amare/openspec/changes/complete-foundation-parity/tasks.md

1. Auth and strict types parity

• 1.1 Add MustVerifyEmail to User and require verified + active in canAccessPanel; update seed so admin/assistant are verified; feature tests for unverified denial and verified access
• 1.2 Confirm Filament/Laravel password reset is enabled; add feature tests for registered vs unknown email without account enumeration
• 1.3 Add declare(strict_types=1); to project-owned PHP files missing it (e.g. AdminPanelProvider); architecture/unit regression as needed
• 1.4 Run composer pint, composer phpstan, and composer test:feature for auth changes

2. Local runtime and PHP 8.4 alignment

• 2.1 Extend docker-compose.yml with FrankenPHP app service (build Dockerfile, depend on healthy postgres, publish 8000); document in README
• 2.2 Align README/docs to PHP 8.4 canonical (keep Composer ^8.3); verify Dockerfile/CI already on 8.4
• 2.3 Smoke local compose: docker compose up -d → GET /up returns 200
• 2.4 Run composer quality after compose/docs changes

3. Quality gates: npm audit and coverage

• 3.1 Add npm audit step to composer quality and CI static (policy: production deps; document any allowlist)
• 3.2 Enable Domain/Application coverage in CI unit with 80% fail threshold; exclude views/migrations/framework
• 3.3 Add/adjust unit tests if current Domain/Application coverage is below threshold
• 3.4 Verify CI static and unit fail appropriately on intentional audit/coverage breakage in a branch experiment or equivalent proof

4. Staging/production Compose and Dokploy prep

• 4.1 Add versioned Compose template (docker-compose.deploy.yml: web, queue, scheduler, migrate one-shot) parameterized by APP_IMAGE/IMAGE_TAG for staging and production stacks
• 4.2 Document Dokploy project setup: GHCR registry credentials, Postgres per environment, Compose import, required env vars (APP_KEY, DB, Resend, R2), trusted proxies/session cookies
• 4.3 Document rollback procedure: move environment alias to previous SHA and redeploy without rebuild
• 4.4 Document PostgreSQL daily backup (≥14d retention), restore procedure, and test restore on staging before first production promotion

5. Deploy workflow and smoke

• 5.1 Create .github/workflows/deploy-staging.yml gated on successful CI on main: build image, push ghcr.io/...:<sha> + :staging, trigger Dokploy compose.deploy
• 5.2 Create .github/workflows/promote-production.yml (workflow_dispatch + confirmation): retag same digest as :production, deploy production stack, smoke
• 5.3 Wire migrate-before-serve (Compose migrate service) and healthcheck on /up
• 5.4 Add post-deploy smoke script/job for /up, /, /admin/login returning 200
• 5.5 Store orchestration secrets only in GitHub; Laravel/DB/R2/Resend only in Dokploy; ensure no secrets in image layers

6. Phase 0 exit evidence

• 6.1 Perform first successful staging deploy of a main SHA and capture evidence (workflow URL, smoke output)
• 6.2 Verify rollback to previous SHA works once on staging
• 6.3 Update SPEC.md §18 Fase 0 checkboxes only for items with evidence; note remaining deferred items if any
• 6.4 Run full composer quality and confirm all five CI jobs + staging deploy path green
• 6.5 Report in SPEC §24 format; archive this change only after remaining parity tasks (1–3) also complete