git:20260812.8481e82 to git:20260813.77236e2
13 added, 0 removed. Audit A to A.
# TaskFlow
A small team task tracker: create tasks, assign them, track status. Single Node.js/Express API + React frontend, single Postgres database.
## Critical rules (read first)
- Task status transitions are `todo -> in_progress -> done` only — never allow a direct `todo -> done` write; see docs/product.md.
- Never log or persist raw user passwords or session tokens, even at debug level.
+ ## Pending decisions — do not resolve these yourself
+ - **Email provider for assignment notifications**: undecided as of 2026-08-12. Keep using the
+ `logNotification()` stub in `/server/notifications`, which writes to the console instead of sending
+ mail; do NOT integrate a real provider (SES, SendGrid, Postmark, etc.) or add provider-specific env
+ vars. Ask before wiring up outbound email. → `docs/decisions.md#pending-email-provider`
+
## Commands
- Install: `npm install`
- Dev/run: `npm run dev`
- Test: `npm test`
- Lint/format: `npm run lint`
## Code style
- Functional React components only, no class components.
- API responses use camelCase keys; database columns stay snake_case — mapping happens at the query layer, not ad hoc per route.
## Architecture
Express API talks to Postgres directly via a query layer in `/server/db`. React frontend calls the API over REST, no GraphQL. No separate service layer — this project is intentionally small.
## Testing requirements
- New API routes need at least one integration test hitting a real (test) database connection, not a mock.
## Security / boundaries
- `/server/db/migrations` should never be edited after being merged — write a new migration instead.
## Related docs
- `docs/decisions.md` — why non-obvious choices were made
- `docs/roadmap.md` — what's in scope now vs. deferred
- `docs/product.md` — current business/feature rules
+
+ ## Maintaining these docs
+ - New rules, commands, and conventions → this file.
+ - New decisions → `docs/decisions.md` (append-only). Current business rules → `docs/product.md`.
+ - Recurring step-by-step procedures → a skill, not this file.
+ - All rules live in THIS file. `CLAUDE.md` is a loader only — never add content to it.
+ - Nested subsystems: edit `<subsystem>/AGENTS.md`, never `<subsystem>/CLAUDE.md`.