In progress

2025-11-03 11:51:02 +01:00
parent 24fb646739
commit fe8ad1c1f9
101 changed files with 26471 additions and 250 deletions
--- a/reports/2025-11-03-Next-Sprint-Action-Plan.md
+++ b/reports/2025-11-03-Next-Sprint-Action-Plan.md
@@ -0,0 +1,697 @@
+# ColaFlow Next Sprint Action Plan
+
+**Plan Date**: 2025-11-03
+**Sprint Name**: M1 Sprint 2 - Authentication and Testing Completion
+**Sprint Goal**: Complete M1 critical path with authentication and comprehensive testing
+**Duration**: 2 weeks (2025-11-04 to 2025-11-15)
+
+---
+
+## Sprint Overview
+
+### Sprint Objectives
+
+1. Implement JWT authentication system (critical blocker)
+2. Complete Application layer testing to 80% coverage
+3. Implement SignalR real-time notifications
+4. Polish and prepare for deployment
+
+### Success Metrics
+
+| Metric | Current | Target | Priority |
+|--------|---------|--------|----------|
+| M1 Completion | 83% | 100% | Critical |
+| Application Test Coverage | 40% | 80% | High |
+| Authentication | 0% | 100% | Critical |
+| SignalR Implementation | 0% | 100% | Medium |
+| Critical Bugs | 0 | 0 | Critical |
+
+---
+
+## Prioritized Task List
+
+### Priority 1: Critical (Must Complete)
+
+#### Task 1.1: JWT Authentication System
+
+**Estimated Effort**: 7 days
+**Assigned To**: Backend Agent + Frontend Agent
+**Dependencies**: None (can start immediately)
+**Acceptance Criteria**:
+- User registration API working
+- Login API returning valid JWT tokens
+- All API endpoints protected with [Authorize]
+- Role-based authorization working (Admin, ProjectManager, Developer, Viewer)
+- Frontend login/logout UI functional
+- Token refresh mechanism working
+- 100% test coverage for authentication logic
+
+**Detailed Subtasks**:
+
+**Day 1: Architecture and Design** (Backend Agent + Architect Agent)
+- [ ] Research authentication approaches (ASP.NET Core Identity vs custom)
+- [ ] Design JWT token structure (claims, expiration, refresh strategy)
+- [ ] Define user roles and permissions matrix
+- [ ] Design database schema for users and roles
+- [ ] Document authentication flow (registration, login, refresh, logout)
+- [ ] Review security best practices (password hashing, token storage)
+
+**Day 2: Database and Domain** (Backend Agent)
+- [ ] Create User aggregate root (Domain layer)
+- [ ] Create Role and Permission value objects
+- [ ] Add UserCreated, UserLoggedIn domain events
+- [ ] Create EF Core User configuration
+- [ ] Generate and apply authentication migration
+- [ ] Write User domain unit tests
+
+**Day 3: Application Layer Commands** (Backend Agent)
+- [ ] Implement RegisterUserCommand + Handler + Validator
+- [ ] Implement LoginCommand + Handler + Validator
+- [ ] Implement RefreshTokenCommand + Handler + Validator
+- [ ] Implement ChangePasswordCommand + Handler + Validator
+- [ ] Add password hashing service (bcrypt or PBKDF2)
+- [ ] Write command handler tests
+
+**Day 4: API Layer and Middleware** (Backend Agent)
+- [ ] Create AuthenticationController (register, login, refresh, logout)
+- [ ] Configure JWT authentication middleware
+- [ ] Add [Authorize] attributes to all existing controllers
+- [ ] Implement role-based authorization policies
+- [ ] Add authentication integration tests
+- [ ] Update API documentation
+
+**Day 5: Frontend Authentication State** (Frontend Agent)
+- [ ] Create authentication context/store (Zustand)
+- [ ] Implement token storage (localStorage with encryption)
+- [ ] Add API client authentication interceptor
+- [ ] Implement token refresh logic
+- [ ] Add route guards for protected pages
+- [ ] Handle 401 unauthorized responses
+
+**Day 6: Frontend UI Components** (Frontend Agent)
+- [ ] Create login page with form validation
+- [ ] Create registration page with form validation
+- [ ] Add user profile dropdown in navigation
+- [ ] Implement logout functionality
+- [ ] Add "Forgot Password" flow (basic)
+- [ ] Add role-based UI element visibility
+
+**Day 7: Testing and Integration** (QA Agent + Backend Agent + Frontend Agent)
+- [ ] End-to-end authentication testing
+- [ ] Test protected route access
+- [ ] Test role-based authorization
+- [ ] Security testing (invalid tokens, expired tokens)
+- [ ] Test token refresh flow
+- [ ] Performance testing (token validation overhead)
+
+**Risk Assessment**:
+- Risk: Authentication breaks existing functionality
+- Mitigation: Comprehensive integration tests, gradual rollout
+- Risk: Password security vulnerabilities
+- Mitigation: Use proven libraries (bcrypt), security review
+
+---
+
+#### Task 1.2: Complete Application Layer Testing
+
+**Estimated Effort**: 3 days (parallel with authentication)
+**Assigned To**: QA Agent + Backend Agent
+**Dependencies**: None
+**Acceptance Criteria**:
+- Application layer test coverage ≥80%
+- All P2 Query Handler tests written (7 test files)
+- All P2 Command Handler tests written (2 test files)
+- Integration tests for all controllers (Testcontainers)
+- 100% test pass rate maintained
+
+**Detailed Subtasks**:
+
+**Day 1: Query Handler Tests** (QA Agent)
+- [ ] Write UpdateTaskCommandHandlerTests (3 test cases)
+- [ ] Write AssignTaskCommandHandlerTests (3 test cases)
+- [ ] Write GetStoriesByEpicIdQueryHandlerTests (2 test cases)
+- [ ] Write GetStoriesByProjectIdQueryHandlerTests (2 test cases)
+- [ ] All tests passing, coverage measured
+
+**Day 2: Query Handler Tests (Continued)** (QA Agent)
+- [ ] Write GetTasksByStoryIdQueryHandlerTests (2 test cases)
+- [ ] Write GetTasksByProjectIdQueryHandlerTests (3 test cases)
+- [ ] Write GetTasksByAssigneeQueryHandlerTests (2 test cases)
+- [ ] Verify all Application layer commands and queries have tests
+- [ ] Run coverage report, identify remaining gaps
+
+**Day 3: Integration Tests** (QA Agent + Backend Agent)
+- [ ] Set up Testcontainers for integration testing
+- [ ] Write ProjectsController integration tests (5 endpoints)
+- [ ] Write EpicsController integration tests (4 endpoints)
+- [ ] Write StoriesController integration tests (7 endpoints)
+- [ ] Write TasksController integration tests (8 endpoints)
+- [ ] Write AuthenticationController integration tests (when available)
+
+**Risk Assessment**:
+- Risk: Test writing takes longer than estimated
+- Mitigation: Focus on P1 tests first, defer P3 if needed
+- Risk: Integration tests require complex setup
+- Mitigation: Use Testcontainers for clean database state
+
+---
+
+### Priority 2: High (Should Complete)
+
+#### Task 2.1: SignalR Real-time Notifications
+
+**Estimated Effort**: 3 days
+**Assigned To**: Backend Agent + Frontend Agent
+**Dependencies**: Authentication (should be implemented after JWT)
+**Acceptance Criteria**:
+- SignalR Hub configured and running
+- Task status changes broadcast to connected clients
+- Frontend receives and displays real-time updates
+- Kanban board updates automatically when other users make changes
+- Connection failure handling and reconnection logic
+- Performance tested with 10+ concurrent connections
+
+**Detailed Subtasks**:
+
+**Day 1: Backend SignalR Setup** (Backend Agent)
+- [ ] Install Microsoft.AspNetCore.SignalR package
+- [ ] Create ProjectHub for project-level events
+- [ ] Create TaskHub for task-level events
+- [ ] Configure SignalR in Program.cs
+- [ ] Add SignalR endpoint mapping
+- [ ] Integrate authentication with SignalR (JWT token in query string)
+- [ ] Write SignalR Hub unit tests
+
+**Day 2: Backend Event Integration** (Backend Agent)
+- [ ] Add SignalR notification to UpdateTaskStatusCommandHandler
+- [ ] Add SignalR notification to CreateTaskCommandHandler
+- [ ] Add SignalR notification to UpdateTaskCommandHandler
+- [ ] Add SignalR notification to DeleteTaskCommandHandler
+- [ ] Define event message formats (JSON)
+- [ ] Test SignalR broadcasting with multiple connections
+
+**Day 3: Frontend SignalR Integration** (Frontend Agent)
+- [ ] Install @microsoft/signalr package
+- [ ] Create SignalR connection management service
+- [ ] Implement auto-reconnection logic
+- [ ] Add SignalR listeners to Kanban board
+- [ ] Update TanStack Query cache on SignalR events
+- [ ] Add toast notifications for real-time updates
+- [ ] Handle connection status UI (connected, disconnected, reconnecting)
+
+**Risk Assessment**:
+- Risk: SignalR connection issues in production
+- Mitigation: Robust reconnection logic, connection status monitoring
+- Risk: Performance impact with many connections
+- Mitigation: Performance testing, connection pooling
+
+---
+
+#### Task 2.2: API Documentation and Polish
+
+**Estimated Effort**: 1 day
+**Assigned To**: Backend Agent
+**Dependencies**: None
+**Acceptance Criteria**:
+- All API endpoints documented in OpenAPI spec
+- Scalar documentation complete with examples
+- Request/response examples for all endpoints
+- Authentication flow documented
+- Error response formats documented
+
+**Detailed Subtasks**:
+- [ ] Review all API endpoints for complete documentation
+- [ ] Add XML documentation comments to all controllers
+- [ ] Add example request/response bodies to OpenAPI spec
+- [ ] Document authentication flow in Scalar
+- [ ] Add error code reference documentation
+- [ ] Generate Postman/Insomnia collection
+- [ ] Update README with API usage examples
+
+---
+
+### Priority 3: Medium (Nice to Have)
+
+#### Task 3.1: Frontend Component Tests
+
+**Estimated Effort**: 2 days
+**Assigned To**: Frontend Agent + QA Agent
+**Dependencies**: None
+**Acceptance Criteria**:
+- Component test coverage ≥60%
+- Critical components have comprehensive tests
+- User interaction flows tested
+
+**Detailed Subtasks**:
+- [ ] Set up React Testing Library
+- [ ] Write tests for authentication components (login, register)
+- [ ] Write tests for project list page
+- [ ] Write tests for Kanban board (without drag & drop)
+- [ ] Write tests for form components
+- [ ] Write tests for API error handling
+
+**Risk Assessment**:
+- Risk: Time constraints may prevent completion
+- Mitigation: Defer to next sprint if Priority 1-2 tasks delayed
+
+---
+
+#### Task 3.2: Frontend Polish and UX Improvements
+
+**Estimated Effort**: 2 days
+**Assigned To**: Frontend Agent + UX-UI Agent
+**Dependencies**: None
+**Acceptance Criteria**:
+- Responsive design on mobile devices
+- Loading states for all async operations
+- Error messages are clear and actionable
+- Accessibility audit passes WCAG AA
+
+**Detailed Subtasks**:
+- [ ] Mobile responsive design audit
+- [ ] Add skeleton loaders for all loading states
+- [ ] Improve error message clarity
+- [ ] Add empty state designs
+- [ ] Accessibility audit (keyboard navigation, screen readers)
+- [ ] Add animations and transitions (subtle)
+- [ ] Performance optimization (code splitting, lazy loading)
+
+---
+
+#### Task 3.3: Performance Optimization
+
+**Estimated Effort**: 2 days
+**Assigned To**: Backend Agent
+**Dependencies**: None
+**Acceptance Criteria**:
+- API P95 response time <500ms
+- Database queries optimized with projections
+- Redis caching for frequently accessed data
+- Query performance tested under load
+
+**Detailed Subtasks**:
+- [ ] Add Redis caching layer
+- [ ] Optimize EF Core queries with Select() projections
+- [ ] Add database indexes for common queries
+- [ ] Implement query result caching
+- [ ] Performance testing with load generation tool
+- [ ] Identify and fix N+1 query problems
+- [ ] Add response compression middleware
+
+**Risk Assessment**:
+- Risk: Premature optimization
+- Mitigation: Only optimize if performance issues identified
+
+---
+
+## Task Assignment Matrix
+
+| Task | Agent | Duration | Dependencies | Priority |
+|------|-------|----------|--------------|----------|
+| Auth Architecture | Backend + Architect | 1 day | None | P1 |
+| Auth Database | Backend | 1 day | Auth Architecture | P1 |
+| Auth Commands | Backend | 1 day | Auth Database | P1 |
+| Auth API | Backend | 1 day | Auth Commands | P1 |
+| Auth Frontend State | Frontend | 1 day | Auth API | P1 |
+| Auth Frontend UI | Frontend | 1 day | Auth Frontend State | P1 |
+| Auth Testing | QA + Backend + Frontend | 1 day | Auth Frontend UI | P1 |
+| Query Handler Tests | QA | 2 days | None | P1 |
+| Integration Tests | QA + Backend | 1 day | None | P1 |
+| SignalR Backend | Backend | 2 days | Auth API | P2 |
+| SignalR Frontend | Frontend | 1 day | SignalR Backend | P2 |
+| API Documentation | Backend | 1 day | Auth API | P2 |
+| Component Tests | Frontend + QA | 2 days | None | P3 |
+| Frontend Polish | Frontend + UX-UI | 2 days | None | P3 |
+| Performance Opt | Backend | 2 days | None | P3 |
+
+---
+
+## Sprint Schedule (2 Weeks)
+
+### Week 1: Authentication and Testing
+
+**Monday (Day 1)**:
+- Backend: Auth architecture design
+- QA: Start Query Handler tests (parallel)
+- Morning standup: Align on auth approach
+
+**Tuesday (Day 2)**:
+- Backend: Auth database and domain
+- QA: Continue Query Handler tests
+- Evening: Review auth domain design
+
+**Wednesday (Day 3)**:
+- Backend: Auth application commands
+- QA: Finish Query Handler tests, start integration tests
+- Evening: Demo auth commands working
+
+**Thursday (Day 4)**:
+- Backend: Auth API layer and middleware
+- QA: Continue integration tests
+- Evening: Test auth API endpoints
+
+**Friday (Day 5)**:
+- Frontend: Auth state management
+- Backend: Support frontend integration
+- QA: Auth integration testing
+- Evening: Weekly review, adjust plan if needed
+
+### Week 2: Real-time and Polish
+
+**Monday (Day 6)**:
+- Frontend: Auth UI components
+- Backend: Start SignalR backend setup
+- Morning: Sprint progress review
+
+**Tuesday (Day 7)**:
+- QA + Backend + Frontend: End-to-end auth testing
+- Backend: Continue SignalR backend
+- Evening: Auth feature complete demo
+
+**Wednesday (Day 8)**:
+- Backend: SignalR event integration
+- Frontend: Start SignalR frontend integration
+- Backend: API documentation
+
+**Thursday (Day 9)**:
+- Frontend: Finish SignalR frontend integration
+- Frontend + QA: Start component tests (if time allows)
+- Evening: Real-time feature demo
+
+**Friday (Day 10)**:
+- Frontend + UX-UI: Polish and UX improvements
+- QA: Final testing and bug fixes
+- Backend: Performance optimization (if time allows)
+- Afternoon: Sprint retrospective and M1 completion celebration
+
+---
+
+## Risk Management
+
+### High Risks
+
+**Risk 1: Authentication Implementation Complexity**
+- **Probability**: Medium
+- **Impact**: High (blocks deployment)
+- **Mitigation**:
+  - Use proven libraries (ASP.NET Core Identity)
+  - Follow security best practices documentation
+  - Allocate buffer time (1-2 days)
+  - Security review before completion
+
+**Risk 2: Testing Takes Longer Than Estimated**
+- **Probability**: Medium
+- **Impact**: Medium (delays sprint)
+- **Mitigation**:
+  - Focus on P1 critical tests first
+  - Defer P3 nice-to-have tests if needed
+  - QA agent can work in parallel
+
+**Risk 3: SignalR Integration Issues**
+- **Probability**: Low
+- **Impact**: Medium (degrades UX)
+- **Mitigation**:
+  - Can defer to next sprint if needed
+  - Not critical for M1 MVP
+  - Allocate extra day if problems arise
+
+### Medium Risks
+
+**Risk 4: Frontend-Backend Integration Issues**
+- **Probability**: Low
+- **Impact**: Medium
+- **Mitigation**:
+  - Daily integration testing
+  - Clear API contract documentation
+  - Quick feedback loops
+
+**Risk 5: Performance Bottlenecks**
+- **Probability**: Low
+- **Impact**: Low (current performance acceptable)
+- **Mitigation**:
+  - Performance optimization is P3 (optional)
+  - Can be addressed in next sprint
+
+---
+
+## Communication Plan
+
+### Daily Standups
+
+**Time**: 9:00 AM daily
+**Participants**: All agents
+**Format**:
+1. What did you complete yesterday?
+2. What will you work on today?
+3. Any blockers or dependencies?
+
+### Mid-Sprint Review
+
+**Time**: Friday, Week 1 (Day 5)
+**Participants**: All agents + Product Manager
+**Agenda**:
+1. Review sprint progress (actual vs planned)
+2. Demo completed features (authentication)
+3. Identify risks and adjust plan if needed
+4. Confirm Week 2 priorities
+
+### Sprint Retrospective
+
+**Time**: Friday, Week 2 (Day 10)
+**Participants**: All agents + Product Manager
+**Agenda**:
+1. Review sprint achievements
+2. Discuss what went well
+3. Discuss what could be improved
+4. Identify action items for next sprint
+5. Celebrate M1 completion
+
+---
+
+## Definition of Done
+
+### Sprint Definition of Done
+
+**Feature Level**:
+- [ ] Code implemented and peer-reviewed
+- [ ] Unit tests written and passing
+- [ ] Integration tests written and passing
+- [ ] API documentation updated
+- [ ] Frontend UI implemented (if applicable)
+- [ ] Manual testing completed
+- [ ] No critical bugs
+
+**Sprint Level**:
+- [ ] All Priority 1 tasks completed
+- [ ] At least 80% of Priority 2 tasks completed
+- [ ] M1 completion ≥95%
+- [ ] Test coverage ≥80% (Application layer)
+- [ ] All tests passing (100% pass rate)
+- [ ] Build with zero errors and warnings
+- [ ] Sprint retrospective completed
+
+### M1 Milestone Definition of Done
+
+**Functional Requirements**:
+- [x] Complete CRUD for Projects, Epics, Stories, Tasks
+- [x] Kanban board with drag & drop
+- [ ] User authentication and authorization
+- [ ] Real-time updates with SignalR
+- [ ] Audit logging for all operations (with user context)
+
+**Quality Requirements**:
+- [x] Domain layer test coverage ≥80% (96.98% achieved)
+- [ ] Application layer test coverage ≥80%
+- [ ] Integration tests for all API endpoints
+- [x] Zero critical bugs
+- [x] Build with zero errors and warnings
+
+**Documentation Requirements**:
+- [x] API documentation (Scalar)
+- [x] Architecture documentation
+- [ ] User guide (basic)
+- [ ] Deployment guide
+
+**Deployment Requirements**:
+- [x] Docker containerization
+- [ ] Environment configuration
+- [ ] Database migrations (including auth tables)
+- [ ] CI/CD pipeline (basic)
+
+---
+
+## Success Criteria
+
+### Sprint Success
+
+**Must Achieve (Minimum Viable Sprint)**:
+1. JWT authentication fully working
+2. All API endpoints secured
+3. Application layer test coverage ≥75%
+4. Zero critical bugs
+
+**Target Achievement (Successful Sprint)**:
+1. JWT authentication fully working
+2. Application layer test coverage ≥80%
+3. SignalR real-time updates working
+4. Integration tests for all controllers
+5. M1 completion ≥95%
+
+**Stretch Goals (Exceptional Sprint)**:
+1. All of the above PLUS:
+2. Frontend component tests ≥60% coverage
+3. Performance optimization complete
+4. M1 completion 100%
+
+---
+
+## Budget and Resource Allocation
+
+### Time Allocation (10 days, 80 hours total)
+
+| Priority | Category | Hours | Percentage |
+|----------|----------|-------|------------|
+| P1 | Authentication | 56h (7 days) | 70% |
+| P1 | Application Testing | 24h (3 days) | 30% |
+| P2 | SignalR | 24h (3 days) | 30% |
+| P2 | Documentation | 8h (1 day) | 10% |
+| P3 | Component Tests | 16h (2 days) | 20% |
+| P3 | Polish | 16h (2 days) | 20% |
+| P3 | Performance | 16h (2 days) | 20% |
+
+**Note**: P2 and P3 tasks are flexible and can be adjusted based on P1 progress
+
+### Resource Requirements
+
+**Development Tools** (already available):
+- .NET 9 SDK
+- Node.js 20+
+- PostgreSQL 16 (Docker)
+- Redis 7 (Docker - to be added)
+- Visual Studio Code / Visual Studio
+
+**Infrastructure** (already available):
+- GitHub repository
+- Docker Desktop
+- Development machines
+
+**No additional budget required for this sprint**
+
+---
+
+## Appendix
+
+### A. Authentication Flow Diagram
+
+```
+Registration Flow:
+User → Frontend (Registration Form) → API (RegisterUserCommand)
+  → Domain (User.Create) → Database → Response (User Created)
+
+Login Flow:
+User → Frontend (Login Form) → API (LoginCommand)
+  → Verify Password → Generate JWT Token → Response (Token)
+  → Frontend (Store Token) → API (Subsequent Requests with Bearer Token)
+
+Protected API Request:
+User → Frontend (With Token) → API (JWT Middleware validates token)
+  → Authorized → Controller → Response
+```
+
+### B. Test Coverage Target Breakdown
+
+| Layer | Current Coverage | Target Coverage | Gap | Priority |
+|-------|-----------------|-----------------|-----|----------|
+| Domain | 96.98% | 80% | +16.98% | ✅ Complete |
+| Application | 40% | 80% | -40% | 🔴 Critical |
+| Infrastructure | 0% | 60% | -60% | 🟡 Medium |
+| API | 0% | 70% | -70% | 🟡 Medium |
+| Frontend | 0% | 60% | -60% | 🟢 Low |
+
+**Focus for this sprint**: Application layer (P1), API layer (P2)
+
+### C. API Endpoints to Secure
+
+**Projects** (5 endpoints):
+- POST /api/v1/projects - [Authorize(Roles = "Admin,ProjectManager")]
+- GET /api/v1/projects - [Authorize]
+- GET /api/v1/projects/{id} - [Authorize]
+- PUT /api/v1/projects/{id} - [Authorize(Roles = "Admin,ProjectManager")]
+- DELETE /api/v1/projects/{id} - [Authorize(Roles = "Admin")]
+
+**Epics** (4 endpoints):
+- All require [Authorize(Roles = "Admin,ProjectManager,Developer")]
+
+**Stories** (7 endpoints):
+- All require [Authorize]
+
+**Tasks** (8 endpoints):
+- All require [Authorize]
+
+### D. Key Decisions Pending
+
+**Decision 1**: ASP.NET Core Identity vs Custom User Management
+- **Options**:
+  1. Use ASP.NET Core Identity (full-featured, battle-tested)
+  2. Custom implementation (lightweight, full control)
+- **Recommendation**: ASP.NET Core Identity (faster, more secure)
+- **Decision Maker**: Backend Agent + Architect Agent
+- **Timeline**: Day 1 of sprint
+
+**Decision 2**: Token Refresh Strategy
+- **Options**:
+  1. Sliding expiration (token refreshes automatically)
+  2. Refresh token (separate refresh token with longer expiration)
+  3. No refresh (user must re-login)
+- **Recommendation**: Refresh token approach (more secure)
+- **Decision Maker**: Backend Agent + Architect Agent
+- **Timeline**: Day 1 of sprint
+
+**Decision 3**: Password Policy
+- **Options**:
+  1. Strict (12+ chars, special chars, numbers)
+  2. Moderate (8+ chars, letters + numbers)
+  3. Minimal (6+ chars)
+- **Recommendation**: Moderate (balance security and UX)
+- **Decision Maker**: Product Manager + Backend Agent
+- **Timeline**: Day 1 of sprint
+
+---
+
+## Next Steps After This Sprint
+
+### Immediate (Week 3)
+
+1. **Deployment Preparation**:
+   - Set up staging environment
+   - Configure CI/CD pipeline
+   - Prepare deployment documentation
+   - Security audit
+
+2. **M1 Completion and Handoff**:
+   - Final testing and bug fixes
+   - User acceptance testing
+   - Documentation completion
+   - M1 retrospective
+
+### M2 Planning (Week 4)
+
+1. **MCP Server Research**:
+   - Research MCP protocol specification
+   - Analyze MCP Server implementation patterns
+   - Design ColaFlow MCP Server architecture
+   - Prototype diff preview mechanism
+
+2. **M2 Sprint 1 Planning**:
+   - Break down M2 into epics and stories
+   - Estimate effort for MCP implementation
+   - Plan first M2 sprint (2-3 weeks)
+   - Allocate resources
+
+---
+
+**End of Action Plan**
+
+**Created By**: Product Manager
+**Last Updated**: 2025-11-03
+**Next Review**: 2025-11-10 (Mid-Sprint Review)