apiVersion: devrunbook.io/v1alpha1
kind: SeedCatalog
metadata:
  name: DevRunbook initial seed catalog
  version: 1.1.0
  count: 72
  notes: The catalog contains 72 roadmap definitions. All 28 P0 entries have publishable package directories under content/playbooks;
    P1 and P2 entries remain explicit authored backlog definitions.
  publishableCount: 28
playbooks:
- id: repository-understanding.repository-inventory
  slug: repository-inventory
  title: Repository Inventory and Map
  category: repository-understanding
  summary: Build an evidence-based inventory of applications, services, packages, data stores, deployment assets and key relationships
    without changing the repository.
  type: guided
  defaultMode: inspect
  riskTier: low
  defaultAutonomy: diagnose
  priority: P0
  tags:
  - architecture
  - inventory
  - onboarding
  keyInputs:
  - target scope
  - desired depth
  doneWhen:
  - Repository structure and major components are mapped with evidence paths.
  - Unknowns and conflicting evidence are reported separately.
  deliveryStatus: publishable-package
- id: repository-understanding.architecture-reconstruction
  slug: architecture-reconstruction
  title: Reconstruct Current Architecture
  category: repository-understanding
  summary: Infer and document the current architecture, boundaries and data flows from code and configuration while distinguishing
    observation from inference.
  type: run-pack
  defaultMode: inspect
  riskTier: low
  defaultAutonomy: diagnose
  priority: P1
  tags:
  - architecture
  - data-flow
  - documentation
  keyInputs:
  - target audience
  - diagram depth
  doneWhen:
  - Architecture document matches observable code and configuration.
  - Inferences and confidence levels are explicit.
  deliveryStatus: authored-backlog
- id: repository-understanding.critical-flow-tracing
  slug: critical-flow-tracing
  title: Trace a Critical User or Data Flow
  category: repository-understanding
  summary: Follow one critical flow across frontend, API, persistence and external integrations to expose behavior, dependencies
    and failure points.
  type: guided
  defaultMode: inspect
  riskTier: low
  defaultAutonomy: diagnose
  priority: P1
  tags:
  - tracing
  - data-flow
  - debugging
  keyInputs:
  - flow description
  - entry point
  doneWhen:
  - The complete flow is traced with file and component references.
  - Error and fallback paths are included.
  deliveryStatus: authored-backlog
- id: repository-understanding.onboarding-documentation
  slug: onboarding-documentation
  title: Generate Developer Onboarding Guide
  category: repository-understanding
  summary: Create accurate setup, architecture and contribution guidance from repository evidence without inventing unavailable
    commands.
  type: run-pack
  defaultMode: guided
  riskTier: low
  defaultAutonomy: plan
  priority: P0
  tags:
  - documentation
  - onboarding
  - setup
  keyInputs:
  - target platform
  - audience experience
  doneWhen:
  - Fresh-clone setup is documented from verified commands.
  - Architecture, common tasks and troubleshooting are included.
  deliveryStatus: publishable-package
- id: repository-understanding.agents-instructions
  slug: agents-instructions
  title: Generate Repository AGENTS.md Guidance
  category: repository-understanding
  summary: Create reviewed persistent Codex instructions from real repository commands, protected paths and engineering policies.
  type: guided
  defaultMode: plan
  riskTier: moderate
  defaultAutonomy: plan
  priority: P0
  tags:
  - codex
  - agents.md
  - governance
  keyInputs:
  - instruction scope
  - directory overrides
  doneWhen:
  - Durable rules are separated from one-time task instructions.
  - Suggested hierarchy and review notes are included.
  deliveryStatus: publishable-package
- id: repository-understanding.documentation-code-drift
  slug: documentation-code-drift
  title: Documentation-to-Code Drift Audit
  category: repository-understanding
  summary: Compare setup, API, configuration and operational documentation with actual implementation and report stale or
    misleading content.
  type: guided
  defaultMode: inspect
  riskTier: low
  defaultAutonomy: diagnose
  priority: P1
  tags:
  - documentation
  - drift
  - audit
  keyInputs:
  - documentation paths
  - critical claims
  doneWhen:
  - Every finding links a documented claim to contradictory or missing evidence.
  - No documentation is changed in inspect mode.
  deliveryStatus: authored-backlog
- id: repository-understanding.dependency-surface-map
  slug: dependency-surface-map
  title: Dependency Surface Map
  category: repository-understanding
  summary: Map internal package dependencies and important external integrations to reveal coupling, cycles and critical dependency
    paths.
  type: guided
  defaultMode: inspect
  riskTier: low
  defaultAutonomy: diagnose
  priority: P2
  tags:
  - dependencies
  - architecture
  - coupling
  keyInputs:
  - scope
  - include dev dependencies
  doneWhen:
  - Internal dependency relationships and cycles are identified.
  - Critical external dependency usage is summarized.
  deliveryStatus: authored-backlog
- id: repository-understanding.technical-debt-register
  slug: technical-debt-register
  title: Create Evidence-Based Technical Debt Register
  category: repository-understanding
  summary: Convert observable maintainability, reliability and operational issues into a prioritized register with impact,
    evidence and remediation shape.
  type: run-pack
  defaultMode: inspect
  riskTier: low
  defaultAutonomy: plan
  priority: P1
  tags:
  - technical-debt
  - prioritization
  - roadmap
  keyInputs:
  - prioritization model
  - time horizon
  doneWhen:
  - Debt items include evidence, impact, effort range and dependencies.
  - Speculation is clearly marked and duplicates are consolidated.
  deliveryStatus: authored-backlog
- id: audit.repository-health
  slug: repository-health-audit
  title: Repository Health Audit
  category: audits
  summary: Assess repository hygiene, documentation, testing, dependency management, release readiness and agent readiness
    without making changes.
  type: guided
  defaultMode: inspect
  riskTier: low
  defaultAutonomy: diagnose
  priority: P0
  tags:
  - audit
  - repository
  - health
  keyInputs:
  - audit depth
  - excluded areas
  doneWhen:
  - Findings are grouped by dimension with severity and evidence.
  - Recommendations are prioritized and mapped to follow-up playbooks.
  deliveryStatus: publishable-package
- id: audits.architecture-audit
  slug: architecture-audit
  title: Architecture Quality Audit
  category: audits
  summary: Review boundaries, coupling, data ownership, dependency direction and operational fit against the repository’s
    stated goals.
  type: run-pack
  defaultMode: inspect
  riskTier: moderate
  defaultAutonomy: diagnose
  priority: P1
  tags:
  - audit
  - architecture
  - coupling
  keyInputs:
  - quality attributes
  - target scale
  doneWhen:
  - Findings distinguish structural risks from stylistic preference.
  - Recommendations include trade-offs and migration sequencing.
  deliveryStatus: authored-backlog
- id: audits.frontend-ux-audit
  slug: frontend-ux-audit
  title: Frontend UX and Interaction Audit
  category: audits
  summary: Evaluate hierarchy, interaction clarity, responsive behavior, empty states, consistency and perceived product quality
    using the running application where available.
  type: guided
  defaultMode: inspect
  riskTier: low
  defaultAutonomy: diagnose
  priority: P0
  tags:
  - frontend
  - ux
  - accessibility
  keyInputs:
  - target flows
  - supported viewports
  doneWhen:
  - Findings reference concrete screens and interaction states.
  - Recommendations are prioritized by user impact and effort.
  deliveryStatus: publishable-package
- id: audits.accessibility-audit
  slug: accessibility-audit
  title: Accessibility Audit
  category: audits
  summary: Audit semantic structure, keyboard use, focus, forms, contrast, motion and assistive-technology behavior for selected
    user flows.
  type: guided
  defaultMode: inspect
  riskTier: moderate
  defaultAutonomy: diagnose
  priority: P0
  tags:
  - accessibility
  - wcag
  - frontend
  keyInputs:
  - target standard
  - critical flows
  doneWhen:
  - Issues include reproduction, affected users and remediation guidance.
  - Automated and manual evidence are clearly separated.
  deliveryStatus: publishable-package
- id: audits.performance-audit
  slug: performance-audit
  title: Application Performance Audit
  category: audits
  summary: Identify measurable frontend, backend, database and build-performance bottlenecks before proposing targeted improvements.
  type: run-pack
  defaultMode: inspect
  riskTier: moderate
  defaultAutonomy: diagnose
  priority: P1
  tags:
  - performance
  - profiling
  - database
  keyInputs:
  - performance symptoms
  - representative workload
  doneWhen:
  - Baseline measurements and bottleneck evidence are recorded.
  - Recommendations include expected impact and validation method.
  deliveryStatus: authored-backlog
- id: audits.api-contract-audit
  slug: api-contract-audit
  title: API Contract and Compatibility Audit
  category: audits
  summary: Assess API consistency, validation, errors, versioning, idempotency and backwards-compatibility risks.
  type: guided
  defaultMode: inspect
  riskTier: moderate
  defaultAutonomy: diagnose
  priority: P1
  tags:
  - api
  - contracts
  - compatibility
  keyInputs:
  - API scope
  - compatibility policy
  doneWhen:
  - Findings reference routes or schemas and affected clients.
  - Breaking-risk items are explicitly identified.
  deliveryStatus: authored-backlog
- id: audits.database-audit
  slug: database-audit
  title: Database Design and Query Audit
  category: audits
  summary: Review schema design, indexes, query patterns, transactions, migrations and data-integrity controls using available
    evidence.
  type: run-pack
  defaultMode: inspect
  riskTier: high
  defaultAutonomy: diagnose
  priority: P1
  tags:
  - database
  - queries
  - migrations
  keyInputs:
  - database scope
  - production constraints
  doneWhen:
  - Findings separate confirmed query evidence from hypotheses.
  - Migration and data-risk recommendations include safe validation.
  deliveryStatus: authored-backlog
- id: audits.docker-self-hosting-audit
  slug: docker-self-hosting-audit
  title: Docker and Self-Hosting Audit
  category: audits
  summary: Review container security, image size, health checks, persistence, configuration and operability for self-hosted
    deployment.
  type: guided
  defaultMode: inspect
  riskTier: moderate
  defaultAutonomy: diagnose
  priority: P0
  tags:
  - docker
  - self-hosting
  - unraid
  keyInputs:
  - deployment target
  - runtime constraints
  doneWhen:
  - Findings cover build, runtime, persistence and upgrade behavior.
  - Recommendations identify breaking deployment changes.
  deliveryStatus: publishable-package
- id: audits.observability-audit
  slug: observability-audit
  title: Logging and Observability Audit
  category: audits
  summary: Assess whether logs, metrics, health checks and audit events support troubleshooting without leaking sensitive
    data.
  type: guided
  defaultMode: inspect
  riskTier: moderate
  defaultAutonomy: diagnose
  priority: P1
  tags:
  - logging
  - metrics
  - observability
  keyInputs:
  - critical operations
  - privacy constraints
  doneWhen:
  - Critical failure paths are mapped to available evidence.
  - Sensitive logging risks and missing signals are explicit.
  deliveryStatus: authored-backlog
- id: release.production-readiness
  slug: production-readiness-audit
  title: Production Readiness Audit
  category: audits
  summary: Evaluate deployability, security, migrations, recovery, monitoring, documentation and release evidence before production
    use.
  type: run-pack
  defaultMode: inspect
  riskTier: high
  defaultAutonomy: plan
  priority: P0
  tags:
  - production
  - readiness
  - release
  keyInputs:
  - target environment
  - release candidate
  doneWhen:
  - Blocking, high-risk and advisory findings are separated.
  - A release decision and evidence checklist are produced.
  deliveryStatus: publishable-package
- id: bugfix.root-cause
  slug: root-cause-bugfix
  title: Root-Cause Bug Fix
  category: bugfixing
  summary: Reproduce a reported defect, identify its root cause, add regression evidence and implement the smallest structural
    fix.
  type: guided
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P0
  tags:
  - bugfix
  - root-cause
  - regression
  keyInputs:
  - problem statement
  - reproduction clues
  doneWhen:
  - The issue is reproduced or inability is evidenced.
  - Regression checks fail before and pass after the fix.
  deliveryStatus: publishable-package
- id: bugfixing.flaky-test-repair
  slug: flaky-test-repair
  title: Flaky Test Investigation and Repair
  category: bugfixing
  summary: Measure, isolate and fix nondeterministic tests without masking real product defects or adding arbitrary retries.
  type: guided
  defaultMode: recovery
  riskTier: moderate
  defaultAutonomy: verify
  priority: P1
  tags:
  - testing
  - flaky
  - reliability
  keyInputs:
  - failing test
  - observed frequency
  doneWhen:
  - Flakiness is reproduced with evidence or bounded investigation results.
  - The repair removes the root nondeterminism and repeated runs pass.
  deliveryStatus: authored-backlog
- id: bugfixing.build-failure-recovery
  slug: build-failure-recovery
  title: Build Failure Recovery
  category: bugfixing
  summary: Diagnose and repair a failing build while preserving intended build checks and avoiding broad dependency churn.
  type: guided
  defaultMode: recovery
  riskTier: moderate
  defaultAutonomy: verify
  priority: P0
  tags:
  - build
  - ci
  - recovery
  keyInputs:
  - build command
  - failure output
  doneWhen:
  - Root cause is identified.
  - The original build command succeeds without disabled checks.
  deliveryStatus: publishable-package
- id: bugfixing.dependency-conflict-repair
  slug: dependency-conflict-repair
  title: Dependency Conflict Repair
  category: bugfixing
  summary: Resolve incompatible or duplicated dependencies with a minimal, explainable dependency graph change and full install/build
    validation.
  type: guided
  defaultMode: recovery
  riskTier: moderate
  defaultAutonomy: verify
  priority: P1
  tags:
  - dependencies
  - lockfile
  - build
  keyInputs:
  - conflict output
  - upgrade constraints
  doneWhen:
  - Install and lockfile are reproducible.
  - Tests/build pass and dependency choice is documented.
  deliveryStatus: authored-backlog
- id: bugfixing.frontend-state-bug
  slug: frontend-state-bug
  title: Frontend State and Lifecycle Bug Fix
  category: bugfixing
  summary: Trace incorrect UI state across events, effects, cache and asynchronous boundaries before implementing a regression-tested
    repair.
  type: guided
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P1
  tags:
  - frontend
  - state
  - react
  keyInputs:
  - affected flow
  - expected behavior
  doneWhen:
  - The incorrect state transition is reproduced.
  - A browser or component regression test covers the flow.
  deliveryStatus: authored-backlog
- id: bugfixing.api-integration-failure
  slug: api-integration-failure
  title: External API Integration Failure
  category: bugfixing
  summary: Diagnose request, authentication, schema, retry and error-handling failures without exposing credentials or weakening
    security.
  type: guided
  defaultMode: recovery
  riskTier: high
  defaultAutonomy: verify
  priority: P1
  tags:
  - api
  - integration
  - security
  keyInputs:
  - integration symptom
  - safe response evidence
  doneWhen:
  - Failure boundary and root cause are evidenced.
  - Credentials remain redacted and fallback/error behavior is tested.
  deliveryStatus: authored-backlog
- id: bugfixing.database-concurrency-bug
  slug: database-concurrency-bug
  title: Database Concurrency Bug Investigation
  category: bugfixing
  summary: Reproduce and repair race conditions, duplicate work or transaction anomalies with data-integrity evidence and
    safe migration handling.
  type: run-pack
  defaultMode: recovery
  riskTier: high
  defaultAutonomy: verify
  priority: P2
  tags:
  - database
  - concurrency
  - transactions
  keyInputs:
  - symptom
  - concurrency conditions
  doneWhen:
  - Concurrency failure is demonstrated with a focused test or harness.
  - Data integrity and rollback behavior are validated.
  deliveryStatus: authored-backlog
- id: bugfixing.upgrade-regression-repair
  slug: upgrade-regression-repair
  title: Post-Upgrade Regression Repair
  category: bugfixing
  summary: Compare pre/post-upgrade behavior, isolate the compatibility break and repair it without reverting unrelated security
    or maintenance improvements.
  type: guided
  defaultMode: recovery
  riskTier: moderate
  defaultAutonomy: verify
  priority: P1
  tags:
  - upgrade
  - regression
  - dependencies
  keyInputs:
  - upgraded component
  - affected behavior
  doneWhen:
  - The causal upgrade change is identified.
  - Compatibility is restored and the retained upgrade is validated.
  deliveryStatus: authored-backlog
- id: maintenance.repository-cleanup
  slug: repository-cleanup
  title: Repository Cleanup and Hygiene
  category: code-quality
  summary: Remove dead files, stale scripts, generated artifacts and unused dependencies while preserving behavior and repository
    history.
  type: guided
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P0
  tags:
  - cleanup
  - dead-code
  - dependencies
  keyInputs:
  - cleanup depth
  - protected paths
  doneWhen:
  - Every removal has evidence of non-use.
  - Install, tests and build remain valid.
  deliveryStatus: publishable-package
- id: code-quality.large-module-decomposition
  slug: large-module-decomposition
  title: Decompose an Oversized Module
  category: code-quality
  summary: Split a large module along real responsibilities while preserving public behavior and avoiding speculative abstraction.
  type: run-pack
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P1
  tags:
  - refactor
  - modularity
  - architecture
  keyInputs:
  - target module
  - compatibility requirements
  doneWhen:
  - Responsibilities and boundaries are clearer.
  - Public behavior and tests remain compatible.
  deliveryStatus: authored-backlog
- id: code-quality.duplication-reduction
  slug: duplication-reduction
  title: Reduce Harmful Duplication
  category: code-quality
  summary: Identify duplicated logic with meaningful maintenance cost and consolidate it without creating an over-generalized
    abstraction.
  type: guided
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P1
  tags:
  - refactor
  - duplication
  - maintainability
  keyInputs:
  - target area
  - minimum duplication threshold
  doneWhen:
  - Selected duplication is removed with a coherent abstraction.
  - Unrelated similar code is not forcibly combined.
  deliveryStatus: authored-backlog
- id: code-quality.error-handling-hardening
  slug: error-handling-hardening
  title: Harden Error Handling
  category: code-quality
  summary: Improve error classification, propagation, user feedback and safe logging across a selected flow.
  type: guided
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P0
  tags:
  - errors
  - logging
  - reliability
  keyInputs:
  - target flow
  - error policy
  doneWhen:
  - Expected failure modes have explicit behavior.
  - Sensitive details are not leaked and tests cover errors.
  deliveryStatus: publishable-package
- id: code-quality.type-safety-improvement
  slug: type-safety-improvement
  title: Improve Type Safety
  category: code-quality
  summary: Replace unsafe casts, implicit any-like behavior and unchecked external data with validated, maintainable types.
  type: guided
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P1
  tags:
  - types
  - typescript
  - validation
  keyInputs:
  - target scope
  - compatibility policy
  doneWhen:
  - Unsafe boundaries are reduced with runtime validation where needed.
  - Typecheck and behavior tests pass.
  deliveryStatus: authored-backlog
- id: code-quality.configuration-centralization
  slug: configuration-centralization
  title: Centralize Configuration Safely
  category: code-quality
  summary: Consolidate duplicated and hardcoded configuration with typed validation, clear defaults and environment separation.
  type: guided
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P1
  tags:
  - configuration
  - environment
  - maintainability
  keyInputs:
  - configuration scope
  - deployment environments
  doneWhen:
  - Configuration has one documented source of truth.
  - Invalid production configuration fails clearly.
  deliveryStatus: authored-backlog
- id: code-quality.logging-improvement
  slug: logging-improvement
  title: Improve Operational Logging
  category: code-quality
  summary: Add structured, actionable and privacy-safe logs around critical operations without noisy duplication.
  type: guided
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P1
  tags:
  - logging
  - observability
  - privacy
  keyInputs:
  - critical operations
  - redaction rules
  doneWhen:
  - Important success/failure paths emit structured events.
  - Tests prove sensitive values are redacted.
  deliveryStatus: authored-backlog
- id: code-quality.performance-refactor
  slug: performance-refactor
  title: Targeted Performance Refactor
  category: code-quality
  summary: Implement a measured performance improvement for one confirmed bottleneck and prove the before/after result.
  type: run-pack
  defaultMode: execute
  riskTier: high
  defaultAutonomy: verify
  priority: P2
  tags:
  - performance
  - refactor
  - benchmark
  keyInputs:
  - baseline evidence
  - target metric
  doneWhen:
  - A reproducible baseline and improved measurement are recorded.
  - Correctness and relevant regression tests pass.
  deliveryStatus: authored-backlog
- id: testing.unit-test-foundation
  slug: unit-test-foundation
  title: Establish Unit Test Foundation
  category: testing
  summary: Introduce a maintainable unit-test baseline around core domain behavior without over-mocking implementation details.
  type: run-pack
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P0
  tags:
  - testing
  - unit-tests
  - foundation
  keyInputs:
  - critical modules
  - test framework preference
  doneWhen:
  - Critical behavior has deterministic tests.
  - Test command is documented and integrated into validation.
  deliveryStatus: publishable-package
- id: testing.integration-test-foundation
  slug: integration-test-foundation
  title: Establish Integration Test Foundation
  category: testing
  summary: Add real integration tests for persistence or service boundaries using isolated, reproducible dependencies.
  type: run-pack
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P1
  tags:
  - testing
  - integration
  - database
  keyInputs:
  - integration boundary
  - environment constraints
  doneWhen:
  - Tests run reproducibly on a fresh environment.
  - Isolation and cleanup are proven.
  deliveryStatus: authored-backlog
- id: testing.playwright-critical-flows
  slug: playwright-critical-flows
  title: Add Playwright Critical-Flow Tests
  category: testing
  summary: Cover selected end-to-end user journeys with resilient selectors, deterministic setup and useful failure artifacts.
  type: run-pack
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P0
  tags:
  - playwright
  - e2e
  - frontend
  keyInputs:
  - critical flows
  - browser targets
  doneWhen:
  - Critical flows pass from clean setup.
  - Failures capture actionable evidence and avoid brittle timing.
  deliveryStatus: publishable-package
- id: testing.regression-suite
  slug: regression-suite
  title: Build a Focused Regression Suite
  category: testing
  summary: Turn historically costly defects and critical behaviors into a prioritized regression suite.
  type: run-pack
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P1
  tags:
  - testing
  - regression
  - risk
  keyInputs:
  - known defects
  - critical behaviors
  doneWhen:
  - Each test maps to a real risk or prior defect.
  - Suite runtime and ownership remain manageable.
  deliveryStatus: authored-backlog
- id: testing.test-isolation
  slug: test-isolation
  title: Improve Test Isolation
  category: testing
  summary: Remove order dependence, shared state and environment leakage while preserving realistic integration behavior.
  type: guided
  defaultMode: recovery
  riskTier: moderate
  defaultAutonomy: verify
  priority: P1
  tags:
  - testing
  - isolation
  - reliability
  keyInputs:
  - failing suites
  - shared resources
  doneWhen:
  - Tests pass in random/repeated order where supported.
  - State cleanup and fixture ownership are explicit.
  deliveryStatus: authored-backlog
- id: testing.test-performance
  slug: test-performance
  title: Speed Up Test Execution
  category: testing
  summary: Measure test-suite bottlenecks and improve execution time without reducing meaningful coverage or hiding slow failures.
  type: guided
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P2
  tags:
  - testing
  - performance
  - ci
  keyInputs:
  - baseline runtime
  - target environment
  doneWhen:
  - Before/after runtime is measured.
  - Coverage and failure detection remain equivalent.
  deliveryStatus: authored-backlog
- id: testing.contract-tests
  slug: contract-tests
  title: Add API or Integration Contract Tests
  category: testing
  summary: Protect external and internal service contracts with schema, compatibility and error-behavior tests.
  type: run-pack
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P1
  tags:
  - testing
  - contracts
  - api
  keyInputs:
  - contract boundary
  - consumer expectations
  doneWhen:
  - Critical request/response and error contracts are executable.
  - Breaking changes are detected before release.
  deliveryStatus: authored-backlog
- id: testing.test-fixture-cleanup
  slug: test-fixture-cleanup
  title: Refactor Test Fixtures and Builders
  category: testing
  summary: Replace duplicated or opaque fixtures with clear builders and data ownership while preserving test intent.
  type: guided
  defaultMode: execute
  riskTier: low
  defaultAutonomy: verify
  priority: P2
  tags:
  - testing
  - fixtures
  - maintainability
  keyInputs:
  - fixture scope
  - problem examples
  doneWhen:
  - Fixtures are easier to understand and isolate.
  - Existing assertions and behavior remain valid.
  deliveryStatus: authored-backlog
- id: feature.from-spec
  slug: feature-from-spec
  title: Implement a Feature from a Functional Specification
  category: feature-implementation
  summary: Translate a bounded specification into architecture-aware code, tests, documentation and verified user behavior.
  type: run-pack
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: repair
  priority: P0
  tags:
  - feature
  - implementation
  - specification
  keyInputs:
  - functional requirements
  - non-goals
  doneWhen:
  - All acceptance criteria are implemented and evidenced.
  - Out-of-scope ideas are not silently added.
  deliveryStatus: publishable-package
- id: feature-implementation.crud-module
  slug: crud-module
  title: Implement a Production-Ready CRUD Module
  category: feature-implementation
  summary: Add a complete create/read/update/delete workflow with validation, authorization, persistence, errors and tests.
  type: run-pack
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: repair
  priority: P1
  tags:
  - crud
  - api
  - frontend
  keyInputs:
  - entity fields
  - authorization rules
  doneWhen:
  - CRUD behavior and invalid cases are tested.
  - Data integrity and user feedback are complete.
  deliveryStatus: authored-backlog
- id: feature-implementation.api-endpoint
  slug: api-endpoint
  title: Add a Compatible API Endpoint
  category: feature-implementation
  summary: Implement a new endpoint with validated input, authorization, stable errors, documentation and contract tests.
  type: guided
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P0
  tags:
  - api
  - endpoint
  - contracts
  keyInputs:
  - endpoint behavior
  - authorization
  doneWhen:
  - Endpoint contract is documented and tested.
  - Existing clients and routes remain compatible.
  deliveryStatus: publishable-package
- id: feature-implementation.background-job
  slug: background-job
  title: Add a Reliable Background Job
  category: feature-implementation
  summary: Implement idempotent queued work with progress, retries, leases, failure visibility and operational controls.
  type: run-pack
  defaultMode: execute
  riskTier: high
  defaultAutonomy: repair
  priority: P1
  tags:
  - jobs
  - worker
  - reliability
  keyInputs:
  - job purpose
  - retry policy
  doneWhen:
  - Job survives worker restart and avoids duplicate side effects.
  - Progress and safe errors are visible.
  deliveryStatus: authored-backlog
- id: feature-implementation.import-export
  slug: import-export
  title: Add Safe Import and Export
  category: feature-implementation
  summary: Implement schema-validated portable import/export with integrity checks, size limits and path safety.
  type: run-pack
  defaultMode: execute
  riskTier: high
  defaultAutonomy: repair
  priority: P1
  tags:
  - import
  - export
  - security
  keyInputs:
  - data format
  - compatibility policy
  doneWhen:
  - Round-trip succeeds without data loss.
  - Malformed and malicious inputs are rejected safely.
  deliveryStatus: authored-backlog
- id: feature-implementation.search-filter
  slug: search-filter
  title: Add Search and Faceted Filtering
  category: feature-implementation
  summary: Implement useful query, filter, sorting, URL state and no-results behavior over an existing dataset.
  type: guided
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P0
  tags:
  - search
  - filters
  - ux
  keyInputs:
  - search fields
  - filter dimensions
  doneWhen:
  - Results and combinations are correct and performant.
  - URL and refresh preserve state.
  deliveryStatus: publishable-package
- id: feature-implementation.role-permissions
  slug: role-permissions
  title: Implement Roles and Permissions
  category: feature-implementation
  summary: Add explicit authorization rules, server-side enforcement, admin UX and cross-tenant tests.
  type: run-pack
  defaultMode: execute
  riskTier: high
  defaultAutonomy: repair
  priority: P2
  tags:
  - authorization
  - roles
  - security
  keyInputs:
  - roles
  - resource permissions
  doneWhen:
  - Every protected operation is enforced server-side.
  - Cross-user/workspace access tests pass.
  deliveryStatus: authored-backlog
- id: feature-implementation.connector-integration
  slug: connector-integration
  title: Implement an External Service Connector
  category: feature-implementation
  summary: Add a capability-detected, secret-safe connector with health, degraded states and bounded data synchronization.
  type: run-pack
  defaultMode: execute
  riskTier: high
  defaultAutonomy: repair
  priority: P1
  tags:
  - integration
  - connector
  - security
  keyInputs:
  - service API
  - required capabilities
  doneWhen:
  - Credentials are protected and least privilege is documented.
  - Unavailable capabilities degrade safely.
  deliveryStatus: authored-backlog
- id: forge.gitea-best-practices
  slug: gitea-best-practices
  title: Gitea Repository Best-Practices Audit
  category: git-gitea
  summary: Review repository metadata, branch/tag protection, templates, Actions, release flow and permissions using available
    evidence.
  type: guided
  defaultMode: inspect
  riskTier: moderate
  defaultAutonomy: diagnose
  priority: P0
  tags:
  - gitea
  - git
  - governance
  keyInputs:
  - repository
  - governance depth
  doneWhen:
  - Findings identify evidence and permission limitations.
  - Recommended settings are prioritized without changing Gitea.
  deliveryStatus: publishable-package
- id: git-gitea.branch-protection-plan
  slug: branch-protection-plan
  title: Design Branch Protection Rules
  category: git-gitea
  summary: Produce a repository-appropriate branch protection plan covering pushes, merges, reviews, status checks and exceptions.
  type: guided
  defaultMode: plan
  riskTier: moderate
  defaultAutonomy: plan
  priority: P0
  tags:
  - gitea
  - branch-protection
  - governance
  keyInputs:
  - branch strategy
  - team model
  doneWhen:
  - Rules balance safety and realistic workflow.
  - Exceptions and rollout risks are documented.
  deliveryStatus: publishable-package
- id: git-gitea.issue-template-system
  slug: issue-template-system
  title: Create Issue Template System
  category: git-gitea
  summary: Design and implement useful bug, feature and operational issue templates with labels and triage guidance.
  type: guided
  defaultMode: execute
  riskTier: low
  defaultAutonomy: verify
  priority: P1
  tags:
  - gitea
  - issues
  - templates
  keyInputs:
  - issue types
  - triage process
  doneWhen:
  - Templates collect actionable information without excessive burden.
  - Repository documentation links to the process.
  deliveryStatus: authored-backlog
- id: git-gitea.pull-request-template
  slug: pull-request-template
  title: Create Pull Request Template and Review Checklist
  category: git-gitea
  summary: Add a concise pull-request template aligned with repository validation, risk and documentation needs.
  type: quick
  defaultMode: execute
  riskTier: low
  defaultAutonomy: verify
  priority: P0
  tags:
  - git
  - pull-request
  - review
  keyInputs:
  - required checks
  - risk areas
  doneWhen:
  - Template is concise and repository-specific.
  - It references real validation commands or roles.
  deliveryStatus: publishable-package
- id: git-gitea.release-process
  slug: release-process
  title: Design Gitea Release Process
  category: git-gitea
  summary: Create a repeatable versioning, tagging, changelog, artifact and rollback workflow suitable for the repository.
  type: run-pack
  defaultMode: plan
  riskTier: moderate
  defaultAutonomy: plan
  priority: P1
  tags:
  - gitea
  - release
  - versioning
  keyInputs:
  - release cadence
  - artifact types
  doneWhen:
  - Release stages and ownership are explicit.
  - Tag protection and rollback are addressed.
  deliveryStatus: authored-backlog
- id: git-gitea.actions-workflow-audit
  slug: actions-workflow-audit
  title: Gitea Actions Workflow Audit
  category: git-gitea
  summary: Review workflows, triggers, permissions, secrets, caching and release behavior for correctness and security.
  type: guided
  defaultMode: inspect
  riskTier: high
  defaultAutonomy: diagnose
  priority: P1
  tags:
  - gitea-actions
  - ci
  - security
  keyInputs:
  - workflow scope
  - runner model
  doneWhen:
  - Findings reference workflow lines and runtime impact.
  - Secret and permission risks are prioritized.
  deliveryStatus: authored-backlog
- id: git-gitea.gitignore-hygiene
  slug: gitignore-hygiene
  title: Audit and Repair .gitignore Hygiene
  category: git-gitea
  summary: Identify tracked runtime/generated files and improve ignore rules without hiding required source or configuration
    examples.
  type: guided
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P0
  tags:
  - gitignore
  - cleanup
  - repository
  keyInputs:
  - runtime paths
  - required examples
  doneWhen:
  - Ignore rules match actual generated/runtime behavior.
  - Required source and example configuration remain tracked.
  deliveryStatus: publishable-package
- id: git-gitea.repository-metadata
  slug: repository-metadata
  title: Improve Repository Metadata and Discoverability
  category: git-gitea
  summary: Align description, topics, README, license, contribution and release metadata for clear internal or public use.
  type: guided
  defaultMode: execute
  riskTier: low
  defaultAutonomy: verify
  priority: P2
  tags:
  - gitea
  - metadata
  - documentation
  keyInputs:
  - audience
  - visibility
  doneWhen:
  - Metadata is consistent and accurate.
  - No private information is exposed.
  deliveryStatus: authored-backlog
- id: release-operations.release-candidate-prep
  slug: release-candidate-prep
  title: Prepare a Release Candidate
  category: release-operations
  summary: Execute a bounded release-readiness pass covering versions, migrations, tests, artifacts, documentation and known
    limitations.
  type: run-pack
  defaultMode: execute
  riskTier: high
  defaultAutonomy: repair
  priority: P0
  tags:
  - release
  - quality
  - validation
  keyInputs:
  - target version
  - release scope
  doneWhen:
  - All release gates have evidence.
  - Known limitations and rollback notes are published.
  deliveryStatus: publishable-package
- id: release-operations.clean-room-validation
  slug: clean-room-validation
  title: Clean-Room Installation Validation
  category: release-operations
  summary: Prove that a fresh clone or deployment can be installed, configured and exercised using only documented steps.
  type: run-pack
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P0
  tags:
  - installation
  - reproducibility
  - deployment
  keyInputs:
  - target platform
  - smoke flow
  doneWhen:
  - Fresh setup succeeds from documented inputs.
  - Missing implicit dependencies are corrected or reported.
  deliveryStatus: publishable-package
- id: release-operations.migration-readiness
  slug: migration-readiness
  title: Database Migration Readiness
  category: release-operations
  summary: Review and validate pending migrations, compatibility, backup, rollback and deployment sequencing.
  type: run-pack
  defaultMode: plan
  riskTier: critical
  defaultAutonomy: plan
  priority: P1
  tags:
  - database
  - migration
  - release
  keyInputs:
  - migration set
  - deployment constraints
  doneWhen:
  - Data risks and rollback limits are explicit.
  - A safe rollout and validation plan is produced.
  deliveryStatus: authored-backlog
- id: release-operations.backup-restore-validation
  slug: backup-restore-validation
  title: Backup and Restore Validation
  category: release-operations
  summary: Test that application data, artifacts, configuration and encryption-key dependencies can be backed up and restored.
  type: run-pack
  defaultMode: execute
  riskTier: high
  defaultAutonomy: verify
  priority: P0
  tags:
  - backup
  - restore
  - recovery
  keyInputs:
  - deployment target
  - recovery objectives
  doneWhen:
  - Restore is performed in an isolated target and verified.
  - Unrecoverable secret/key dependencies are documented.
  deliveryStatus: publishable-package
- id: release-operations.docker-image-hardening
  slug: docker-image-hardening
  title: Harden and Optimize Docker Images
  category: release-operations
  summary: Reduce image risk and size while preserving runtime behavior, non-root operation and health checks.
  type: guided
  defaultMode: execute
  riskTier: high
  defaultAutonomy: verify
  priority: P1
  tags:
  - docker
  - security
  - performance
  keyInputs:
  - image targets
  - runtime requirements
  doneWhen:
  - Image builds reproducibly and runs as intended.
  - Security and size changes are measured.
  deliveryStatus: authored-backlog
- id: release-operations.health-readiness
  slug: health-readiness
  title: Implement Health and Readiness Checks
  category: release-operations
  summary: Add accurate liveness, readiness and dependency health without hiding partial outages.
  type: guided
  defaultMode: execute
  riskTier: moderate
  defaultAutonomy: verify
  priority: P0
  tags:
  - healthcheck
  - operations
  - reliability
  keyInputs:
  - required dependencies
  - degraded components
  doneWhen:
  - Orchestrator behavior matches documented semantics.
  - Optional integration outages do not misreport total failure.
  deliveryStatus: publishable-package
- id: release-operations.rollback-plan
  slug: rollback-plan
  title: Create Release Rollback Plan
  category: release-operations
  summary: Document and validate rollback boundaries for application, configuration, database and artifacts.
  type: guided
  defaultMode: plan
  riskTier: high
  defaultAutonomy: plan
  priority: P1
  tags:
  - rollback
  - release
  - operations
  keyInputs:
  - release type
  - migration impact
  doneWhen:
  - Rollback steps and irreversible limits are explicit.
  - Decision triggers and verification are defined.
  deliveryStatus: authored-backlog
- id: release-operations.release-notes
  slug: release-notes
  title: Generate Evidence-Based Release Notes
  category: release-operations
  summary: Create concise release notes from verified changes, migrations, fixes, known limitations and operator actions.
  type: quick
  defaultMode: guided
  riskTier: low
  defaultAutonomy: plan
  priority: P0
  tags:
  - release-notes
  - documentation
  - changelog
  keyInputs:
  - release range
  - audience
  doneWhen:
  - Notes match actual changes and validation evidence.
  - Operator actions and breaking changes are prominent.
  deliveryStatus: publishable-package
- id: security-reliability.security-hygiene-audit
  slug: security-hygiene-audit
  title: Security Hygiene Audit
  category: security-reliability
  summary: Review authentication, authorization, secrets, input validation, dependency risk and unsafe defaults within a defined
    application scope.
  type: run-pack
  defaultMode: inspect
  riskTier: high
  defaultAutonomy: diagnose
  priority: P0
  tags:
  - security
  - audit
  - threat-model
  keyInputs:
  - scope
  - deployment context
  doneWhen:
  - Findings include evidence, exploitability context and remediation priority.
  - The report states that it is not a formal penetration test.
  deliveryStatus: publishable-package
- id: security-reliability.secrets-exposure-audit
  slug: secrets-exposure-audit
  title: Secrets Exposure Audit
  category: security-reliability
  summary: Inspect repository and runtime configuration patterns for committed, logged or exported secrets without echoing
    sensitive values.
  type: guided
  defaultMode: inspect
  riskTier: critical
  defaultAutonomy: diagnose
  priority: P0
  tags:
  - secrets
  - security
  - logging
  keyInputs:
  - scope
  - redaction policy
  doneWhen:
  - Potential exposures are safely fingerprinted, not reproduced.
  - Rotation and containment actions are prioritized.
  deliveryStatus: publishable-package
- id: security-reliability.authorization-review
  slug: authorization-review
  title: Authorization Boundary Review
  category: security-reliability
  summary: Trace protected resources and operations to verify server-side enforcement and cross-user or cross-workspace isolation.
  type: run-pack
  defaultMode: inspect
  riskTier: high
  defaultAutonomy: diagnose
  priority: P1
  tags:
  - authorization
  - security
  - multi-tenant
  keyInputs:
  - resource types
  - roles
  doneWhen:
  - Authorization matrix and enforcement gaps are evidenced.
  - Cross-boundary tests are proposed or implemented by selected mode.
  deliveryStatus: authored-backlog
- id: security-reliability.threat-model
  slug: threat-model
  title: Create Application Threat Model
  category: security-reliability
  summary: Identify assets, trust boundaries, abuse cases and prioritized controls tied to the actual architecture.
  type: run-pack
  defaultMode: plan
  riskTier: moderate
  defaultAutonomy: plan
  priority: P1
  tags:
  - security
  - threat-model
  - architecture
  keyInputs:
  - system scope
  - deployment assumptions
  doneWhen:
  - Threats map to real components and data flows.
  - Controls, owners and residual risk are recorded.
  deliveryStatus: authored-backlog
- id: security-reliability.resilience-failure-review
  slug: resilience-failure-review
  title: Failure and Resilience Review
  category: security-reliability
  summary: Assess dependency outages, retry behavior, idempotency, data loss, degraded states and recovery visibility.
  type: run-pack
  defaultMode: inspect
  riskTier: high
  defaultAutonomy: diagnose
  priority: P1
  tags:
  - reliability
  - resilience
  - failure
  keyInputs:
  - critical operations
  - dependency map
  doneWhen:
  - Failure modes and blast radius are mapped.
  - Recommendations include detection and recovery evidence.
  deliveryStatus: authored-backlog
- id: security-reliability.privacy-data-review
  slug: privacy-data-review
  title: Privacy and Data Handling Review
  category: security-reliability
  summary: Map personal or sensitive data, retention, exports, logging and deletion behavior to identify unnecessary collection
    and leakage risks.
  type: run-pack
  defaultMode: inspect
  riskTier: high
  defaultAutonomy: diagnose
  priority: P2
  tags:
  - privacy
  - data
  - retention
  keyInputs:
  - data categories
  - deployment model
  doneWhen:
  - Data flows and retention points are evidenced.
  - Minimization and deletion recommendations are actionable.
  deliveryStatus: authored-backlog