commit

.gitignore

@@ -31,6 +31,7 @@ next-env.d.ts
 .env
 .env.local
 .env.*.local
+.secrets
 
 # Editor
 .vscode/*

.secrets.example

@@ -0,0 +1 @@
+GITHUB_TOKEN=ghp_your_token_here

TODO/1-TODO.md

@@ -1,6 +1,16 @@
 # TODO 1 - Workflows and SDLC automation
 
-- [ ] Review `.github/prompts/` guidance and update or add prompts to match current workflows.
-- [ ] Run `npm run act:diagnose` and `npm run act` to validate local GitHub Actions testing as documented.
-- [ ] Verify Copilot workflows (`planning.yml`, `development.yml`, `deployment.yml`, etc.) align with `.github/COPILOT_SDLC_SUMMARY.md`; update workflows or docs when mismatched.
-- [ ] Confirm PR/issue auto-labeling and auto-merge rules behave as documented; adjust configuration if gaps appear.
+> **See also**: [21-SDLC-TODO.md](21-SDLC-TODO.md) for comprehensive SDLC coverage
+
+## Quick Wins
+
+- [ ] Run `npm run act:diagnose` and `npm run act` to validate local GitHub Actions testing
+- [ ] Confirm PR/issue auto-labeling and auto-merge rules behave as documented
+- [ ] Review `.github/prompts/` guidance and update for current workflows
+- [ ] Verify Copilot workflows align with `.github/COPILOT_SDLC_SUMMARY.md`
+
+## Related Files
+
+- `.github/workflows/` - All workflow definitions
+- `.github/prompts/` - Copilot prompt templates
+- `.github/COPILOT_SDLC_SUMMARY.md` - SDLC integration docs

TODO/17-GITHUB-COPILOT-TODO.md

@@ -1,5 +1,7 @@
 # TODO 17 - GitHub Copilot & AI Integration
 
+> **See also**: [21-SDLC-TODO.md](21-SDLC-TODO.md) for SDLC workflow integration with Copilot
+
 ## Copilot Instructions
 
 - [ ] Review and update `.github/copilot-instructions.md`
@@ -8,7 +10,7 @@
 - [ ] Document Copilot-friendly code conventions
 - [ ] Add Copilot-aware inline comments
 
-## Prompts
+## Prompts (see 21-SDLC-TODO.md for full list)
 
 - [ ] Review all prompts in `.github/prompts/`
 - [ ] Add new prompts for common development tasks

TODO/2-TODO.md

@@ -1,8 +1,60 @@
 # TODO 2 - Architecture and refactoring
 
-- [ ] Audit the codebase for components over 150 LOC and split into smaller, declarative, generic renderers.
-- [ ] Identify hardcoded configuration in TypeScript/TSX and move it to JSON/Lua and database-driven configuration.
-- [ ] Review schema and data access paths to ensure `tenantId` is present and filters are consistently applied.
-- [ ] Verify packages follow the standard structure (`seed/metadata.json`, `components.json`, `scripts/`, `index.ts`, `static_content/`) and add missing files.
-- [ ] Use Prisma for standard CRUD and DBAL for server-only complex operations; confirm DBAL usage matches docs.
-- [ ] Follow the refactoring phases (analysis, planning, implementation, testing, documentation) for any large changes.
+> **See also**: [13-DECLARATIVE-UI-TODO.md](13-DECLARATIVE-UI-TODO.md), [14-MULTI-TENANT-TODO.md](14-MULTI-TENANT-TODO.md), [6-PACKAGES-TODO.md](6-PACKAGES-TODO.md)
+
+## Atomic Design Refactoring
+
+> Reference: `docs/reference/DOCUMENTATION_FINDINGS.md`, `docs/implementation/component-atomicity-refactor.md`
+
+### Atoms (`src/components/atoms/`)
+- [ ] Audit existing atoms (~12 components) for proper isolation
+- [ ] Ensure atoms have no dependencies on molecules/organisms
+- [ ] Add missing base UI atoms (buttons, inputs, labels, icons)
+- [ ] Document atom prop interfaces with JSDoc
+
+### Molecules (`src/components/molecules/`)
+- [ ] Audit molecules (~10 components) - should be 2-5 atoms combined
+- [ ] Identify organisms incorrectly categorized as molecules
+- [ ] Ensure molecules only import from atoms, not organisms
+- [ ] Create missing common molecules (form fields, search bars, nav items)
+
+### Organisms (`src/components/organisms/`)
+- [ ] Audit organisms for proper composition of molecules/atoms
+- [ ] Split oversized organisms (>150 LOC) into smaller organisms
+- [ ] Document organism data flow and state management
+- [ ] Ensure organisms handle layout, molecules handle interaction
+
+### Templates & Pages
+- [ ] Create page templates using organism composition
+- [ ] Ensure pages only compose templates/organisms, minimal logic
+- [ ] Add route-level code splitting for pages
+
+## Component Refactoring
+
+- [ ] Audit codebase for components over 150 LOC
+- [ ] Split large components into smaller, declarative, generic renderers
+- [ ] Convert hardcoded JSX to `RenderComponent` pattern
+
+## Configuration Migration
+
+- [ ] Identify hardcoded configuration in TypeScript/TSX
+- [ ] Move configuration to JSON/Lua and database-driven storage
+
+## Multi-Tenant Safety
+
+- [ ] Review schema and data access paths for `tenantId` presence
+- [ ] Ensure tenant filters are consistently applied to all queries
+
+## Package Structure
+
+- [ ] Verify packages follow standard structure (`seed/metadata.json`, `components.json`, `scripts/`, `index.ts`, `static_content/`)
+- [ ] Add missing files to non-compliant packages
+
+## Data Layer
+
+- [ ] Use Prisma for standard CRUD, DBAL for server-only complex operations
+- [ ] Confirm DBAL usage matches documentation
+
+## Refactoring Process
+
+- [ ] Follow phases: analysis → planning → implementation → testing → documentation

TODO/21-SDLC-TODO.md

@@ -0,0 +1,213 @@
+# TODO 21 - SDLC (Software Development Lifecycle)
+
+## Phase 1: Planning & Design
+
+### Workflow: `planning.yml`
+- [ ] Test `planning.yml` workflow with real feature requests
+- [ ] Validate architecture review suggestions are actionable
+- [ ] Ensure PRD alignment checks reference correct docs
+- [ ] Add planning templates for different feature types
+- [ ] Create checklist automation for complex features
+
+### Design Tooling
+- [ ] Add visual architecture diagram generation
+- [ ] Create component dependency visualization
+- [ ] Implement impact analysis for proposed changes
+- [ ] Add package structure recommendation engine
+- [ ] Create permission level planning tool
+
+---
+
+## Phase 2: Development
+
+### Workflow: `development.yml`
+- [ ] Verify code metrics calculation is accurate
+- [ ] Test component size monitoring thresholds
+- [ ] Validate declarative ratio tracking
+- [ ] Ensure refactoring suggestions are relevant
+- [ ] Test @copilot mention responses in PRs
+
+### Developer Experience
+- [ ] Add real-time linting feedback in IDE
+- [ ] Create code snippet library for common patterns
+- [ ] Implement auto-imports for project conventions
+- [ ] Add declarative-first code suggestions
+- [ ] Create hardcoded-to-config migration tool
+
+### Metrics Goals
+- [ ] Achieve declarative ratio >50% (JSON + Lua / TS)
+- [ ] Maintain component size <150 LOC
+- [ ] Move 100% configuration to database
+- [ ] Track and reduce TypeScript LOC over time
+
+---
+
+## Phase 3: Testing & Code Review
+
+### Workflow: `code-review.yml`
+- [ ] Validate security scanning detects all risk patterns
+- [ ] Test auto-approval logic for clean PRs
+- [ ] Ensure label management is consistent
+- [ ] Add custom rule configuration for project
+- [ ] Implement incremental review for large PRs
+
+### Workflow: `ci.yml`
+- [ ] Fix current build failures
+- [ ] Add parallel test execution
+- [ ] Implement test result caching
+- [ ] Add visual regression testing
+- [ ] Create accessibility checks in CI
+
+### Review Automation
+- [ ] Add AI-powered code suggestions
+- [ ] Implement pattern-based review rules
+- [ ] Create architecture compliance checker
+- [ ] Add multi-tenant safety validator
+- [ ] Implement Lua script linting
+
+---
+
+## Phase 4: Integration & Merge
+
+### Workflow: `pr-management.yml`
+- [ ] Test auto-labeling accuracy
+- [ ] Validate size classification thresholds
+- [ ] Ensure description quality checks are helpful
+- [ ] Add branch naming convention validation
+- [ ] Create PR template enforcement
+
+### Workflow: `merge-conflict-check.yml`
+- [ ] Test conflict detection accuracy
+- [ ] Add conflict resolution suggestions
+- [ ] Implement auto-rebase for simple conflicts
+- [ ] Create conflict notification system
+
+### Workflow: `auto-merge.yml`
+- [ ] Validate auto-merge conditions are correct
+- [ ] Add merge queue support
+- [ ] Implement merge window configuration
+- [ ] Create merge analytics tracking
+- [ ] Add rollback automation on failure
+
+---
+
+## Phase 5: Deployment
+
+### Workflow: `deployment.yml`
+- [ ] Complete pre-deployment validation checks
+- [ ] Test breaking change detection
+- [ ] Validate deployment notes generation
+- [ ] Add environment-specific deployment paths
+- [ ] Implement blue-green deployment support
+
+### Deployment Safety
+- [ ] Add database migration validation
+- [ ] Implement feature flag integration
+- [ ] Create canary deployment support
+- [ ] Add automated rollback triggers
+- [ ] Implement deployment approval gates
+
+### Monitoring Integration
+- [ ] Create deployment health check automation
+- [ ] Add performance regression detection
+- [ ] Implement error rate monitoring post-deploy
+- [ ] Create deployment success metrics
+- [ ] Add 48-hour monitoring issue automation
+
+---
+
+## Phase 6: Maintenance & Operations
+
+### Workflow: `issue-triage.yml`
+- [ ] Validate automatic categorization accuracy
+- [ ] Test AI-fixable issue detection
+- [ ] Ensure priority assignment is correct
+- [ ] Add custom triage rules for project
+- [ ] Implement stale issue handling
+
+### Workflow: `quality-metrics.yml`
+- [ ] Verify all metrics are calculated correctly
+- [ ] Add trend tracking over time
+- [ ] Create quality dashboard integration
+- [ ] Implement quality gate enforcement
+- [ ] Add quality regression alerts
+
+### Workflow: `detect-stubs.yml`
+- [ ] Validate stub detection patterns
+- [ ] Test PR comment generation
+- [ ] Add completeness scoring tracking
+- [ ] Implement stub-to-issue conversion
+- [ ] Create stub reduction metrics
+
+### Dependabot & Dependencies
+- [ ] Configure daily npm update schedule
+- [ ] Set up weekly devcontainer updates
+- [ ] Add security vulnerability auto-issues
+- [ ] Implement dependency review automation
+- [ ] Create license compliance checking
+
+---
+
+## Prompts & Copilot Integration
+
+### `.github/prompts/` Review
+- [ ] Audit [0-kickstart.md](../.github/prompts/0-kickstart.md) for current accuracy
+- [ ] Update [1-plan-feature.prompt.md](../.github/prompts/1-plan-feature.prompt.md)
+- [ ] Review [2-design-component.prompt.md](../.github/prompts/2-design-component.prompt.md)
+- [ ] Update all `3-impl-*.prompt.md` implementation prompts
+- [ ] Review [4-test-*.prompt.md](../.github/prompts/4-test-run.prompt.md) testing prompts
+- [ ] Update [5-review-code.prompt.md](../.github/prompts/5-review-code.prompt.md)
+- [ ] Review [6-deploy-*.prompt.md](../.github/prompts/6-deploy-ci-local.prompt.md) deployment prompts
+- [ ] Update [7-maintain-*.prompt.md](../.github/prompts/7-maintain-debug.prompt.md) maintenance prompts
+- [ ] Review [8-docs-feature.prompt.md](../.github/prompts/8-docs-feature.prompt.md)
+- [ ] Update [EEK-STUCK.md](../.github/prompts/EEK-STUCK.md) troubleshooting guide
+
+### Copilot Instructions
+- [ ] Review `.github/copilot-instructions.md` for accuracy
+- [ ] Add new patterns and examples
+- [ ] Update architecture documentation links
+- [ ] Add common mistake examples
+- [ ] Create context-specific instruction sections
+
+---
+
+## Future Enhancements (from COPILOT_SDLC_SUMMARY.md)
+
+### Planned Additions
+- [ ] Copilot Workspace integration with workflow context
+- [ ] AI-generated E2E tests from issue descriptions
+- [ ] Performance monitoring (bundle size, render performance)
+- [ ] Accessibility checks in PRs
+- [ ] Visual regression testing with screenshot comparison
+- [ ] Lua linting for project patterns
+- [ ] Package structure validation
+- [ ] Multi-tenant isolation testing automation
+
+### Metrics Dashboard
+- [ ] Declarative ratio trend visualization
+- [ ] Average component size tracking
+- [ ] PR merge time analytics
+- [ ] Auto-fix success rate tracking
+- [ ] Security vulnerability resolution time
+- [ ] Test coverage trend graphs
+- [ ] Deployment frequency metrics
+
+---
+
+## Local Development Validation
+
+- [ ] Run `npm run act:diagnose` to verify local Actions setup
+- [ ] Run `npm run act` to test workflows locally
+- [ ] Validate all workflow files syntax
+- [ ] Test workflow triggers manually
+- [ ] Document workflow testing procedures
+
+---
+
+## Documentation Alignment
+
+- [ ] Ensure COPILOT_SDLC_SUMMARY.md reflects actual workflow behavior
+- [ ] Update workflows README with current status
+- [ ] Create workflow troubleshooting guide
+- [ ] Add workflow customization documentation
+- [ ] Document CI/CD pipeline architecture

TODO/3-TODO.md

@@ -1,8 +1,34 @@
 # TODO 3 - Testing, quality metrics, and documentation
 
-- [ ] Expand unit and integration tests using `it.each` parameterized patterns; target >80% coverage per testing docs.
-- [ ] Add/expand JSDoc for new or updated APIs and run `npm run check-jsdoc-coverage`.
-- [ ] Update feature docs in `docs/architecture/` (why, data-flow diagrams, permission requirements) and update `docs/INDEX.md` or `docs/NAVIGATION.md`.
-- [ ] Ensure package docs exist (`tests/README.md`, `static_content/examples.json`, `seed/metadata.json`) when adding or changing packages.
-- [ ] Ensure the quality-metrics workflow and its scripts produce the documented reports and enforce thresholds (including size/complexity limits).
-- [ ] Evaluate future enhancements from the Copilot SDLC summary: a11y checks, visual regression tests, Lua linting, package validation, and metrics dashboard.
+> **See also**: [8-TESTING-TODO.md](8-TESTING-TODO.md), [12-DOCUMENTATION-TODO.md](12-DOCUMENTATION-TODO.md), [18-ACCESSIBILITY-TODO.md](18-ACCESSIBILITY-TODO.md)
+
+## Testing Expansion
+
+- [ ] Expand unit/integration tests using `it.each` parameterized patterns
+- [ ] Target >80% coverage per testing docs
+
+## Documentation
+
+- [ ] Add/expand JSDoc for new or updated APIs
+- [ ] Run `npm run check-jsdoc-coverage` to verify
+- [ ] Update feature docs in `docs/architecture/` (why, data-flow, permissions)
+- [ ] Update `docs/INDEX.md` or `docs/NAVIGATION.md` for new content
+
+## Package Documentation
+
+- [ ] Ensure `tests/README.md` exists for each package
+- [ ] Add `static_content/examples.json` where applicable
+- [ ] Verify `seed/metadata.json` is complete
+
+## Quality Metrics
+
+- [ ] Ensure quality-metrics workflow produces documented reports
+- [ ] Enforce size/complexity limits
+
+## Future Enhancements
+
+- [ ] Accessibility (a11y) checks in CI
+- [ ] Visual regression testing
+- [ ] Lua script linting
+- [ ] Package validation
+- [ ] Metrics dashboard

TODO/README.md

@@ -26,6 +26,7 @@ This folder contains comprehensive TODO lists organized by area of the MetaBuild
 | [18-ACCESSIBILITY-TODO.md](18-ACCESSIBILITY-TODO.md) | Accessibility (a11y) | Medium |
 | [19-PERFORMANCE-TODO.md](19-PERFORMANCE-TODO.md) | Performance optimization | Medium |
 | [20-FUTURE-FEATURES-TODO.md](20-FUTURE-FEATURES-TODO.md) | Future features | Low |
+| [21-SDLC-TODO.md](21-SDLC-TODO.md) | SDLC workflows & Copilot | High |
 
 ## Priority Legend