# TODO

Durable backlog. Agents append here instead of leaving `TODO` comments in source.
Small, specific, independently actionable. Remove only when actually done.

## Now
- [ ] Owner: approve `docs/specs/001-staurtomation.md` (set `status: approved`).
- [ ] Write the implementation plan for Phase 0 + Release 1 (`docs/plans/001-staurtomation.md`).
- [ ] Phase 0: add `LICENSE` (AGPL-3.0 full text), `CONTRIBUTING.md`, CLA, `THIRD_PARTY.md`, PR template with provenance note.
- [ ] Phase 0: CI on Gitea Actions — tests, typecheck, SPDX header check, dependency-license allowlist, dependency denylist, code-similarity scan (spec §3.2 rule 5a).
- [ ] Once `package.json` exists: verify commands and fill `AGENTS.md` Commands + `docs/PERMISSIONS.md`.

## Next
- [ ] Verify Better Auth SAML/SCIM maturity and Bun compatibility (spec §12.1).
- [ ] Measure Bun compatibility of popular n8n community nodes (spec §12.2) — without reading n8n source.
- [ ] CI check that `AGENTS.md`, pointer files and docs paths exist; fail if `AGENTS.md` > 150 lines.

## Someday
- [ ] Owner: Entra ID test tenant + CI credentials (needed by Release 2).
- [ ] Owner: legal review of the compatibility-layer approach (blocks Release 3).

## Recurring
- [ ] Maintain `AGENTS.md`:
  - **Add a rule only in response to a real failure.** When an agent repeatedly gets something wrong,
    that is a gap; add one line, ideally with a code example. Do not pre-empt hypothetical mistakes.
  - **Update in the same PR as the convention change.** A stale rules file is worse than none — it
    actively misleads.
  - **Prune quarterly.** Delete rules whose convention has changed or whose mistake no longer occurs.
  - **Optional, cheap validation:** run the same task twice in clean sessions, with and without the
    file, and compare steps and token use.

## Known issues