 后端工程师（backend.md）
 - `frontend` - 前端工程师（frontend.md）
 - `ai` - AI工程师（ai.md）
- `qa` - 质量保证工程师（qa.md）
+- `qa` - 质量保证工程师（qa.md）- **负责通用测试策略和后端测试**
+- `qa-frontend` - 前端质量保证工程师（qa-frontend.md）- **专注于 React/Next.js 测试、Playwright E2E、组件测试**
 - `ux-ui` - UX/UI设计师（ux-ui.md）
- `code-reviewer` - 代码审查员（code-reviewer.md）- **负责代码质量审查和最佳实践检查**
+- `code-reviewer` - 代码审查员（code-reviewer.md）- **负责通用代码质量审查和后端审查**
+- `code-reviewer-frontend` - 前端代码审查员（code-reviewer-frontend.md）- **专注于 React/Next.js 代码审查、TypeScript 类型安全、前端性能和可访问性**
 - `progress-recorder` - 进度记录员（progress-recorder.md）- **负责项目记忆管理**

 ## 协调原则
--- a/DEV-SCRIPTS-README.md
+++ b/DEV-SCRIPTS-README.md
@@ -0,0 +1,143 @@
+# ColaFlow Development Scripts
+
+This directory contains convenient scripts to start and stop the ColaFlow development environment.
+
+## Available Scripts
+
+### Windows (PowerShell)
+
+#### Start Development Environment
+```powershell
+.\start-dev.ps1
+```
+
+This script will:
+- Check if backend (port 5000) and frontend (port 3000) are already running
+- Start the backend API in a new PowerShell window
+- Start the frontend web application in a new PowerShell window
+- Display the URLs for accessing the services
+
+#### Stop Development Environment
+```powershell
+.\stop-dev.ps1
+```
+
+This script will:
+- Stop all .NET (dotnet.exe) processes
+- Stop all Node.js processes running on port 3000
+- Clean up gracefully
+
+### Linux/macOS/Git Bash (Bash)
+
+#### Start Development Environment
+```bash
+./start-dev.sh
+```
+
+This script will:
+- Check if backend (port 5000) and frontend (port 3000) are already running
+- Start the backend API in the background
+- Start the frontend web application in the background
+- Save process IDs to `backend.pid` and `frontend.pid`
+- Save logs to `backend.log` and `frontend.log`
+- Keep running until you press Ctrl+C (which will stop all services)
+
+#### Stop Development Environment
+```bash
+./stop-dev.sh
+```
+
+This script will:
+- Stop the backend and frontend processes using saved PIDs
+- Fall back to killing processes by port/name if PIDs are not found
+- Clean up log files and PID files
+
+## Service URLs
+
+Once started, the services will be available at:
+
+- **Backend API**: http://localhost:5167 (or the port shown in the startup output)
+- **Swagger UI**: http://localhost:5167/swagger
+- **Frontend**: http://localhost:3000
+
+## Manual Startup
+
+If you prefer to start the services manually:
+
+### Backend
+```bash
+cd colaflow-api
+dotnet run --project src/ColaFlow.API/ColaFlow.API.csproj
+```
+
+### Frontend
+```bash
+cd colaflow-web
+npm run dev
+```
+
+## Troubleshooting
+
+### Port Already in Use
+
+If you see errors about ports already being in use:
+
+1. Run the stop script first:
+   - Windows: `.\stop-dev.ps1`
+   - Linux/macOS: `./stop-dev.sh`
+
+2. Then start again:
+   - Windows: `.\start-dev.ps1`
+   - Linux/macOS: `./start-dev.sh`
+
+### Lock File Issues (Frontend)
+
+If you see "Unable to acquire lock" errors for the frontend:
+
+```bash
+# Remove the lock file
+rm -f colaflow-web/.next/dev/lock
+
+# Then restart
+./start-dev.sh  # or .\start-dev.ps1 on Windows
+```
+
+### Database Connection Issues
+
+Make sure PostgreSQL is running and the connection string in `.env` or `appsettings.Development.json` is correct.
+
+### Node Modules Missing
+
+If the frontend fails to start due to missing dependencies:
+
+```bash
+cd colaflow-web
+npm install
+```
+
+## Development Workflow
+
+1. Start the development environment:
+   ```bash
+   ./start-dev.sh  # or .\start-dev.ps1 on Windows
+   ```
+
+2. Make your changes to the code
+
+3. The services will automatically reload when you save files:
+   - Backend: Hot reload is enabled for .NET
+   - Frontend: Next.js Turbopack provides fast refresh
+
+4. When done, stop the services:
+   ```bash
+   ./stop-dev.sh  # or .\stop-dev.ps1 on Windows
+   ```
+
+   Or press `Ctrl+C` if using the bash version of start-dev.sh
+
+## Notes
+
+- The PowerShell scripts open new windows for each service, making it easy to see logs
+- The Bash scripts run services in the background and save logs to files
+- Both sets of scripts check for already-running services to avoid conflicts
+- The scripts handle graceful shutdown when possible
--- a/DOCKER-ENVIRONMENT-FINAL-VALIDATION-REPORT.md
+++ b/DOCKER-ENVIRONMENT-FINAL-VALIDATION-REPORT.md
@@ -0,0 +1,565 @@
+# Docker Environment Final Validation Report
+
+**Test Date**: 2025-11-05
+**Test Time**: 09:07 CET
+**Testing Environment**: Windows 11, Docker Desktop
+**Tester**: QA Agent (ColaFlow Team)
+
+---
+
+## Executive Summary
+
+**VALIDATION RESULT: ❌ NO GO**
+
+The Docker development environment **FAILED** final validation due to a **CRITICAL (P0) bug** that prevents the backend container from starting. The backend application crashes on startup with dependency injection errors related to Sprint command handlers.
+
+**Impact**:
+- Frontend developers **CANNOT** use the Docker environment
+- All containers fail to start successfully
+- Database migrations are never executed
+- Complete blocker for Day 18 delivery
+
+---
+
+## Test Results Summary
+
+| Test ID | Test Name | Status | Priority |
+|---------|-----------|--------|----------|
+| Test 1 | Docker Environment Complete Startup | ❌ FAIL | ⭐⭐⭐ CRITICAL |
+| Test 2 | Database Migrations Verification | ⏸️ BLOCKED | ⭐⭐⭐ CRITICAL |
+| Test 3 | Demo Data Seeding Validation | ⏸️ BLOCKED | ⭐⭐ HIGH |
+| Test 4 | API Health Checks | ⏸️ BLOCKED | ⭐⭐ HIGH |
+| Test 5 | Container Health Status | ❌ FAIL | ⭐⭐⭐ CRITICAL |
+
+**Overall Pass Rate: 0/5 (0%)**
+
+---
+
+## Critical Bug Discovered
+
+### BUG-008: Backend Application Fails to Start Due to DI Registration Error
+
+**Severity**: 🔴 CRITICAL (P0)
+**Priority**: IMMEDIATE FIX REQUIRED
+**Status**: BLOCKING RELEASE
+
+#### Symptoms
+
+Backend container enters continuous restart loop with the following error:
+
+```
+System.AggregateException: Some services are not able to be constructed
+(Error while validating the service descriptor 'ServiceType: MediatR.IRequestHandler`2[ColaFlow.Modules.ProjectManagement.Application.Commands.UpdateSprint.UpdateSprintCommand,MediatR.Unit]
+Lifetime: Transient ImplementationType: ColaFlow.Modules.ProjectManagement.Application.Commands.UpdateSprint.UpdateSprintCommandHandler':
+Unable to resolve service for type 'ColaFlow.Modules.ProjectManagement.Application.Common.Interfaces.IApplicationDbContext'
+while attempting to activate 'ColaFlow.Modules.ProjectManagement.Application.Commands.UpdateSprint.UpdateSprintCommandHandler'.)
+```
+
+#### Affected Command Handlers (7 Total)
+
+All Sprint-related command handlers are affected:
+1. `CreateSprintCommandHandler` ❌
+2. `UpdateSprintCommandHandler` ❌
+3. `StartSprintCommandHandler` ❌
+4. `CompleteSprintCommandHandler` ❌
+5. `DeleteSprintCommandHandler` ❌
+6. `AddTaskToSprintCommandHandler` ❌
+7. `RemoveTaskFromSprintCommandHandler` ❌
+
+#### Root Cause Analysis
+
+**Suspected Issue**: MediatR configuration problem in `ModuleExtensions.cs`
+
+```csharp
+// Line 72 in ModuleExtensions.cs
+services.AddMediatR(cfg =>
+{
+    cfg.LicenseKey = configuration["MediatR:LicenseKey"]; // ← PROBLEMATIC
+    cfg.RegisterServicesFromAssembly(typeof(CreateProjectCommand).Assembly);
+});
+```
+
+**Hypothesis**:
+- MediatR v13.x does NOT require a `LicenseKey` property
+- Setting a non-existent `LicenseKey` may prevent proper handler registration
+- The `IApplicationDbContext` IS registered correctly (line 50-51) but MediatR can't see it
+
+**Evidence**:
+1. ✅ `IApplicationDbContext` IS registered in DI container (line 50-51)
+2. ✅ `PMDbContext` DOES implement `IApplicationDbContext` (verified)
+3. ✅ Sprint handlers DO inject `IApplicationDbContext` correctly (verified)
+4. ❌ MediatR fails to resolve the dependency during service validation
+5. ❌ Build succeeds (no compilation errors)
+6. ❌ Runtime fails (DI validation error)
+
+#### Impact Assessment
+
+**Development Impact**: HIGH
+- Frontend developers blocked from testing backend APIs
+- No way to test database migrations
+- No way to validate demo data seeding
+- Docker environment completely non-functional
+
+**Business Impact**: CRITICAL
+- Day 18 milestone at risk (frontend SignalR integration)
+- M1 delivery timeline threatened
+- Sprint 1 goals cannot be met
+
+**Technical Debt**: MEDIUM
+- Sprint functionality was recently added (Day 16-17)
+- Not properly tested in Docker environment
+- Integration tests may be passing but Docker config broken
+
+---
+
+## Detailed Test Results
+
+### ✅ Test 0: Environment Preparation (Pre-Test)
+
+**Status**: PASS ✅
+
+**Actions Taken**:
+- Stopped all running containers: `docker-compose down`
+- Verified clean state: No containers running
+- Confirmed database volumes removed (fresh state)
+
+**Result**: Clean starting environment established
+
+---
+
+### ❌ Test 1: Docker Environment Complete Startup
+
+**Status**: FAIL ❌
+**Priority**: ⭐⭐⭐ CRITICAL
+
+**Test Steps**:
+```powershell
+docker-compose up -d
+```
+
+**Expected Result**:
+- All containers start successfully
+- postgres: healthy ✅
+- redis: healthy ✅
+- backend: healthy ✅
+- Total startup time < 90 seconds
+
+**Actual Result**:
+
+| Container | Status | Health Check | Result |
+|-----------|--------|--------------|--------|
+| colaflow-postgres | ✅ Running | healthy | PASS |
+| colaflow-redis | ✅ Running | healthy | PASS |
+| colaflow-postgres-test | ✅ Running | healthy | PASS |
+| **colaflow-api** | ❌ **Restarting** | **unhealthy** | **FAIL** |
+| colaflow-web | ⏸️ Not Started | N/A | BLOCKED |
+
+**Backend Error Log**:
+```
+[ProjectManagement] Module registered
+[IssueManagement] Module registered
+Unhandled exception. System.AggregateException: Some services are not able to be constructed
+  (Error while validating the service descriptor... IApplicationDbContext...)
+```
+
+**Startup Time**: N/A (never completed)
+
+**Verdict**: ❌ **CRITICAL FAILURE** - Backend container cannot start
+
+---
+
+### ⏸️ Test 2: Database Migrations Verification
+
+**Status**: BLOCKED ⏸️
+**Priority**: ⭐⭐⭐ CRITICAL
+
+**Reason**: Backend container not running, migrations never executed
+
+**Expected Verification**:
+```powershell
+docker-compose logs backend | Select-String "migrations"
+docker exec -it colaflow-postgres psql -U colaflow -d colaflow_identity -c "\dt identity.*"
+```
+
+**Actual Result**: Cannot execute - backend container not running
+
+**Critical Questions**:
+- ❓ Are `identity.user_tenant_roles` and `identity.refresh_tokens` tables created? (BUG-007 fix validation)
+- ❓ Do ProjectManagement migrations run successfully?
+- ❓ Are Sprint tables created with TenantId column?
+
+**Verdict**: ⏸️ **BLOCKED** - Cannot verify migrations
+
+---
+
+### ⏸️ Test 3: Demo Data Seeding Validation
+
+**Status**: BLOCKED ⏸️
+**Priority**: ⭐⭐ HIGH
+
+**Reason**: Backend container not running, seeding script never executed
+
+**Expected Verification**:
+```powershell
+docker exec -it colaflow-postgres psql -U colaflow -d colaflow_identity -c "SELECT * FROM identity.tenants LIMIT 5;"
+docker exec -it colaflow-postgres psql -U colaflow -d colaflow_identity -c "SELECT email, LEFT(password_hash, 20) FROM identity.users;"
+```
+
+**Actual Result**: Cannot execute - backend container not running
+
+**Critical Questions**:
+- ❓ Are demo tenants created?
+- ❓ Are demo users (owner@demo.com, developer@demo.com) created?
+- ❓ Are password hashes valid BCrypt hashes ($2a$11$...)?
+
+**Verdict**: ⏸️ **BLOCKED** - Cannot verify demo data
+
+---
+
+### ⏸️ Test 4: API Health Checks
+
+**Status**: BLOCKED ⏸️
+**Priority**: ⭐⭐ HIGH
+
+**Reason**: Backend container not running, API endpoints not available
+
+**Expected Tests**:
+```powershell
+curl http://localhost:5000/health  # Expected: HTTP 200 "Healthy"
+curl http://localhost:5000/scalar/v1  # Expected: Swagger UI loads
+```
+
+**Actual Result**: Cannot execute - backend not responding
+
+**Verdict**: ⏸️ **BLOCKED** - Cannot test API health
+
+---
+
+### ❌ Test 5: Container Health Status Verification
+
+**Status**: FAIL ❌
+**Priority**: ⭐⭐⭐ CRITICAL
+
+**Test Command**:
+```powershell
+docker-compose ps
+```
+
+**Expected Result**:
+```
+NAME                     STATUS
+colaflow-postgres        Up 30s (healthy)
+colaflow-redis           Up 30s (healthy)
+colaflow-api             Up 30s (healthy)  ← KEY VALIDATION
+colaflow-web             Up 30s (healthy)
+```
+
+**Actual Result**:
+```
+NAME                     STATUS
+colaflow-postgres        Up 16s (healthy) ✅
+colaflow-redis           Up 18s (healthy) ✅
+colaflow-postgres-test   Up 18s (healthy) ✅
+colaflow-api             Restarting (139) 2 seconds ago ❌ CRITICAL
+colaflow-web             [Not Started - Dependency Failed] ❌
+```
+
+**Key Finding**:
+- Backend container **NEVER** reaches healthy state
+- Continuous restart loop (exit code 139 = SIGSEGV or unhandled exception)
+- Frontend container cannot start (depends on backend health)
+
+**Verdict**: ❌ **CRITICAL FAILURE** - Backend health check never passes
+
+---
+
+## BUG-007 Validation Status
+
+**Status**: ⏸️ **CANNOT VALIDATE**
+
+**Original Bug**: Missing `user_tenant_roles` and `refresh_tokens` tables
+
+**Reason**: Backend crashes before migrations run, so we cannot verify if BUG-007 fix is effective
+
+**Recommendation**: After fixing BUG-008, re-run validation to confirm BUG-007 is truly resolved
+
+---
+
+## Quality Gate Decision
+
+### ❌ **NO GO - DO NOT DELIVER**
+
+**Decision Date**: 2025-11-05
+**Decision**: **REJECT** Docker Environment for Production Use
+**Blocker**: BUG-008 (CRITICAL)
+
+### Reasons for NO GO
+
+1. **✋ CRITICAL P0 Bug Blocking Release**
+   - Backend container cannot start
+   - 100% failure rate on container startup
+   - Zero functionality available
+
+2. **✋ Core Functionality Untested**
+   - Database migrations: BLOCKED ⏸️
+   - Demo data seeding: BLOCKED ⏸️
+   - API endpoints: BLOCKED ⏸️
+   - Multi-tenant security: BLOCKED ⏸️
+
+3. **✋ BUG-007 Fix Cannot Be Verified**
+   - Cannot confirm if `user_tenant_roles` table is created
+   - Cannot confirm if migrations work end-to-end
+
+4. **✋ Developer Experience Completely Broken**
+   - Frontend developers cannot use Docker environment
+   - No way to test backend APIs locally
+   - No way to run E2E tests
+
+### Minimum Requirements for GO Decision
+
+To achieve a **GO** decision, ALL of the following must be true:
+
+- ✅ Backend container reaches **healthy** state (currently ❌)
+- ✅ All database migrations execute successfully (currently ⏸️)
+- ✅ Demo data seeded with valid BCrypt hashes (currently ⏸️)
+- ✅ `/health` endpoint returns HTTP 200 (currently ⏸️)
+- ✅ No P0/P1 bugs blocking core functionality (currently ❌ BUG-008)
+
+**Current Status**: 0/5 requirements met (0%)
+
+---
+
+## Recommended Next Steps
+
+### 🔴 URGENT: Fix BUG-008 (Estimated Time: 2-4 hours)
+
+**Step 1: Investigate MediatR Configuration**
+```csharp
+// Option A: Remove LicenseKey (if not needed in v13)
+services.AddMediatR(cfg =>
+{
+    // cfg.LicenseKey = configuration["MediatR:LicenseKey"]; // ← REMOVE THIS LINE
+    cfg.RegisterServicesFromAssembly(typeof(CreateProjectCommand).Assembly);
+});
+```
+
+**Step 2: Verify IApplicationDbContext Registration**
+- Confirm registration order (should be before MediatR)
+- Confirm no duplicate registrations
+- Confirm PMDbContext lifetime (should be Scoped)
+
+**Step 3: Add Diagnostic Logging**
+```csharp
+// Add before builder.Build()
+var serviceProvider = builder.Services.BuildServiceProvider();
+var dbContext = serviceProvider.GetService<IApplicationDbContext>();
+Console.WriteLine($"IApplicationDbContext resolved: {dbContext != null}");
+```
+
+**Step 4: Test Sprint Command Handlers in Isolation**
+```csharp
+// Create unit test to verify DI resolution
+var services = new ServiceCollection();
+services.AddProjectManagementModule(configuration, environment);
+var provider = services.BuildServiceProvider();
+var handler = provider.GetService<IRequestHandler<CreateSprintCommand, SprintDto>>();
+Assert.NotNull(handler); // Should pass
+```
+
+**Step 5: Rebuild and Retest**
+```powershell
+docker-compose down -v
+docker-compose build --no-cache backend
+docker-compose up -d
+docker-compose logs backend --tail 100
+```
+
+---
+
+### 🟡 MEDIUM PRIORITY: Re-run Full Validation (Estimated Time: 40 minutes)
+
+After BUG-008 is fixed, execute the complete test plan again:
+
+1. Test 1: Docker Environment Startup (15 min)
+2. Test 2: Database Migrations (10 min)
+3. Test 3: Demo Data Seeding (5 min)
+4. Test 4: API Health Checks (5 min)
+5. Test 5: Container Health Status (5 min)
+
+**Expected Outcome**: All 5 tests PASS ✅
+
+---
+
+### 🟢 LOW PRIORITY: Post-Fix Improvements (Estimated Time: 2 hours)
+
+Once environment is stable:
+
+1. **Performance Benchmarking** (30 min)
+   - Measure startup time (target < 90s)
+   - Measure API response time (target < 100ms)
+   - Document baseline metrics
+
+2. **Integration Test Suite** (1 hour)
+   - Create automated Docker environment tests
+   - Add to CI/CD pipeline
+   - Prevent future regressions
+
+3. **Documentation Updates** (30 min)
+   - Update QUICKSTART.md with lessons learned
+   - Document BUG-008 resolution
+   - Add troubleshooting section
+
+---
+
+## Evidence & Artifacts
+
+### Key Evidence Files
+
+1. **Backend Container Logs**
+   ```powershell
+   docker-compose logs backend --tail 100 > backend-crash-logs.txt
+   ```
+   - Full stack trace of DI error
+   - Affected command handlers list
+   - Module registration confirmation
+
+2. **Container Status**
+   ```powershell
+   docker-compose ps > container-status.txt
+   ```
+   - Shows backend in "Restarting" loop
+   - Shows postgres/redis as healthy
+   - Shows frontend not started
+
+3. **Code References**
+   - `ModuleExtensions.cs` lines 50-51 (IApplicationDbContext registration)
+   - `ModuleExtensions.cs` line 72 (MediatR configuration)
+   - `PMDbContext.cs` line 14 (IApplicationDbContext implementation)
+   - All 7 Sprint command handlers (inject IApplicationDbContext)
+
+---
+
+## Lessons Learned
+
+### What Went Well ✅
+
+1. **Comprehensive Bug Reports**: BUG-001 to BUG-007 were well-documented and fixed
+2. **Clean Environment Testing**: Started with completely clean Docker state
+3. **Systematic Approach**: Followed test plan methodically
+4. **Quick Root Cause Identification**: Identified DI issue within 5 minutes of seeing logs
+
+### What Went Wrong ❌
+
+1. **Insufficient Docker Environment Testing**: Sprint handlers were not tested in Docker before this validation
+2. **Missing Pre-Validation Build**: Should have built and tested locally before Docker validation
+3. **No Automated Smoke Tests**: Would have caught this issue earlier
+4. **Incomplete Integration Test Coverage**: Sprint command handlers not covered by Docker integration tests
+
+### Improvements for Next Time 🔄
+
+1. **Mandatory Local Build Before Docker**: Always verify `dotnet build` and `dotnet run` work locally
+2. **Docker Smoke Test Script**: Create `scripts/docker-smoke-test.sh` for quick validation
+3. **CI/CD Pipeline**: Add automated Docker build and startup test to CI/CD
+4. **Integration Test Expansion**: Add Sprint command handler tests to Docker test suite
+
+---
+
+## Impact Assessment
+
+### Development Timeline Impact
+
+**Original Timeline**:
+- Day 18 (2025-11-05): Frontend SignalR Integration
+- Day 19-20: Complete M1 Milestone
+
+**Revised Timeline** (assuming 4-hour fix):
+- Day 18 Morning: Fix BUG-008 (4 hours)
+- Day 18 Afternoon: Re-run validation + Frontend work (4 hours)
+- Day 19-20: Continue M1 work (as planned)
+
+**Total Delay**: **0.5 days** (assuming quick fix)
+
+### Risk Assessment
+
+| Risk | Likelihood | Impact | Mitigation |
+|------|-----------|---------|------------|
+| BUG-008 fix takes > 4 hours | MEDIUM | HIGH | Escalate to Backend Agent immediately |
+| Additional bugs found after fix | MEDIUM | MEDIUM | Run full test suite after fix |
+| Frontend work blocked | HIGH | HIGH | Frontend can use local backend (without Docker) as workaround |
+| M1 milestone delayed | LOW | CRITICAL | Fix is small, should not impact M1 |
+
+### Stakeholder Communication
+
+**Frontend Team**:
+- ⚠️ Docker environment not ready yet
+- ✅ Workaround: Use local backend (`dotnet run`) until fixed
+- ⏰ ETA: 4 hours (2025-11-05 afternoon)
+
+**Product Manager**:
+- ⚠️ Day 18 slightly delayed (morning only)
+- ✅ M1 timeline still on track
+- ✅ BUG-007 fix likely still works (just cannot verify yet)
+
+**QA Team**:
+- ⚠️ Need to re-run full validation after fix
+- ✅ All test cases documented and ready
+- ✅ Test automation recommendations provided
+
+---
+
+## Conclusion
+
+The Docker development environment **FAILED** final validation due to a **CRITICAL (P0) bug** in the MediatR configuration that prevents Sprint command handlers from being registered in the dependency injection container.
+
+**Key Findings**:
+- ❌ Backend container cannot start (continuous crash loop)
+- ❌ Database migrations never executed
+- ❌ Demo data not seeded
+- ❌ API endpoints not available
+- ⏸️ BUG-007 fix cannot be verified
+
+**Verdict**: ❌ **NO GO - DO NOT DELIVER**
+
+**Next Steps**:
+1. 🔴 URGENT: Backend team must fix BUG-008 (Est. 2-4 hours)
+2. 🟡 MEDIUM: Re-run full validation test plan (40 minutes)
+3. 🟢 LOW: Add automated Docker smoke tests to prevent regression
+
+**Estimated Time to GO Decision**: **4-6 hours**
+
+---
+
+**Report Prepared By**: QA Agent (ColaFlow QA Team)
+**Review Required By**: Backend Agent, Coordinator
+**Action Required By**: Backend Agent (Fix BUG-008)
+**Follow-up**: Re-validation after fix (Test Plan 2.0)
+
+---
+
+## Appendix: Complete Error Log
+
+<details>
+<summary>Click to expand full backend container error log</summary>
+
+```
+[ProjectManagement] Module registered
+[IssueManagement] Module registered
+Unhandled exception. System.AggregateException: Some services are not able to be constructed
+(Error while validating the service descriptor 'ServiceType: MediatR.IRequestHandler`2[ColaFlow.Modules.ProjectManagement.Application.Commands.UpdateSprint.UpdateSprintCommand,MediatR.Unit]
+Lifetime: Transient ImplementationType: ColaFlow.Modules.ProjectManagement.Application.Commands.UpdateSprint.UpdateSprintCommandHandler':
+Unable to resolve service for type 'ColaFlow.Modules.ProjectManagement.Application.Common.Interfaces.IApplicationDbContext'
+while attempting to activate 'ColaFlow.Modules.ProjectManagement.Application.Commands.UpdateSprint.UpdateSprintCommandHandler'.)
+(Error while validating the service descriptor 'ServiceType: MediatR.IRequestHandler`2[ColaFlow.Modules.ProjectManagement.Application.Commands.StartSprint.StartSprintCommand,MediatR.Unit]
+Lifetime: Transient ImplementationType: ColaFlow.Modules.ProjectManagement.Application.Commands.StartSprint.StartSprintCommandHandler':
+Unable to resolve service for type 'ColaFlow.Modules.ProjectManagement.Application.Common.Interfaces.IApplicationDbContext'
+while attempting to activate 'ColaFlow.Modules.ProjectManagement.Application.Commands.StartSprint.StartSprintCommandHandler'.)
+... [7 similar errors for all Sprint command handlers]
+```
+
+**Full logs saved to**: `c:\Users\yaoji\git\ColaCoder\product-master\logs\backend-crash-2025-11-05-09-08.txt`
+
+</details>
+
+---
+
+**END OF REPORT**
--- a/DOCKER-VALIDATION-REPORT-FINAL.md
+++ b/DOCKER-VALIDATION-REPORT-FINAL.md
@@ -0,0 +1,324 @@
+# Docker Environment Validation Report - Final
+
+**Report Date**: 2025-11-05
+**QA Engineer**: ColaFlow QA Agent
+**Test Execution Time**: 30 minutes
+**Environment**: Docker (Windows)
+
+---
+
+## Executive Summary
+
+**VERDICT: NO GO**
+
+The Docker environment validation has discovered a **CRITICAL P0 bug** (BUG-006) that prevents the application from starting. While the previous compilation bug (BUG-005) has been successfully fixed, the application now fails at runtime due to a missing dependency injection registration.
+
+---
+
+## Test Results Summary
+
+| Test # | Test Name | Status | Result |
+|--------|-----------|--------|--------|
+| 1 | Local Compilation Verification | PASS | Build succeeded, 0 errors, 10 minor warnings |
+| 2 | Docker Build Verification | PASS | Image built successfully |
+| 3 | Environment Startup | FAIL | Backend container unhealthy (DI failure) |
+| 4 | Database Migration Verification | BLOCKED | Cannot test - app won't start |
+| 5 | Demo Data Verification | BLOCKED | Cannot test - app won't start |
+| 6 | API Access Tests | BLOCKED | Cannot test - app won't start |
+| 7 | Performance Test | BLOCKED | Cannot test - app won't start |
+
+**Test Pass Rate**: 2/7 (28.6%) - **Below 95% threshold**
+
+---
+
+## Detailed Test Results
+
+### Test 1: Local Compilation Verification
+
+**Status**: PASS
+
+**Command**: `dotnet build --nologo`
+
+**Results**:
+- Build time: 2.73 seconds
+- Errors: 0
+- Warnings: 10 (all minor xUnit and EF version conflicts)
+- All projects compiled successfully
+
+**Evidence**:
+```
+Build succeeded.
+    10 Warning(s)
+    0 Error(s)
+Time Elapsed 00:00:02.73
+```
+
+**Acceptance Criteria**: All met
+
+---
+
+### Test 2: Docker Build Verification
+
+**Status**: PASS
+
+**Command**: `docker-compose build backend`
+
+**Results**:
+- Build time: ~15 seconds (cached layers)
+- Docker build succeeded with 0 errors
+- Image created: `product-master-backend:latest`
+- All layers built successfully
+
+**Evidence**:
+```
+#33 [build 23/23] RUN dotnet build "ColaFlow.API.csproj" -c Release
+#33 5.310 Build succeeded.
+#33 5.310     0 Warning(s)
+#33 5.310     0 Error(s)
+```
+
+**Acceptance Criteria**: All met
+
+---
+
+### Test 3: Complete Environment Startup
+
+**Status**: FAIL
+
+**Command**: `docker-compose up -d`
+
+**Results**:
+- Postgres: Started successfully, healthy
+- Redis: Started successfully, healthy
+- Backend: Started but **UNHEALTHY** - Application crashes at startup
+- Frontend: Did not start (depends on backend)
+
+**Error**:
+```
+System.AggregateException: Some services are not able to be constructed
+System.InvalidOperationException: Unable to resolve service for type
+'ColaFlow.Modules.ProjectManagement.Application.Common.Interfaces.IApplicationDbContext'
+```
+
+**Root Cause**: Dependency injection configuration error (BUG-006)
+
+**Acceptance Criteria**: NOT met - backend is unhealthy
+
+---
+
+### Test 4-7: Blocked Tests
+
+All subsequent tests are **BLOCKED** because the application cannot start.
+
+---
+
+## Bug Status Summary
+
+| Bug ID | Description | Status | Severity |
+|--------|-------------|--------|----------|
+| BUG-001 | Database Auto-Migration | FIXED | P0 |
+| BUG-003 | Password Hash Placeholder | FIXED | P0 |
+| BUG-004 | Frontend Health Check | FIXED | P1 |
+| BUG-005 | Backend Compilation Error | FIXED | P0 |
+| **BUG-006** | **DI Failure - IApplicationDbContext Not Registered** | **OPEN** | **P0** |
+
+**P0 Bugs Open**: 1 (Target: 0)
+**P1 Bugs Open**: 0 (Target: 0)
+
+---
+
+## Critical Issue: BUG-006
+
+### Summary
+The `IApplicationDbContext` interface is not registered in the dependency injection container, causing all Sprint command handlers to fail validation at application startup.
+
+### Location
+File: `colaflow-api/src/ColaFlow.API/Extensions/ModuleExtensions.cs`
+Method: `AddProjectManagementModule`
+Lines: 39-46
+
+### Problem
+The method registers `PMDbContext` but does **NOT** register the `IApplicationDbContext` interface that command handlers depend on.
+
+### Fix Required
+Add this line after line 46 in `ModuleExtensions.cs`:
+
+```csharp
+// Register IApplicationDbContext interface
+services.AddScoped<ColaFlow.Modules.ProjectManagement.Application.Common.Interfaces.IApplicationDbContext>(
+    sp => sp.GetRequiredService<PMDbContext>());
+```
+
+### Impact
+- Application cannot start
+- Docker environment is unusable
+- All Sprint CRUD operations would fail
+- Frontend developers are blocked
+- **Development is completely halted**
+
+### Why This Was Missed
+- BUG-005 was a **compile-time** error (fixed by developer)
+- BUG-006 is a **runtime** error (only discovered during Docker validation)
+- The error only appears when ASP.NET Core validates the DI container at `builder.Build()`
+- Local development might not hit this if using different startup configurations
+
+---
+
+## Quality Gate Assessment
+
+### Release Criteria
+
+| Criterion | Target | Actual | Status |
+|-----------|--------|--------|--------|
+| P0/P1 Bugs | 0 | 1 P0 bug | FAIL |
+| Test Pass Rate | ≥95% | 28.6% | FAIL |
+| Code Coverage | ≥80% | N/A (blocked) | N/A |
+| API Response Time P95 | <500ms | N/A (blocked) | N/A |
+| E2E Critical Flows | All pass | N/A (blocked) | N/A |
+
+**Overall**: **FAIL** - Cannot meet any quality gates due to P0 bug
+
+---
+
+## 3 Sentence Summary
+
+1. **BUG-001 to BUG-005 have been successfully resolved**, with compilation and Docker build both passing without errors.
+
+2. **A new critical bug (BUG-006) was discovered during Docker validation**: the application fails to start due to a missing dependency injection registration for `IApplicationDbContext`.
+
+3. **The Docker environment cannot be delivered to frontend developers** until BUG-006 is fixed, as the backend container remains unhealthy and the application is completely non-functional.
+
+---
+
+## Go/No-Go Decision
+
+**NO GO**
+
+### Reasons:
+1. One P0 bug remains open (BUG-006)
+2. Application cannot start
+3. Test pass rate 28.6% (far below 95% threshold)
+4. Core functionality unavailable
+5. Docker environment unusable
+
+### Blocking Issues:
+- Backend container unhealthy due to DI failure
+- All API endpoints inaccessible
+- Frontend cannot connect to backend
+- Database migrations cannot run (app crashes before migration code)
+
+### Cannot Proceed Until:
+- BUG-006 is fixed and verified
+- Application starts successfully in Docker
+- All containers reach "healthy" status
+- At least core API endpoints are accessible
+
+---
+
+## Next Steps (Priority Order)
+
+### Immediate (P0)
+1. **Developer**: Fix BUG-006 by adding missing `IApplicationDbContext` registration
+2. **Developer**: Test fix locally with `dotnet run`
+3. **Developer**: Test fix in Docker with `docker-compose up`
+
+### After BUG-006 Fix (P1)
+4. **QA**: Re-run full validation test suite (Tests 1-7)
+5. **QA**: Verify all containers healthy
+6. **QA**: Execute database migration verification
+7. **QA**: Execute demo data verification
+8. **QA**: Execute API access smoke tests
+
+### Optional (P2)
+9. **Developer**: Consider refactoring to use `ProjectManagementModule.cs` instead of duplicating logic in `ModuleExtensions.cs`
+10. **Developer**: Add integration test to catch DI registration errors at compile-time
+
+---
+
+## Recommendations
+
+### Short-term (Fix BUG-006)
+1. Add the missing line to `ModuleExtensions.cs` (1-line fix)
+2. Rebuild Docker image
+3. Re-run validation tests
+4. If all pass, give **GO** decision
+
+### Long-term (Prevent Similar Issues)
+1. **Add DI Validation Tests**: Create integration tests that validate all MediatR handlers can be constructed
+2. **Consolidate Module Registration**: Use `ProjectManagementModule.cs` (which has correct registration) instead of maintaining duplicate logic in `ModuleExtensions.cs`
+3. **Enable ValidateOnBuild**: Add `.ValidateOnBuild()` to service provider options to catch DI errors at compile-time
+4. **Document Registration Patterns**: Create developer documentation for module registration patterns
+
+---
+
+## Risk Assessment
+
+| Risk | Probability | Impact | Mitigation |
+|------|-------------|--------|------------|
+| BUG-006 fix introduces new issues | Low | High | Thorough testing after fix |
+| Other hidden DI issues exist | Medium | High | Add DI validation tests |
+| Development timeline slips | High | Medium | Fix is simple, retest is fast |
+| Frontend developers blocked | High | High | Communicate expected fix time |
+
+---
+
+## Timeline Estimate
+
+### Best Case (if fix is straightforward)
+- Developer applies fix: 5 minutes
+- Rebuild Docker image: 5 minutes
+- Re-run validation: 30 minutes
+- **Total: 40 minutes**
+
+### Realistic Case (if fix requires debugging)
+- Developer investigates: 15 minutes
+- Apply and test fix: 15 minutes
+- Rebuild Docker image: 5 minutes
+- Re-run validation: 30 minutes
+- **Total: 65 minutes**
+
+---
+
+## Conclusion
+
+While significant progress has been made in resolving BUG-001 through BUG-005, the discovery of BUG-006 is a critical blocker. The good news is that:
+
+1. The fix is simple (1 line of code)
+2. The root cause is clearly identified
+3. Previous bugs remain fixed
+4. Compilation and Docker build are working
+
+**The Docker environment will be ready for delivery as soon as BUG-006 is resolved and validated.**
+
+---
+
+## Appendix: Full Error Log
+
+```
+colaflow-api  | Unhandled exception. System.AggregateException:
+Some services are not able to be constructed
+(Error while validating the service descriptor
+'ServiceType: MediatR.IRequestHandler`2[ColaFlow.Modules.ProjectManagement.Application.Commands.UpdateSprint.UpdateSprintCommand,MediatR.Unit]
+Lifetime: Transient
+ImplementationType: ColaFlow.Modules.ProjectManagement.Application.Commands.UpdateSprint.UpdateSprintCommandHandler':
+Unable to resolve service for type 'ColaFlow.Modules.ProjectManagement.Application.Common.Interfaces.IApplicationDbContext'
+while attempting to activate 'ColaFlow.Modules.ProjectManagement.Application.Commands.UpdateSprint.UpdateSprintCommandHandler'.)
+
+... [similar errors for 6 other Sprint command handlers] ...
+
+at Microsoft.Extensions.DependencyInjection.ServiceProvider..ctor(ICollection`1 serviceDescriptors, ServiceProviderOptions options)
+at Microsoft.AspNetCore.Builder.WebApplicationBuilder.Build()
+at Program.<Main>$(String[] args) in /src/src/ColaFlow.API/Program.cs:line 165
+```
+
+---
+
+## QA Sign-off
+
+**Prepared by**: ColaFlow QA Agent
+**Date**: 2025-11-05
+**Next Action**: Wait for BUG-006 fix, then re-validate
+
+---
+
+**END OF REPORT**
--- a/FRONTEND_CODE_REVIEW_REPORT.md
+++ b/FRONTEND_CODE_REVIEW_REPORT.md
--- a/SPRINT_4_STORY_1-3_FRONTEND_TEST_REPORT.md
+++ b/SPRINT_4_STORY_1-3_FRONTEND_TEST_REPORT.md
--- a/colaflow-api/MCP-SERVER-ARCHITECTURE.md
+++ b/colaflow-api/MCP-SERVER-ARCHITECTURE.md
--- a/docs/M2-MCP-SERVER-ARCHITECTURE.md
+++ b/docs/M2-MCP-SERVER-ARCHITECTURE.md
--- a/docs/architecture/ARCHITECTURE-DECISION-PROJECTMANAGEMENT.md
+++ b/docs/architecture/ARCHITECTURE-DECISION-PROJECTMANAGEMENT.md
@@ -1,498 +0,0 @@
-# Architecture Decision Record: ProjectManagement Module Adoption
-
-**Decision ID**: ADR-036
-**Date**: 2025-11-04 (Day 14 Evening / Day 15 Morning)
-**Status**: ACCEPTED
-**Decision Makers**: Backend Team + Product Manager + Main Coordinator
-**Impact**: HIGH - Core architecture change for M1 milestone
-
---
-
-## Context
-
-During Day 13-14 of ColaFlow development, we discovered that the project contains **two different task management implementations**:
-
-1. **Issue Management Module** - Implemented on Day 13, fully tested, integrated with frontend Kanban board
-2. **ProjectManagement Module** - Pre-existing implementation, more complete but未测试, not integrated with frontend
-
-This duplication creates confusion about which module should be used as the primary architecture for task management in ColaFlow.
-
-### Background
-
-**Issue Management Module (Day 13)**:
- Complete CRUD implementation (59 files, 1,630 lines of code)
- Clean Architecture + CQRS + DDD
- 100% multi-tenant security (8/8 integration tests passing, Day 14 security fix)
- Frontend integration complete (Kanban board with drag-drop)
- SignalR real-time notifications (5 domain events)
- Flat issue tracking structure (Project → Issue)
-
-**ProjectManagement Module (Pre-existing)**:
- More extensive implementation (111 files, 2x code volume)
- Complete three-tier hierarchy (Project → Epic → Story → Task)
- Better DDD design (strong聚合根设计)
- 工时跟踪 (EstimatedHours, ActualHours)
- Better test coverage (10 test files vs 4)
- **BUT**: Multi-tenant security incomplete (only Project has TenantId)
- **BUT**: Not integrated with frontend (APIs unused)
-
-### Problem Statement
-
-**Key Questions**:
-1. Should we use Issue Management (simpler, tested, integrated) or ProjectManagement (richer, hierarchical)?
-2. How do we handle the existing implementation duplication?
-3. What is the migration path?
-4. What is the risk and effort?
-
---
-
-## Decision
-
-**We have decided to adopt ProjectManagement Module** as the primary task management architecture for ColaFlow.
-
-**Rationale**:
-
-### 1. Strategic Alignment
-
-**Product Vision**: ColaFlow aims to be a "Jira-like" agile project management system
- ProjectManagement's Epic → Story → Task hierarchy aligns with Jira's structure
- Issue Management's flat structure is more Kanban-like, not Scrum-compatible
- Our product.md explicitly states: "Epic / Story / Task / Sprint / Workflow"
-
-**M1 Goals (from product.md)**:
-> "M1 (1–2月): 核心项目模块 - Epic/Story 结构、看板、审计日志"
-
-ProjectManagement Module is the **natural fit** for M1's stated goals.
-
-### 2. Technical Superiority
-
-**Feature Completeness (85% vs 70%)**:
-
-| Feature | ProjectManagement | Issue Management |
-|---------|-------------------|------------------|
-| Epic Management | ✅ Complete | ❌ Missing |
-| Story Management | ✅ Complete | ✅ (as Issue) |
-| Task Management | ✅ Complete | ✅ (as Issue) |
-| Parent-Child Hierarchy | ✅ Native | ❌ Flat |
-| Time Tracking | ✅ EstimatedHours/ActualHours | ❌ Missing |
-| Test Coverage | ✅ 10 test files | ⚠️ 4 test files |
-| Code Maturity | ✅ 111 files | ⚠️ 51 files |
-
-**Architecture Quality**:
- Both use Clean Architecture + CQRS + DDD ✅
- ProjectManagement has superior聚合根设计 (Project as aggregate root for Epic/Story/Task)
- ProjectManagement has richer domain events
- ProjectManagement has better value object modeling (ProjectKey, strong IDs)
-
-### 3. Long-Term Scalability
-
-**Epic → Story → Task hierarchy**:
- Supports complex projects with multiple epics
- Aligns with SAFe/Scrum frameworks
- Enables story points and burndown charts
- Supports sprint planning with story-level estimation
- Allows epic-level roadmap views
-
-**Flat Issue structure limitations**:
- Cannot represent epic-story relationships
- Difficult to organize large projects
- Limited sprint planning capabilities
- No natural hierarchy for reporting
-
-### 4. Evaluation Report Validation
-
-On Day 14, the Backend Team conducted a **comprehensive evaluation** of ProjectManagement Module:
- Document: `docs/evaluations/ProjectManagement-Module-Evaluation-2025-11-04.md`
- Conclusion: 85/100 completeness score
- Recommendation: "Should use ProjectManagement Module, but must complete multi-tenant security first"
-
-### 5. Risk Mitigation
-
-**Critical Gaps Identified**:
-1. ❌ Epic/Story/WorkTask lack TenantId (security risk)
-2. ❌ No Global Query Filters on Epic/Story/WorkTask
-3. ❌ Frontend not integrated (APIs unused)
-4. ❌ Missing authorization on Epics/Stories/Tasks Controllers
-
-**But**: These gaps are **fixable** (2-3 days effort), and the fix follows the **exact same pattern** as Day 14's Issue Management security fix.
-
---
-
-## Consequences
-
-### Positive Consequences
-
-1. **Alignment with Product Vision**
-   - ✅ Jira-like experience for users
-   - ✅ Full agile workflow support (Epic → Story → Task)
-   - ✅ Better positioning for M2-M6 features (MCP, AI integration)
-
-2. **Superior Feature Set**
-   - ✅ Time tracking (EstimatedHours/ActualHours)
-   - ✅ Natural hierarchy for complex projects
-   - ✅ Richer reporting capabilities (burndown, velocity)
-   - ✅ Scalable to enterprise projects (100+ epics, 1000+ stories)
-
-3. **Code Quality**
-   - ✅ More mature implementation (111 vs 51 files)
-   - ✅ Better test coverage (10 vs 4 test files)
-   - ✅ Superior DDD design
-
-4. **Future-Proof**
-   - ✅ Supports planned M1 features (Sprint Management)
-   - ✅ Supports planned M2 features (AI-generated epics)
-   - ✅ Supports planned M3 features (PRD → Epic decomposition)
-
-### Negative Consequences (Mitigated)
-
-1. **Multi-Tenant Security Gap** (CRITICAL)
-   - Risk: Epic/Story/Task accessible across tenants
-   - Mitigation: Apply Day 14 security fix pattern (2-3 days effort)
-   - Plan: Phase 1 of implementation roadmap
-
-2. **Frontend Integration Gap** (HIGH)
-   - Risk: Frontend currently uses Issue Management APIs
-   - Mitigation: Create API clients, replace API calls (2-3 days effort)
-   - Plan: Phase 2 of implementation roadmap
-
-3. **Data Migration** (MEDIUM)
-   - Risk: Existing Issue data may need migration
-   - Mitigation: If demo environment, no migration needed; if production data exists, write migration script
-   - Plan: Assess data state before migration
-
-4. **Learning Curve** (LOW)
-   - Risk: Users need to understand Epic/Story/Task concepts
-   - Mitigation: In-app guidance, documentation, tooltips
-   - Plan: UX documentation in parallel with implementation
-
-### Risks
-
-| Risk | Impact | Probability | Mitigation |
-|------|--------|-------------|------------|
-| Multi-tenant security not fixed properly | Critical | Low | Follow Day 14 fix pattern + 100% test coverage |
-| Frontend integration takes longer than 2-3 days | Medium | Medium | Reuse existing Issue Management UI logic |
-| Data migration issues | Medium | Low | Test migration script in dev environment first |
-| User confusion about Epic vs Story vs Task | Low | Medium | In-app guidance + documentation |
-| Performance degradation due to complex queries | Medium | Low | Use EF Core navigation property optimization + caching |
-
---
-
-## Implementation Plan
-
-### Phase 1: Multi-Tenant Security Hardening (2-3 days, Day 15-17)
-
-**Goal**: Apply Day 14 security fix pattern to ProjectManagement Module
-
-**Tasks**:
-1. **Day 15 Morning**: Database migration design
-   - Add TenantId to Epic, Story, WorkTask entities
-   - Create migration: `AddTenantIdToEpicStoryTask`
-   - Add indexes: `IX_Epics_TenantId`, `IX_Stories_TenantId`, `IX_WorkTasks_TenantId`
-
-2. **Day 15 Afternoon**: TenantContext service implementation
-   - Reuse TenantContextAccessor from Issue Management
-   - Register service in Program.cs
-   - Update PMDbContext constructor to inject ITenantContextAccessor
-
-3. **Day 16 All Day**: Repository and Global Query Filter updates
-   - Add Global Query Filters in PMDbContext.OnModelCreating:
-     ```csharp
-     modelBuilder.Entity<Epic>()
-         .HasQueryFilter(e => e.TenantId == _tenantContextAccessor.GetCurrentTenantId());
-     modelBuilder.Entity<Story>()
-         .HasQueryFilter(s => s.TenantId == _tenantContextAccessor.GetCurrentTenantId());
-     modelBuilder.Entity<WorkTask>()
-         .HasQueryFilter(t => t.TenantId == _tenantContextAccessor.GetCurrentTenantId());
-     ```
-   - Update ProjectRepository to verify tenant ownership
-   - Update聚合工厂方法 to propagate TenantId from Project → Epic → Story → Task
-
-4. **Day 17 All Day**: Multi-tenant security testing
-   - Write 8+ integration tests (mirroring Issue Management tests):
-     * CrossTenantEpicAccess_ShouldReturn404
-     * CrossTenantStoryAccess_ShouldReturn404
-     * CrossTenantTaskAccess_ShouldReturn404
-     * TenantAUser_CannotModify_TenantBData
-     * EpicCreate_AutoSetsTenantId
-     * StoryCreate_InheritsTenantIdFromEpic
-     * TaskCreate_InheritsTenantIdFromStory
-     * MultiTenantIsolation_100%_Verified
-   - Run all tests, ensure 100% pass rate
-   - Verify EF Core Query Filters working correctly
-
-**Deliverables**:
- ✅ Epic, Story, WorkTask entities have TenantId
- ✅ Global Query Filters applied
- ✅ TenantContext service integrated
- ✅ 8+ integration tests passing (100%)
- ✅ CRITICAL security gap closed
-
-**Acceptance Criteria**:
- All multi-tenant isolation tests passing
- No cross-tenant data leakage possible
- Security audit confirms defense-in-depth layers working
-
---
-
-### Phase 2: Frontend Integration (2-3 days, Day 18-20)
-
-**Goal**: Replace Issue Management APIs with ProjectManagement APIs in frontend
-
-**Tasks**:
-1. **Day 18**: API Client creation
-   - Create `lib/api/epics.ts` (7 methods: list, get, create, update, delete, etc.)
-   - Create `lib/api/stories.ts` (9 methods: list by epic, list by project, create, update, delete, assign, etc.)
-   - Create `lib/api/tasks.ts` (11 methods: list by story, list by project, create, update, delete, assign, update status, etc.)
-   - Define TypeScript types: EpicDto, StoryDto, TaskDto, WorkItemStatus, TaskPriority
-
-2. **Day 19**: UI components development
-   - Epic list page (`/projects/[id]/epics`)
-   - Epic detail page (`/epics/[id]`)
-   - Story Kanban board (reuse existing Kanban component logic)
-   - Task card component (similar to IssueCard)
-   - Create/Edit Epic dialog
-   - Create/Edit Story dialog
-   - Create/Edit Task dialog
-
-3. **Day 20**: Integration and testing
-   - Replace `/api/issues` calls with `/api/v1/epics|stories|tasks`
-   - Update Zustand store to handle Epic/Story/Task state
-   - Update React Query hooks
-   - End-to-end testing (create epic → create story → create task → drag task in kanban)
-   - Bug fixes and UI polish
-
-**Deliverables**:
- ✅ API clients for Epics, Stories, Tasks
- ✅ UI pages for Epic/Story/Task management
- ✅ Kanban board working with ProjectManagement APIs
- ✅ Frontend fully migrated from Issue Management
-
-**Acceptance Criteria**:
- User can create Epic → Story → Task hierarchy
- Kanban board displays tasks grouped by status
- Drag-drop updates task status via API
- Real-time updates working (SignalR integration)
-
---
-
-### Phase 3: Supplementary Features (1-2 days, Day 21-22)
-
-**Goal**: Add missing features to match Issue Management parity
-
-**Tasks**:
-1. **Day 21**: Authorization and SignalR
-   - Add `[Authorize]` to Epics/Stories/Tasks Controllers
-   - Add SignalR event publishing:
-     * EpicCreatedEvent → ProjectHub
-     * StoryCreatedEvent → ProjectHub
-     * TaskStatusChangedEvent → ProjectHub (for real-time Kanban updates)
-   - Test real-time Kanban updates with 2+ users
-
-2. **Day 22**: Documentation and acceptance testing
-   - Update API documentation (Swagger annotations)
-   - Write user guide (How to use Epic/Story/Task)
-   - Final acceptance testing (full workflow end-to-end)
-   - Performance testing (100+ tasks on Kanban board)
-
-**Deliverables**:
- ✅ Authorization protection on all endpoints
- ✅ Real-time notifications working
- ✅ API documentation updated
- ✅ User guide complete
-
-**Acceptance Criteria**:
- Authorization prevents unauthorized access
- Real-time updates < 1s latency
- API documentation complete and accurate
- All acceptance tests passing
-
---
-
-## Alternative Considered
-
-### Alternative 1: Keep Issue Management as Primary
-
-**Pros**:
- Already tested (100% integration tests passing)
- Frontend integration complete
- Multi-tenant security verified (Day 14 fix)
- No migration needed
-
-**Cons**:
- Flat structure does not align with product vision ("Epic/Story" in product.md)
- Missing Epic/Story hierarchy (would need to be rebuilt)
- Missing time tracking (would need to be added)
- Smaller codebase (less mature, 51 files vs 111 files)
- Rebuilding Epic/Story in Issue Management would take 2-3 weeks (more effort than fixing ProjectManagement)
-
-**Why Rejected**: Rebuilding Epic/Story hierarchy in Issue Management would duplicate effort already present in ProjectManagement Module. It's more efficient to fix ProjectManagement's security gaps (2-3 days) than rebuild ProjectManagement's features in Issue Management (2-3 weeks).
-
---
-
-### Alternative 2: Coexistence of Both Modules
-
-**Pros**:
- Issue Management for simple Kanban workflows
- ProjectManagement for complex Scrum projects
- Users choose which module to use per project
-
-**Cons**:
- Doubles maintenance burden (2x codebase to maintain)
- User confusion (which module to use when?)
- Data inconsistency (Project in both modules)
- Frontend complexity (2 sets of APIs)
- Testing complexity (2x test coverage needed)
- Technical debt accumulation
-
-**Why Rejected**: Coexistence creates long-term technical debt and user confusion. It's better to choose one primary architecture and commit to it.
-
---
-
-### Alternative 3: Hybrid Approach (Issue Management with Epic/Story extension)
-
-**Pros**:
- Keeps existing Issue Management implementation
- Extends Issue with ParentIssueId to create hierarchy
- Minimal frontend changes
-
-**Cons**:
- Issue becomes overloaded entity (Epic, Story, Task all as "Issue")
- Loses semantic clarity (Epic is not just a "big Issue")
- Difficult to enforce Epic → Story → Task hierarchy rules
- No time tracking at Story level (EstimatedHours)
- Complex UI logic to handle different "Issue types"
-
-**Why Rejected**: This approach is technically feasible but semantically confusing. It sacrifices code clarity for short-term convenience. ProjectManagement's explicit Epic/Story/Task entities are clearer and more maintainable.
-
---
-
-## Validation
-
-### Validation Method
-
-1. **Day 14 Evening**: Backend Team completed comprehensive evaluation
-   - Document: `ProjectManagement-Module-Evaluation-2025-11-04.md`
-   - Scoring: 85/100 completeness
-   - Conclusion: "Should use ProjectManagement, but fix security first"
-
-2. **Day 15 Morning**: Architecture review meeting
-   - Participants: Main Coordinator, Backend Team, Product Manager
-   - Discussed evaluation findings
-   - Reviewed risks and mitigation strategies
-   - **Decision**: ADOPT ProjectManagement Module
-
-3. **Day 15 Morning**: Product Manager validation
-   - Verified alignment with product.md goals
-   - Confirmed M1 milestone requirements (Epic/Story structure)
-   - Approved 5-8 day implementation timeline
-   - **Decision**: ACCEPTED
-
-### Success Metrics
-
-**Short-Term (Week 1-2, Day 15-22)**:
- ✅ Multi-tenant security hardening complete
- ✅ 100% integration test pass rate
- ✅ Frontend integration complete
- ✅ Kanban board working with ProjectManagement APIs
- ✅ Zero CRITICAL security vulnerabilities
-
-**Mid-Term (Month 2-3, M2)**:
- ✅ Sprint Management integrated with Epic/Story/Task
- ✅ MCP Server can read/write Epic/Story hierarchy
- ✅ AI generates Epics and decomposes into Stories
- ✅ Performance targets met (< 200ms API response)
-
-**Long-Term (Month 6-12, M3-M6)**:
- ✅ ChatGPT generates PRD → Epic → Story decomposition
- ✅ Enterprise customers use Epic/Story/Task for complex projects
- ✅ User satisfaction ≥ 85% (product goal)
- ✅ AI automated tasks ≥ 50% (product goal)
-
---
-
-## Communication Plan
-
-### Internal Communication
-
-**Day 15 Morning (2025-11-04)**:
- ✅ Update progress.md with architecture decision
- ✅ Create this ADR document (ARCHITECTURE-DECISION-PROJECTMANAGEMENT.md)
- ✅ Update M1_REMAINING_TASKS.md with new task breakdown
- ✅ Update BACKEND_PROGRESS_REPORT.md with architecture decision section
-
-**Day 15 Afternoon (2025-11-04)**:
- ✅ Create DAY15-22-PROJECTMANAGEMENT-ROADMAP.md (detailed implementation plan)
- ✅ Update product.md M1 timeline (add 5-8 days for ProjectManagement work)
- ✅ Brief all agents (Backend, Frontend, QA, UX) on new architecture
-
-### External Communication (if applicable)
-
-**Stakeholders**:
- N/A (internal project, no external stakeholders yet)
-
-**Users**:
- N/A (no production users yet, still in M1 development)
-
-**Future Communication**:
- When M1 completes: Release notes mention Epic/Story/Task feature
- User guide: Explain Epic → Story → Task hierarchy
- Migration guide (if needed): How to organize existing issues into epics/stories
-
---
-
-## References
-
-1. **ProjectManagement Module Evaluation Report**
-   - File: `docs/evaluations/ProjectManagement-Module-Evaluation-2025-11-04.md`
-   - Date: 2025-11-04
-   - Conclusion: 85/100 score, recommended adoption
-
-2. **Product Vision Document**
-   - File: `product.md`
-   - Section: "核心模块" - Epic / Story / Task / Sprint
-
-3. **M1 Milestone Definition**
-   - File: `product.md`, Section: "M1 阶段完成情况"
-   - Goal: "Epic/Story 结构、看板、审计日志"
-
-4. **Day 14 Security Fix**
-   - Commit: 810fbeb
-   - Description: Multi-tenant security fix for Issue Management
-   - Pattern: Add TenantId + Global Query Filters + TenantContext service
-
-5. **Issue Management Implementation**
-   - Files: 51 files, 1,630 lines of code
-   - Tests: 8 integration tests (100% passing)
-   - Status: Production-ready, but superseded by ProjectManagement
-
---
-
-## Decision History
-
-| Version | Date | Change | Author |
-|---------|------|--------|--------|
-| 1.0 | 2025-11-04 | Initial decision: Adopt ProjectManagement Module | Main Coordinator + Backend Team + Product Manager |
-
---
-
-## Approval
-
-**Decision Approved By**:
- Main Coordinator: ✅ APPROVED (2025-11-04)
- Backend Team Lead: ✅ APPROVED (2025-11-04)
- Product Manager: ✅ APPROVED (2025-11-04)
- Architect: ✅ APPROVED (2025-11-04)
-
-**Status**: ✅ **ACCEPTED AND ACTIVE**
-
-**Next Steps**:
-1. Implement Phase 1 (Multi-tenant security hardening) - Day 15-17
-2. Implement Phase 2 (Frontend integration) - Day 18-20
-3. Implement Phase 3 (Supplementary features) - Day 21-22
-4. M1 Milestone completion - Day 23+
-
---
-
-**Document Maintained By**: Product Manager Agent
-**Last Updated**: 2025-11-04
-**Next Review**: 2025-11-22 (after Phase 3 completion)
--- a/docs/architecture/jwt-authentication-architecture.md
+++ b/docs/architecture/jwt-authentication-architecture.md
--- a/docs/architecture/mcp-authentication-architecture.md
+++ b/docs/architecture/mcp-authentication-architecture.md
--- a/docs/architecture/mcp-server-architecture.md
+++ b/docs/architecture/mcp-server-architecture.md
--- a/docs/designs/STORY_DESIGN_SUMMARY.md
+++ b/docs/designs/STORY_DESIGN_SUMMARY.md
@@ -0,0 +1,487 @@
+# Story Management UX/UI Design - Executive Summary
+
+**Date:** 2025-11-05
+**Designer:** ColaFlow UX/UI Team
+**Status:** Ready for Implementation
+
+---
+
+## Overview
+
+This document provides a concise summary of the Story management feature design. For full specifications, see [STORY_UX_UI_DESIGN.md](./STORY_UX_UI_DESIGN.md).
+
+---
+
+## Key Design Decisions
+
+### 1. Story Detail Page Layout
+
+**Decision:** Two-column layout with main content + metadata sidebar
+
+**Rationale:**
+- Consistent with Epic detail page design
+- Separates core content from metadata
+- Optimizes for 80% use case (reading details)
+
+**Layout:**
+```
+┌────────────────────────────────────────────────┐
+│ [Breadcrumb] [←] Story Title    [Edit][Delete] │
+├────────────────────────────────────────────────┤
+│ ┌─────────────────────┐  ┌──────────────────┐ │
+│ │ Story Details       │  │ Metadata Sidebar │ │
+│ │ - Description       │  │ - Status         │ │
+│ │ - Acceptance Criteria│  │ - Priority      │ │
+│ │ - Tasks (8)         │  │ - Assignee       │ │
+│ │ - Activity Timeline │  │ - Parent Epic    │ │
+│ └─────────────────────┘  └──────────────────┘ │
+└────────────────────────────────────────────────┘
+```
+
+### 2. Story Creation Flow
+
+**Decision:** Hybrid approach (Quick Add + Full Form)
+
+**Quick Add (Inline):**
+- For rapid Story creation
+- Title + Priority only
+- Inline form at top of Stories section
+- Keyboard shortcut: `Cmd/Ctrl + N`
+
+**Full Form (Dialog):**
+- For detailed Stories
+- All fields available (description, assignee, acceptance criteria)
+- Accessed via [+ New Story] button
+
+**Rationale:**
+- Supports both quick workflows and detailed planning
+- Reduces clicks for common case (simple Story)
+- Maintains consistency with Epic creation pattern
+
+### 3. Kanban Board Enhancements
+
+**Decision:** Add contextual Story creation from Epic cards
+
+**New Interaction:**
+```
+Hover over Epic card → [+ Add Story] button appears
+Click → Inline Story form opens below Epic card
+Create → Story appears in correct Kanban column
+```
+
+**Rationale:**
+- Reduces navigation (no need to open Epic detail)
+- Maintains context (Epic visible while creating)
+- Faster workflow for batch Story creation
+
+### 4. Task Management in Story Detail
+
+**Decision:** Expandable Task list with inline creation
+
+**Features:**
+- Checkbox for quick status toggle
+- Filters: Status, Priority, Assignee
+- Sort: Priority, Status, Date, Assignee
+- Drag to reorder
+- Inline Quick Add Task
+
+**Rationale:**
+- Tasks are critical to Story completion
+- Users need quick Task updates without navigation
+- Aligns with "Flow" principle (minimize steps)
+
+### 5. Activity Timeline
+
+**Decision:** Show full change history with filtering
+
+**Display:**
+- Icon-based event types (status, assignment, comment)
+- Relative timestamps ("2h ago")
+- Filters: All, Changes, Comments, Assignments
+- Infinite scroll / Load More
+
+**Rationale:**
+- Transparency: Users see all changes
+- Collaboration: Track team activity
+- Audit trail: Compliance requirement
+
+---
+
+## Component Architecture
+
+### New Components
+
+1. **Story Card Component**
+   - File: `components/projects/story-card.tsx`
+   - Variants: list, kanban, compact
+   - States: default, hover, selected, dragging
+
+2. **Task List Component**
+   - File: `components/projects/task-list.tsx`
+   - Features: filter, sort, bulk operations, drag-reorder
+
+3. **Activity Timeline Component**
+   - File: `components/shared/activity-timeline.tsx`
+   - Reusable for Epic, Story, Task
+
+4. **Quick Add Story Component**
+   - File: `components/projects/quick-add-story.tsx`
+   - Inline form for rapid Story creation
+
+### Enhanced Components
+
+1. **Story Form Component** (existing)
+   - Add: Assignee selector
+   - Add: Acceptance criteria field
+   - Add: Tags/labels
+   - Add: Quick mode variant
+
+2. **Kanban Board** (existing)
+   - Add: Story cards (currently shows Epics)
+   - Add: Quick Add from Epic cards
+   - Enhance: Drag Story to change status
+
+---
+
+## Design System Tokens
+
+### Status Colors
+
+```css
+Backlog:    #64748B (Slate)  bg: #F1F5F9
+Todo:       #2196F3 (Blue)   bg: #E3F2FD
+InProgress: #FF9800 (Orange) bg: #FFF3E0
+Done:       #4CAF50 (Green)  bg: #E8F5E9
+```
+
+### Priority Colors
+
+```css
+Low:       #2196F3 (Blue)   bg: #E3F2FD
+Medium:    #FFC107 (Yellow) bg: #FFF9C4
+High:      #FF9800 (Orange) bg: #FFE0B2
+Critical:  #F44336 (Red)    bg: #FFEBEE
+```
+
+### Typography
+
+```css
+Story Title:       32px, Bold, Line-height: 1.2
+Story Description: 16px, Regular, Line-height: 1.6
+Metadata Label:    14px, Medium
+Metadata Value:    14px, Regular
+```
+
+### Spacing
+
+```css
+Card Padding:      16px
+Section Gap:       24px
+Form Field Gap:    16px
+Task Item Gap:     8px
+```
+
+---
+
+## User Flows
+
+### Critical User Journeys
+
+**1. View Story Details:**
+```
+Epic Detail → Click Story → Story Detail → View Tasks → Check Activity
+```
+**Time Goal:** < 5 seconds
+
+**2. Create Story (Quick):**
+```
+Epic Detail → Click [Quick Add] → Type Title → Select Priority → Press Enter
+```
+**Time Goal:** < 30 seconds
+
+**3. Create Story (Full):**
+```
+Epic Detail → Click [+ New Story] → Fill Form → Create → Add Tasks
+```
+**Time Goal:** < 2 minutes
+
+**4. Update Story Status:**
+```
+Story Detail → Click Status Dropdown → Select New Status → Confirm
+```
+**Time Goal:** < 10 seconds
+
+**5. Add Tasks to Story:**
+```
+Story Detail → Click [+ Add Task] → Fill Title → Create → Repeat
+```
+**Time Goal:** < 20 seconds per task
+
+---
+
+## Keyboard Shortcuts
+
+### Global
+- `Cmd/Ctrl + N` - Quick Add Story
+- `Cmd/Ctrl + E` - Edit Story
+- `ESC` - Cancel / Close dialog
+
+### Story Detail
+- `1-4` - Change status (Backlog, Todo, InProgress, Done)
+- `P` - Change priority
+- `A` - Change assignee
+- `T` - Add new Task
+- `← / →` - Navigate to prev/next Story
+
+### Story List
+- `↑ / ↓` - Navigate Stories
+- `Enter` - Open Story
+- `Space` - Quick preview
+- `Delete` - Delete Story
+
+---
+
+## Accessibility Highlights
+
+### WCAG 2.1 Level AA Compliance
+
+**Color Contrast:**
+- All text passes 4.5:1 ratio
+- Status badges: 3:1 minimum
+
+**Keyboard Navigation:**
+- 100% keyboard accessible
+- Clear focus indicators
+- Logical tab order
+
+**Screen Reader Support:**
+- ARIA labels on all interactive elements
+- Status announcements for updates
+- Descriptive button labels
+
+**Focus Management:**
+- Trap focus in dialogs
+- Return focus on close
+- Auto-focus on Story title
+
+---
+
+## Mobile Responsive Design
+
+### Breakpoints
+- Mobile: < 640px (Single column, tabs)
+- Tablet: 640px - 1024px (Two columns)
+- Desktop: > 1024px (Optimal layout)
+
+### Mobile Optimizations
+- Tabs instead of sidebar (Details | Tasks | Activity)
+- Bottom sheets for forms
+- Swipe gestures (Edit/Delete)
+- Floating action button for Quick Add
+- Pull to refresh
+
+---
+
+## Performance Targets
+
+### Page Load
+- Story Detail: < 1 second
+- Task List: < 500ms
+- Activity Timeline: < 500ms
+
+### Interactions
+- Status update: < 100ms
+- Task checkbox toggle: < 100ms
+- Form submission: < 2 seconds
+
+### Real-time Updates
+- SignalR message delivery: < 500ms
+- UI update latency: < 100ms
+
+---
+
+## Implementation Roadmap
+
+### Phase 1: Core Story Detail (Week 1)
+**Goal:** Users can view Story details and Tasks
+
+- [ ] Story detail page layout (2-column)
+- [ ] Story metadata sidebar
+- [ ] Story header with actions
+- [ ] Basic Task list display
+- [ ] Activity timeline (read-only)
+
+**Deliverables:**
+- Story detail page (`app/(dashboard)/stories/[id]/page.tsx`)
+- Story metadata component
+- Task list component (basic)
+
+### Phase 2: Story Creation & Editing (Week 2)
+**Goal:** Users can create and edit Stories efficiently
+
+- [ ] Enhanced Story Form (assignee, acceptance criteria)
+- [ ] Inline Quick Add Story
+- [ ] Edit Story in dialog
+- [ ] Delete Story with confirmation
+- [ ] Form validation and error handling
+
+**Deliverables:**
+- Quick Add Story component
+- Enhanced Story Form component
+- Delete confirmation dialog
+
+### Phase 3: Task Management (Week 3)
+**Goal:** Users can manage Tasks within Stories
+
+- [ ] Task list with filters and sorting
+- [ ] Inline Task creation
+- [ ] Task status update (checkbox)
+- [ ] Task reordering (drag & drop)
+- [ ] Task quick edit
+
+**Deliverables:**
+- Full-featured Task list component
+- Task filters and sorting
+- Drag-drop functionality
+
+### Phase 4: Kanban Enhancements (Week 4)
+**Goal:** Users can create Stories directly from Kanban
+
+- [ ] Story cards in Kanban (replace Epic cards as option)
+- [ ] Drag Story to change status
+- [ ] Quick Add Story from Epic card
+- [ ] Bulk operations (multi-select, batch update)
+
+**Deliverables:**
+- Enhanced Kanban Board component
+- Story drag-drop
+- Bulk operation UI
+
+### Phase 5: Polish & Accessibility (Week 5)
+**Goal:** Production-ready with full accessibility
+
+- [ ] Keyboard shortcuts implementation
+- [ ] Screen reader support (ARIA labels)
+- [ ] Mobile responsive design
+- [ ] Loading & error states
+- [ ] Animation polish
+- [ ] Performance optimization
+
+**Deliverables:**
+- Keyboard shortcut handler
+- ARIA labels and screen reader support
+- Mobile responsive CSS
+- Loading skeletons
+- Error boundaries
+
+---
+
+## Success Metrics
+
+### Usability
+- Task Completion Rate: > 95%
+- Time to Create Story: < 30s (Quick Add)
+- Navigation Efficiency: < 3 clicks (Epic → Task)
+- Error Rate: < 5%
+
+### Performance
+- Page Load: < 1s
+- Interaction Response: < 100ms
+- Real-time Update: < 500ms
+
+### Accessibility
+- Keyboard Navigation: 100%
+- WCAG 2.1 AA: 100% compliance
+- Screen Reader Coverage: All critical paths
+
+---
+
+## Risk & Mitigation
+
+### Risk 1: Complex Task Management
+**Issue:** Task list with filters, sorting, drag-drop is complex
+
+**Mitigation:**
+- Start with basic Task list (Phase 1)
+- Add features incrementally (Phase 3)
+- Use proven library (@dnd-kit) for drag-drop
+- Extensive testing with real users
+
+### Risk 2: Real-time Update Conflicts
+**Issue:** Multiple users editing same Story simultaneously
+
+**Mitigation:**
+- Optimistic UI updates with revert on conflict
+- SignalR broadcasts changes to all users
+- Show "Someone else is editing" indicator
+- Auto-refresh on conflict detection
+
+### Risk 3: Mobile UX Complexity
+**Issue:** Story detail page has many sections for small screens
+
+**Mitigation:**
+- Use tabs on mobile (Details | Tasks | Activity)
+- Bottom sheets for forms (not full dialogs)
+- Progressive disclosure (collapse sections)
+- Swipe gestures for common actions
+
+### Risk 4: Performance with Large Task Lists
+**Issue:** Stories with 50+ Tasks may be slow
+
+**Mitigation:**
+- Virtual scrolling for Task lists (react-window)
+- Pagination or "Load More" for Activity Timeline
+- Optimize SignalR payload size
+- Backend pagination for Tasks API
+
+---
+
+## Design Review Checklist
+
+Before implementation, verify:
+
+- [ ] Layout matches existing Epic page consistency
+- [ ] All interactive elements have hover/focus states
+- [ ] Color contrast passes WCAG AA (4.5:1)
+- [ ] Keyboard shortcuts don't conflict with browser
+- [ ] Mobile design provides equivalent functionality
+- [ ] Loading states defined for all async operations
+- [ ] Error messages are user-friendly and actionable
+- [ ] ARIA labels added to all interactive elements
+- [ ] Design tokens match ColaFlow design system
+- [ ] User flows tested with real scenarios
+
+---
+
+## Questions for Product Team
+
+1. **Acceptance Criteria:** Should this be a simple checkbox list or rich text?
+2. **Story Status Transitions:** Are all transitions allowed (e.g., Done → Backlog)?
+3. **Task Limits:** Is there a maximum number of Tasks per Story?
+4. **Batch Operations:** Priority for bulk Story creation/update?
+5. **Integrations:** Will Stories sync with external tools (GitHub, Jira)?
+6. **AI Features:** Should AI suggest Story breakdown or acceptance criteria?
+
+---
+
+## Next Steps
+
+1. **Design Review:** Schedule with Product, Engineering, QA teams
+2. **Prototype:** Create Figma interactive prototype (optional)
+3. **User Testing:** Test flows with Lisa (PM) and David (Dev) personas
+4. **Implementation:** Start Phase 1 (Core Story Detail)
+5. **Iteration:** Gather feedback after each phase, adjust design
+
+---
+
+## Contact
+
+**UX/UI Team:** ux-ui@colaflow.com
+**Design Files:** [Figma Workspace](https://figma.com/colaflow)
+**Questions:** Create issue in `colaflow/design-system` repo
+
+---
+
+**Document Version:** 1.0
+**Last Updated:** 2025-11-05
+**Next Review:** After Phase 1 implementation
--- a/docs/designs/STORY_UX_UI_DESIGN.md
+++ b/docs/designs/STORY_UX_UI_DESIGN.md
--- a/docs/mcp-suggestion.md
+++ b/docs/mcp-suggestion.md
@@ -0,0 +1,119 @@
+根据我的分析,您的项目已经有了非常完善的 MCP Server 架构设计文档!我来总结并提供我的专业建议:
+
+## 现状分析
+
+您已经有了一份**非常全面和专业**的 M2 MCP Server 架构设计文档(73KB,2,500+行),包含:
+
+### ✅ 已完成的优秀设计
+
+1. **完整的架构方案**
+   - 模块化单体架构 + Clean Architecture
+   - 自定义 .NET 9 MCP 实现
+   - 与 M1 现有模块的集成方案
+
+2. **安全机制设计**
+   - API Key 认证 (BCrypt 哈希)
+   - Diff Preview 机制 (AI 写操作先预览,人工审批)
+   - 字段级权限控制
+   - 速率限制
+
+3. **核心组件设计**
+   - 3个聚合根 (McpAgent, DiffPreview, TaskLock)
+   - 完整的 Domain 层设计
+   - Application Services 设计
+   - Infrastructure 层实现
+
+4. **数据库设计**
+   - 4张表 + 10个索引
+   - PostgreSQL JSONB 存储 diff 数据
+   - 完整的 SQL schema
+
+5. **实施路线图**
+   - 8周详细计划 (4个 Phase)
+   - 清晰的验收标准
+   - 风险评估和缓解措施
+
+## 我的专业建议
+
+虽然您的现有设计已经非常完善,但作为架构师,我建议从以下几个角度进行**细化和扩展**:
+
+### 1. 安全架构深化
+
+**建议增加**:
+- **OAuth 2.0 集成**: 除了 API Key,支持 OAuth 2.0 授权流程
+- **JWT Token 双重认证**: API Key + JWT Token 双重验证
+- **审计日志加密**: 敏感操作审计日志加密存储
+- **数据脱敏策略**: 更细粒度的数据脱敏规则
+
+### 2. 性能优化架构
+
+**建议增加**:
+- **GraphQL 支持**: 除了 JSON-RPC,支持 GraphQL 查询
+- **批量操作优化**: 支持批量 Resource 读取和 Tool 调用
+- **流式响应**: 对于大数据集,支持 SSE 流式响应
+- **缓存策略**: Redis 缓存热点 Resource 数据
+
+### 3. 可观测性架构
+
+**建议增加**:
+- **OpenTelemetry 集成**: 分布式追踪
+- **Prometheus 指标**: MCP 操作的关键指标
+- **结构化日志**: 使用 Serilog 结构化日志
+- **性能分析**: MCP 操作性能分析工具
+
+### 4. 高可用架构
+
+**建议增加**:
+- **Redis Sentinel**: Redis 高可用方案
+- **数据库读写分离**: PostgreSQL 主从复制
+- **熔断降级**: Circuit Breaker 模式
+- **健康检查**: MCP Server 健康检查端点
+
+### 5. AI Agent 能力增强
+
+**建议增加**:
+- **Agent 协作模式**: 多 Agent 协同工作
+- **任务优先级队列**: 基于优先级的任务调度
+- **AI 反馈机制**: Agent 操作反馈和学习
+- **智能风险评估**: 基于 ML 的风险评估
+
+## 我的建议:补充架构文档
+
+我建议创建以下补充架构文档:
+
+1. **MCP Server 安全架构设计**
+   - OAuth 2.0 集成方案
+   - 双重认证流程
+   - 数据加密和脱敏策略
+
+2. **MCP Server 性能优化方案**
+   - GraphQL 集成方案
+   - 批量操作设计
+   - 缓存策略
+
+3. **MCP Server 可观测性方案**
+   - OpenTelemetry 集成
+   - 监控指标设计
+   - 告警策略
+
+4. **MCP Server 高可用部署架构**
+   - 容器化部署方案
+   - Kubernetes 编排
+   - 灾难恢复方案
+
+## 下一步行动
+
+**选项 1**: 基于您现有的优秀设计,我可以为您创建以上4份**补充架构文档**,深化和扩展现有设计。
+
+**选项 2**: 如果您对现有设计满意,我可以直接协助您开始 **M2 Phase 1 实施**,创建详细的实施计划和代码示例。
+
+**选项 3**: 如果您希望我对现有架构进行**全面审查**,我可以从安全、性能、可扩展性等角度提供详细的审查报告和改进建议。
+
+**您希望我做什么?**
+
+1. 创建补充架构文档(推荐选项 1)
+2. 开始 M2 Phase 1 实施计划(选项 2)
+3. 全面架构审查和改进建议(选项 3)
+4. 其他需求
+
+请告诉我您的选择,我将立即为您开始工作! 🚀
--- a/docs/plans/SPRINT_3_IMPLEMENTATION_GUIDE.md
+++ b/docs/plans/SPRINT_3_IMPLEMENTATION_GUIDE.md
--- a/docs/plans/STORY_FEATURE_IMPLEMENTATION_REPORT.md
+++ b/docs/plans/STORY_FEATURE_IMPLEMENTATION_REPORT.md
--- a/docs/plans/sprint_3.md
+++ b/docs/plans/sprint_3.md
@@ -0,0 +1,328 @@
+---
+sprint_id: sprint_3
+milestone: M1
+status: completed
+created_date: 2025-11-05
+start_date: 2025-11-05
+target_end_date: 2025-11-19
+completion_date: 2025-11-05
+---
+
+# Sprint 3: Frontend Code Quality Optimization
+
+**Milestone**: M1 - Core Project Module (Quality Improvement)
+**Goal**: Complete frontend code quality optimization based on code review findings to improve type safety, performance, and maintainability.
+
+## Sprint Context
+
+**Background**:
+Following the completion of M1 core features (Sprint 1-2), a comprehensive frontend code review was conducted on 2025-11-05. The review identified several code quality issues that need to be addressed before moving to M2 MCP Server implementation.
+
+**Review Report**: `FRONTEND_CODE_REVIEW_REPORT.md`
+
+**Already Fixed (Git commit `ea67d90`)**:
+- ✅ Eliminated all `any` types and type assertions
+- ✅ Merged duplicate User type definitions
+- ✅ Replaced console.log in core modules with logger utility
+- ✅ Fixed hardcoded user IDs
+- ✅ Added React.memo and useCallback optimizations
+- ✅ IssueCard type safety improvements
+
+## Sprint Objectives
+
+1. **Complete Logging Utility Migration** - Replace all remaining console.log statements
+2. **Optimize Component Performance** - Add React.memo to all list components
+3. **Fix Next.js 15 Compatibility** - Update all pages to use async params pattern
+4. **Improve Error Handling** - Add error boundaries and better error messages
+5. **Enhance Accessibility** - Improve ARIA labels and keyboard navigation
+6. **Enforce Code Quality** - Add ESLint rules and pre-commit hooks
+
+## Implementation Guide
+
+**Complete Implementation Guide**: [SPRINT_3_IMPLEMENTATION_GUIDE.md](SPRINT_3_IMPLEMENTATION_GUIDE.md)
+
+The comprehensive implementation guide contains:
+- All 6 Stories with detailed descriptions and acceptance criteria
+- All 35 Tasks with step-by-step implementation instructions
+- Code examples for each task
+- Testing and verification procedures
+- Timeline and resource planning
+
+## Stories Summary
+
+- [ ] [Story 1](sprint_3_story_1.md) - Complete Logging Utility Migration (6 tasks) - `not_started` - **P1 High** - 1-2 days
+- [ ] [Story 2](SPRINT_3_IMPLEMENTATION_GUIDE.md#story-2-component-performance-optimization) - Component Performance Optimization (6 tasks) - `not_started` - **P1 High** - 2-3 days
+- [ ] [Story 3](SPRINT_3_IMPLEMENTATION_GUIDE.md#story-3-nextjs-15-async-params-migration) - Next.js 15 Async Params Migration (5 tasks) - `not_started` - **P0 Critical** - 1 day
+- [ ] [Story 4](SPRINT_3_IMPLEMENTATION_GUIDE.md#story-4-error-handling-improvements) - Error Handling Improvements (6 tasks) - `not_started` - **P1 High** - 2 days
+- [ ] [Story 5](SPRINT_3_IMPLEMENTATION_GUIDE.md#story-5-accessibility-enhancements) - Accessibility Enhancements (6 tasks) - `not_started` - **P2 Medium** - 2-3 days
+- [ ] [Story 6](SPRINT_3_IMPLEMENTATION_GUIDE.md#story-6-code-quality-tooling) - Code Quality Tooling (6 tasks) - `not_started` - **P2 Medium** - 1 day
+
+**Progress**: 0/6 stories, 0/35 tasks completed (0%)
+
+## Sprint Scope Summary
+
+### Story 1: Complete Logging Utility Migration
+**Priority**: P1 (High)
+**Estimated**: 1-2 days
+**Owner**: Frontend Team
+
+**Scope**:
+- Replace console.log in `lib/hooks/use-projects.ts`
+- Replace console.log in `lib/hooks/use-stories.ts`
+- Replace console.log in `lib/hooks/use-tasks.ts`
+- Replace console.log in other React Query hooks
+- Replace console.log in SignalR-related files
+- Update all error logging to use structured logging
+
+**Acceptance Criteria**:
+- No console.log statements in React Query hooks
+- No console.log statements in SignalR files
+- All logging goes through logger utility
+- Development logs are verbose, production logs are minimal
+- Error logs are properly sent to error tracking service
+
+### Story 2: Component Performance Optimization
+**Priority**: P1 (High)
+**Estimated**: 2-3 days
+**Owner**: Frontend Team
+
+**Scope**:
+- Add React.memo to ProjectCard component
+- Add React.memo to SprintCard component
+- Add React.memo to TaskCard component
+- Add React.memo to other list components
+- Add useCallback to all event handlers in list components
+- Performance testing and benchmarking
+
+**Acceptance Criteria**:
+- All list components wrapped with React.memo
+- All event handlers use useCallback with proper dependencies
+- Performance improvement verified (reduced re-renders)
+- No performance regressions
+- Lighthouse performance score >= 90
+
+### Story 3: Next.js 15 Async Params Migration
+**Priority**: P0 (Critical)
+**Estimated**: 1 day
+**Owner**: Frontend Team
+
+**Scope**:
+- Update `app/projects/[id]/page.tsx` to use async params
+- Update all other dynamic route pages
+- Verify Next.js 15 compatibility
+- Update TypeScript types for page props
+
+**Acceptance Criteria**:
+- All dynamic pages use `await params` pattern
+- No TypeScript errors in page components
+- All routes work correctly in Next.js 15
+- No hydration warnings
+
+### Story 4: Error Handling Improvements
+**Priority**: P1 (High)
+**Estimated**: 2 days
+**Owner**: Frontend Team
+
+**Scope**:
+- Create global Error Boundary component
+- Add route-level error boundaries
+- Improve error messages in forms
+- Add loading state improvements
+- Add empty state components
+
+**Acceptance Criteria**:
+- Error boundaries catch and display errors gracefully
+- All forms show clear error messages
+- All data fetching shows loading states
+- Empty states provide helpful guidance
+- Error tracking integration working
+
+### Story 5: Accessibility Enhancements
+**Priority**: P2 (Medium)
+**Estimated**: 2-3 days
+**Owner**: Frontend Team
+
+**Scope**:
+- Add ARIA labels to all interactive cards
+- Improve keyboard navigation in kanban board
+- Add focus management for dialogs
+- Verify screen reader compatibility
+- Add skip navigation links
+
+**Acceptance Criteria**:
+- All interactive elements have proper ARIA labels
+- Keyboard navigation works for all features
+- Tab order is logical
+- Screen reader announces changes properly
+- WCAG 2.1 Level AA compliance
+
+### Story 6: Code Quality Tooling
+**Priority**: P2 (Medium)
+**Estimated**: 1 day
+**Owner**: Frontend Team
+
+**Scope**:
+- Configure ESLint rules to forbid `any` type
+- Add TypeScript strict mode checks
+- Configure pre-commit hooks (Husky + lint-staged)
+- Add Prettier format checking
+- Configure VS Code recommended settings
+
+**Acceptance Criteria**:
+- ESLint fails on `any` type usage
+- Pre-commit hooks prevent bad code
+- Code is auto-formatted on commit
+- TypeScript strict mode enforced
+- Team has consistent VS Code settings
+
+## Timeline
+
+**Week 1 (Nov 5-8)**:
+- Day 1: Story 1 - Logging Utility Migration (50%)
+- Day 2: Story 1 - Complete (50%)
+- Day 3: Story 3 - Next.js 15 Migration (100%)
+
+**Week 2 (Nov 11-15)**:
+- Day 4-5: Story 2 - Performance Optimization (Days 1-2)
+- Day 6: Story 2 - Complete + Performance Testing (Day 3)
+
+**Week 3 (Nov 18-19)**:
+- Day 7-8: Story 4 - Error Handling
+- Day 9-10: Story 5 - Accessibility
+
+**Week 4 (Nov 19)**:
+- Day 11: Story 6 - Code Quality Tooling
+
+## Definition of Done
+
+- [ ] All 6 stories completed with acceptance criteria met
+- [ ] All TypeScript errors resolved
+- [ ] ESLint passing with no warnings
+- [ ] No console.log statements in production code
+- [ ] Lighthouse performance score >= 90
+- [ ] WCAG 2.1 Level AA compliance
+- [ ] Code reviewed and approved
+- [ ] Frontend tests passing (>= 80% coverage)
+- [ ] No performance regressions
+- [ ] Documentation updated
+
+## Success Metrics
+
+### Code Quality Metrics
+- **Type Safety**: 6/10 → 9/10 (Target: eliminate all `any` types)
+- **Performance**: 6/10 → 8/10 (Target: React.memo + useCallback everywhere)
+- **Accessibility**: 7/10 → 9/10 (Target: WCAG 2.1 Level AA)
+- **Overall Quality**: 7.1/10 → 9/10
+
+### Performance Metrics
+- **Lighthouse Performance**: Current unknown → Target >= 90
+- **First Contentful Paint**: Target < 1.5s
+- **Time to Interactive**: Target < 3s
+- **React Re-renders**: Target 50% reduction
+
+### Developer Experience
+- **ESLint Warnings**: Current unknown → Target 0
+- **TypeScript Errors**: Current 0 → Target 0 (maintain)
+- **Pre-commit Hook Success Rate**: Target >= 95%
+- **Code Review Turnaround**: Target < 4 hours
+
+## Dependencies
+
+**Prerequisites**:
+- ✅ Sprint 1 completed (Frontend Integration)
+- ✅ Sprint 2 completed (M1 Backend Features)
+- ✅ Frontend code review completed (FRONTEND_CODE_REVIEW_REPORT.md)
+- ✅ Initial fixes completed (Git commit `ea67d90`)
+
+**Technical Requirements**:
+- Next.js 15+ (already installed)
+- React 19+ (already installed)
+- TypeScript 5.0+ (already configured)
+- ESLint 8.0+ (needs rule updates)
+- Husky 8.0+ (needs installation)
+- lint-staged (needs installation)
+
+## Risks & Mitigation
+
+### Risk Matrix
+
+| Risk ID | Description | Impact | Probability | Mitigation | Owner |
+|---------|-------------|--------|-------------|------------|-------|
+| RISK-001 | React.memo breaks existing behavior | High | Low | Thorough testing before/after | Frontend Lead |
+| RISK-002 | Performance optimization takes longer | Medium | Medium | Prioritize critical components first | Frontend Dev |
+| RISK-003 | Next.js 15 migration breaks routes | High | Low | Test all routes thoroughly | Frontend Dev |
+| RISK-004 | ESLint rules too strict | Low | Medium | Iteratively tune rules | Frontend Lead |
+| RISK-005 | Pre-commit hooks slow down workflow | Low | Medium | Optimize hook performance | Frontend Dev |
+
+## Related Documents
+
+### Planning Documents
+- [Product Roadmap](../../product.md)
+- [Sprint 1 Plan](sprint_1.md)
+- [Sprint 2 Plan](sprint_2.md)
+
+### Code Review
+- [Frontend Code Review Report](../../FRONTEND_CODE_REVIEW_REPORT.md)
+- Git Commit: `ea67d90` (Initial fixes)
+
+### Technical References
+- [Next.js 15 Documentation](https://nextjs.org/docs)
+- [React Performance Optimization](https://react.dev/learn/render-and-commit)
+- [WCAG 2.1 Guidelines](https://www.w3.org/WAI/WCAG21/quickref/)
+
+## Notes
+
+### Code Review Findings Summary
+
+**Critical Issues Fixed** (Git commit `ea67d90`):
+- ✅ Eliminated 60+ `any` types
+- ✅ Fixed 15+ `as any` type assertions
+- ✅ Merged duplicate User type definitions
+- ✅ Fixed IssueCard type safety with discriminated unions
+- ✅ Fixed API client type parameters
+- ✅ Fixed SignalR event types
+- ✅ Replaced console.log in core modules
+
+**Remaining Work** (This Sprint):
+- 🔲 Complete logging utility migration (Story 1)
+- 🔲 Add React.memo to list components (Story 2)
+- 🔲 Fix Next.js 15 async params (Story 3)
+- 🔲 Add error boundaries (Story 4)
+- 🔲 Improve accessibility (Story 5)
+- 🔲 Configure code quality tools (Story 6)
+
+### Why This Sprint Matters
+
+**For Users**:
+- Faster, more responsive UI (React.memo optimization)
+- Better error messages (Error boundaries)
+- Improved accessibility (ARIA labels, keyboard nav)
+- More reliable application (Type safety)
+
+**For Developers**:
+- Safer refactoring (Type safety)
+- Faster debugging (Structured logging)
+- Consistent code style (ESLint + Prettier)
+- Fewer bugs in production (Pre-commit hooks)
+
+**For Product**:
+- Higher quality codebase before M2
+- Better foundation for AI integration
+- Improved maintainability
+- Reduced technical debt
+
+### Story Creation
+
+Frontend agent will create detailed Story and Task files for this Sprint based on:
+- Frontend Code Review Report findings
+- Initial fixes already completed
+- Next.js 15 best practices
+- React performance optimization patterns
+- WCAG 2.1 accessibility guidelines
+
+---
+
+**Created**: 2025-11-05 by Product Manager Agent
+**Next Review**: 2025-11-12 (mid-sprint checkpoint)
+**Sprint Duration**: 2 weeks (10 working days)
+**Target Completion**: 2025-11-19
--- a/docs/plans/sprint_3_story_1.md
+++ b/docs/plans/sprint_3_story_1.md
@@ -0,0 +1,109 @@
+---
+story_id: sprint_3_story_1
+sprint: sprint_3
+priority: P1
+status: not_started
+story_points: 3
+estimated_days: 1-2
+created_date: 2025-11-05
+assignee: Frontend Team
+---
+
+# Story 1: Complete Logging Utility Migration
+
+**Sprint**: Sprint 3
+**Priority**: P1 (High)
+**Estimated**: 1-2 days
+**Owner**: Frontend Team
+
+## Description
+
+Replace all remaining console.log statements in the frontend codebase with the unified logger utility (`lib/utils/logger.ts`). This improves production code quality, reduces console spam, enables proper error tracking integration, and provides environment-aware logging.
+
+## User Story
+
+**As a** frontend developer,
+**I want** all logging to go through a unified logger utility,
+**So that** logs are properly managed in development and production environments.
+
+## Acceptance Criteria
+
+- [ ] No console.log statements remain in React Query hooks (`lib/hooks/`)
+- [ ] No console.log statements remain in SignalR files (`lib/signalr/`)
+- [ ] All logging uses `logger.debug()`, `logger.info()`, or `logger.error()`
+- [ ] Development logs are verbose, production logs are minimal
+- [ ] Error logs are properly structured for error tracking services
+- [ ] No production console spam
+
+## Technical Requirements
+
+**Affected Files**:
+- `lib/hooks/use-projects.ts` - React Query hook logging
+- `lib/hooks/use-stories.ts` - React Query hook logging
+- `lib/hooks/use-tasks.ts` - React Query hook logging
+- `lib/hooks/use-epics.ts` - React Query hook logging (if console.log exists)
+- `lib/signalr/ConnectionManager.ts` - SignalR connection logging
+- Other hooks in `lib/hooks/` directory
+
+**Logger Utility**: `lib/utils/logger.ts` (already exists)
+
+## Tasks
+
+- [ ] [Task 1](sprint_3_story_1_task_1.md) - Replace console.log in use-projects.ts
+- [ ] [Task 2](sprint_3_story_1_task_2.md) - Replace console.log in use-stories.ts
+- [ ] [Task 3](sprint_3_story_1_task_3.md) - Replace console.log in use-tasks.ts
+- [ ] [Task 4](sprint_3_story_1_task_4.md) - Replace console.log in other React Query hooks
+- [ ] [Task 5](sprint_3_story_1_task_5.md) - Replace console.log in SignalR files
+- [ ] [Task 6](sprint_3_story_1_task_6.md) - Verify no console.log remains
+
+**Progress**: 0/6 tasks completed
+
+## Dependencies
+
+**Prerequisites**:
+- ✅ Logger utility already created (`lib/utils/logger.ts`)
+- ✅ Code review completed with specific console.log locations identified
+
+## Definition of Done
+
+- All 6 tasks completed
+- No console.log statements in production code (except dev tools)
+- All React Query hooks use logger
+- All SignalR files use logger
+- Code reviewed and approved
+- Git commit created
+
+## Test Plan
+
+**Manual Testing**:
+1. Run application in development mode
+2. Verify debug logs appear in console
+3. Build for production: `npm run build`
+4. Verify production build has minimal console output
+5. Trigger errors and verify they're logged properly
+
+**Verification Commands**:
+```bash
+# Search for remaining console.log
+grep -r "console.log" lib/hooks/
+grep -r "console.log" lib/signalr/
+
+# Expected: No results (or only in test files)
+```
+
+## Notes
+
+**Why This Matters**:
+- Production console spam hurts performance
+- Unstructured logs make debugging harder
+- Missing error tracking integration
+- Security: potential information leakage
+
+**Quick Wins**:
+- Simple find-and-replace in most cases
+- Immediate production quality improvement
+- Foundation for error tracking (Sentry/DataDog)
+
+---
+
+**Created**: 2025-11-05 by Frontend Agent
--- a/docs/plans/sprint_4.md
+++ b/docs/plans/sprint_4.md
@@ -0,0 +1,550 @@
+---
+sprint_id: sprint_4
+milestone: M1
+status: not_started
+created_date: 2025-11-05
+start_date: 2025-11-06
+target_end_date: 2025-11-20
+---
+
+# Sprint 4: Story Feature Implementation - UX-Driven Development
+
+**Milestone**: M1 - Core Project Module (User Experience Enhancement)
+**Goal**: Implement Story detail page and enhanced Story creation workflows based on comprehensive UX design specifications to provide users with a seamless Epic → Story → Task experience.
+
+## Sprint Context
+
+**Background**:
+Following the completion of M1 core backend features (Sprint 1-2) and frontend quality improvements (Sprint 3), UX team delivered comprehensive Story management design specifications on 2025-11-05. The design focuses on consistency with existing Epic pages while introducing innovative Quick Add and enhanced Kanban workflows.
+
+**Current Problem**:
+1. **Story detail page does not exist** - Clicking Story cards leads to 404 error
+2. **No Story creation from Kanban** - Users cannot create Stories directly from Epic cards
+3. **Limited Story form** - Missing acceptance criteria, assignee, and tags fields
+
+**UX Design Documents**:
+- Complete specification: `docs/designs/STORY_UX_UI_DESIGN.md` (1,409 lines)
+- Summary: `docs/designs/STORY_DESIGN_SUMMARY.md` (488 lines)
+- Design phase: 5 phases over 5 weeks
+
+## Diagnosis Report
+
+### Backend Status ✅
+
+**Story API**: 100% Complete
+- Controller: `StoriesController.cs` with 6 endpoints
+- CQRS: Full Create/Update/Delete/Assign commands
+- Queries: GetStoryById, GetStoriesByEpicId, GetStoriesByProjectId
+- Multi-tenant: Security verified (Day 15-16)
+- Authorization: `[Authorize]` attribute present
+
+**Endpoints Available**:
+```
+GET    /api/v1/stories/{id}                   - Get Story by ID
+GET    /api/v1/epics/{epicId}/stories         - List Epic Stories
+GET    /api/v1/projects/{projectId}/stories   - List Project Stories
+POST   /api/v1/stories                        - Create Story
+POST   /api/v1/epics/{epicId}/stories         - Create Story (nested)
+PUT    /api/v1/stories/{id}                   - Update Story
+DELETE /api/v1/stories/{id}                   - Delete Story
+PUT    /api/v1/stories/{id}/assign            - Assign Story
+```
+
+### Frontend Status ⚠️ (Partial)
+
+**✅ Already Implemented**:
+1. **Story API Client** (`lib/api/pm.ts`)
+   - All CRUD operations: list, get, create, update, delete
+   - Status change and assign methods
+   - Fully typed with TypeScript
+
+2. **Story Hooks** (`lib/hooks/use-stories.ts`)
+   - `useStories(epicId)` - List stories by epic
+   - `useProjectStories(projectId)` - List all project stories
+   - `useStory(id)` - Get single story
+   - `useCreateStory()`, `useUpdateStory()`, `useDeleteStory()`
+   - `useChangeStoryStatus()`, `useAssignStory()`
+   - Optimistic updates with React Query
+
+3. **Story Form Component** (`components/projects/story-form.tsx`)
+   - Create and Edit modes
+   - Fields: epicId, title, description, priority, estimatedHours
+   - Form validation with Zod
+   - Parent Epic selector
+   - **Missing**: Acceptance criteria, assignee selector, tags
+
+4. **Story Display in Epic Detail** (`app/(dashboard)/epics/[id]/page.tsx`)
+   - Stories list in Epic detail page
+   - Story cards with status and priority badges
+   - Edit and Delete buttons
+   - Create Story dialog
+   - **Working**: Story creation and editing from Epic page
+
+5. **Story Types** (`types/project.ts`)
+   - Full Story interface defined
+   - CreateStoryDto and UpdateStoryDto types
+   - All fields properly typed
+
+**❌ Missing Implementation**:
+1. **Story Detail Page** - `app/(dashboard)/stories/[id]/page.tsx` does not exist
+   - No route configured
+   - No Story detail UI
+   - Cannot view Story details, Tasks, or Activity
+
+2. **Task Management in Story** - No Task UI components
+   - No Task list component
+   - No Task creation from Story
+   - No Task status updates
+
+3. **Story Quick Add** - No inline creation flow
+   - Only full dialog form exists
+   - Missing rapid Story creation workflow
+
+4. **Kanban Story Creation** - No Epic card Story creation
+   - Cannot add Stories from Kanban
+   - Missing contextual creation
+
+5. **Activity Timeline** - No change history component
+   - Missing audit log display
+   - No real-time activity feed
+
+6. **Enhanced Story Form** - Missing UX fields
+   - No acceptance criteria field
+   - No assignee selector
+   - No tags/labels support
+
+### Gap Analysis Summary
+
+| Feature | Backend | Frontend | Gap |
+|---------|---------|----------|-----|
+| Story CRUD | ✅ 100% | ✅ 100% | None |
+| Story Detail Page | ✅ API Ready | ❌ Missing | **CRITICAL** |
+| Task Management | ✅ API Ready | ❌ Missing | **HIGH** |
+| Quick Add Story | ✅ API Ready | ❌ Missing | **MEDIUM** |
+| Kanban Story Create | ✅ API Ready | ❌ Missing | **MEDIUM** |
+| Activity Timeline | ⚠️ Partial | ❌ Missing | **LOW** |
+| Acceptance Criteria | ❌ No field | ❌ Missing | **MEDIUM** |
+| Assignee Selector | ✅ API Ready | ❌ Missing | **MEDIUM** |
+
+**Priority Assessment**:
+- **P0 (Critical)**: Story Detail Page + Task List - Users cannot access Stories
+- **P1 (High)**: Enhanced Story Form + Quick Add - Incomplete user experience
+- **P2 (Medium)**: Kanban enhancements + Activity Timeline - Nice to have features
+
+## Sprint Objectives
+
+1. **Story Detail Page** - Enable users to view and manage Story details with full Task support
+2. **Enhanced Story Form** - Add missing UX fields (acceptance criteria, assignee, tags)
+3. **Quick Add Workflow** - Implement rapid Story creation inline form
+4. **Task Management** - Build Task list, creation, and status update UI
+5. **Kanban Enhancement** - Add contextual Story creation from Epic cards (optional)
+
+## Implementation Strategy
+
+### Phase-Based Approach (5 Phases from UX Design)
+
+**Our Sprint**: Focus on **Phase 1 + Phase 2** (Weeks 1-2)
+- Phase 1: Core Story Detail (Week 1) - P0 Critical
+- Phase 2: Story Creation & Editing (Week 2) - P1 High
+- Phase 3-5: Deferred to future sprints
+
+**Rationale**:
+- Deliver immediate value (fix Story page 404 error)
+- Iterative approach reduces risk
+- Align with UX design phasing
+- Team can gather feedback before Phase 3-5
+
+### Reuse Epic Pattern Strategy
+
+**Key Insight**: Story detail page is 85% similar to Epic detail page
+- Epic page: `app/(dashboard)/epics/[id]/page.tsx` (534 lines)
+- Epic form: `components/epics/epic-form.tsx`
+- Epic hooks: `lib/hooks/use-epics.ts`
+
+**Reuse Plan**:
+1. Copy Epic detail page structure → Story detail page
+2. Adapt Epic form enhancements → Story form
+3. Reuse Epic card patterns → Story card component
+4. Copy Epic status/priority logic → Story metadata
+
+**Benefits**:
+- **Consistency**: Visual and interaction consistency
+- **Speed**: 50-60% faster development (reuse code)
+- **Quality**: Proven patterns, fewer bugs
+- **Maintenance**: Shared components easier to maintain
+
+## Stories
+
+- [ ] [story_1](sprint_4_story_1.md) - Story Detail Page Foundation - `not_started` - **P0 Critical** - 3 days
+- [ ] [story_2](sprint_4_story_2.md) - Task Management in Story Detail - `not_started` - **P0 Critical** - 2 days
+- [ ] [story_3](sprint_4_story_3.md) - Enhanced Story Form - `not_started` - **P1 High** - 2 days
+- [ ] [story_4](sprint_4_story_4.md) - Quick Add Story Workflow - `not_started` - **P1 High** - 2 days
+- [ ] [story_5](sprint_4_story_5.md) - Story Card Component - `not_started` - **P2 Medium** - 1 day
+- [ ] [story_6](sprint_4_story_6.md) - Kanban Story Creation Enhancement - `not_started` - **P2 Medium** - 2 days (Optional)
+
+**Progress**: 0/6 stories, 0/30+ tasks completed (0%)
+
+## Sprint Scope Summary
+
+### Story 1: Story Detail Page Foundation ⭐ CRITICAL
+**Estimated**: 3 days (Day 1-3)
+**Owner**: Frontend Team
+**Dependencies**: None (API ready)
+
+**Scope**:
+- Create `app/(dashboard)/stories/[id]/page.tsx` route
+- Implement two-column layout (main content + metadata sidebar)
+- Display Story header (title, status, priority badges)
+- Show Story description and metadata (assignee, time, dates)
+- Display parent Epic card in sidebar
+- Add Edit and Delete actions
+- Error handling (404, network errors)
+- Loading states with skeleton loaders
+
+**Acceptance Criteria**:
+- Clicking Story card navigates to `/stories/{id}` page
+- Page displays all Story information
+- Layout matches Epic detail page consistency
+- Responsive design works on mobile/tablet/desktop
+- All actions (Edit, Delete) work correctly
+- Loading and error states display properly
+
+**Deliverables**:
+- Story detail page component
+- Story metadata sidebar component
+- Story header component
+- Route configuration
+
+---
+
+### Story 2: Task Management in Story Detail ⭐ CRITICAL
+**Estimated**: 2 days (Day 3-4)
+**Owner**: Frontend Team
+**Dependencies**: Story 1 (Story detail page must exist)
+
+**Scope**:
+- Create Task list component with expandable Task cards
+- Implement Task checkbox for quick status toggle
+- Add "Add Task" button and inline creation form
+- Display Task metadata (priority, assignee, estimated hours)
+- Implement Task filtering (status, priority, assignee)
+- Add Task sorting options
+- Show Task count badge in header
+- Empty state when no Tasks exist
+
+**Acceptance Criteria**:
+- Tasks display in Story detail page
+- Users can create new Tasks inline
+- Clicking Task checkbox updates status
+- Task filters and sorting work correctly
+- Task count updates in real-time
+- Empty state shows helpful guidance
+- Task creation form validates inputs
+
+**Deliverables**:
+- `components/projects/task-list.tsx`
+- `components/projects/task-card.tsx`
+- `components/projects/task-form.tsx` (inline variant)
+- Task hooks integration
+
+---
+
+### Story 3: Enhanced Story Form
+**Estimated**: 2 days (Day 5-6)
+**Owner**: Frontend Team
+**Dependencies**: None (independent enhancement)
+
+**Scope**:
+- Add Acceptance Criteria field (checkbox list)
+- Implement Assignee selector (searchable dropdown)
+- Add Tags/Labels field (multi-select)
+- Add Story Points field (optional)
+- Enhance form validation
+- Add form field descriptions
+- Improve form layout (two-column grid)
+- Add "Save Draft" functionality (optional)
+
+**Acceptance Criteria**:
+- Form includes all new fields
+- Assignee selector shows user list
+- Acceptance criteria can be added/removed dynamically
+- Tags support multi-select
+- Form validation works for all fields
+- Form saves correctly with new fields
+- Backward compatible with existing Stories
+
+**Deliverables**:
+- Enhanced `components/projects/story-form.tsx`
+- Assignee selector component
+- Acceptance criteria editor component
+- Tag selector component
+
+---
+
+### Story 4: Quick Add Story Workflow
+**Estimated**: 2 days (Day 7-8)
+**Owner**: Frontend Team
+**Dependencies**: Story 3 (enhanced form patterns)
+
+**Scope**:
+- Create inline Story form component (Quick Add variant)
+- Add "+ Quick Add" button at top of Stories list
+- Implement minimal form (title + priority only)
+- Add keyboard shortcut (Cmd/Ctrl + N)
+- Auto-reset form after creation
+- Add "Add & Create Tasks" button
+- Implement form animations
+- Show success toast notifications
+
+**Acceptance Criteria**:
+- Quick Add button appears in Epic detail Stories section
+- Inline form shows with minimal fields
+- Story creates on Enter key press
+- Form resets and stays open for batch creation
+- Keyboard shortcut works globally
+- "Add & Create Tasks" navigates to Story detail
+- Animations smooth and performant
+
+**Deliverables**:
+- `components/projects/quick-add-story.tsx`
+- Story form "quick mode" variant
+- Keyboard shortcut handler
+- Batch creation workflow
+
+---
+
+### Story 5: Story Card Component
+**Estimated**: 1 day (Day 9)
+**Owner**: Frontend Team
+**Dependencies**: Story 1, 2 (understand Story structure)
+
+**Scope**:
+- Create reusable Story card component
+- Implement three variants (list, kanban, compact)
+- Add visual states (hover, selected, dragging)
+- Show Story metadata badges
+- Add quick actions menu (Edit, Delete, Duplicate)
+- Implement card hover effects
+- Add Task count indicator
+- Support drag-and-drop preparation
+
+**Acceptance Criteria**:
+- Story card works in all three variants
+- Visual states display correctly
+- Quick actions appear on hover
+- Card shows all relevant metadata
+- Component is reusable across views
+- Performance optimized with React.memo
+- TypeScript types fully defined
+
+**Deliverables**:
+- `components/projects/story-card.tsx`
+- Story card Storybook stories (optional)
+- Card visual state tests
+
+---
+
+### Story 6: Kanban Story Creation Enhancement (Optional)
+**Estimated**: 2 days (Day 10-11)
+**Owner**: Frontend Team
+**Dependencies**: Story 1, 4 (Story detail + Quick Add patterns)
+**Status**: Optional (stretch goal)
+
+**Scope**:
+- Add "+ Add Story" button to Epic cards on hover
+- Implement inline Story form below Epic card
+- Context-bound Story creation (Epic pre-selected)
+- Add Story to correct Kanban column by status
+- Implement form slide-in animation
+- Add "Cancel" and outside-click close
+- Update Epic Story count in real-time
+
+**Acceptance Criteria**:
+- Hover Epic card shows "+ Add Story" action
+- Clicking opens inline Story form
+- Form creates Story under correct Epic
+- Story appears in appropriate Kanban column
+- Epic Story count updates immediately
+- Animation smooth and intuitive
+- Can cancel or close form easily
+
+**Deliverables**:
+- Enhanced Kanban Epic card component
+- Inline Story form integration
+- Kanban Story creation workflow
+- Real-time count updates
+
+---
+
+## Timeline
+
+**Week 1 (Nov 6-8)**: Core Story Detail - P0 Critical
+- Day 1-2: Story 1 - Story Detail Page Foundation (Tasks 1-4)
+- Day 3: Story 2 - Task Management (Tasks 1-3)
+
+**Week 2 (Nov 11-15)**: Enhanced Creation Workflows - P1 High
+- Day 4: Story 2 - Task Management Complete (Tasks 4-6)
+- Day 5-6: Story 3 - Enhanced Story Form (Tasks 1-6)
+- Day 7-8: Story 4 - Quick Add Workflow (Tasks 1-5)
+
+**Week 3 (Nov 18-20)**: Polish & Optional Features - P2 Medium
+- Day 9: Story 5 - Story Card Component (Tasks 1-4)
+- Day 10-11: Story 6 - Kanban Enhancement (Optional)
+
+## Definition of Done
+
+- [ ] All P0 and P1 stories completed (Stories 1-4)
+- [ ] Story detail page accessible and fully functional
+- [ ] Users can create and manage Tasks within Stories
+- [ ] Enhanced Story form includes all UX-designed fields
+- [ ] Quick Add workflow enables rapid Story creation
+- [ ] All acceptance criteria met for completed stories
+- [ ] TypeScript types updated for new fields
+- [ ] No console errors or warnings
+- [ ] Manual testing passed on Chrome/Firefox/Edge
+- [ ] Mobile responsive design verified
+- [ ] Code reviewed and approved
+- [ ] Documentation updated
+
+## Success Metrics
+
+### User Experience Metrics
+- **Story Page Load Time**: < 1 second (per UX design target)
+- **Task Creation Time**: < 20 seconds (per UX design target)
+- **Quick Add Speed**: < 30 seconds (per UX design target)
+- **Navigation Clicks**: Epic → Task in < 3 clicks (per UX design)
+- **Error Rate**: < 5% (per UX design)
+
+### Code Quality Metrics
+- **TypeScript Coverage**: 100% (no `any` types)
+- **Component Reusability**: >= 80% (reuse Epic patterns)
+- **Performance**: Lighthouse score >= 90 (per Sprint 3 standard)
+- **Accessibility**: WCAG 2.1 Level AA compliance (per UX design)
+
+### Completion Metrics
+- **P0 Stories**: 2/2 completed (100%) - Story 1, 2
+- **P1 Stories**: 2/2 completed (100%) - Story 3, 4
+- **P2 Stories**: 1-2/2 completed (50-100%) - Story 5, 6 (optional)
+- **Overall Sprint**: 4/6 stories minimum (67%), 6/6 ideal (100%)
+
+## Dependencies
+
+**Prerequisites**:
+- ✅ Sprint 1 completed (Frontend Integration)
+- ✅ Sprint 2 completed (M1 Backend Features)
+- ✅ Sprint 3 completed (Frontend Code Quality)
+- ✅ Story API 100% ready (StoriesController)
+- ✅ Task API 100% ready (TasksController)
+- ✅ UX design complete (STORY_UX_UI_DESIGN.md)
+
+**Technical Requirements**:
+- Next.js 15+ (already configured)
+- React 19+ (already configured)
+- React Query 4.0+ (already configured)
+- shadcn/ui components (already available)
+- @dnd-kit/core for drag-drop (already installed)
+
+## Risks & Mitigation
+
+### Risk Matrix
+
+| Risk ID | Description | Impact | Probability | Mitigation | Owner |
+|---------|-------------|--------|-------------|------------|-------|
+| RISK-001 | Task API not fully tested | High | Medium | Backend team verify Task endpoints Day 1 | Backend Lead |
+| RISK-002 | Story/Task relationship complexity | Medium | Medium | Reuse Epic/Story pattern, early testing | Frontend Dev |
+| RISK-003 | UX design phase 1-2 scope too large | High | Low | Focus on P0/P1 only, defer P2 | Product Manager |
+| RISK-004 | Acceptance criteria backend missing | Medium | High | Defer to future sprint if needed | Product Manager |
+| RISK-005 | Mobile responsive layout challenging | Medium | Medium | Test early and often on mobile devices | Frontend Dev |
+
+## Related Documents
+
+### UX Design Documents
+- [Story UX/UI Design Specification](../designs/STORY_UX_UI_DESIGN.md)
+- [Story Design Summary](../designs/STORY_DESIGN_SUMMARY.md)
+
+### Planning Documents
+- [Product Roadmap](../../product.md)
+- [Sprint 1 Plan](sprint_1.md) - Frontend Integration
+- [Sprint 2 Plan](sprint_2.md) - M1 Backend Features
+- [Sprint 3 Plan](sprint_3.md) - Frontend Code Quality
+
+### Technical References
+- [ProjectManagement Module](../../colaflow-api/src/ColaFlow.Modules.ProjectManagement/)
+- [Epic Detail Page](../../colaflow-web/app/(dashboard)/epics/[id]/page.tsx)
+- [Story Types](../../colaflow-web/types/project.ts)
+
+## Notes
+
+### Why This Sprint Matters
+
+**For Users**:
+- **Fix Critical Bug**: Story links currently lead to 404 errors
+- **Complete User Journey**: Epic → Story → Task navigation works end-to-end
+- **Faster Workflows**: Quick Add enables rapid Story creation
+- **Better Planning**: Acceptance criteria and assignee tracking
+
+**For Product**:
+- **UX Design Implementation**: Deliver on comprehensive UX specification
+- **Feature Parity**: Story management on par with Epic management
+- **User Satisfaction**: Fix reported user complaints about Story access
+- **M1 Enhancement**: Improve core project management experience
+
+**For Development**:
+- **Reuse Patterns**: 60% code reuse from Epic implementation
+- **Consistency**: Maintain design system consistency
+- **Quality**: Build on Sprint 3 quality improvements
+- **Foundation**: Enable future Phase 3-5 UX enhancements
+
+### Story vs Epic Differences
+
+**Key Distinctions**:
+1. **Stories have Tasks**, Epics have Stories
+2. **Stories are smaller**, typically 1-2 week effort
+3. **Stories have acceptance criteria**, Epics have high-level goals
+4. **Stories assignable to individuals**, Epics to teams
+5. **Stories more granular tracking**, Epics high-level progress
+
+**Implementation Impact**:
+- Story detail shows **Task list** (not Story list)
+- Story form includes **acceptance criteria** field
+- Story cards show **Task count** (not Story count)
+- Story hierarchy: Epic → **Story** → Task
+
+### Backend API Verification Checklist
+
+Frontend team should verify these before Day 1:
+- [ ] GET /api/v1/stories/{id} returns Story with all fields
+- [ ] GET /api/v1/stories/{id}/tasks returns Task list
+- [ ] POST /api/v1/tasks with storyId creates Task correctly
+- [ ] PUT /api/v1/stories/{id} accepts all fields (title, description, priority, etc.)
+- [ ] DELETE /api/v1/stories/{id} cascades to Tasks
+- [ ] Multi-tenant isolation works (cannot access other tenant Stories)
+
+### Future Enhancements (Post-Sprint 4)
+
+**Phase 3 (Future Sprint)**: Task Management Enhancements
+- Task drag-and-drop reordering
+- Task bulk operations (multi-select)
+- Task filters advanced (custom queries)
+- Task due dates and reminders
+
+**Phase 4 (Future Sprint)**: Kanban Full Integration
+- Story cards in Kanban (alongside Epic cards)
+- Story drag-and-drop to change status
+- Story grouping options
+- Story swimlanes
+
+**Phase 5 (Future Sprint)**: Polish & Accessibility
+- Keyboard shortcuts (Cmd/Ctrl + N, 1-4 for status, etc.)
+- Screen reader ARIA labels
+- Mobile swipe gestures
+- Activity timeline component
+- Performance optimization
+
+---
+
+**Created**: 2025-11-05 by Product Manager Agent
+**Next Review**: 2025-11-13 (mid-sprint checkpoint)
+**Sprint Duration**: 3 weeks (15 working days)
+**Target Completion**: 2025-11-20
+**Minimum Viable**: 2025-11-15 (P0/P1 only, 10 days)
--- a/docs/plans/sprint_5.md
+++ b/docs/plans/sprint_5.md
--- a/docs/sprints/sprint_4.md
+++ b/docs/sprints/sprint_4.md
@@ -0,0 +1,456 @@
+---
+sprint_id: sprint_4
+milestone: M1
+status: not_started
+created_date: 2025-11-05
+start_date: 2025-11-06
+target_end_date: 2025-11-20
+---
+
+# Sprint 4: Story Management & UX Enhancement
+
+**Milestone**: M1 - Core Project Module (User Experience Enhancement)
+**Goal**: Implement Story detail page and Task management to enable seamless Epic → Story → Task navigation and fix critical Story page 404 error.
+
+## Sprint Objectives
+
+1. **Fix Critical Bug**: Story detail page returns 404 error - Users cannot access Story information
+2. **Complete User Journey**: Enable full Epic → Story → Task navigation in less than 3 clicks
+3. **Task Management**: Implement Task list, creation, and status updates within Story context
+4. **Enhanced UX**: Improve Story creation workflow with Quick Add and enhanced form fields
+
+## Stories
+
+### Frontend Stories (P0/P1)
+- [ ] [story_1](../plans/sprint_4_story_1.md) - Story Detail Page Foundation - `not_started` - **P0 Critical**
+- [ ] [story_2](../plans/sprint_4_story_2.md) - Task Management in Story Detail - `not_started` - **P0 Critical**
+- [ ] [story_3](../plans/sprint_4_story_3.md) - Enhanced Story Form - `not_started` - **P1 High**
+- [ ] [story_4](../plans/sprint_4_story_4.md) - Quick Add Story Workflow - `not_started` - **P1 High**
+- [ ] [story_5](../plans/sprint_4_story_5.md) - Story Card Component - `not_started` - **P2 Medium**
+- [ ] [story_6](../plans/sprint_4_story_6.md) - Kanban Story Creation Enhancement - `not_started` - **P2 Optional**
+
+### Backend Stories (Optional)
+- [ ] [story_0](../plans/sprint_4_story_0.md) - Backend API Enhancements (AcceptanceCriteria, Tags, StoryPoints, Task Order) - `not_started` - **P2 Optional**
+
+**Progress**: 0/7 completed (0%)
+
+## Sprint Context
+
+### Current Problem
+
+**Critical Issue**: Story detail page does not exist
+- Clicking Story cards from Epic detail page results in 404 error
+- Users cannot view Story information or manage Tasks
+- Incomplete user experience for core project management flow
+
+**Gap Analysis**:
+
+| Feature | Backend Status | Frontend Status | Priority |
+|---------|----------------|-----------------|----------|
+| Story CRUD | ✅ 100% Ready | ✅ 100% Ready | - |
+| Story Detail Page | ✅ API Ready | ❌ Missing | **P0 Critical** |
+| Task Management | ✅ API Ready | ❌ Missing | **P0 Critical** |
+| Enhanced Story Form | ⚠️ Partial | ❌ Missing | **P1 High** |
+| Quick Add Workflow | ✅ API Ready | ❌ Missing | **P1 High** |
+| Story Card Component | ✅ API Ready | ⚠️ Partial | **P2 Medium** |
+
+### Backend API Status ✅
+
+**Verification Report**: See [Backend API Verification](sprint_4/backend_api_verification.md) for detailed analysis
+
+**Story API**: 100% Complete (StoriesController.cs)
+
+Available Endpoints:
+- `GET /api/v1/stories/{id}` - Get Story by ID
+- `GET /api/v1/epics/{epicId}/stories` - List Stories by Epic
+- `GET /api/v1/projects/{projectId}/stories` - List Stories by Project
+- `POST /api/v1/stories` - Create Story
+- `POST /api/v1/epics/{epicId}/stories` - Create Story (nested)
+- `PUT /api/v1/stories/{id}` - Update Story
+- `DELETE /api/v1/stories/{id}` - Delete Story
+- `PUT /api/v1/stories/{id}/assign` - Assign Story
+
+**Task API**: 100% Complete (TasksController.cs)
+- `GET /api/v1/tasks/{id}` - Get Task by ID
+- `GET /api/v1/stories/{storyId}/tasks` - List Tasks by Story
+- `POST /api/v1/stories/{storyId}/tasks` - Create Task
+- `PUT /api/v1/tasks/{id}` - Update Task
+- `PUT /api/v1/tasks/{id}/status` - Quick status toggle
+- `DELETE /api/v1/tasks/{id}` - Delete Task
+
+**Security**: Multi-tenant isolation verified, `[Authorize]` attribute present
+
+**Optional Enhancements**: AcceptanceCriteria, Tags, StoryPoints, Task Order fields can be added via [Story 0](../plans/sprint_4_story_0.md) if needed
+
+### Frontend Status ⚠️
+
+**Already Implemented**:
+- ✅ Story API Client (`lib/api/pm.ts`)
+- ✅ Story Hooks (`lib/hooks/use-stories.ts`)
+- ✅ Basic Story Form (`components/projects/story-form.tsx`)
+- ✅ Story display in Epic detail page
+- ✅ Story types defined (`types/project.ts`)
+
+**Missing Implementation**:
+- ❌ Story Detail Page (`app/(dashboard)/stories/[id]/page.tsx`)
+- ❌ Task Management UI components
+- ❌ Enhanced Story Form fields (acceptance criteria, assignee, tags)
+- ❌ Quick Add Story workflow
+- ❌ Story Card Component (reusable variants)
+
+## Sprint Scope Summary
+
+### Story 1: Story Detail Page Foundation ⭐ P0 CRITICAL
+**Estimated**: 3 days (Day 1-3)
+**Owner**: Frontend Team
+
+**Scope**:
+- Create Story detail page route (`/stories/[id]`)
+- Implement two-column layout (content + metadata sidebar)
+- Display Story header, description, and metadata
+- Show parent Epic card in sidebar
+- Add Edit and Delete actions
+- Error handling (404, network errors) and loading states
+
+**Acceptance Criteria**:
+- Clicking Story card navigates to `/stories/{id}` page
+- Page displays all Story information
+- Layout matches Epic detail page consistency
+- Responsive design works on mobile/tablet/desktop
+- All actions (Edit, Delete) work correctly
+
+**Deliverables**:
+- `app/(dashboard)/stories/[id]/page.tsx`
+- Story metadata sidebar component
+- Story header component
+- Route configuration
+
+---
+
+### Story 2: Task Management in Story Detail ⭐ P0 CRITICAL
+**Estimated**: 2 days (Day 3-4)
+**Owner**: Frontend Team
+**Dependencies**: Story 1 (Story detail page must exist)
+
+**Scope**:
+- Create Task list component with expandable cards
+- Implement Task checkbox for quick status toggle
+- Add "Add Task" button and inline creation form
+- Display Task metadata (priority, assignee, estimated hours)
+- Implement Task filtering and sorting
+- Show Task count badge in header
+- Empty state when no Tasks exist
+
+**Acceptance Criteria**:
+- Tasks display in Story detail page
+- Users can create new Tasks inline
+- Clicking Task checkbox updates status
+- Task filters and sorting work correctly
+- Task count updates in real-time
+- Empty state shows helpful guidance
+
+**Deliverables**:
+- `components/projects/task-list.tsx`
+- `components/projects/task-card.tsx`
+- `components/projects/task-form.tsx` (inline variant)
+- Task hooks integration
+
+---
+
+### Story 3: Enhanced Story Form
+**Estimated**: 2 days (Day 5-6)
+**Owner**: Frontend Team
+
+**Scope**:
+- Add Acceptance Criteria field (checkbox list)
+- Implement Assignee selector (searchable dropdown)
+- Add Tags/Labels field (multi-select)
+- Add Story Points field
+- Enhance form validation
+- Improve form layout (two-column grid)
+
+**Acceptance Criteria**:
+- Form includes all new fields
+- Assignee selector shows user list
+- Acceptance criteria can be added/removed dynamically
+- Tags support multi-select
+- Form validation works for all fields
+- Backward compatible with existing Stories
+
+**Deliverables**:
+- Enhanced `components/projects/story-form.tsx`
+- Assignee selector component
+- Acceptance criteria editor component
+- Tag selector component
+
+---
+
+### Story 4: Quick Add Story Workflow
+**Estimated**: 2 days (Day 7-8)
+**Owner**: Frontend Team
+**Dependencies**: Story 3 (enhanced form patterns)
+
+**Scope**:
+- Create inline Story form component (Quick Add variant)
+- Add "+ Quick Add" button at top of Stories list
+- Implement minimal form (title + priority only)
+- Add keyboard shortcut (Cmd/Ctrl + N)
+- Auto-reset form after creation
+- Show success toast notifications
+
+**Acceptance Criteria**:
+- Quick Add button appears in Epic detail Stories section
+- Inline form shows with minimal fields
+- Story creates on Enter key press
+- Form resets and stays open for batch creation
+- Keyboard shortcut works globally
+- Animations smooth and performant
+
+**Deliverables**:
+- `components/projects/quick-add-story.tsx`
+- Story form "quick mode" variant
+- Keyboard shortcut handler
+- Batch creation workflow
+
+---
+
+### Story 5: Story Card Component
+**Estimated**: 1 day (Day 9)
+**Owner**: Frontend Team
+**Dependencies**: Story 1, 2 (understand Story structure)
+
+**Scope**:
+- Create reusable Story card component
+- Implement three variants (list, kanban, compact)
+- Add visual states (hover, selected, dragging)
+- Show Story metadata badges
+- Add quick actions menu (Edit, Delete, Duplicate)
+- Add Task count indicator
+- Support drag-and-drop preparation
+
+**Acceptance Criteria**:
+- Story card works in all three variants
+- Visual states display correctly
+- Quick actions appear on hover
+- Card shows all relevant metadata
+- Component is reusable across views
+- Performance optimized with React.memo
+
+**Deliverables**:
+- `components/projects/story-card.tsx`
+- Card visual state tests
+
+---
+
+### Story 6: Kanban Story Creation Enhancement (Optional)
+**Estimated**: 2 days (Day 10-11)
+**Owner**: Frontend Team
+**Dependencies**: Story 1, 4
+**Status**: Optional (stretch goal)
+
+**Scope**:
+- Add "+ Add Story" button to Epic cards on hover
+- Implement inline Story form below Epic card
+- Context-bound Story creation (Epic pre-selected)
+- Add Story to correct Kanban column by status
+- Update Epic Story count in real-time
+
+**Acceptance Criteria**:
+- Hover Epic card shows "+ Add Story" action
+- Clicking opens inline Story form
+- Form creates Story under correct Epic
+- Story appears in appropriate Kanban column
+- Epic Story count updates immediately
+
+**Deliverables**:
+- Enhanced Kanban Epic card component
+- Inline Story form integration
+- Real-time count updates
+
+## Timeline
+
+**Week 1 (Nov 6-8)**: Core Story Detail - P0 Critical
+- Day 1-2: Story 1 - Story Detail Page Foundation
+- Day 3: Story 2 - Task Management (start)
+
+**Week 2 (Nov 11-15)**: Task Management & Enhanced Creation - P0 + P1
+- Day 4: Story 2 - Task Management Complete
+- Day 5-6: Story 3 - Enhanced Story Form
+- Day 7-8: Story 4 - Quick Add Workflow
+
+**Week 3 (Nov 18-20)**: Polish & Optional Features - P2
+- Day 9: Story 5 - Story Card Component
+- Day 10-11: Story 6 - Kanban Enhancement (Optional)
+
+## Implementation Strategy
+
+### Reuse Epic Pattern Strategy
+
+**Key Insight**: Story detail page is 85% similar to Epic detail page
+
+Reuse Plan:
+1. Copy Epic detail page structure → Story detail page
+2. Adapt Epic form enhancements → Story form
+3. Reuse Epic card patterns → Story card component
+4. Copy Epic status/priority logic → Story metadata
+
+**Benefits**:
+- **Consistency**: Visual and interaction consistency across the app
+- **Speed**: 50-60% faster development through code reuse
+- **Quality**: Proven patterns, fewer bugs
+- **Maintenance**: Shared components easier to maintain
+
+### Story vs Epic Differences
+
+**Key Distinctions**:
+1. **Stories have Tasks**, Epics have Stories
+2. **Stories are smaller**, typically 1-2 week effort
+3. **Stories have acceptance criteria**, Epics have high-level goals
+4. **Stories assignable to individuals**, Epics to teams
+5. **Stories more granular tracking**, Epics high-level progress
+
+**Implementation Impact**:
+- Story detail shows **Task list** (not Story list)
+- Story form includes **acceptance criteria** field
+- Story cards show **Task count** (not Story count)
+- Story hierarchy: Epic → **Story** → Task
+
+## Definition of Done
+
+- [ ] All P0 and P1 stories completed (Stories 1-4)
+- [ ] Story detail page accessible and fully functional
+- [ ] Users can create and manage Tasks within Stories
+- [ ] Enhanced Story form includes all UX-designed fields
+- [ ] Quick Add workflow enables rapid Story creation
+- [ ] All acceptance criteria met for completed stories
+- [ ] TypeScript types updated for new fields
+- [ ] No console errors or warnings
+- [ ] Manual testing passed on Chrome/Firefox/Edge
+- [ ] Mobile responsive design verified
+- [ ] Code reviewed and approved
+- [ ] Documentation updated
+
+## Success Metrics
+
+### User Experience Metrics
+- **Story Page Load Time**: < 1 second
+- **Task Creation Time**: < 20 seconds
+- **Quick Add Speed**: < 30 seconds (from idea to created Story)
+- **Navigation Clicks**: Epic → Task in < 3 clicks
+- **Error Rate**: < 5%
+
+### Code Quality Metrics
+- **TypeScript Coverage**: 100% (no `any` types)
+- **Component Reusability**: >= 80% (reuse Epic patterns)
+- **Performance**: Lighthouse score >= 90 (per Sprint 3 standard)
+- **Accessibility**: WCAG 2.1 Level AA compliance
+
+### Completion Metrics
+- **P0 Stories**: 2/2 completed (100%) - Story 1, 2
+- **P1 Stories**: 2/2 completed (100%) - Story 3, 4
+- **P2 Stories**: 1-2/2 completed (50-100%) - Story 5, 6 (optional)
+- **Overall Sprint**: 4/6 stories minimum (67%), 6/6 ideal (100%)
+
+## Dependencies
+
+**Prerequisites**:
+- ✅ Sprint 1 completed (Frontend Integration)
+- ✅ Sprint 2 completed (M1 Backend Features)
+- ✅ Sprint 3 completed (Frontend Code Quality)
+- ✅ Story API 100% ready (StoriesController)
+- ✅ Task API 100% ready (TasksController)
+
+**Technical Requirements**:
+- Next.js 15+ (already configured)
+- React 19+ (already configured)
+- React Query 4.0+ (already configured)
+- shadcn/ui components (already available)
+- @dnd-kit/core for drag-drop (already installed)
+
+## Risks & Mitigation
+
+| Risk ID | Description | Impact | Probability | Mitigation | Owner |
+|---------|-------------|--------|-------------|------------|-------|
+| RISK-001 | Task API not fully tested | High | Medium | Backend team verify Task endpoints Day 1 | Backend Lead |
+| RISK-002 | Story/Task relationship complexity | Medium | Medium | Reuse Epic/Story pattern, early testing | Frontend Dev |
+| RISK-003 | UX design scope too large | High | Low | Focus on P0/P1 only, defer P2 | Product Manager |
+| RISK-004 | Acceptance criteria backend missing | Medium | High | Defer to future sprint if needed | Product Manager |
+| RISK-005 | Mobile responsive layout challenging | Medium | Medium | Test early and often on mobile devices | Frontend Dev |
+
+## Related Documents
+
+### UX Design Documents
+- [Story UX/UI Design Specification](../designs/STORY_UX_UI_DESIGN.md) (1,409 lines)
+- [Story Design Summary](../designs/STORY_DESIGN_SUMMARY.md) (488 lines)
+
+### Planning Documents
+- [Product Roadmap](../../product.md)
+- [Sprint 1 Plan](../plans/sprint_1.md) - Frontend Integration
+- [Sprint 2 Plan](../plans/sprint_2.md) - M1 Backend Features
+- [Sprint 3 Plan](../plans/sprint_3.md) - Frontend Code Quality
+
+### Technical References
+- [ProjectManagement Module](../../colaflow-api/src/ColaFlow.Modules.ProjectManagement/)
+- [Epic Detail Page](../../colaflow-web/app/(dashboard)/epics/[id]/page.tsx) (534 lines - reference implementation)
+- [Story Types](../../colaflow-web/types/project.ts)
+
+## Backend API Verification Checklist
+
+Frontend team should verify these before Day 1:
+- [ ] GET /api/v1/stories/{id} returns Story with all fields
+- [ ] GET /api/v1/stories/{id}/tasks returns Task list
+- [ ] POST /api/v1/tasks with storyId creates Task correctly
+- [ ] PUT /api/v1/stories/{id} accepts all fields
+- [ ] DELETE /api/v1/stories/{id} cascades to Tasks
+- [ ] Multi-tenant isolation works (cannot access other tenant Stories)
+
+## Notes
+
+### Why This Sprint Matters
+
+**For Users**:
+- **Fix Critical Bug**: Story links currently lead to 404 errors
+- **Complete User Journey**: Epic → Story → Task navigation works end-to-end
+- **Faster Workflows**: Quick Add enables rapid Story creation
+- **Better Planning**: Acceptance criteria and assignee tracking
+
+**For Product**:
+- **UX Design Implementation**: Deliver on comprehensive UX specification
+- **Feature Parity**: Story management on par with Epic management
+- **User Satisfaction**: Fix reported user complaints about Story access
+- **M1 Enhancement**: Improve core project management experience
+
+**For Development**:
+- **Reuse Patterns**: 60% code reuse from Epic implementation
+- **Consistency**: Maintain design system consistency
+- **Quality**: Build on Sprint 3 quality improvements
+- **Foundation**: Enable future Phase 3-5 UX enhancements
+
+### Future Enhancements (Post-Sprint 4)
+
+**Phase 3**: Task Management Enhancements
+- Task drag-and-drop reordering
+- Task bulk operations (multi-select)
+- Task filters advanced (custom queries)
+- Task due dates and reminders
+
+**Phase 4**: Kanban Full Integration
+- Story cards in Kanban (alongside Epic cards)
+- Story drag-and-drop to change status
+- Story grouping options
+- Story swimlanes
+
+**Phase 5**: Polish & Accessibility
+- Keyboard shortcuts (Cmd/Ctrl + N, 1-4 for status)
+- Screen reader ARIA labels
+- Mobile swipe gestures
+- Activity timeline component
+- Performance optimization
+
+---
+
+**Created**: 2025-11-05 by Product Manager Agent
+**Next Review**: 2025-11-13 (mid-sprint checkpoint)
+**Sprint Duration**: 3 weeks (15 working days)
+**Target Completion**: 2025-11-20
+**Minimum Viable**: 2025-11-15 (P0/P1 only, 10 days)
--- a/login-payload.json
+++ b/login-payload.json
@@ -0,0 +1,5 @@
+{
+  "tenantSlug": "testcompany",
+  "email": "admin@test.com",
+  "password": "Admin@123456"
+}
--- a/node_modules/.bin/husky
+++ b/node_modules/.bin/husky
@@ -0,0 +1,16 @@
+#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
+
+case `uname` in
+    *CYGWIN*|*MINGW*|*MSYS*)
+        if command -v cygpath > /dev/null 2>&1; then
+            basedir=`cygpath -w "$basedir"`
+        fi
+    ;;
+esac
+
+if [ -x "$basedir/node" ]; then
+  exec "$basedir/node"  "$basedir/../husky/bin.js" "$@"
+else 
+  exec node  "$basedir/../husky/bin.js" "$@"
+fi
--- a/node_modules/.bin/husky.cmd
+++ b/node_modules/.bin/husky.cmd
@@ -0,0 +1,17 @@
+@ECHO off
+GOTO start
+:find_dp0
+SET dp0=%~dp0
+EXIT /b
+:start
+SETLOCAL
+CALL :find_dp0
+
+IF EXIST "%dp0%\node.exe" (
+  SET "_prog=%dp0%\node.exe"
+) ELSE (
+  SET "_prog=node"
+  SET PATHEXT=%PATHEXT:;.JS;=;%
+)
+
+endLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & "%_prog%"  "%dp0%\..\husky\bin.js" %*
--- a/node_modules/.bin/husky.ps1
+++ b/node_modules/.bin/husky.ps1
@@ -0,0 +1,28 @@
+#!/usr/bin/env pwsh
+$basedir=Split-Path $MyInvocation.MyCommand.Definition -Parent
+
+$exe=""
+if ($PSVersionTable.PSVersion -lt "6.0" -or $IsWindows) {
+  # Fix case when both the Windows and Linux builds of Node
+  # are installed in the same directory
+  $exe=".exe"
+}
+$ret=0
+if (Test-Path "$basedir/node$exe") {
+  # Support pipeline input
+  if ($MyInvocation.ExpectingInput) {
+    $input | & "$basedir/node$exe"  "$basedir/../husky/bin.js" $args
+  } else {
+    & "$basedir/node$exe"  "$basedir/../husky/bin.js" $args
+  }
+  $ret=$LASTEXITCODE
+} else {
+  # Support pipeline input
+  if ($MyInvocation.ExpectingInput) {
+    $input | & "node$exe"  "$basedir/../husky/bin.js" $args
+  } else {
+    & "node$exe"  "$basedir/../husky/bin.js" $args
+  }
+  $ret=$LASTEXITCODE
+}
+exit $ret
--- a/node_modules/husky/LICENSE
+++ b/node_modules/husky/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 typicode
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
--- a/node_modules/husky/README.md
+++ b/node_modules/husky/README.md
@@ -0,0 +1 @@
+https://typicode.github.io/husky
--- a/node_modules/husky/bin.js
+++ b/node_modules/husky/bin.js
@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import f, { writeFileSync as w } from 'fs'
+import i from './index.js'
+
+let p, a, n, s, o, d
+
+p = process
+a = p.argv[2]
+
+if (a == 'init') {
+	n = 'package.json'
+	s = f.readFileSync(n)
+	o = JSON.parse(s)
+	;(o.scripts ||= {}).prepare = 'husky'
+	w(n, JSON.stringify(o, 0, /\t/.test(s) ? '\t' : 2) + '\n')
+	p.stdout.write(i())
+	try { f.mkdirSync('.husky') } catch {}
+	w('.husky/pre-commit', (p.env.npm_config_user_agent?.split('/')[0] ?? 'npm') + ' test\n')
+	p.exit()
+}
+
+d = c => console.error(`husky - ${c} command is DEPRECATED`)
+if (['add', 'set', 'uninstall'].includes(a)) { d(a); p.exit(1) }
+if (a == 'install') d(a)
+
+p.stdout.write(i(a == 'install' ? undefined : a))
--- a/node_modules/husky/husky
+++ b/node_modules/husky/husky
@@ -0,0 +1,22 @@
+#!/usr/bin/env sh
+[ "$HUSKY" = "2" ] && set -x
+n=$(basename "$0")
+s=$(dirname "$(dirname "$0")")/$n
+
+[ ! -f "$s" ] && exit 0
+
+if [ -f "$HOME/.huskyrc" ]; then
+	echo "husky - '~/.huskyrc' is DEPRECATED, please move your code to ~/.config/husky/init.sh"
+fi
+i="${XDG_CONFIG_HOME:-$HOME/.config}/husky/init.sh"
+[ -f "$i" ] && . "$i"
+
+[ "${HUSKY-}" = "0" ] && exit 0
+
+export PATH="node_modules/.bin:$PATH"
+sh -e "$s" "$@"
+c=$?
+
+[ $c != 0 ] && echo "husky - $n script failed (code $c)"
+[ $c = 127 ] && echo "husky - command not found in PATH=$PATH"
+exit $c
--- a/node_modules/husky/index.d.ts
+++ b/node_modules/husky/index.d.ts
@@ -0,0 +1 @@
+export default function (dir?: string): string;
--- a/node_modules/husky/index.js
+++ b/node_modules/husky/index.js
@@ -0,0 +1,25 @@
+import c from 'child_process'
+import f, { readdir, writeFileSync as w } from 'fs'
+import p from 'path'
+
+let l = [ 'pre-commit', 'pre-merge-commit', 'prepare-commit-msg', 'commit-msg', 'post-commit', 'applypatch-msg', 'pre-applypatch', 'post-applypatch', 'pre-rebase', 'post-rewrite', 'post-checkout', 'post-merge', 'pre-push', 'pre-auto-gc' ],
+	msg = `echo "husky - DEPRECATED\n\nPlease remove the following two lines from $0:\n\n#!/usr/bin/env sh\n. \\"\\$(dirname -- \\"\\$0\\")/_/husky.sh\\"\n\nThey WILL FAIL in v10.0.0\n"`
+
+export default (d = '.husky') => {
+	if (process.env.HUSKY === '0') return 'HUSKY=0 skip install'
+	if (d.includes('..')) return '.. not allowed'
+	if (!f.existsSync('.git')) return `.git can't be found`
+
+	let _ = (x = '') => p.join(d, '_', x)
+	let { status: s, stderr: e } = c.spawnSync('git', ['config', 'core.hooksPath', `${d}/_`])
+	if (s == null) return 'git command not found'
+	if (s) return '' + e
+
+	f.rmSync(_('husky.sh'), { force: true })
+	f.mkdirSync(_(), { recursive: true })
+	w(_('.gitignore'), '*')
+	f.copyFileSync(new URL('husky', import.meta.url), _('h'))
+	l.forEach(h => w(_(h), `#!/usr/bin/env sh\n. "\$(dirname "\$0")/h"`, { mode: 0o755 }))
+	w(_('husky.sh'), msg)
+	return ''
+}
--- a/node_modules/husky/package.json
+++ b/node_modules/husky/package.json
@@ -0,0 +1,25 @@
+{
+	"name": "husky",
+	"version": "9.1.7",
+	"type": "module",
+	"description": "Modern native Git hooks",
+	"keywords": [
+		"git",
+		"hooks",
+		"pre-commit"
+	],
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/typicode/husky.git"
+	},
+	"funding": "https://github.com/sponsors/typicode",
+	"license": "MIT",
+	"author": "typicode",
+	"bin": {
+		"husky": "bin.js"
+	},
+	"exports": "./index.js",
+	"engines": {
+		"node": ">=18"
+	}
+}
--- a/register-payload.json
+++ b/register-payload.json
@@ -0,0 +1,8 @@
+{
+  "TenantName": "Test Company",
+  "TenantSlug": "testcompany",
+  "SubscriptionPlan": "Free",
+  "AdminEmail": "admin@test.com",
+  "AdminPassword": "Admin@123456",
+  "AdminFullName": "Test Admin"
+}
--- a/register-test-user.ps1
+++ b/register-test-user.ps1
@@ -0,0 +1,52 @@
+# ColaFlow 测试用户注册脚本
+# 创建一个测试租户和管理员账号
+
+$apiUrl = "http://localhost:5167"
+
+Write-Host "🚀 正在注册测试租户和用户..." -ForegroundColor Cyan
+
+# 注册租户
+$registerPayload = @{
+    companyName = "测试公司"
+    slug = "testcompany"
+    ownerEmail = "admin@test.com"
+    ownerPassword = "Admin@123456"
+    ownerFullName = "测试管理员"
+} | ConvertTo-Json
+
+try {
+    $response = Invoke-RestMethod -Uri "$apiUrl/api/tenants/register" -Method Post -Body $registerPayload -ContentType "application/json"
+
+    Write-Host "✅ 注册成功！" -ForegroundColor Green
+    Write-Host ""
+    Write-Host "📋 测试账号信息：" -ForegroundColor Yellow
+    Write-Host "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" -ForegroundColor Yellow
+    Write-Host "租户 Slug:  testcompany" -ForegroundColor White
+    Write-Host "邮箱:       admin@test.com" -ForegroundColor White
+    Write-Host "密码:       Admin@123456" -ForegroundColor White
+    Write-Host "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" -ForegroundColor Yellow
+    Write-Host ""
+    Write-Host "🌐 访问地址：" -ForegroundColor Cyan
+    Write-Host "前端: http://localhost:3000" -ForegroundColor White
+    Write-Host "API:  http://localhost:5167" -ForegroundColor White
+    Write-Host ""
+    Write-Host "返回数据：" -ForegroundColor Gray
+    $response | ConvertTo-Json -Depth 5
+
+} catch {
+    $statusCode = $_.Exception.Response.StatusCode.value__
+    $errorBody = $_.ErrorDetails.Message
+
+    if ($statusCode -eq 400) {
+        Write-Host "⚠️  租户可能已存在，尝试登录..." -ForegroundColor Yellow
+        Write-Host ""
+        Write-Host "📋 使用以下账号登录：" -ForegroundColor Yellow
+        Write-Host "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" -ForegroundColor Yellow
+        Write-Host "租户 Slug:  testcompany" -ForegroundColor White
+        Write-Host "邮箱:       admin@test.com" -ForegroundColor White
+        Write-Host "密码:       Admin@123456" -ForegroundColor White
+        Write-Host "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" -ForegroundColor Yellow
+    } else {
+        Write-Host "❌ 注册失败：$errorBody" -ForegroundColor Red
+    }
+}
--- a/relogin-test-user.ps1
+++ b/relogin-test-user.ps1
@@ -0,0 +1,42 @@
+# ColaFlow 重新登录脚本
+# 获取新的 JWT Token
+
+$apiUrl = "http://localhost:5167"
+
+Write-Host "🔑 正在登录测试账号..." -ForegroundColor Cyan
+
+# 登录请求
+$loginPayload = @{
+    tenantSlug = "testcompany"
+    email = "admin@test.com"
+    password = "Admin@123456"
+} | ConvertTo-Json
+
+try {
+    $response = Invoke-RestMethod -Uri "$apiUrl/api/auth/login" -Method Post -Body $loginPayload -ContentType "application/json"
+
+    Write-Host "✅ 登录成功！" -ForegroundColor Green
+    Write-Host ""
+    Write-Host "📋 用户信息：" -ForegroundColor Yellow
+    Write-Host "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" -ForegroundColor Yellow
+    Write-Host "用户 ID:     $($response.user.id)" -ForegroundColor White
+    Write-Host "邮箱:        $($response.user.email)" -ForegroundColor White
+    Write-Host "姓名:        $($response.user.fullName)" -ForegroundColor White
+    Write-Host "租户 ID:     $($response.user.tenantId)" -ForegroundColor White
+    Write-Host "租户名称:    $($response.user.tenantName)" -ForegroundColor White
+    Write-Host "角色:        $($response.user.role)" -ForegroundColor White
+    Write-Host "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" -ForegroundColor Yellow
+    Write-Host ""
+    Write-Host "🔑 JWT Token (前50字符):" -ForegroundColor Cyan
+    Write-Host $response.accessToken.Substring(0, [Math]::Min(50, $response.accessToken.Length))... -ForegroundColor Gray
+    Write-Host ""
+    Write-Host "💡 提示: 请在前端浏览器重新登录以获取有效的 Token" -ForegroundColor Yellow
+
+} catch {
+    $statusCode = $_.Exception.Response.StatusCode.value__
+    $errorBody = $_.ErrorDetails.Message
+
+    Write-Host "❌ 登录失败" -ForegroundColor Red
+    Write-Host "状态码: $statusCode" -ForegroundColor Red
+    Write-Host "错误详情: $errorBody" -ForegroundColor Red
+}
--- a/start-dev.ps1
+++ b/start-dev.ps1
@@ -0,0 +1,128 @@
+#!/usr/bin/env pwsh
+# ColaFlow Development Environment Startup Script
+# This script starts both backend API and frontend web application
+
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host "  ColaFlow Development Environment" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host ""
+
+# Get the script directory (project root)
+$ProjectRoot = $PSScriptRoot
+
+# Function to check if a port is in use
+function Test-Port {
+    param (
+        [int]$Port
+    )
+    $connection = Test-NetConnection -ComputerName localhost -Port $Port -WarningAction SilentlyContinue -InformationLevel Quiet
+    return $connection
+}
+
+# Function to start backend
+function Start-Backend {
+    Write-Host "[Backend] Starting ColaFlow API..." -ForegroundColor Yellow
+
+    # Check if backend port is already in use
+    if (Test-Port -Port 5000) {
+        Write-Host "[Backend] Port 5000 is already in use. Backend may already be running." -ForegroundColor Green
+        return
+    }
+
+    # Start backend in a new window
+    $backendPath = Join-Path $ProjectRoot "colaflow-api"
+    $backendProject = Join-Path $backendPath "src\ColaFlow.API\ColaFlow.API.csproj"
+
+    if (-not (Test-Path $backendProject)) {
+        Write-Host "[Backend] ERROR: Backend project not found at $backendProject" -ForegroundColor Red
+        return
+    }
+
+    Write-Host "[Backend] Starting at $backendPath" -ForegroundColor Gray
+    Start-Process pwsh -ArgumentList "-NoExit", "-Command", "cd '$backendPath'; dotnet run --project '$backendProject'" -WindowStyle Normal
+
+    Write-Host "[Backend] Waiting for API to start..." -ForegroundColor Yellow
+    Start-Sleep -Seconds 5
+
+    if (Test-Port -Port 5000) {
+        Write-Host "[Backend] API started successfully at http://localhost:5000" -ForegroundColor Green
+        Write-Host "[Backend] Swagger UI: http://localhost:5000/swagger" -ForegroundColor Green
+    } else {
+        Write-Host "[Backend] API is starting... Please check the backend window for status" -ForegroundColor Yellow
+    }
+}
+
+# Function to start frontend
+function Start-Frontend {
+    Write-Host "[Frontend] Starting ColaFlow Web..." -ForegroundColor Yellow
+
+    # Check if frontend port is already in use
+    if (Test-Port -Port 3000) {
+        Write-Host "[Frontend] Port 3000 is already in use. Frontend may already be running." -ForegroundColor Green
+        Write-Host "[Frontend] Web UI: http://localhost:3000" -ForegroundColor Green
+        return
+    }
+
+    # Start frontend in a new window
+    $frontendPath = Join-Path $ProjectRoot "colaflow-web"
+
+    if (-not (Test-Path $frontendPath)) {
+        Write-Host "[Frontend] ERROR: Frontend directory not found at $frontendPath" -ForegroundColor Red
+        return
+    }
+
+    # Check if node_modules exists
+    $nodeModules = Join-Path $frontendPath "node_modules"
+    if (-not (Test-Path $nodeModules)) {
+        Write-Host "[Frontend] node_modules not found. Installing dependencies first..." -ForegroundColor Yellow
+        Push-Location $frontendPath
+        npm install
+        Pop-Location
+    }
+
+    Write-Host "[Frontend] Starting at $frontendPath" -ForegroundColor Gray
+    Start-Process pwsh -ArgumentList "-NoExit", "-Command", "cd '$frontendPath'; npm run dev" -WindowStyle Normal
+
+    Write-Host "[Frontend] Waiting for Web to start..." -ForegroundColor Yellow
+    Start-Sleep -Seconds 5
+
+    if (Test-Port -Port 3000) {
+        Write-Host "[Frontend] Web started successfully at http://localhost:3000" -ForegroundColor Green
+    } else {
+        Write-Host "[Frontend] Web is starting... Please check the frontend window for status" -ForegroundColor Yellow
+    }
+}
+
+# Main execution
+Write-Host "Starting development environment..." -ForegroundColor Cyan
+Write-Host ""
+
+# Start backend first
+Start-Backend
+Write-Host ""
+
+# Start frontend
+Start-Frontend
+Write-Host ""
+
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host "  Development Environment Started" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host ""
+Write-Host "Services:" -ForegroundColor White
+Write-Host "  - Backend API: http://localhost:5000" -ForegroundColor White
+Write-Host "  - Swagger UI:  http://localhost:5000/swagger" -ForegroundColor White
+Write-Host "  - Frontend:    http://localhost:3000" -ForegroundColor White
+Write-Host ""
+Write-Host "Press Ctrl+C to exit this script." -ForegroundColor Gray
+Write-Host "Note: Backend and Frontend are running in separate windows." -ForegroundColor Gray
+Write-Host ""
+
+# Keep the script running
+try {
+    while ($true) {
+        Start-Sleep -Seconds 1
+    }
+} finally {
+    Write-Host "Goodbye!" -ForegroundColor Cyan
+}
--- a/start-dev.sh
+++ b/start-dev.sh
@@ -0,0 +1,188 @@
+#!/bin/bash
+# ColaFlow Development Environment Startup Script
+# This script starts both backend API and frontend web application
+
+set -e
+
+# Colors
+CYAN='\033[0;36m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+RED='\033[0;31m'
+GRAY='\033[0;90m'
+NC='\033[0m' # No Color
+
+echo -e "${CYAN}========================================${NC}"
+echo -e "${CYAN}  ColaFlow Development Environment${NC}"
+echo -e "${CYAN}========================================${NC}"
+echo ""
+
+# Get the script directory (project root)
+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Function to check if a port is in use
+check_port() {
+    local port=$1
+    if command -v netstat &> /dev/null; then
+        netstat -an | grep ":$port " | grep -q LISTEN
+    elif command -v lsof &> /dev/null; then
+        lsof -i ":$port" -sTCP:LISTEN -t &> /dev/null
+    else
+        # Fallback: try to connect
+        timeout 1 bash -c "cat < /dev/null > /dev/tcp/localhost/$port" 2>/dev/null
+    fi
+}
+
+# Function to start backend
+start_backend() {
+    echo -e "${YELLOW}[Backend] Starting ColaFlow API...${NC}"
+
+    # Check if backend port is already in use
+    if check_port 5000; then
+        echo -e "${GREEN}[Backend] Port 5000 is already in use. Backend may already be running.${NC}"
+        echo -e "${GREEN}[Backend] Swagger UI: http://localhost:5000/swagger${NC}"
+        return
+    fi
+
+    # Start backend in background
+    local backend_path="$PROJECT_ROOT/colaflow-api"
+    local backend_project="$backend_path/src/ColaFlow.API/ColaFlow.API.csproj"
+
+    if [ ! -f "$backend_project" ]; then
+        echo -e "${RED}[Backend] ERROR: Backend project not found at $backend_project${NC}"
+        return
+    fi
+
+    echo -e "${GRAY}[Backend] Starting at $backend_path${NC}"
+
+    # Start backend in background, redirecting output to a log file
+    cd "$backend_path"
+    nohup dotnet run --project "$backend_project" > "$PROJECT_ROOT/backend.log" 2>&1 &
+    local backend_pid=$!
+    echo $backend_pid > "$PROJECT_ROOT/backend.pid"
+
+    echo -e "${YELLOW}[Backend] Waiting for API to start (PID: $backend_pid)...${NC}"
+
+    # Wait for the backend to start (up to 30 seconds)
+    for i in {1..30}; do
+        if check_port 5000; then
+            echo -e "${GREEN}[Backend] API started successfully at http://localhost:5000${NC}"
+            echo -e "${GREEN}[Backend] Swagger UI: http://localhost:5000/swagger${NC}"
+            return
+        fi
+        sleep 1
+    done
+
+    echo -e "${YELLOW}[Backend] API is starting... Check backend.log for status${NC}"
+}
+
+# Function to start frontend
+start_frontend() {
+    echo -e "${YELLOW}[Frontend] Starting ColaFlow Web...${NC}"
+
+    # Check if frontend port is already in use
+    if check_port 3000; then
+        echo -e "${GREEN}[Frontend] Port 3000 is already in use. Frontend may already be running.${NC}"
+        echo -e "${GREEN}[Frontend] Web UI: http://localhost:3000${NC}"
+        return
+    fi
+
+    # Start frontend in background
+    local frontend_path="$PROJECT_ROOT/colaflow-web"
+
+    if [ ! -d "$frontend_path" ]; then
+        echo -e "${RED}[Frontend] ERROR: Frontend directory not found at $frontend_path${NC}"
+        return
+    fi
+
+    # Check if node_modules exists
+    if [ ! -d "$frontend_path/node_modules" ]; then
+        echo -e "${YELLOW}[Frontend] node_modules not found. Installing dependencies first...${NC}"
+        cd "$frontend_path"
+        npm install
+    fi
+
+    echo -e "${GRAY}[Frontend] Starting at $frontend_path${NC}"
+
+    # Start frontend in background, redirecting output to a log file
+    cd "$frontend_path"
+    nohup npm run dev > "$PROJECT_ROOT/frontend.log" 2>&1 &
+    local frontend_pid=$!
+    echo $frontend_pid > "$PROJECT_ROOT/frontend.pid"
+
+    echo -e "${YELLOW}[Frontend] Waiting for Web to start (PID: $frontend_pid)...${NC}"
+
+    # Wait for the frontend to start (up to 30 seconds)
+    for i in {1..30}; do
+        if check_port 3000; then
+            echo -e "${GREEN}[Frontend] Web started successfully at http://localhost:3000${NC}"
+            return
+        fi
+        sleep 1
+    done
+
+    echo -e "${YELLOW}[Frontend] Web is starting... Check frontend.log for status${NC}"
+}
+
+# Function to stop services
+stop_services() {
+    echo ""
+    echo -e "${YELLOW}Stopping services...${NC}"
+
+    if [ -f "$PROJECT_ROOT/backend.pid" ]; then
+        local backend_pid=$(cat "$PROJECT_ROOT/backend.pid")
+        if ps -p $backend_pid > /dev/null 2>&1; then
+            echo -e "${YELLOW}[Backend] Stopping (PID: $backend_pid)...${NC}"
+            kill $backend_pid 2>/dev/null || true
+        fi
+        rm "$PROJECT_ROOT/backend.pid"
+    fi
+
+    if [ -f "$PROJECT_ROOT/frontend.pid" ]; then
+        local frontend_pid=$(cat "$PROJECT_ROOT/frontend.pid")
+        if ps -p $frontend_pid > /dev/null 2>&1; then
+            echo -e "${YELLOW}[Frontend] Stopping (PID: $frontend_pid)...${NC}"
+            kill $frontend_pid 2>/dev/null || true
+        fi
+        rm "$PROJECT_ROOT/frontend.pid"
+    fi
+
+    echo -e "${GREEN}Services stopped.${NC}"
+    exit 0
+}
+
+# Set up trap to stop services on Ctrl+C
+trap stop_services INT TERM
+
+# Main execution
+echo -e "${CYAN}Starting development environment...${NC}"
+echo ""
+
+# Start backend first
+start_backend
+echo ""
+
+# Start frontend
+start_frontend
+echo ""
+
+echo -e "${CYAN}========================================${NC}"
+echo -e "${CYAN}  Development Environment Started${NC}"
+echo -e "${CYAN}========================================${NC}"
+echo ""
+echo -e "Services:"
+echo -e "  - Backend API: http://localhost:5000"
+echo -e "  - Swagger UI:  http://localhost:5000/swagger"
+echo -e "  - Frontend:    http://localhost:3000"
+echo ""
+echo -e "${GRAY}Logs:${NC}"
+echo -e "  - Backend:  tail -f backend.log"
+echo -e "  - Frontend: tail -f frontend.log"
+echo ""
+echo -e "${GRAY}Press Ctrl+C to stop all services.${NC}"
+echo ""
+
+# Keep the script running
+while true; do
+    sleep 1
+done
--- a/stop-dev.ps1
+++ b/stop-dev.ps1
@@ -0,0 +1,45 @@
+#!/usr/bin/env pwsh
+# ColaFlow Development Environment Stop Script
+# This script stops both backend API and frontend web application
+
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host "  Stopping ColaFlow Services" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host ""
+
+# Stop backend (dotnet processes)
+Write-Host "[Backend] Stopping all .NET processes..." -ForegroundColor Yellow
+try {
+    $dotnetProcesses = Get-Process -Name "dotnet" -ErrorAction SilentlyContinue
+    if ($dotnetProcesses) {
+        $dotnetProcesses | Stop-Process -Force
+        Write-Host "[Backend] Stopped $($dotnetProcesses.Count) dotnet process(es)" -ForegroundColor Green
+    } else {
+        Write-Host "[Backend] No dotnet processes found" -ForegroundColor Gray
+    }
+} catch {
+    Write-Host "[Backend] Error stopping dotnet processes: $_" -ForegroundColor Red
+}
+
+# Stop frontend (node processes on port 3000)
+Write-Host "[Frontend] Stopping Node.js processes on port 3000..." -ForegroundColor Yellow
+try {
+    $port = 3000
+    $connections = Get-NetTCPConnection -LocalPort $port -ErrorAction SilentlyContinue
+    if ($connections) {
+        $pids = $connections | Select-Object -ExpandProperty OwningProcess -Unique
+        foreach ($pid in $pids) {
+            Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue
+            Write-Host "[Frontend] Stopped process $pid" -ForegroundColor Green
+        }
+    } else {
+        Write-Host "[Frontend] No processes found on port 3000" -ForegroundColor Gray
+    }
+} catch {
+    Write-Host "[Frontend] Error stopping frontend processes: $_" -ForegroundColor Red
+}
+
+Write-Host ""
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host "  Services Stopped" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
--- a/stop-dev.sh
+++ b/stop-dev.sh
@@ -0,0 +1,67 @@
+#!/bin/bash
+# ColaFlow Development Environment Stop Script
+# This script stops both backend API and frontend web application
+
+# Colors
+CYAN='\033[0;36m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+GRAY='\033[0;90m'
+NC='\033[0m' # No Color
+
+echo -e "${CYAN}========================================${NC}"
+echo -e "${CYAN}  Stopping ColaFlow Services${NC}"
+echo -e "${CYAN}========================================${NC}"
+echo ""
+
+# Get the script directory (project root)
+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Stop backend
+echo -e "${YELLOW}[Backend] Stopping dotnet processes...${NC}"
+if [ -f "$PROJECT_ROOT/backend.pid" ]; then
+    backend_pid=$(cat "$PROJECT_ROOT/backend.pid")
+    if ps -p $backend_pid > /dev/null 2>&1; then
+        kill $backend_pid 2>/dev/null
+        echo -e "${GREEN}[Backend] Stopped process $backend_pid${NC}"
+    else
+        echo -e "${GRAY}[Backend] Process $backend_pid not running${NC}"
+    fi
+    rm "$PROJECT_ROOT/backend.pid"
+else
+    # Fallback: kill all dotnet processes
+    pkill -f "dotnet.*ColaFlow" 2>/dev/null && echo -e "${GREEN}[Backend] Stopped dotnet processes${NC}" || echo -e "${GRAY}[Backend] No dotnet processes found${NC}"
+fi
+
+# Stop frontend
+echo -e "${YELLOW}[Frontend] Stopping Node.js processes...${NC}"
+if [ -f "$PROJECT_ROOT/frontend.pid" ]; then
+    frontend_pid=$(cat "$PROJECT_ROOT/frontend.pid")
+    if ps -p $frontend_pid > /dev/null 2>&1; then
+        kill $frontend_pid 2>/dev/null
+        echo -e "${GREEN}[Frontend] Stopped process $frontend_pid${NC}"
+    else
+        echo -e "${GRAY}[Frontend] Process $frontend_pid not running${NC}"
+    fi
+    rm "$PROJECT_ROOT/frontend.pid"
+else
+    # Fallback: kill processes on port 3000
+    if command -v lsof &> /dev/null; then
+        lsof -ti:3000 | xargs kill 2>/dev/null && echo -e "${GREEN}[Frontend] Stopped processes on port 3000${NC}" || echo -e "${GRAY}[Frontend] No processes found on port 3000${NC}"
+    else
+        pkill -f "next dev" 2>/dev/null && echo -e "${GREEN}[Frontend] Stopped Next.js processes${NC}" || echo -e "${GRAY}[Frontend] No Next.js processes found${NC}"
+    fi
+fi
+
+# Clean up log files
+if [ -f "$PROJECT_ROOT/backend.log" ]; then
+    rm "$PROJECT_ROOT/backend.log"
+fi
+if [ -f "$PROJECT_ROOT/frontend.log" ]; then
+    rm "$PROJECT_ROOT/frontend.log"
+fi
+
+echo ""
+echo -e "${CYAN}========================================${NC}"
+echo -e "${CYAN}  Services Stopped${NC}"
+echo -e "${CYAN}========================================${NC}"
--- a/test-create-epic.ps1
+++ b/test-create-epic.ps1
@@ -0,0 +1,56 @@
+# Test Epic Creation with Authentication
+
+$apiUrl = "http://localhost:5167"
+
+Write-Host "Step 1: Login to get JWT Token..." -ForegroundColor Cyan
+
+# Login
+$loginPayload = @{
+    tenantSlug = "testcompany"
+    email = "admin@test.com"
+    password = "Admin@123456"
+} | ConvertTo-Json
+
+$loginResponse = Invoke-RestMethod -Uri "$apiUrl/api/auth/login" -Method Post -Body $loginPayload -ContentType "application/json"
+$token = $loginResponse.accessToken
+$userId = $loginResponse.user.id
+
+Write-Host "✅ Login successful" -ForegroundColor Green
+Write-Host "User ID: $userId" -ForegroundColor Gray
+Write-Host "Token (first 50 chars): $($token.Substring(0,50))..." -ForegroundColor Gray
+Write-Host ""
+
+Write-Host "Step 2: Create Epic..." -ForegroundColor Cyan
+
+# Create Epic
+$projectId = "599e0a24-38be-4ada-945c-2bd11d5b051b"
+$createEpicPayload = @{
+    projectId = $projectId
+    name = "Test Epic from PowerShell"
+    description = "This is a test epic created via API"
+    priority = "Medium"
+    createdBy = $userId
+} | ConvertTo-Json
+
+Write-Host "Request Payload:" -ForegroundColor Gray
+Write-Host $createEpicPayload -ForegroundColor Gray
+Write-Host ""
+
+try {
+    $headers = @{
+        "Authorization" = "Bearer $token"
+        "Content-Type" = "application/json"
+    }
+
+    $epicResponse = Invoke-RestMethod -Uri "$apiUrl/api/v1/epics" -Method Post -Body $createEpicPayload -Headers $headers
+
+    Write-Host "✅ Epic created successfully!" -ForegroundColor Green
+    Write-Host ""
+    Write-Host "Epic Details:" -ForegroundColor Yellow
+    $epicResponse | ConvertTo-Json -Depth 3
+
+} catch {
+    Write-Host "❌ Failed to create epic" -ForegroundColor Red
+    Write-Host "Status Code: $($_.Exception.Response.StatusCode.value__)" -ForegroundColor Red
+    Write-Host "Error: $($_.ErrorDetails.Message)" -ForegroundColor Red
+}
--- a/verify-user-fix-simple.ps1
+++ b/verify-user-fix-simple.ps1
@@ -0,0 +1,42 @@
+# Simple verification script for user field fix
+
+$baseUrl = "http://localhost:5000"
+$loginUrl = "$baseUrl/api/auth/login"
+
+$loginPayload = @{
+    email = "admin@test.com"
+    password = "Test@123456"
+    tenantSlug = "testcompany"
+} | ConvertTo-Json
+
+Write-Host "Testing Login Flow..." -ForegroundColor Cyan
+
+try {
+    $response = Invoke-RestMethod -Uri $loginUrl -Method Post -Body $loginPayload -ContentType "application/json"
+
+    Write-Host "Login successful!" -ForegroundColor Green
+    Write-Host ""
+    Write-Host "User Object from Backend:" -ForegroundColor Cyan
+    $response.user | Format-List
+
+    $token = $response.accessToken
+    $headers = @{ Authorization = "Bearer $token" }
+
+    Write-Host ""
+    Write-Host "Testing /me Endpoint..." -ForegroundColor Cyan
+    $meResponse = Invoke-RestMethod -Uri "$baseUrl/api/auth/me" -Method Get -Headers $headers
+
+    Write-Host "/me endpoint successful!" -ForegroundColor Green
+    Write-Host ""
+    Write-Host "User Object from /me:" -ForegroundColor Cyan
+    $meResponse | Format-List
+
+    Write-Host ""
+    Write-Host "Verification Complete!" -ForegroundColor Green
+
+} catch {
+    Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Red
+    if ($_.ErrorDetails) {
+        Write-Host "Details: $($_.ErrorDetails.Message)" -ForegroundColor Red
+    }
+}
--- a/verify-user-fix.ps1
+++ b/verify-user-fix.ps1
@@ -0,0 +1,92 @@
+# Verify user field fix
+# This script tests the login flow and verifies user.id is correctly set
+
+$baseUrl = "http://localhost:5000"
+$loginUrl = "$baseUrl/api/auth/login"
+
+# Login payload
+$loginPayload = @{
+    email = "admin@test.com"
+    password = "Test@123456"
+    tenantSlug = "testcompany"
+} | ConvertTo-Json
+
+Write-Host "=== Testing Login Flow ===" -ForegroundColor Cyan
+Write-Host "Login URL: $loginUrl" -ForegroundColor Gray
+Write-Host "Payload: $loginPayload" -ForegroundColor Gray
+Write-Host ""
+
+try {
+    # Login
+    $response = Invoke-RestMethod -Uri $loginUrl -Method Post -Body $loginPayload -ContentType "application/json"
+
+    Write-Host "✓ Login successful!" -ForegroundColor Green
+    Write-Host ""
+
+    # Display user object
+    Write-Host "=== User Object from Backend ===" -ForegroundColor Cyan
+    Write-Host "User ID: $($response.user.id)" -ForegroundColor Yellow
+    Write-Host "Email: $($response.user.email)" -ForegroundColor Gray
+    Write-Host "Full Name: $($response.user.fullName)" -ForegroundColor Gray
+    Write-Host "Tenant ID: $($response.user.tenantId)" -ForegroundColor Gray
+    Write-Host ""
+
+    # Check if ID exists
+    if ($response.user.id) {
+        Write-Host "✓ User ID field exists (camelCase)!" -ForegroundColor Green
+        Write-Host "  Field name: id" -ForegroundColor Gray
+        Write-Host "  Value: $($response.user.id)" -ForegroundColor Gray
+    } elseif ($response.user.Id) {
+        Write-Host "✓ User ID field exists (PascalCase)!" -ForegroundColor Green
+        Write-Host "  Field name: Id" -ForegroundColor Gray
+        Write-Host "  Value: $($response.user.Id)" -ForegroundColor Gray
+    } else {
+        Write-Host "✗ User ID field missing!" -ForegroundColor Red
+    }
+    Write-Host ""
+
+    # Test /me endpoint
+    Write-Host "=== Testing /me Endpoint ===" -ForegroundColor Cyan
+    $token = $response.accessToken
+    $headers = @{
+        Authorization = "Bearer $token"
+    }
+
+    $meResponse = Invoke-RestMethod -Uri "$baseUrl/api/auth/me" -Method Get -Headers $headers
+
+    Write-Host "✓ /me endpoint successful!" -ForegroundColor Green
+    Write-Host ""
+    Write-Host "=== User Object from /me ===" -ForegroundColor Cyan
+    Write-Host "User ID field: $($meResponse.userId)" -ForegroundColor Yellow
+    Write-Host "Email: $($meResponse.email)" -ForegroundColor Gray
+    Write-Host "Full Name: $($meResponse.fullName)" -ForegroundColor Gray
+    Write-Host "Tenant ID: $($meResponse.tenantId)" -ForegroundColor Gray
+    Write-Host "Tenant Slug: $($meResponse.tenantSlug)" -ForegroundColor Gray
+    Write-Host "Tenant Role: $($meResponse.tenantRole)" -ForegroundColor Gray
+    Write-Host ""
+
+    if ($meResponse.userId) {
+        Write-Host "✓ userId field exists in /me response!" -ForegroundColor Green
+    } else {
+        Write-Host "✗ userId field missing in /me response!" -ForegroundColor Red
+    }
+    Write-Host ""
+
+    Write-Host "=== Field Mapping Required ===" -ForegroundColor Cyan
+    Write-Host "Login response:" -ForegroundColor Gray
+    if ($response.user.id) {
+        Write-Host "  - user.id -> frontend user.id" -ForegroundColor Gray
+    } else {
+        Write-Host "  - user.Id -> frontend user.id" -ForegroundColor Gray
+    }
+    Write-Host "/me response:" -ForegroundColor Gray
+    Write-Host "  - userId -> frontend user.id" -ForegroundColor Gray
+    Write-Host "  - tenantSlug -> frontend user.tenantName" -ForegroundColor Gray
+    Write-Host ""
+
+    Write-Host "=== Verification Complete ===" -ForegroundColor Green
+
+} catch {
+    Write-Host "✗ Error: $($_.Exception.Message)" -ForegroundColor Red
+    Write-Host "Details: $($_.ErrorDetails.Message)" -ForegroundColor Red
+}
				`@@ -0,0 +1 @@`
				`export default function (dir?: string): string;`