suaveplan/openspec/changes/biometrics/tasks.md

Tasks — biometrics

Every checkbox MUST reflect work actually done in this change. Do not retroactively tick boxes for work that was already in main when this change opened.

0. Pre-flight (non-negotiable)

• 0.1 Confirm clean working tree (git status reports nothing) and no in-flight worktrees with uncommitted work (git worktree list then git status in each)
• 0.2 If any worktrees exist under .claude/worktrees/, account for each one: still-active agent, work-pending-merge, or stale-and-prune. Stale worktrees MUST be removed (git worktree remove) before opening a new one — code that has been lost twice on main is the failure mode this guards against.
• 0.3 Confirm the package set in MANIFEST.md matches find packages -maxdepth 3 -name package.json count. Drift here means a prior change archived without regenerating the manifest.

1. Spec authoring

• 1.1 Read MIGRATION.md Section 4.6 for source requirements (skip enterprise — genesis-original)
• 1.2 Read openspec/specs/biometrics/spec.md if it exists
• 1.3 Read openspec/AGENTS.md Sections 13 and 14
• 1.4 Draft proposal.md from openspec/templates/proposal.md
• 1.5 Confirm no ## Source mapping section (genesis-original)
• 1.6 Draft specs/biometrics/spec.md from openspec/templates/spec-delta.md
• 1.7 Every requirement in the spec delta carries a **Verified by:** line naming concrete it(...) titles

2. Implementation

• 2.1 Scaffold packages/universal/biometrics/ with package.json, tsconfig.json, tsconfig.lib.json, vite.config.ts, vitest.config.ts, README.md
• 2.2 Implement src/error-codes.ts — BIOMETRIC.* codes via defineCodes
• 2.3 Implement src/errors/biometric-error.ts, biometric-not-available-error.ts, biometric-hardware-error.ts
• 2.4 Implement src/types.ts — BiometricAvailability, BiometricType, UnavailabilityReason, AuthenticateOptions
• 2.5 Implement src/schemas.ts — Zod schemas for boundary types
• 2.6 Implement src/delegate/delegate.ts — BiometricDelegate interface
• 2.7 Implement src/delegate/capacitor.ts — CapacitorBiometricDelegate
• 2.8 Implement src/delegate/electrobun.ts — ElectrobunBiometricDelegate
• 2.9 Implement src/delegate/macos-keychain.ts — MacosKeychainBiometricDelegate
• 2.10 Implement src/delegate/noop.ts — NoOpBiometricDelegate
• 2.11 Implement src/platform/platform.ts — runtime platform detection
• 2.12 Implement src/auth/auth.ts — BiometricAuth facade
• 2.13 Implement src/telemetry/meters.ts — OTel counters and histograms
• 2.14 Wire subpath exports in package.json for every feature module
• 2.15 Implement src/clock.ts — injectable Clock for deterministic timeout testing in BiometricAuth

3. Tests

• 3.1 Unit tests at src/auth/auth.test.ts covering every scenario
• 3.2 Unit tests at src/platform/platform.test.ts covering every scenario
• 3.3 Unit tests at src/delegate/delegate.test.ts covering every scenario
• 3.4 Unit tests at src/availability/availability.test.ts covering every scenario
• 3.5 Spec-conformance tests at src/errors/errors.spec-conformance.test.ts pinning type-level / observability / strict-mode scenarios
• 3.6 Integration / contract tests where the spec demands them
• 3.7 Every it(...) carries { timeout: 5000 } (or 30000 for genuinely async)

4. Documentation

• 4.1 Sibling .md for every implementation .ts (≥200 words, basic + advanced examples, full API reference)
• 4.2 README links every co-located .md under ## Modules
• 4.3 Update CLAUDE.md package listing if this is a new package or removes a package

5. Pre-archive verification (the 5-gate triple)

• 5.1 bun run check — Biome 0 errors / 0 warnings / 0 info across the whole monorepo
• 5.2 bunx turbo lint typecheck test --filter=@suaveplan/biometrics — green
• 5.3 bunx turbo test:coverage --filter=@suaveplan/biometrics — 100/100/100/100
• 5.4 bun scripts/openspec-conformance.ts @suaveplan/biometrics — exit 0, no error findings
• 5.5 bunx turbo build --filter=@suaveplan/biometrics — green

6. Pre-archive 7-row checklist (AGENTS.md Section 13)

• 6.1 Generics threaded; expectTypeOf assertions on every literal-type claim
• 6.2 Zod schemas wired at every declared boundary
• 6.3 Every error code in error-codes.ts thrown by at least one production path
• 6.4 Strict-mode behaviors tested both on and off
• 6.5 OTel instruments emitted from production paths and asserted with a real in-memory MeterProvider
• 6.6 Lifecycle dedup tested where claimed (in-flight Promise, idempotent set/load)
• 6.7 No retroactive tick — every box above reflects work done in this change

7. Archive

• 7.1 Fold spec delta into openspec/specs/biometrics/spec.md
• 7.2 Move openspec/changes/biometrics/ → openspec/archive/<yyyy-mm-dd>-biometrics/
• 7.3 Refresh MANIFEST.md if package set or deps changed