suaveplan/openspec/archive/2026-05-18-add-api-plugin-audit/tasks.md

Tasks — add-api-plugin-audit

Every checkbox MUST reflect work actually done in this change.

1. Spec authoring

• 1.1 Read ../suaveplan/enterprise/api-plugin-audit.md end-to-end
• 1.2 Read openspec/specs/api-plugin-audit/spec.md (does not exist — net-new)
• 1.3 Read openspec/AGENTS.md Sections 13 and 14
• 1.4 Draft proposal.md from openspec/templates/proposal.md
• 1.5 Fill in ## Source mapping table — every requirement cites a line range OR appears in the "no source line" table with justification
• 1.6 Draft specs/api-plugin-audit/spec.md from openspec/templates/spec-delta.md
• 1.7 Every requirement in the spec delta carries a **Verified by:** line naming concrete it(...) titles

2. Implementation

• 2.1 Scaffold packages/api/api-plugin-audit/ with package.json, tsconfig.json, tsconfig.lib.json, vite.config.ts, vitest.config.ts, README.md
• 2.2 Error codes — src/error-codes/error-codes.ts (AUDIT_PLUGIN_CODES + AuditPluginError)
• 2.3 Types — src/types/types.ts (AuditPluginOptions, AuditPluginConfig, AuditService, AuditContext, RedactionRules, etc.)
• 2.4 Zod schemas — src/schemas/options.ts
• 2.5 Redaction — src/redact/redact.ts (redactPayload, default lists)
• 2.6 Audit context — src/context/audit-context.ts (factory + Hono ContextVariableMap augmentation)
• 2.7 Audit service — src/services/audit-service.ts (wraps AuditLogger from @suaveplan/audit-logging) + registry-augmentation.ts
• 2.8 OTel — src/otel/instruments.ts (counters + histogram, in-memory test exporter wiring)
• 2.9 Middleware — src/middleware/audit-middleware.ts (global request audit, sampling, exclude, never-throw, redact)
• 2.10 Plugin factory — src/plugin/plugin.ts (Zod-validated createAuditPlugin, onInit lifecycle, sink wiring)
• 2.11 Barrel src/index.ts with side-effect imports (registry + context augmentations) + explicit named re-exports

3. Tests

• 3.1 Unit tests at src/<feature>/<feature>.test.ts covering every scenario
• 3.2 Spec-conformance tests at src/<feature>/<feature>.spec-conformance.test.ts pinning type-level / observability / strict-mode / lifecycle scenarios
• 3.3 Integration tests at tests/integration/full-boot.test.ts (real api + plugin + sample route) + tests/integration/sampling.test.ts (50% sampling band)
• 3.4 tests/dep-graph.test.ts — sibling .md, subpath export resolution
• 3.5 Every it(...) carries { timeout: 5000 } (or 30000 for genuinely async)

4. Documentation

• 4.1 Sibling .md for every implementation .ts (≥200 words, basic + advanced examples, full API reference)
• 4.2 README links every co-located .md under ## Modules
• 4.3 Do NOT touch CLAUDE.md, MANIFEST.md, STATUS.md per task instructions

5. Pre-archive verification (the 5-gate triple)

• 5.1 bun run check — Biome 0 errors / 0 warnings / 0 info across the whole monorepo
• 5.2 bunx turbo lint typecheck test --filter=@suaveplan/api-plugin-audit --force — green
• 5.3 bunx turbo test:coverage --filter=@suaveplan/api-plugin-audit — 100/100/100/100
• 5.4 bun scripts/openspec-conformance.ts @suaveplan/api-plugin-audit — exit 0
• 5.5 bunx turbo build --filter=@suaveplan/api-plugin-audit --force — green
• 5.6 bun scripts/lint/check-test-runner-imports.ts — exit 0

6. Pre-archive 9-row checklist (skill SKILL.md)

• 6.1 Generics threaded; expectTypeOf assertions on every literal-type claim
• 6.2 Zod schemas wired at every declared boundary
• 6.3 Every error code in error-codes.ts thrown by at least one production path
• 6.4 Strict-mode behaviors tested both on and off
• 6.5 OTel instruments emitted from production paths and asserted with a real in-memory MeterProvider
• 6.6 Lifecycle dedup tested where claimed (in-flight Promise, idempotent set/load)
• 6.7 No retroactive tick — every box above reflects work done in this change
• 6.8 No export * in any feature-module barrel (§6a)
• 6.9 No direct vitest / bun:test imports in test files (§7)

7. Archive

• 7.1 Fold spec delta into openspec/specs/api-plugin-audit/spec.md
• 7.2 Move openspec/changes/add-api-plugin-audit/ → openspec/archive/2026-05-18-add-api-plugin-audit/
• 7.3 Skip MANIFEST.md / STATUS.md refresh per task instructions