<!-- Pull request template — AI Software Factory

Title format (conventional commit): <type>(<scope>): <imperative summary> e.g. feat(editor): add draggable blocks fix(auth): rotate refresh tokens on reuse detection test(database): add filter tree integration tests Types: feat | fix | refactor | perf | docs | test | infra | build | ci | chore Scopes: auth | workspace | pages | editor | database | relations | collab | search | files | forms | automation | ai | api | enterprise | infra | ci | docs | <package-name> -->

Task link

• Task file: docs/tasks/phase-XX-<name>.md
• TASK id: TASK-XXXX
• Related issues: #

Description

What this PR changes and why. 2-6 sentences. Reference the task's Requirements / Acceptance Criteria it satisfies.

Type of change

• [ ] feat — new feature (phase task)
• [ ] fix — bug fix against spec
• [ ] refactor — no behavior change
• [ ] docs — documentation only
• [ ] test — tests only
• [ ] infra — CI/CD, docker, k8s, terraform, nginx

Checklist

Definition of Done (from AGENTS.md — check every box that applies; leave unchecked with a note when genuinely N/A):

• [ ] Backend implemented (or N/A)
• [ ] Frontend implemented (or N/A)
• [ ] Database migration added (schema changed → prisma migrate dev run; migration file committed)
• [ ] API validation (zod/DTO on all inputs)
• [ ] Authorization — server-side permission check added/updated; audit event written where the operation is security-sensitive
• [ ] Error handling (typed errors, no stack traces to clients)
• [ ] Loading state
• [ ] Empty state
• [ ] Mobile behavior (responsive, ≥375px)
• [ ] Accessibility (keyboard path, ARIA, focus management, WCAG 2.2 AA)
• [ ] Unit tests added + passing
• [ ] Integration tests added + passing (pnpm test:integration)
• [ ] E2E test added + passing (pnpm test:e2e) — or the spec file's test is test.skip-marked with the landing-phase comment (documented convention)
• [ ] Documentation updated (task file, README, ADR if an architectural decision changed)
• [ ] Logging + observability on important paths
• [ ] pnpm lint passes
• [ ] pnpm typecheck passes
• [ ] No secrets in code, env, or logs (.env.example updated if a new variable was introduced)

UI changes?

• [ ] Screenshot (or short recording) of the change attached below
• [ ] Console clean (no errors/warnings in browser devtools)

Security-sensitive change? (auth, permissions, sharing, files, API keys, webhooks, automation)

• [ ] Threat note below: what was considered (IDOR/tenant isolation, injection, rate limits, secret handling)
• [ ] Audit event emitted and asserted in a test

Screenshots

<!-- UI changes only -->

Security note

<!-- Required when touching authz/authn/sharing/keys/webhooks; otherwise delete. -->

Out of scope / follow-ups

<!-- Deliberately deferred work, linked tasks, known limitations. -->