git:20260813.3f72731 to git:20260823.5cb9a4c
2 added, 1 removed. Audit A to A.
# TaskFlow
A small team task tracker: create tasks, assign them, track status. Single Node.js/Express API + React frontend, single Postgres database.
## Critical rules (read first)
- Task status transitions are `todo -> in_progress -> done` only — never allow a direct `todo -> done` write; see docs/product.md.
- Never log or persist raw user passwords or session tokens, even at debug level.
## Pending decisions — do not resolve these yourself
- **Email provider for assignment notifications**: undecided as of 2026-08-12. Keep using the
`logNotification()` stub in `/server/notifications`, which writes to the console instead of sending
mail; do NOT integrate a real provider (SES, SendGrid, Postmark, etc.) or add provider-specific env
vars. Ask before wiring up outbound email. → `docs/decisions.md`
## Commands
- Install: `npm install`
- Dev/run: `npm run dev`
- Test: `npm test`
- Lint/format: `npm run lint`
## Code style
- Functional React components only, no class components.
- API responses use camelCase keys; database columns stay snake_case — mapping happens at the query layer, not ad hoc per route.
## Architecture
Express API talks to Postgres directly via a query layer in `/server/db`. React frontend calls the API over REST, no GraphQL. No separate service layer — this project is intentionally small.
## Testing requirements
- New API routes need at least one integration test hitting a real (test) database connection, not a mock.
## Security / boundaries
- `/server/db/migrations` should never be edited after being merged — write a new migration instead.
## Related docs
- `docs/decisions.md` — why non-obvious choices were made
- - `docs/roadmap.md` — what's in scope now vs. deferred
+ - `docs/development-roadmap.md` — the module/sub-module breakdown, dependency order, and what's deliberately deferred
+ - `docs/guides/feature_assignment_plan.md` — the phase plan for Module 3, currently in flight
- `docs/product.md` — current business/feature rules
## Maintaining these docs
- New rules, commands, and conventions → this file.
- New decisions → `docs/decisions.md` (append-only). Current business rules → `docs/product.md`.
- Recurring step-by-step procedures → a skill, not this file.
- All rules live in THIS file. `CLAUDE.md` is a loader only — never add content to it.
- Nested subsystems: edit `<subsystem>/AGENTS.md`, never `<subsystem>/CLAUDE.md`.