sync: Auto-sync from Mikes-MacBook-Air.local at 2026-03-09 08:14:13

Synced files: - Session logs updated - Latest context and credentials - Command/directive updates Machine: Mikes-MacBook-Air.local Timestamp: 2026-03-09 08:14:13 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-03-09 08:14:13 -07:00
parent f81872784b
commit a1a19f8c00
59 changed files with 14435 additions and 1 deletions
--- a/projects/msp-tools/quote-wizard/prompts/.spec_status.json
+++ b/projects/msp-tools/quote-wizard/prompts/.spec_status.json
@@ -0,0 +1,10 @@
+{
+  "status": "complete",
+  "version": 1,
+  "timestamp": "2026-03-09T12:00:00.000Z",
+  "files_written": [
+    "prompts/app_spec.txt",
+    "prompts/initializer_prompt.md"
+  ],
+  "feature_count": 141
+}
--- a/projects/msp-tools/quote-wizard/prompts/app_spec.txt
+++ b/projects/msp-tools/quote-wizard/prompts/app_spec.txt
@@ -0,0 +1,533 @@
+<project_specification>
+  <project_name>MSP Quote Wizard</project_name>
+
+  <overview>
+    An interactive quotation wizard embedded on azcomputerguru.com that guides prospects through MSP service selection, generates proposals with pricing, and syncs leads to SyncroRMM. Features a 7-step linear wizard with expandable educational content, real-time price calculations, and admin dashboard for lead management.
+  </overview>
+
+  <technology_stack>
+    <frontend>
+      <framework>React 19 + TypeScript</framework>
+      <build_tool>Vite</build_tool>
+      <styling>Tailwind CSS v4 (GuruRMM glassmorphism design system)</styling>
+      <state_management>React Context + useReducer</state_management>
+      <api_client>Axios + React Query</api_client>
+      <animations>Framer Motion</animations>
+      <icons>Lucide React</icons>
+    </frontend>
+    <backend>
+      <runtime>Python 3.11+ (FastAPI)</runtime>
+      <database>MariaDB 10.6</database>
+      <orm>SQLAlchemy</orm>
+      <api_host>172.16.3.30:8001 (extend existing ClaudeTools API)</api_host>
+    </backend>
+    <communication>
+      <api>RESTful JSON API</api>
+      <auth>JWT for admin endpoints, token-based for public quote access</auth>
+    </communication>
+    <integrations>
+      <crm>SyncroRMM API (https://computerguru.syncromsp.com/api/v1)</crm>
+      <email>SMTP or SendGrid for notifications</email>
+      <pdf>WeasyPrint or Puppeteer for quote generation</pdf>
+    </integrations>
+  </technology_stack>
+
+  <prerequisites>
+    <environment_setup>
+      - Node.js 20+ for frontend development
+      - Python 3.11+ for backend
+      - Access to MariaDB at 172.16.3.30:3306
+      - SyncroRMM API credentials
+      - SMTP credentials for email notifications
+    </environment_setup>
+  </prerequisites>
+
+  <feature_count>141</feature_count>
+
+  <security_and_access_control>
+    <user_roles>
+      <role name="public">
+        <permissions>
+          - Can create and view their own quotes via access token
+          - Can submit quotes with contact information
+          - Can view/download PDF of their quote
+          - Cannot access admin endpoints
+        </permissions>
+        <protected_routes>
+          - /api/quotes/* (public with token)
+        </protected_routes>
+      </role>
+      <role name="admin">
+        <permissions>
+          - Can view all quotes
+          - Can update quote status
+          - Can view analytics/stats
+          - Can manually sync to SyncroRMM
+          - Can configure notification settings
+        </permissions>
+        <protected_routes>
+          - /api/admin/* (JWT required)
+          - /admin/* pages in GuruRMM dashboard
+        </protected_routes>
+      </role>
+    </user_roles>
+    <authentication>
+      <method>Token-based for public quotes, JWT for admin</method>
+      <session_timeout>24 hours for quote tokens, standard JWT for admin</session_timeout>
+      <quote_expiry>30 days after creation</quote_expiry>
+    </authentication>
+    <sensitive_operations>
+      - Quote submission triggers SyncroRMM sync
+      - Admin status changes are logged
+      - Email/phone validation before sync
+    </sensitive_operations>
+    <seo>
+      - noindex, nofollow meta tags on quote wizard
+      - X-Robots-Tag header on hosting server
+    </seo>
+  </security_and_access_control>
+
+  <core_features>
+    <wizard_navigation>
+      - Progress bar showing current step and completion
+      - Step indicators with clickable navigation (for completed steps)
+      - Next/Back buttons with validation
+      - Step transition animations
+      - Auto-save draft on step change
+      - Resume incomplete quote via token
+      - Mobile-responsive step layout
+    </wizard_navigation>
+
+    <step_1_company_profile>
+      - Company name input (optional)
+      - Number of endpoints/employees input
+      - Industry dropdown selection
+      - "What brings you here today?" textarea (optional)
+      - Form validation with helpful messages
+      - Auto-create quote draft on entry
+    </step_1_company_profile>
+
+    <step_2_gps_monitoring>
+      - Three tier pricing cards (Basic $19, Pro $26, Advanced $39)
+      - Expandable feature descriptions for each tier
+      - Quantity input tied to endpoint count from Step 1
+      - Equipment monitoring add-on toggle ($25/mo base + $3/device)
+      - Real-time price calculation display
+      - Tier comparison table (expandable)
+      - Recommended tier highlight based on company size
+    </step_2_gps_monitoring>
+
+    <step_3_support_plan>
+      - Four tier pricing cards (Essential $200, Standard $380, Premium $540, Priority $850)
+      - Included hours and response time display
+      - Effective hourly rate calculation
+      - Prepaid block time option (10hr/$1500, 20hr/$2600, 30hr/$3000)
+      - Expandable details for each tier
+      - Recommendation based on endpoint count
+    </step_3_support_plan>
+
+    <step_4_voip>
+      - Toggle: "Need business phones?"
+      - Skip step if toggle is off
+      - Four VoIP tier cards (Basic $22, Standard $28, Pro $35, CallCenter $55)
+      - User count input
+      - Hardware options with quantity selectors
+        - Basic Desk Phone (T53W) $219
+        - Business Desk Phone (T54W) $279
+        - Executive Phone (T57W) $359
+        - Conference Phone (CP920) $599
+        - Wireless Headset (WH62) $159
+        - Cordless Phone (W73P) $199
+      - Add-on services (DID, toll-free, SMS, fax, Teams)
+      - Real-time total calculation
+    </step_4_voip>
+
+    <step_5_web_email>
+      - Web hosting toggle with tier selection
+        - Starter $15 (5GB, 1 site)
+        - Business $35 (25GB, 5 sites)
+        - Commerce $65 (50GB, unlimited)
+      - Email provider choice (expandable comparison)
+        - WHM Email ($2-20/mailbox based on storage)
+        - Microsoft 365 Basic $7, Standard $14, Premium $24
+        - Exchange Online $5
+      - Email user count input
+      - Add-ons: email security $3/mailbox, dedicated IP $5, SSL $6.25
+    </step_5_web_email>
+
+    <step_6_summary>
+      - Itemized breakdown by category
+      - Monthly recurring total (prominent display)
+      - One-time/setup costs (separate section)
+      - Edit buttons to revisit any step
+      - Collapsible category sections
+      - Savings highlight if applicable
+      - Print-friendly view option
+    </step_6_summary>
+
+    <step_7_contact>
+      - Contact name (required)
+      - Email address (required, validated)
+      - Phone number (recommended, formatted)
+      - Company name (pre-filled from Step 1)
+      - Current IT situation textarea
+      - Preferred contact method selection
+      - Terms acceptance checkbox
+      - Submit button with loading state
+      - Duplicate email check against SyncroRMM
+      - Success confirmation with quote reference
+    </step_7_contact>
+
+    <expandable_info>
+      - Collapsible info cards throughout wizard
+      - "Learn more" buttons for each feature
+      - Smooth expand/collapse animations
+      - Feature definitions in plain language
+      - Use case examples
+      - Comparison tables within expandables
+    </expandable_info>
+
+    <pricing_calculations>
+      - Real-time total updates as selections change
+      - Category subtotals
+      - One-time vs recurring separation
+      - Quantity-based calculations
+      - Add-on aggregation
+      - Discount display (if applicable)
+    </pricing_calculations>
+
+    <quote_api_public>
+      - POST /api/quotes - Create new quote (returns access_token)
+      - GET /api/quotes/{token} - Get quote by access token
+      - PUT /api/quotes/{token} - Update quote (wizard progress)
+      - POST /api/quotes/{token}/submit - Finalize and submit
+      - GET /api/quotes/{token}/pdf - Generate PDF
+      - Rate limiting for public endpoints
+    </quote_api_public>
+
+    <quote_api_admin>
+      - GET /api/admin/quotes - List all quotes (paginated, filterable)
+      - GET /api/admin/quotes/{id} - Get quote details
+      - PUT /api/admin/quotes/{id} - Update status, add notes
+      - GET /api/admin/quotes/stats - Dashboard analytics
+      - POST /api/admin/quotes/{id}/sync-syncro - Manual sync
+    </quote_api_admin>
+
+    <syncro_integration>
+      - Duplicate check via GET /customers?email={email}
+      - Lead creation via POST /leads
+      - Quote details in ticket_description
+      - Sync status tracking
+      - Error handling for API failures
+      - Manual retry capability
+    </syncro_integration>
+
+    <notifications>
+      - Customer confirmation email with quote link
+      - Admin alert email on new submission
+      - Email templates with branding
+      - Quote PDF attachment option
+      - Webhook support for automation
+    </notifications>
+
+    <admin_dashboard>
+      - Quote listing with filters (status, date, value)
+      - Search by company/contact/email
+      - Quote detail view with full breakdown
+      - Activity timeline per quote
+      - Status management (draft, submitted, followed_up, converted)
+      - SyncroRMM sync status indicator
+      - Basic analytics (conversion funnel, popular services)
+    </admin_dashboard>
+
+    <pdf_generation>
+      - Professional quote document
+      - Company branding (logo, colors)
+      - Itemized service breakdown
+      - Terms and conditions
+      - Validity period display
+      - Contact information
+    </pdf_generation>
+  </core_features>
+
+  <database_schema>
+    <tables>
+      <quotes>
+        - id (UUID, PK)
+        - company_name (VARCHAR 255, nullable)
+        - contact_name (VARCHAR 255, not null)
+        - contact_email (VARCHAR 255, not null)
+        - contact_phone (VARCHAR 50, nullable)
+        - employee_count (INT, nullable)
+        - industry (VARCHAR 100, nullable)
+        - current_it_situation (TEXT, nullable)
+        - status (ENUM: draft, submitted, viewed, followed_up, converted, expired)
+        - access_token (VARCHAR 64, unique, not null)
+        - monthly_total (DECIMAL 10,2)
+        - setup_total (DECIMAL 10,2)
+        - syncro_lead_id (VARCHAR 100, nullable)
+        - syncro_synced_at (DATETIME, nullable)
+        - is_existing_customer (BOOLEAN, default false)
+        - source (VARCHAR 50, default 'website')
+        - utm_source, utm_medium, utm_campaign (VARCHAR 100 each)
+        - ip_address (VARCHAR 45)
+        - user_agent (TEXT)
+        - created_at, updated_at, submitted_at, expires_at (DATETIME)
+      </quotes>
+
+      <quote_items>
+        - id (UUID, PK)
+        - quote_id (UUID, FK to quotes, cascade delete)
+        - category (ENUM: gps_monitoring, support_plan, voip, web_hosting, email, hardware, addon)
+        - product_code (VARCHAR 50, not null)
+        - product_name (VARCHAR 255, not null)
+        - description (TEXT, nullable)
+        - quantity (INT, default 1)
+        - unit_price (DECIMAL 10,2, not null)
+        - setup_price (DECIMAL 10,2, default 0)
+        - billing_frequency (ENUM: monthly, yearly, one_time)
+        - tier (VARCHAR 50, nullable)
+        - is_recommended (BOOLEAN, default false)
+        - created_at (DATETIME)
+      </quote_items>
+
+      <quote_activity>
+        - id (UUID, PK)
+        - quote_id (UUID, FK to quotes, cascade delete)
+        - action (VARCHAR 50, not null: created, step_completed, submitted, viewed, pdf_generated, synced_syncro, status_changed)
+        - step_name (VARCHAR 50, nullable)
+        - details (JSON, nullable)
+        - ip_address (VARCHAR 45, nullable)
+        - created_at (DATETIME)
+      </quote_activity>
+
+      <quote_notifications>
+        - id (UUID, PK)
+        - quote_id (UUID, FK to quotes, cascade delete)
+        - notification_type (ENUM: email, webhook)
+        - recipient (VARCHAR 255, not null)
+        - subject (VARCHAR 255, nullable)
+        - body (TEXT, nullable)
+        - status (ENUM: pending, sent, failed)
+        - attempts (INT, default 0)
+        - last_attempt_at, sent_at (DATETIME, nullable)
+        - error_message (TEXT, nullable)
+        - created_at (DATETIME)
+      </quote_notifications>
+    </tables>
+  </database_schema>
+
+  <api_endpoints_summary>
+    <public_quotes>
+      - POST /api/quotes (create quote, returns token)
+      - GET /api/quotes/{token} (get quote by token)
+      - PUT /api/quotes/{token} (update quote)
+      - POST /api/quotes/{token}/submit (finalize)
+      - GET /api/quotes/{token}/pdf (generate PDF)
+    </public_quotes>
+
+    <admin_quotes>
+      - GET /api/admin/quotes (list with filters)
+      - GET /api/admin/quotes/{id} (detail view)
+      - PUT /api/admin/quotes/{id} (update status/notes)
+      - GET /api/admin/quotes/stats (analytics)
+      - POST /api/admin/quotes/{id}/sync-syncro (manual sync)
+    </admin_quotes>
+
+    <syncro_proxy>
+      - GET /api/syncro/check-customer?email={email} (duplicate check)
+    </syncro_proxy>
+  </api_endpoints_summary>
+
+  <ui_layout>
+    <main_structure>
+      Full-width wizard container with centered content (max-width 1200px).
+      Progress bar at top showing 7 steps.
+      Main content area with current step.
+      Fixed bottom navigation (Back/Next buttons).
+      Running total display in corner/sidebar on desktop.
+    </main_structure>
+
+    <wizard_step_layout>
+      Step title with icon.
+      Optional subtitle/description.
+      Main content area (cards, forms, selections).
+      Expandable info sections.
+      Step-specific help text.
+    </wizard_step_layout>
+
+    <pricing_card_layout>
+      Card with tier name and price header.
+      Feature list with checkmarks.
+      "Most Popular" badge for recommended tier.
+      Select button at bottom.
+      Expandable "Learn more" section.
+    </pricing_card_layout>
+
+    <admin_layout>
+      Integrated into existing GuruRMM dashboard.
+      Left sidebar navigation (add "Quotes" menu item).
+      Main content area with quote listing.
+      Slide-out panel for quick view.
+      Full page for quote details.
+    </admin_layout>
+  </ui_layout>
+
+  <design_system>
+    <color_palette>
+      Match azcomputerguru.com website theme:
+      - Primary Dark: #333d49 (dark blue-gray)
+      - Accent Orange: #fe7400 (call-to-action, highlights)
+      - Navy: #113559 (headers, dark elements)
+      - White: #ffffff (backgrounds, text on dark)
+      - Black: #000000 (text)
+      - Gray: #4d4d4d (secondary text)
+    </color_palette>
+
+    <typography>
+      - Font Family: Lexend (Google Fonts) - same as main website
+      - Headings: Bold weight, navy or dark
+      - Body: Regular weight, gray/black
+      - Prices: Bold, larger size, orange accent (#fe7400)
+    </typography>
+
+    <effects>
+      - Clean, professional cards with subtle shadows
+      - Smooth transitions (200ms)
+      - Orange hover effects on buttons
+      - Progress bar with orange fill
+      - Step transition slides
+      - Consistent with main website aesthetic
+    </effects>
+  </design_system>
+
+  <implementation_steps>
+    <step number="1">
+      <title>Foundation - Database and API Setup</title>
+      <tasks>
+        - Create database migration for quote tables
+        - Build SQLAlchemy models (Quote, QuoteItem, QuoteActivity, QuoteNotification)
+        - Create Pydantic schemas for request/response
+        - Implement QuoteService with CRUD operations
+        - Build public quote endpoints (/api/quotes/*)
+        - Add token generation and validation
+      </tasks>
+    </step>
+
+    <step number="2">
+      <title>Frontend Project Setup</title>
+      <tasks>
+        - Initialize Vite + React + TypeScript project
+        - Configure Tailwind CSS v4 with GuruRMM design tokens
+        - Copy/adapt UI components from GuruRMM (Button, Card, Input)
+        - Set up React Router for wizard navigation
+        - Configure Axios + React Query for API calls
+        - Create pricing data constants from MSP pricing docs
+      </tasks>
+    </step>
+
+    <step number="3">
+      <title>Wizard Core Implementation</title>
+      <tasks>
+        - Build WizardContainer with progress tracking
+        - Implement WizardProgress component
+        - Create each step component (Steps 1-7)
+        - Build pricing card components
+        - Implement quantity selectors and toggles
+        - Wire up quote creation/update API calls
+        - Add form validation for each step
+      </tasks>
+    </step>
+
+    <step number="4">
+      <title>Educational Content and Polish</title>
+      <tasks>
+        - Build ExpandableInfo component
+        - Add feature descriptions and comparisons
+        - Implement tier comparison tables
+        - Add Framer Motion animations
+        - Ensure mobile responsiveness
+        - Add loading states and error handling
+      </tasks>
+    </step>
+
+    <step number="5">
+      <title>Integrations</title>
+      <tasks>
+        - Build SyncroService for API integration
+        - Implement duplicate customer check
+        - Create lead in SyncroRMM on submit
+        - Build NotificationService for emails
+        - Create email templates
+        - Implement PDF generation
+      </tasks>
+    </step>
+
+    <step number="6">
+      <title>Admin Dashboard</title>
+      <tasks>
+        - Add admin API endpoints
+        - Build quote listing page in GuruRMM
+        - Create quote detail view
+        - Implement filters and search
+        - Add status management
+        - Build basic analytics view
+      </tasks>
+    </step>
+
+    <step number="7">
+      <title>Deployment and Website Link</title>
+      <tasks>
+        - Build production frontend bundle
+        - Deploy to quote.azcomputerguru.com or ClaudeTools server
+        - Add noindex meta tags to quote wizard
+        - Configure CORS for API access
+        - Add "Get a Quote" button/link on azcomputerguru.com
+        - End-to-end testing
+      </tasks>
+    </step>
+  </implementation_steps>
+
+  <success_criteria>
+    <functionality>
+      - Complete wizard flow from start to submission
+      - All pricing calculations accurate
+      - Quote saved to database with all items
+      - SyncroRMM lead created on submission
+      - Email notifications sent
+      - PDF generation works
+      - Admin can view and manage all quotes
+    </functionality>
+
+    <user_experience>
+      - Wizard intuitive for non-technical users
+      - Expandable info provides education without cluttering
+      - Progress clearly visible at all times
+      - Mobile-friendly on all devices
+      - Fast loading and responsive interactions
+    </user_experience>
+
+    <technical_quality>
+      - No mock data - all real database operations
+      - Proper error handling throughout
+      - API validation on both client and server
+      - Secure token-based quote access
+      - Rate limiting on public endpoints
+    </technical_quality>
+
+    <design_polish>
+      - Matches GuruRMM design system
+      - Consistent glassmorphism styling
+      - Smooth animations and transitions
+      - Professional appearance suitable for business
+    </design_polish>
+  </success_criteria>
+
+  <pricing_data_reference>
+    <source_files>
+      - /projects/msp-pricing/docs/gps-pricing-structure.md
+      - /projects/msp-pricing/docs/voip-pricing-structure.md
+      - /projects/msp-pricing/docs/web-email-hosting-pricing.md
+    </source_files>
+  </pricing_data_reference>
+</project_specification>
--- a/projects/msp-tools/quote-wizard/prompts/initializer_prompt.md
+++ b/projects/msp-tools/quote-wizard/prompts/initializer_prompt.md
@@ -0,0 +1,523 @@
+## YOUR ROLE - INITIALIZER AGENT (Session 1 of Many)
+
+You are the FIRST agent in a long-running autonomous development process.
+Your job is to set up the foundation for all future coding agents.
+
+### FIRST: Read the Project Specification
+
+Start by reading `app_spec.txt` in your working directory. This file contains
+the complete specification for what you need to build. Read it carefully
+before proceeding.
+
+---
+
+## REQUIRED FEATURE COUNT
+
+**CRITICAL:** You must create exactly **141** features using the `feature_create_bulk` tool.
+
+This number was determined during spec creation and must be followed precisely. Do not create more or fewer features than specified.
+
+---
+
+### CRITICAL FIRST TASK: Create Features
+
+Based on `app_spec.txt`, create features using the feature_create_bulk tool. The features are stored in a SQLite database,
+which is the single source of truth for what needs to be built.
+
+**Creating Features:**
+
+Use the feature_create_bulk tool to add all features at once:
+
+```
+Use the feature_create_bulk tool with features=[
+  {
+    "category": "functional",
+    "name": "Brief feature name",
+    "description": "Brief description of the feature and what this test verifies",
+    "steps": [
+      "Step 1: Navigate to relevant page",
+      "Step 2: Perform action",
+      "Step 3: Verify expected result"
+    ]
+  },
+  {
+    "category": "style",
+    "name": "Brief feature name",
+    "description": "Brief description of UI/UX requirement",
+    "steps": [
+      "Step 1: Navigate to page",
+      "Step 2: Take screenshot",
+      "Step 3: Verify visual requirements"
+    ]
+  }
+]
+```
+
+**Notes:**
+- IDs and priorities are assigned automatically based on order
+- All features start with `passes: false` by default
+- You can create features in batches if there are many (e.g., 50 at a time)
+
+**Requirements for features:**
+
+- Feature count must match the `feature_count` specified in app_spec.txt
+- Reference tiers for other projects:
+  - **Simple apps**: ~150 tests
+  - **Medium apps**: ~250 tests
+  - **Complex apps**: ~400+ tests
+- Both "functional" and "style" categories
+- Mix of narrow tests (2-5 steps) and comprehensive tests (10+ steps)
+- At least 25 tests MUST have 10+ steps each (more for complex apps)
+- Order features by priority: fundamental features first (the API assigns priority based on order)
+- All features start with `passes: false` automatically
+- Cover every feature in the spec exhaustively
+- **MUST include tests from ALL 20 mandatory categories below**
+
+---
+
+## MANDATORY TEST CATEGORIES
+
+The feature_list.json **MUST** include tests from ALL of these categories. The minimum counts scale by complexity tier.
+
+### Category Distribution by Complexity Tier
+
+| Category                         | Simple  | Medium  | Complex  |
+| -------------------------------- | ------- | ------- | -------- |
+| A. Security & Access Control     | 5       | 20      | 40       |
+| B. Navigation Integrity          | 15      | 25      | 40       |
+| C. Real Data Verification        | 20      | 30      | 50       |
+| D. Workflow Completeness         | 10      | 20      | 40       |
+| E. Error Handling                | 10      | 15      | 25       |
+| F. UI-Backend Integration        | 10      | 20      | 35       |
+| G. State & Persistence           | 8       | 10      | 15       |
+| H. URL & Direct Access           | 5       | 10      | 20       |
+| I. Double-Action & Idempotency   | 5       | 8       | 15       |
+| J. Data Cleanup & Cascade        | 5       | 10      | 20       |
+| K. Default & Reset               | 5       | 8       | 12       |
+| L. Search & Filter Edge Cases    | 8       | 12      | 20       |
+| M. Form Validation               | 10      | 15      | 25       |
+| N. Feedback & Notification       | 8       | 10      | 15       |
+| O. Responsive & Layout           | 8       | 10      | 15       |
+| P. Accessibility                 | 8       | 10      | 15       |
+| Q. Temporal & Timezone           | 5       | 8       | 12       |
+| R. Concurrency & Race Conditions | 5       | 8       | 15       |
+| S. Export/Import                 | 5       | 6       | 10       |
+| T. Performance                   | 5       | 5       | 10       |
+| **TOTAL**                        | **150** | **250** | **400+** |
+
+---
+
+### A. Security & Access Control Tests
+
+Test that unauthorized access is blocked and permissions are enforced.
+
+**Required tests (examples):**
+
+- Unauthenticated user cannot access protected routes (redirect to login)
+- Regular user cannot access admin-only pages (403 or redirect)
+- API endpoints return 401 for unauthenticated requests
+- API endpoints return 403 for unauthorized role access
+- Session expires after configured inactivity period
+- Logout clears all session data and tokens
+- Invalid/expired tokens are rejected
+- Each role can ONLY see their permitted menu items
+- Direct URL access to unauthorized pages is blocked
+- Sensitive operations require confirmation or re-authentication
+- Cannot access another user's data by manipulating IDs in URL
+- Password reset flow works securely
+- Failed login attempts are handled (no information leakage)
+
+### B. Navigation Integrity Tests
+
+Test that every button, link, and menu item goes to the correct place.
+
+**Required tests (examples):**
+
+- Every button in sidebar navigates to correct page
+- Every menu item links to existing route
+- All CRUD action buttons (Edit, Delete, View) go to correct URLs with correct IDs
+- Back button works correctly after each navigation
+- Deep linking works (direct URL access to any page with auth)
+- Breadcrumbs reflect actual navigation path
+- 404 page shown for non-existent routes (not crash)
+- After login, user redirected to intended destination (or dashboard)
+- After logout, user redirected to login page
+- Pagination links work and preserve current filters
+- Tab navigation within pages works correctly
+- Modal close buttons return to previous state
+- Cancel buttons on forms return to previous page
+
+### C. Real Data Verification Tests
+
+Test that data is real (not mocked) and persists correctly.
+
+**Required tests (examples):**
+
+- Create a record via UI with unique content → verify it appears in list
+- Create a record → refresh page → record still exists
+- Create a record → log out → log in → record still exists
+- Edit a record → verify changes persist after refresh
+- Delete a record → verify it's gone from list AND database
+- Delete a record → verify it's gone from related dropdowns
+- Filter/search → results match actual data created in test
+- Dashboard statistics reflect real record counts (create 3 items, count shows 3)
+- Reports show real aggregated data
+- Export functionality exports actual data you created
+- Related records update when parent changes
+- Timestamps are real and accurate (created_at, updated_at)
+- Data created by User A is not visible to User B (unless shared)
+- Empty state shows correctly when no data exists
+
+### D. Workflow Completeness Tests
+
+Test that every workflow can be completed end-to-end through the UI.
+
+**Required tests (examples):**
+
+- Every entity has working Create operation via UI form
+- Every entity has working Read/View operation (detail page loads)
+- Every entity has working Update operation (edit form saves)
+- Every entity has working Delete operation (with confirmation dialog)
+- Every status/state has a UI mechanism to transition to next state
+- Multi-step processes (wizards) can be completed end-to-end
+- Bulk operations (select all, delete selected) work
+- Cancel/Undo operations work where applicable
+- Required fields prevent submission when empty
+- Form validation shows errors before submission
+- Successful submission shows success feedback
+- Backend workflow (e.g., user→customer conversion) has UI trigger
+
+### E. Error Handling Tests
+
+Test graceful handling of errors and edge cases.
+
+**Required tests (examples):**
+
+- Network failure shows user-friendly error message, not crash
+- Invalid form input shows field-level errors
+- API errors display meaningful messages to user
+- 404 responses handled gracefully (show not found page)
+- 500 responses don't expose stack traces or technical details
+- Empty search results show "no results found" message
+- Loading states shown during all async operations
+- Timeout doesn't hang the UI indefinitely
+- Submitting form with server error keeps user data in form
+- File upload errors (too large, wrong type) show clear message
+- Duplicate entry errors (e.g., email already exists) are clear
+
+### F. UI-Backend Integration Tests
+
+Test that frontend and backend communicate correctly.
+
+**Required tests (examples):**
+
+- Frontend request format matches what backend expects
+- Backend response format matches what frontend parses
+- All dropdown options come from real database data (not hardcoded)
+- Related entity selectors (e.g., "choose category") populated from DB
+- Changes in one area reflect in related areas after refresh
+- Deleting parent handles children correctly (cascade or block)
+- Filters work with actual data attributes from database
+- Sort functionality sorts real data correctly
+- Pagination returns correct page of real data
+- API error responses are parsed and displayed correctly
+- Loading spinners appear during API calls
+- Optimistic updates (if used) rollback on failure
+
+### G. State & Persistence Tests
+
+Test that state is maintained correctly across sessions and tabs.
+
+**Required tests (examples):**
+
+- Refresh page mid-form - appropriate behavior (data kept or cleared)
+- Close browser, reopen - session state handled correctly
+- Same user in two browser tabs - changes sync or handled gracefully
+- Browser back after form submit - no duplicate submission
+- Bookmark a page, return later - works (with auth check)
+- LocalStorage/cookies cleared - graceful re-authentication
+- Unsaved changes warning when navigating away from dirty form
+
+### H. URL & Direct Access Tests
+
+Test direct URL access and URL manipulation security.
+
+**Required tests (examples):**
+
+- Change entity ID in URL - cannot access others' data
+- Access /admin directly as regular user - blocked
+- Malformed URL parameters - handled gracefully (no crash)
+- Very long URL - handled correctly
+- URL with SQL injection attempt - rejected/sanitized
+- Deep link to deleted entity - shows "not found", not crash
+- Query parameters for filters are reflected in UI
+- Sharing a URL with filters preserves those filters
+
+### I. Double-Action & Idempotency Tests
+
+Test that rapid or duplicate actions don't cause issues.
+
+**Required tests (examples):**
+
+- Double-click submit button - only one record created
+- Rapid multiple clicks on delete - only one deletion occurs
+- Submit form, hit back, submit again - appropriate behavior
+- Multiple simultaneous API calls - server handles correctly
+- Refresh during save operation - data not corrupted
+- Click same navigation link twice quickly - no issues
+- Submit button disabled during processing
+
+### J. Data Cleanup & Cascade Tests
+
+Test that deleting data cleans up properly everywhere.
+
+**Required tests (examples):**
+
+- Delete parent entity - children removed from all views
+- Delete item - removed from search results immediately
+- Delete item - statistics/counts updated immediately
+- Delete item - related dropdowns updated
+- Delete item - cached views refreshed
+- Soft delete (if applicable) - item hidden but recoverable
+- Hard delete - item completely removed from database
+
+### K. Default & Reset Tests
+
+Test that defaults and reset functionality work correctly.
+
+**Required tests (examples):**
+
+- New form shows correct default values
+- Date pickers default to sensible dates (today, not 1970)
+- Dropdowns default to correct option (or placeholder)
+- Reset button clears to defaults, not just empty
+- Clear filters button resets all filters to default
+- Pagination resets to page 1 when filters change
+- Sorting resets when changing views
+
+### L. Search & Filter Edge Cases
+
+Test search and filter functionality thoroughly.
+
+**Required tests (examples):**
+
+- Empty search shows all results (or appropriate message)
+- Search with only spaces - handled correctly
+- Search with special characters (!@#$%^&\*) - no errors
+- Search with quotes - handled correctly
+- Search with very long string - handled correctly
+- Filter combinations that return zero results - shows message
+- Filter + search + sort together - all work correctly
+- Filter persists after viewing detail and returning to list
+- Clear individual filter - works correctly
+- Search is case-insensitive (or clearly case-sensitive)
+
+### M. Form Validation Tests
+
+Test all form validation rules exhaustively.
+
+**Required tests (examples):**
+
+- Required field empty - shows error, blocks submit
+- Email field with invalid email formats - shows error
+- Password field - enforces complexity requirements
+- Numeric field with letters - rejected
+- Date field with invalid date - rejected
+- Min/max length enforced on text fields
+- Min/max values enforced on numeric fields
+- Duplicate unique values rejected (e.g., duplicate email)
+- Error messages are specific (not just "invalid")
+- Errors clear when user fixes the issue
+- Server-side validation matches client-side
+- Whitespace-only input rejected for required fields
+
+### N. Feedback & Notification Tests
+
+Test that users get appropriate feedback for all actions.
+
+**Required tests (examples):**
+
+- Every successful save/create shows success feedback
+- Every failed action shows error feedback
+- Loading spinner during every async operation
+- Disabled state on buttons during form submission
+- Progress indicator for long operations (file upload)
+- Toast/notification disappears after appropriate time
+- Multiple notifications don't overlap incorrectly
+- Success messages are specific (not just "Success")
+
+### O. Responsive & Layout Tests
+
+Test that the UI works on different screen sizes.
+
+**Required tests (examples):**
+
+- Desktop layout correct at 1920px width
+- Tablet layout correct at 768px width
+- Mobile layout correct at 375px width
+- No horizontal scroll on any standard viewport
+- Touch targets large enough on mobile (44px min)
+- Modals fit within viewport on mobile
+- Long text truncates or wraps correctly (no overflow)
+- Tables scroll horizontally if needed on mobile
+- Navigation collapses appropriately on mobile
+
+### P. Accessibility Tests
+
+Test basic accessibility compliance.
+
+**Required tests (examples):**
+
+- Tab navigation works through all interactive elements
+- Focus ring visible on all focused elements
+- Screen reader can navigate main content areas
+- ARIA labels on icon-only buttons
+- Color contrast meets WCAG AA (4.5:1 for text)
+- No information conveyed by color alone
+- Form fields have associated labels
+- Error messages announced to screen readers
+- Skip link to main content (if applicable)
+- Images have alt text
+
+### Q. Temporal & Timezone Tests
+
+Test date/time handling.
+
+**Required tests (examples):**
+
+- Dates display in user's local timezone
+- Created/updated timestamps accurate and formatted correctly
+- Date picker allows only valid date ranges
+- Overdue items identified correctly (timezone-aware)
+- "Today", "This Week" filters work correctly for user's timezone
+- Recurring items generate at correct times (if applicable)
+- Date sorting works correctly across months/years
+
+### R. Concurrency & Race Condition Tests
+
+Test multi-user and race condition scenarios.
+
+**Required tests (examples):**
+
+- Two users edit same record - last save wins or conflict shown
+- Record deleted while another user viewing - graceful handling
+- List updates while user on page 2 - pagination still works
+- Rapid navigation between pages - no stale data displayed
+- API response arrives after user navigated away - no crash
+- Concurrent form submissions from same user handled
+
+### S. Export/Import Tests (if applicable)
+
+Test data export and import functionality.
+
+**Required tests (examples):**
+
+- Export all data - file contains all records
+- Export filtered data - only filtered records included
+- Import valid file - all records created correctly
+- Import duplicate data - handled correctly (skip/update/error)
+- Import malformed file - error message, no partial import
+- Export then import - data integrity preserved exactly
+
+### T. Performance Tests
+
+Test basic performance requirements.
+
+**Required tests (examples):**
+
+- Page loads in <3s with 100 records
+- Page loads in <5s with 1000 records
+- Search responds in <1s
+- Infinite scroll doesn't degrade with many items
+- Large file upload shows progress
+- Memory doesn't leak on long sessions
+- No console errors during normal operation
+
+---
+
+## ABSOLUTE PROHIBITION: NO MOCK DATA
+
+The feature_list.json must include tests that **actively verify real data** and **detect mock data patterns**.
+
+**Include these specific tests:**
+
+1. Create unique test data (e.g., "TEST_12345_VERIFY_ME")
+2. Verify that EXACT data appears in UI
+3. Refresh page - data persists
+4. Delete data - verify it's gone
+5. If data appears that wasn't created during test - FLAG AS MOCK DATA
+
+**The agent implementing features MUST NOT use:**
+
+- Hardcoded arrays of fake data
+- `mockData`, `fakeData`, `sampleData`, `dummyData` variables
+- `// TODO: replace with real API`
+- `setTimeout` simulating API delays with static data
+- Static returns instead of database queries
+
+---
+
+**CRITICAL INSTRUCTION:**
+IT IS CATASTROPHIC TO REMOVE OR EDIT FEATURES IN FUTURE SESSIONS.
+Features can ONLY be marked as passing (via the `feature_mark_passing` tool with the feature_id).
+Never remove features, never edit descriptions, never modify testing steps.
+This ensures no functionality is missed.
+
+### SECOND TASK: Create init.sh
+
+Create a script called `init.sh` that future agents can use to quickly
+set up and run the development environment. The script should:
+
+1. Install any required dependencies
+2. Start any necessary servers or services
+3. Print helpful information about how to access the running application
+
+Base the script on the technology stack specified in `app_spec.txt`.
+
+### THIRD TASK: Initialize Git
+
+Create a git repository and make your first commit with:
+
+- init.sh (environment setup script)
+- README.md (project overview and setup instructions)
+- Any initial project structure files
+
+Note: Features are stored in the SQLite database (features.db), not in a JSON file.
+
+Commit message: "Initial setup: init.sh, project structure, and features created via API"
+
+### FOURTH TASK: Create Project Structure
+
+Set up the basic project structure based on what's specified in `app_spec.txt`.
+This typically includes directories for frontend, backend, and any other
+components mentioned in the spec.
+
+### OPTIONAL: Start Implementation
+
+If you have time remaining in this session, you may begin implementing
+the highest-priority features. Get the next feature with:
+
+```
+Use the feature_get_next tool
+```
+
+Remember:
+- Work on ONE feature at a time
+- Test thoroughly before marking as passing
+- Commit your progress before session ends
+
+### ENDING THIS SESSION
+
+Before your context fills up:
+
+1. Commit all work with descriptive messages
+2. Create `claude-progress.txt` with a summary of what you accomplished
+3. Verify features were created using the feature_get_stats tool
+4. Leave the environment in a clean, working state
+
+The next agent will continue from here with a fresh context window.
+
+---
+
+**Remember:** You have unlimited time across many sessions. Focus on
+quality over speed. Production-ready is the goal.