2026-05-13 00:29:45 -05:00
|
|
|
# Project Requirements — Queue North Website
|
|
|
|
|
|
docs: adopt project template, retire the markdown backlog
This repository is the one the template's README describes: 205 issues, zero
milestones, and severity labels spelled "P0 Critical" / "P1 High" / "P2 Medium",
which privacyllc.dev reports as NOT ADOPTED rather than as 87% complete.
Six markdown records described the same work and none pointed at the tracker.
Two of them said the project was in "Phase 5" while the code was at 0.9.3.
Migrated, then deleted in this commit:
FUTURE.md -> docs/history/BATCH_LEDGER.md (Archived). Its open
items were all already filed as issues, so nothing
needed migrating into the tracker
HISTORY.md -> docs/history/DEVELOPMENT_LOG.md, verbatim, 0 lines lost
DEVELOPMENT_LOG.md -> the same file, as a second labelled block. Not
interleaved: the changelog has three duplicated version
headings, so one date order would have implied more
than the record supports
PROJECT.md -> docs/planning/PROJECT_PLAN.md
STRUCTURE.md -> the agent pipeline into README.md; its versioning rules
retired
BUILD_SUMMARY.md -> BATCH_LEDGER.md. Its embedded SQL schema deliberately
NOT carried: it predated the UNIQUE constraint on
leads.email, and server/index.js owns the schema
SCRIPTS.md -> docs/TOOLS.md, corrected for the SSR + prerender build
Moved with history (git detects all four as renames):
OVERHAUL_PLAN.md, review.md, project-requirements.md, docs/zoho-setup.md
Kept because this project earned them: the five-agent pipeline, the design
system in OVERHAUL_PLAN.md (Status: Current, with a front-note saying which half
is history), the positioning argument in REDESIGN_REVIEW.md, and REQUIREMENTS.md
whole, including its change policy.
Deleted from the template because they do not apply, each said out loud in
DOC_TRUST_MAP.md: QA pass I (no money moves), the authorisation checklist group
and the session-token row (no accounts, no sessions), and one PRECAUTIONARY
paragraph in SECURITY.md about holding credentials on behalf of users — there
are none, and PROJECT_PLAN.md records accounts as out of scope. Pass H was kept
and rewritten: its authorisation half does not apply, its what-a-stranger-can-
reach half is the most exposed surface here.
Also removed: main.js, the old static site's hash router, referenced by nothing
and preserved in .drop/; and test-results/.last-run.json, a May Playwright
artifact reading {"status":"failed"} for a suite that does not exist.
The repository was made private on Forgejo before this commit. That is what let
the internal history be committed rather than exempted — null/fruit-fall is
already private and reports normally.
Two defects found on the way in and fixed here: zoho-setup.md told admins to
edit `server/zoho/`, a directory that has never existed in any commit (the
mapping is in server/index.js), and README.md's route list still advertised
/8x8, removed at 0.6.6, while omitting /privacy-policy.
Branding: icon.webp and logo.webp converted from this project's own marks in
assets/. banner.webp is absent and is filed as an issue rather than faked.
Verified: verify.sh 3/3, doc-claims 71 claimed paths all present, backup and a
first-ever restore of the live leads database (2 tables, 3 rows, under 1s).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-18 01:19:02 -05:00
|
|
|
```
|
|
|
|
|
Status: Current
|
|
|
|
|
Owner: _null
|
|
|
|
|
Last reviewed: 2026-08-18
|
|
|
|
|
Governs: package.json — the engineering standards every agent works to:
|
|
|
|
|
stack, frontend, backend, database, code quality and security
|
|
|
|
|
Review trigger: Any change of stack, runtime or storage; any new class of input
|
|
|
|
|
reaching the API. Note the change policy at the bottom of this
|
|
|
|
|
file: these may not be modified without _null's explicit approval
|
|
|
|
|
```
|
|
|
|
|
|
2026-05-13 00:29:45 -05:00
|
|
|
These requirements apply to all agents working on Queue North Website.
|
|
|
|
|
|
|
|
|
|
## Project Philosophy
|
|
|
|
|
|
|
|
|
|
- Feel modern for 2026 standards
|
|
|
|
|
- Prioritize responsiveness and reactivity
|
|
|
|
|
- Provide smooth user interaction
|
|
|
|
|
- Avoid outdated UI/UX patterns
|
|
|
|
|
- Maintain fast perceived performance
|
|
|
|
|
- Remain lightweight and maintainable
|
|
|
|
|
- Prioritize usability over unnecessary complexity
|
|
|
|
|
|
|
|
|
|
## Technology Stack
|
|
|
|
|
|
|
|
|
|
- **Build:** Vite
|
|
|
|
|
- **Frontend:** React 19 with client-side routing (React Router 7)
|
|
|
|
|
- **Styling:** Tailwind CSS with custom Queue North theme
|
|
|
|
|
- **UI Components:** shadcn/ui-style local primitives (Button, Card, Input, etc.)
|
|
|
|
|
- **State:** TanStack Query for server state
|
|
|
|
|
- **Notifications:** Sonner (toast)
|
|
|
|
|
- **Backend:** Express (Node.js)
|
|
|
|
|
- **Database:** SQLite via better-sqlite3
|
|
|
|
|
- **NOT Next.js.** This project uses Vite + React SPA, not Next.js App Router.
|
|
|
|
|
|
|
|
|
|
## Frontend Standards
|
|
|
|
|
|
|
|
|
|
- React SPA with React Router (no SSR, no server components)
|
|
|
|
|
- shadcn/ui-style primitives in `src/components/ui/`
|
|
|
|
|
- Tailwind utilities cleanly and predictably
|
|
|
|
|
- Responsive design (mobile + desktop)
|
|
|
|
|
- Loading states, error states, accessible interfaces
|
|
|
|
|
- Queue North brand colors: navy, light blue, white palette
|
|
|
|
|
- Georgia font for numeric content
|
|
|
|
|
|
|
|
|
|
## Backend Standards
|
|
|
|
|
|
|
|
|
|
- Express.js REST API
|
|
|
|
|
- SQLite via better-sqlite3
|
|
|
|
|
- Lead capture endpoints (`/api/leads`, `/api/support`)
|
|
|
|
|
- Validate all input, sanitize user-supplied data
|
|
|
|
|
- Structured error handling, no silent failures
|
|
|
|
|
- Environment variables for configuration, no hardcoded secrets
|
|
|
|
|
|
|
|
|
|
## Database Standards
|
|
|
|
|
|
|
|
|
|
- SQLite only
|
|
|
|
|
- Validate schema changes before deployment
|
|
|
|
|
|
|
|
|
|
## Code Quality
|
|
|
|
|
|
|
|
|
|
- Readable, maintainable, no overengineering
|
|
|
|
|
- Remove dead code, consistent formatting
|
|
|
|
|
- Document non-obvious logic
|
|
|
|
|
- Prefer clarity over cleverness
|
|
|
|
|
|
|
|
|
|
## Security
|
|
|
|
|
|
|
|
|
|
- OWASP best practices
|
|
|
|
|
- Input validation on all endpoints
|
|
|
|
|
- No secrets in logs
|
|
|
|
|
- Review dependencies for vulnerabilities
|
|
|
|
|
|
|
|
|
|
## Requirement Change Policy
|
|
|
|
|
|
|
|
|
|
Requirements may NOT be modified without explicit approval from `_null`.
|