From 04022b7e0b0d33111aae8cf7589f1ad592281e13 Mon Sep 17 00:00:00 2001
From: Santhosh Janardhanan <santhoshj@gmail.com>
Date: Tue, 17 Feb 2026 02:10:23 -0500
Subject: [PATCH] Headroom - Foundation

---
 .opencode/command/opsx-apply.md               |  149 +++
 .opencode/command/opsx-archive.md             |  154 +++
 .opencode/command/opsx-bulk-archive.md        |  239 ++++
 .opencode/command/opsx-continue.md            |  111 ++
 .opencode/command/opsx-explore.md             |  171 +++
 .opencode/command/opsx-ff.md                  |   91 ++
 .opencode/command/opsx-new.md                 |   66 +
 .opencode/command/opsx-onboard.md             |  522 ++++++++
 .opencode/command/opsx-sync.md                |  131 ++
 .opencode/command/opsx-verify.md              |  161 +++
 .../skills/openspec-apply-change/SKILL.md     |  156 +++
 .../skills/openspec-archive-change/SKILL.md   |  114 ++
 .../openspec-bulk-archive-change/SKILL.md     |  246 ++++
 .../skills/openspec-continue-change/SKILL.md  |  118 ++
 .opencode/skills/openspec-explore/SKILL.md    |  290 ++++
 .opencode/skills/openspec-ff-change/SKILL.md  |  101 ++
 .opencode/skills/openspec-new-change/SKILL.md |   74 ++
 .opencode/skills/openspec-onboard/SKILL.md    |  529 ++++++++
 .opencode/skills/openspec-sync-specs/SKILL.md |  138 ++
 .../skills/openspec-verify-change/SKILL.md    |  168 +++
 devnotes.md                                   |  896 +++++++++++++
 docs/README.md                                |  188 +++
 docs/headroom-architecture.md                 | 1161 +++++++++++++++++
 docs/headroom-decision-log.md                 |  840 ++++++++++++
 docs/headroom-executive-summary.md            |  637 +++++++++
 docs/headroom-project-charter.md              |  613 +++++++++
 .../headroom-foundation/.openspec.yaml        |    2 +
 .../changes/headroom-foundation/design.md     |  559 ++++++++
 .../changes/headroom-foundation/proposal.md   |   68 +
 .../specs/actuals-tracking/spec.md            |   78 ++
 .../specs/allocation-reporting/spec.md        |   74 ++
 .../specs/allocation-validation/spec.md       |   87 ++
 .../specs/authentication/spec.md              |  111 ++
 .../specs/capacity-planning/spec.md           |   99 ++
 .../specs/cost-reporting/spec.md              |   85 ++
 .../specs/forecast-reporting/spec.md          |   70 +
 .../specs/master-data-management/spec.md      |  119 ++
 .../specs/project-lifecycle/spec.md           |  100 ++
 .../specs/resource-allocation/spec.md         |  111 ++
 .../specs/role-based-access/spec.md           |  105 ++
 .../specs/team-member-management/spec.md      |   60 +
 .../specs/utilization-calculations/spec.md    |   91 ++
 .../specs/utilization-reporting/spec.md       |   71 +
 .../specs/variance-reporting/spec.md          |   73 ++
 openspec/changes/headroom-foundation/tasks.md |  441 +++++++
 openspec/config.yaml                          |   20 +
 46 files changed, 10488 insertions(+)
 create mode 100644 .opencode/command/opsx-apply.md
 create mode 100644 .opencode/command/opsx-archive.md
 create mode 100644 .opencode/command/opsx-bulk-archive.md
 create mode 100644 .opencode/command/opsx-continue.md
 create mode 100644 .opencode/command/opsx-explore.md
 create mode 100644 .opencode/command/opsx-ff.md
 create mode 100644 .opencode/command/opsx-new.md
 create mode 100644 .opencode/command/opsx-onboard.md
 create mode 100644 .opencode/command/opsx-sync.md
 create mode 100644 .opencode/command/opsx-verify.md
 create mode 100644 .opencode/skills/openspec-apply-change/SKILL.md
 create mode 100644 .opencode/skills/openspec-archive-change/SKILL.md
 create mode 100644 .opencode/skills/openspec-bulk-archive-change/SKILL.md
 create mode 100644 .opencode/skills/openspec-continue-change/SKILL.md
 create mode 100644 .opencode/skills/openspec-explore/SKILL.md
 create mode 100644 .opencode/skills/openspec-ff-change/SKILL.md
 create mode 100644 .opencode/skills/openspec-new-change/SKILL.md
 create mode 100644 .opencode/skills/openspec-onboard/SKILL.md
 create mode 100644 .opencode/skills/openspec-sync-specs/SKILL.md
 create mode 100644 .opencode/skills/openspec-verify-change/SKILL.md
 create mode 100644 devnotes.md
 create mode 100644 docs/README.md
 create mode 100644 docs/headroom-architecture.md
 create mode 100644 docs/headroom-decision-log.md
 create mode 100644 docs/headroom-executive-summary.md
 create mode 100644 docs/headroom-project-charter.md
 create mode 100644 openspec/changes/headroom-foundation/.openspec.yaml
 create mode 100644 openspec/changes/headroom-foundation/design.md
 create mode 100644 openspec/changes/headroom-foundation/proposal.md
 create mode 100644 openspec/changes/headroom-foundation/specs/actuals-tracking/spec.md
 create mode 100644 openspec/changes/headroom-foundation/specs/allocation-reporting/spec.md
 create mode 100644 openspec/changes/headroom-foundation/specs/allocation-validation/spec.md
 create mode 100644 openspec/changes/headroom-foundation/specs/authentication/spec.md
 create mode 100644 openspec/changes/headroom-foundation/specs/capacity-planning/spec.md
 create mode 100644 openspec/changes/headroom-foundation/specs/cost-reporting/spec.md
 create mode 100644 openspec/changes/headroom-foundation/specs/forecast-reporting/spec.md
 create mode 100644 openspec/changes/headroom-foundation/specs/master-data-management/spec.md
 create mode 100644 openspec/changes/headroom-foundation/specs/project-lifecycle/spec.md
 create mode 100644 openspec/changes/headroom-foundation/specs/resource-allocation/spec.md
 create mode 100644 openspec/changes/headroom-foundation/specs/role-based-access/spec.md
 create mode 100644 openspec/changes/headroom-foundation/specs/team-member-management/spec.md
 create mode 100644 openspec/changes/headroom-foundation/specs/utilization-calculations/spec.md
 create mode 100644 openspec/changes/headroom-foundation/specs/utilization-reporting/spec.md
 create mode 100644 openspec/changes/headroom-foundation/specs/variance-reporting/spec.md
 create mode 100644 openspec/changes/headroom-foundation/tasks.md
 create mode 100644 openspec/config.yaml

diff --git a/.opencode/command/opsx-apply.md b/.opencode/command/opsx-apply.md
new file mode 100644
index 00000000..94b8c1ee
--- /dev/null
+++ b/.opencode/command/opsx-apply.md
@@ -0,0 +1,149 @@
+---
+description: Implement tasks from an OpenSpec change (Experimental)
+---
+
+Implement tasks from an OpenSpec change.
+
+**Input**: Optionally specify a change name (e.g., `/opsx-apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx-apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - Context file paths (varies by schema)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx-continue`
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read the files listed in `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! You can archive this change with `/opsx-archive`.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.opencode/command/opsx-archive.md b/.opencode/command/opsx-archive.md
new file mode 100644
index 00000000..20ad82b2
--- /dev/null
+++ b/.opencode/command/opsx-archive.md
@@ -0,0 +1,154 @@
+---
+description: Archive a completed change in the experimental workflow
+---
+
+Archive a completed change in the experimental workflow.
+
+**Input**: Optionally specify a change name after `/opsx-archive` (e.g., `/opsx-archive add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Check for delta specs at `openspec/changes/<name>/specs/`. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, execute `/opsx-sync` logic. Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create the archive directory if it doesn't exist:
+   ```bash
+   mkdir -p openspec/changes/archive
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move the change directory to archive
+
+   ```bash
+   mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Spec sync status (synced / sync skipped / no delta specs)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success (No Delta Specs)**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Specs:** No delta specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success With Warnings**
+
+```
+## Archive Complete (with warnings)
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Specs:** Sync skipped (user chose to skip)
+
+**Warnings:**
+- Archived with 2 incomplete artifacts
+- Archived with 3 incomplete tasks
+- Delta spec sync was skipped (user chose to skip)
+
+Review the archive if this was not intentional.
+```
+
+**Output On Error (Archive Exists)**
+
+```
+## Archive Failed
+
+**Change:** <change-name>
+**Target:** openspec/changes/archive/YYYY-MM-DD-<name>/
+
+Target archive directory already exists.
+
+**Options:**
+1. Rename the existing archive
+2. Delete the existing archive if it's a duplicate
+3. Wait until a different date to archive
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use /opsx-sync approach (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.opencode/command/opsx-bulk-archive.md b/.opencode/command/opsx-bulk-archive.md
new file mode 100644
index 00000000..05fdf8d6
--- /dev/null
+++ b/.opencode/command/opsx-bulk-archive.md
@@ -0,0 +1,239 @@
+---
+description: Archive multiple completed changes at once
+---
+
+Archive multiple completed changes in a single operation.
+
+This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
+
+**Input**: None required (prompts for selection)
+
+**Steps**
+
+1. **Get active changes**
+
+   Run `openspec list --json` to get all active changes.
+
+   If no active changes exist, inform user and stop.
+
+2. **Prompt for change selection**
+
+   Use **AskUserQuestion tool** with multi-select to let user choose changes:
+   - Show each change with its schema
+   - Include an option for "All changes"
+   - Allow any number of selections (1+ works, 2+ is the typical use case)
+
+   **IMPORTANT**: Do NOT auto-select. Always let the user choose.
+
+3. **Batch validation - gather status for all selected changes**
+
+   For each selected change, collect:
+
+   a. **Artifact status** - Run `openspec status --change "<name>" --json`
+      - Parse `schemaName` and `artifacts` list
+      - Note which artifacts are `done` vs other states
+
+   b. **Task completion** - Read `openspec/changes/<name>/tasks.md`
+      - Count `- [ ]` (incomplete) vs `- [x]` (complete)
+      - If no tasks file exists, note as "No tasks"
+
+   c. **Delta specs** - Check `openspec/changes/<name>/specs/` directory
+      - List which capability specs exist
+      - For each, extract requirement names (lines matching `### Requirement: <name>`)
+
+4. **Detect spec conflicts**
+
+   Build a map of `capability -> [changes that touch it]`:
+
+   ```
+   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
+   api  -> [change-c]            <- OK (only 1 change)
+   ```
+
+   A conflict exists when 2+ selected changes have delta specs for the same capability.
+
+5. **Resolve conflicts agentically**
+
+   **For each conflict**, investigate the codebase:
+
+   a. **Read the delta specs** from each conflicting change to understand what each claims to add/modify
+
+   b. **Search the codebase** for implementation evidence:
+      - Look for code implementing requirements from each delta spec
+      - Check for related files, functions, or tests
+
+   c. **Determine resolution**:
+      - If only one change is actually implemented -> sync that one's specs
+      - If both implemented -> apply in chronological order (older first, newer overwrites)
+      - If neither implemented -> skip spec sync, warn user
+
+   d. **Record resolution** for each conflict:
+      - Which change's specs to apply
+      - In what order (if both)
+      - Rationale (what was found in codebase)
+
+6. **Show consolidated status table**
+
+   Display a table summarizing all changes:
+
+   ```
+   | Change               | Artifacts | Tasks | Specs   | Conflicts | Status |
+   |---------------------|-----------|-------|---------|-----------|--------|
+   | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
+   | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
+   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
+   | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
+   ```
+
+   For conflicts, show the resolution:
+   ```
+   * Conflict resolution:
+     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
+   ```
+
+   For incomplete changes, show warnings:
+   ```
+   Warnings:
+   - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
+   ```
+
+7. **Confirm batch operation**
+
+   Use **AskUserQuestion tool** with a single confirmation:
+
+   - "Archive N changes?" with options based on status
+   - Options might include:
+     - "Archive all N changes"
+     - "Archive only N ready changes (skip incomplete)"
+     - "Cancel"
+
+   If there are incomplete changes, make clear they'll be archived with warnings.
+
+8. **Execute archive for each confirmed change**
+
+   Process changes in the determined order (respecting conflict resolution):
+
+   a. **Sync specs** if delta specs exist:
+      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
+      - For conflicts, apply in resolved order
+      - Track if sync was done
+
+   b. **Perform the archive**:
+      ```bash
+      mkdir -p openspec/changes/archive
+      mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
+      ```
+
+   c. **Track outcome** for each change:
+      - Success: archived successfully
+      - Failed: error during archive (record error)
+      - Skipped: user chose not to archive (if applicable)
+
+9. **Display summary**
+
+   Show final results:
+
+   ```
+   ## Bulk Archive Complete
+
+   Archived 3 changes:
+   - schema-management-cli -> archive/2026-01-19-schema-management-cli/
+   - project-config -> archive/2026-01-19-project-config/
+   - add-oauth -> archive/2026-01-19-add-oauth/
+
+   Skipped 1 change:
+   - add-verify-skill (user chose not to archive incomplete)
+
+   Spec sync summary:
+   - 4 delta specs synced to main specs
+   - 1 conflict resolved (auth: applied both in chronological order)
+   ```
+
+   If any failures:
+   ```
+   Failed 1 change:
+   - some-change: Archive directory already exists
+   ```
+
+**Conflict Resolution Examples**
+
+Example 1: Only one implemented
+```
+Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
+
+Checking add-oauth:
+- Delta adds "OAuth Provider Integration" requirement
+- Searching codebase... found src/auth/oauth.ts implementing OAuth flow
+
+Checking add-jwt:
+- Delta adds "JWT Token Handling" requirement
+- Searching codebase... no JWT implementation found
+
+Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
+```
+
+Example 2: Both implemented
+```
+Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
+
+Checking add-rest-api (created 2026-01-10):
+- Delta adds "REST Endpoints" requirement
+- Searching codebase... found src/api/rest.ts
+
+Checking add-graphql (created 2026-01-15):
+- Delta adds "GraphQL Schema" requirement
+- Searching codebase... found src/api/graphql.ts
+
+Resolution: Both implemented. Will apply add-rest-api specs first,
+then add-graphql specs (chronological order, newer takes precedence).
+```
+
+**Output On Success**
+
+```
+## Bulk Archive Complete
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+- <change-2> -> archive/YYYY-MM-DD-<change-2>/
+
+Spec sync summary:
+- N delta specs synced to main specs
+- No conflicts (or: M conflicts resolved)
+```
+
+**Output On Partial Success**
+
+```
+## Bulk Archive Complete (partial)
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+
+Skipped M changes:
+- <change-2> (user chose not to archive incomplete)
+
+Failed K changes:
+- <change-3>: Archive directory already exists
+```
+
+**Output When No Changes**
+
+```
+## No Changes to Archive
+
+No active changes found. Use `/opsx-new` to create a new change.
+```
+
+**Guardrails**
+- Allow any number of changes (1+ is fine, 2+ is the typical use case)
+- Always prompt for selection, never auto-select
+- Detect spec conflicts early and resolve by checking codebase
+- When both changes are implemented, apply specs in chronological order
+- Skip spec sync only when implementation is missing (warn user)
+- Show clear per-change status before confirming
+- Use single confirmation for entire batch
+- Track and report all outcomes (success/skip/fail)
+- Preserve .openspec.yaml when moving to archive
+- Archive directory target uses current date: YYYY-MM-DD-<name>
+- If archive target exists, fail that change but continue with others
diff --git a/.opencode/command/opsx-continue.md b/.opencode/command/opsx-continue.md
new file mode 100644
index 00000000..1a648109
--- /dev/null
+++ b/.opencode/command/opsx-continue.md
@@ -0,0 +1,111 @@
+---
+description: Continue working on a change - create the next artifact (Experimental)
+---
+
+Continue working on a change by creating the next artifact.
+
+**Input**: Optionally specify a change name after `/opsx-continue` (e.g., `/opsx-continue add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
+
+   Present the top 3-4 most recently modified changes as options, showing:
+   - Change name
+   - Schema (from `schema` field if present, otherwise "spec-driven")
+   - Status (e.g., "0/5 tasks", "complete", "no tasks")
+   - How recently it was modified (from `lastModified` field)
+
+   Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check current status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand current state. The response includes:
+   - `schemaName`: The workflow schema being used (e.g., "spec-driven")
+   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
+   - `isComplete`: Boolean indicating if all artifacts are complete
+
+3. **Act based on status**:
+
+   ---
+
+   **If all artifacts are complete (`isComplete: true`)**:
+   - Congratulate the user
+   - Show final status including the schema used
+   - Suggest: "All artifacts created! You can now implement this change with `/opsx-apply` or archive it with `/opsx-archive`."
+   - STOP
+
+   ---
+
+   **If artifacts are ready to create** (status shows artifacts with `status: "ready"`):
+   - Pick the FIRST artifact with `status: "ready"` from the status output
+   - Get its instructions:
+     ```bash
+     openspec instructions <artifact-id> --change "<name>" --json
+     ```
+   - Parse the JSON. The key fields are:
+     - `context`: Project background (constraints for you - do NOT include in output)
+     - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+     - `template`: The structure to use for your output file
+     - `instruction`: Schema-specific guidance
+     - `outputPath`: Where to write the artifact
+     - `dependencies`: Completed artifacts to read for context
+   - **Create the artifact file**:
+     - Read any completed dependency files for context
+     - Use `template` as the structure - fill in its sections
+     - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
+     - Write to the output path specified in instructions
+   - Show what was created and what's now unlocked
+   - STOP after creating ONE artifact
+
+   ---
+
+   **If no artifacts are ready (all blocked)**:
+   - This shouldn't happen with a valid schema
+   - Show status and suggest checking for issues
+
+4. **After creating an artifact, show progress**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After each invocation, show:
+- Which artifact was created
+- Schema workflow being used
+- Current progress (N/M complete)
+- What artifacts are now unlocked
+- Prompt: "Run `/opsx-continue` to create the next artifact"
+
+**Artifact Creation Guidelines**
+
+The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
+
+Common artifact patterns:
+
+**spec-driven schema** (proposal → specs → design → tasks):
+- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
+  - The Capabilities section is critical - each capability listed will need a spec file.
+- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
+- **design.md**: Document technical decisions, architecture, and implementation approach.
+- **tasks.md**: Break down implementation into checkboxed tasks.
+
+For other schemas, follow the `instruction` field from the CLI output.
+
+**Guardrails**
+- Create ONE artifact per invocation
+- Always read dependency artifacts before creating a new one
+- Never skip artifacts or create out of order
+- If context is unclear, ask the user before creating
+- Verify the artifact file exists after writing before marking progress
+- Use the schema's artifact sequence, don't assume specific artifact names
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
diff --git a/.opencode/command/opsx-explore.md b/.opencode/command/opsx-explore.md
new file mode 100644
index 00000000..01ee33cb
--- /dev/null
+++ b/.opencode/command/opsx-explore.md
@@ -0,0 +1,171 @@
+---
+description: Enter explore mode - think through ideas, investigate problems, clarify requirements
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first (e.g., start a change with `/opsx-new` or `/opsx-ff`). You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+**Input**: The argument after `/opsx-explore` is whatever the user wants to think about. Could be:
+- A vague idea: "real-time collaboration"
+- A specific problem: "the auth system is getting unwieldy"
+- A change name: "add-dark-mode" (to explore in context of that change)
+- A comparison: "postgres vs sqlite for this"
+- Nothing (just enter explore mode)
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│   ┌────────┐         ┌────────┐        │
+│   │ State  │────────▶│ State  │        │
+│   │   A    │         │   B    │        │
+│   └────────┘         └────────┘        │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+If the user mentioned a specific change name, read its artifacts for context.
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create one?"
+  → Can transition to `/opsx-new` or `/opsx-ff`
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Read existing artifacts for context**
+   - `openspec/changes/<name>/proposal.md`
+   - `openspec/changes/<name>/design.md`
+   - `openspec/changes/<name>/tasks.md`
+   - etc.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+   | Insight Type | Where to Capture |
+   |--------------|------------------|
+   | New requirement discovered | `specs/<capability>/spec.md` |
+   | Requirement changed | `specs/<capability>/spec.md` |
+   | Design decision made | `design.md` |
+   | Scope changed | `proposal.md` |
+   | New work identified | `tasks.md` |
+   | Assumption invalidated | Relevant artifact |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into action**: "Ready to start? `/opsx-new` or `/opsx-ff`"
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When things crystallize, you might offer a summary - but it's optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.opencode/command/opsx-ff.md b/.opencode/command/opsx-ff.md
new file mode 100644
index 00000000..33190e08
--- /dev/null
+++ b/.opencode/command/opsx-ff.md
@@ -0,0 +1,91 @@
+---
+description: Create a change and generate all artifacts needed for implementation in one go
+---
+
+Fast-forward through artifact creation - generate everything needed to start implementation.
+
+**Input**: The argument after `/opsx-ff` is the change name (kebab-case), OR a description of what the user wants to build.
+
+**Steps**
+
+1. **If no input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change at `openspec/changes/<name>/`.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `outputPath`: Where to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "✓ Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx-apply` to start implementing."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use the `template` as a starting point, filling in based on context
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, ask if user wants to continue it or create a new one
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.opencode/command/opsx-new.md b/.opencode/command/opsx-new.md
new file mode 100644
index 00000000..0f30abd7
--- /dev/null
+++ b/.opencode/command/opsx-new.md
@@ -0,0 +1,66 @@
+---
+description: Start a new change using the experimental artifact workflow (OPSX)
+---
+
+Start a new change using the experimental artifact-driven approach.
+
+**Input**: The argument after `/opsx-new` is the change name (kebab-case), OR a description of what the user wants to build.
+
+**Steps**
+
+1. **If no input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Determine the workflow schema**
+
+   Use the default schema (omit `--schema`) unless the user explicitly requests a different workflow.
+
+   **Use a different schema only if the user mentions:**
+   - A specific schema name → use `--schema <name>`
+   - "show workflows" or "what workflows" → run `openspec schemas --json` and let them choose
+
+   **Otherwise**: Omit `--schema` to use the default.
+
+3. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   Add `--schema <name>` only if the user requested a specific workflow.
+   This creates a scaffolded change at `openspec/changes/<name>/` with the selected schema.
+
+4. **Show the artifact status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+   This shows which artifacts need to be created and which are ready (dependencies satisfied).
+
+5. **Get instructions for the first artifact**
+   The first artifact depends on the schema. Check the status output to find the first artifact with status "ready".
+   ```bash
+   openspec instructions <first-artifact-id> --change "<name>"
+   ```
+   This outputs the template and context for creating the first artifact.
+
+6. **STOP and wait for user direction**
+
+**Output**
+
+After completing the steps, summarize:
+- Change name and location
+- Schema/workflow being used and its artifact sequence
+- Current status (0/N artifacts complete)
+- The template for the first artifact
+- Prompt: "Ready to create the first artifact? Run `/opsx-continue` or just describe what this change is about and I'll draft it."
+
+**Guardrails**
+- Do NOT create any artifacts yet - just show the instructions
+- Do NOT advance beyond showing the first artifact template
+- If the name is invalid (not kebab-case), ask for a valid name
+- If a change with that name already exists, suggest using `/opsx-continue` instead
+- Pass --schema if using a non-default workflow
diff --git a/.opencode/command/opsx-onboard.md b/.opencode/command/opsx-onboard.md
new file mode 100644
index 00000000..50b4b821
--- /dev/null
+++ b/.opencode/command/opsx-onboard.md
@@ -0,0 +1,522 @@
+---
+description: Guided onboarding - walk through a complete OpenSpec workflow cycle with narration
+---
+
+Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
+
+---
+
+## Preflight
+
+Before starting, check if OpenSpec is initialized:
+
+```bash
+openspec status --json 2>&1 || echo "NOT_INITIALIZED"
+```
+
+**If not initialized:**
+> OpenSpec isn't set up in this project yet. Run `openspec init` first, then come back to `/opsx-onboard`.
+
+Stop here if not initialized.
+
+---
+
+## Phase 1: Welcome
+
+Display:
+
+```
+## Welcome to OpenSpec!
+
+I'll walk you through a complete change cycle—from idea to implementation—using a real task in your codebase. Along the way, you'll learn the workflow by doing it.
+
+**What we'll do:**
+1. Pick a small, real task in your codebase
+2. Explore the problem briefly
+3. Create a change (the container for our work)
+4. Build the artifacts: proposal → specs → design → tasks
+5. Implement the tasks
+6. Archive the completed change
+
+**Time:** ~15-20 minutes
+
+Let's start by finding something to work on.
+```
+
+---
+
+## Phase 2: Task Selection
+
+### Codebase Analysis
+
+Scan the codebase for small improvement opportunities. Look for:
+
+1. **TODO/FIXME comments** - Search for `TODO`, `FIXME`, `HACK`, `XXX` in code files
+2. **Missing error handling** - `catch` blocks that swallow errors, risky operations without try-catch
+3. **Functions without tests** - Cross-reference `src/` with test directories
+4. **Type issues** - `any` types in TypeScript files (`: any`, `as any`)
+5. **Debug artifacts** - `console.log`, `console.debug`, `debugger` statements in non-debug code
+6. **Missing validation** - User input handlers without validation
+
+Also check recent git activity:
+```bash
+git log --oneline -10 2>/dev/null || echo "No git history"
+```
+
+### Present Suggestions
+
+From your analysis, present 3-4 specific suggestions:
+
+```
+## Task Suggestions
+
+Based on scanning your codebase, here are some good starter tasks:
+
+**1. [Most promising task]**
+   Location: `src/path/to/file.ts:42`
+   Scope: ~1-2 files, ~20-30 lines
+   Why it's good: [brief reason]
+
+**2. [Second task]**
+   Location: `src/another/file.ts`
+   Scope: ~1 file, ~15 lines
+   Why it's good: [brief reason]
+
+**3. [Third task]**
+   Location: [location]
+   Scope: [estimate]
+   Why it's good: [brief reason]
+
+**4. Something else?**
+   Tell me what you'd like to work on.
+
+Which task interests you? (Pick a number or describe your own)
+```
+
+**If nothing found:** Fall back to asking what the user wants to build:
+> I didn't find obvious quick wins in your codebase. What's something small you've been meaning to add or fix?
+
+### Scope Guardrail
+
+If the user picks or describes something too large (major feature, multi-day work):
+
+```
+That's a valuable task, but it's probably larger than ideal for your first OpenSpec run-through.
+
+For learning the workflow, smaller is better—it lets you see the full cycle without getting stuck in implementation details.
+
+**Options:**
+1. **Slice it smaller** - What's the smallest useful piece of [their task]? Maybe just [specific slice]?
+2. **Pick something else** - One of the other suggestions, or a different small task?
+3. **Do it anyway** - If you really want to tackle this, we can. Just know it'll take longer.
+
+What would you prefer?
+```
+
+Let the user override if they insist—this is a soft guardrail.
+
+---
+
+## Phase 3: Explore Demo
+
+Once a task is selected, briefly demonstrate explore mode:
+
+```
+Before we create a change, let me quickly show you **explore mode**—it's how you think through problems before committing to a direction.
+```
+
+Spend 1-2 minutes investigating the relevant code:
+- Read the file(s) involved
+- Draw a quick ASCII diagram if it helps
+- Note any considerations
+
+```
+## Quick Exploration
+
+[Your brief analysis—what you found, any considerations]
+
+┌─────────────────────────────────────────┐
+│   [Optional: ASCII diagram if helpful]  │
+└─────────────────────────────────────────┘
+
+Explore mode (`/opsx-explore`) is for this kind of thinking—investigating before implementing. You can use it anytime you need to think through a problem.
+
+Now let's create a change to hold our work.
+```
+
+**PAUSE** - Wait for user acknowledgment before proceeding.
+
+---
+
+## Phase 4: Create the Change
+
+**EXPLAIN:**
+```
+## Creating a Change
+
+A "change" in OpenSpec is a container for all the thinking and planning around a piece of work. It lives in `openspec/changes/<name>/` and holds your artifacts—proposal, specs, design, tasks.
+
+Let me create one for our task.
+```
+
+**DO:** Create the change with a derived kebab-case name:
+```bash
+openspec new change "<derived-name>"
+```
+
+**SHOW:**
+```
+Created: `openspec/changes/<name>/`
+
+The folder structure:
+```
+openspec/changes/<name>/
+├── proposal.md    ← Why we're doing this (empty, we'll fill it)
+├── design.md      ← How we'll build it (empty)
+├── specs/         ← Detailed requirements (empty)
+└── tasks.md       ← Implementation checklist (empty)
+```
+
+Now let's fill in the first artifact—the proposal.
+```
+
+---
+
+## Phase 5: Proposal
+
+**EXPLAIN:**
+```
+## The Proposal
+
+The proposal captures **why** we're making this change and **what** it involves at a high level. It's the "elevator pitch" for the work.
+
+I'll draft one based on our task.
+```
+
+**DO:** Draft the proposal content (don't save yet):
+
+```
+Here's a draft proposal:
+
+---
+
+## Why
+
+[1-2 sentences explaining the problem/opportunity]
+
+## What Changes
+
+[Bullet points of what will be different]
+
+## Capabilities
+
+### New Capabilities
+- `<capability-name>`: [brief description]
+
+### Modified Capabilities
+<!-- If modifying existing behavior -->
+
+## Impact
+
+- `src/path/to/file.ts`: [what changes]
+- [other files if applicable]
+
+---
+
+Does this capture the intent? I can adjust before we save it.
+```
+
+**PAUSE** - Wait for user approval/feedback.
+
+After approval, save the proposal:
+```bash
+openspec instructions proposal --change "<name>" --json
+```
+Then write the content to `openspec/changes/<name>/proposal.md`.
+
+```
+Proposal saved. This is your "why" document—you can always come back and refine it as understanding evolves.
+
+Next up: specs.
+```
+
+---
+
+## Phase 6: Specs
+
+**EXPLAIN:**
+```
+## Specs
+
+Specs define **what** we're building in precise, testable terms. They use a requirement/scenario format that makes expected behavior crystal clear.
+
+For a small task like this, we might only need one spec file.
+```
+
+**DO:** Create the spec file:
+```bash
+mkdir -p openspec/changes/<name>/specs/<capability-name>
+```
+
+Draft the spec content:
+
+```
+Here's the spec:
+
+---
+
+## ADDED Requirements
+
+### Requirement: <Name>
+
+<Description of what the system should do>
+
+#### Scenario: <Scenario name>
+
+- **WHEN** <trigger condition>
+- **THEN** <expected outcome>
+- **AND** <additional outcome if needed>
+
+---
+
+This format—WHEN/THEN/AND—makes requirements testable. You can literally read them as test cases.
+```
+
+Save to `openspec/changes/<name>/specs/<capability>/spec.md`.
+
+---
+
+## Phase 7: Design
+
+**EXPLAIN:**
+```
+## Design
+
+The design captures **how** we'll build it—technical decisions, tradeoffs, approach.
+
+For small changes, this might be brief. That's fine—not every change needs deep design discussion.
+```
+
+**DO:** Draft design.md:
+
+```
+Here's the design:
+
+---
+
+## Context
+
+[Brief context about the current state]
+
+## Goals / Non-Goals
+
+**Goals:**
+- [What we're trying to achieve]
+
+**Non-Goals:**
+- [What's explicitly out of scope]
+
+## Decisions
+
+### Decision 1: [Key decision]
+
+[Explanation of approach and rationale]
+
+---
+
+For a small task, this captures the key decisions without over-engineering.
+```
+
+Save to `openspec/changes/<name>/design.md`.
+
+---
+
+## Phase 8: Tasks
+
+**EXPLAIN:**
+```
+## Tasks
+
+Finally, we break the work into implementation tasks—checkboxes that drive the apply phase.
+
+These should be small, clear, and in logical order.
+```
+
+**DO:** Generate tasks based on specs and design:
+
+```
+Here are the implementation tasks:
+
+---
+
+## 1. [Category or file]
+
+- [ ] 1.1 [Specific task]
+- [ ] 1.2 [Specific task]
+
+## 2. Verify
+
+- [ ] 2.1 [Verification step]
+
+---
+
+Each checkbox becomes a unit of work in the apply phase. Ready to implement?
+```
+
+**PAUSE** - Wait for user to confirm they're ready to implement.
+
+Save to `openspec/changes/<name>/tasks.md`.
+
+---
+
+## Phase 9: Apply (Implementation)
+
+**EXPLAIN:**
+```
+## Implementation
+
+Now we implement each task, checking them off as we go. I'll announce each one and occasionally note how the specs/design informed the approach.
+```
+
+**DO:** For each task:
+
+1. Announce: "Working on task N: [description]"
+2. Implement the change in the codebase
+3. Reference specs/design naturally: "The spec says X, so I'm doing Y"
+4. Mark complete in tasks.md: `- [ ]` → `- [x]`
+5. Brief status: "✓ Task N complete"
+
+Keep narration light—don't over-explain every line of code.
+
+After all tasks:
+
+```
+## Implementation Complete
+
+All tasks done:
+- [x] Task 1
+- [x] Task 2
+- [x] ...
+
+The change is implemented! One more step—let's archive it.
+```
+
+---
+
+## Phase 10: Archive
+
+**EXPLAIN:**
+```
+## Archiving
+
+When a change is complete, we archive it. This moves it from `openspec/changes/` to `openspec/changes/archive/YYYY-MM-DD-<name>/`.
+
+Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
+```
+
+**DO:**
+```bash
+openspec archive "<name>"
+```
+
+**SHOW:**
+```
+Archived to: `openspec/changes/archive/YYYY-MM-DD-<name>/`
+
+The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
+```
+
+---
+
+## Phase 11: Recap & Next Steps
+
+```
+## Congratulations!
+
+You just completed a full OpenSpec cycle:
+
+1. **Explore** - Thought through the problem
+2. **New** - Created a change container
+3. **Proposal** - Captured WHY
+4. **Specs** - Defined WHAT in detail
+5. **Design** - Decided HOW
+6. **Tasks** - Broke it into steps
+7. **Apply** - Implemented the work
+8. **Archive** - Preserved the record
+
+This same rhythm works for any size change—a small fix or a major feature.
+
+---
+
+## Command Reference
+
+| Command | What it does |
+|---------|--------------|
+| `/opsx-explore` | Think through problems before/during work |
+| `/opsx-new` | Start a new change, step through artifacts |
+| `/opsx-ff` | Fast-forward: create all artifacts at once |
+| `/opsx-continue` | Continue working on an existing change |
+| `/opsx-apply` | Implement tasks from a change |
+| `/opsx-verify` | Verify implementation matches artifacts |
+| `/opsx-archive` | Archive a completed change |
+
+---
+
+## What's Next?
+
+Try `/opsx-new` or `/opsx-ff` on something you actually want to build. You've got the rhythm now!
+```
+
+---
+
+## Graceful Exit Handling
+
+### User wants to stop mid-way
+
+If the user says they need to stop, want to pause, or seem disengaged:
+
+```
+No problem! Your change is saved at `openspec/changes/<name>/`.
+
+To pick up where we left off later:
+- `/opsx-continue <name>` - Resume artifact creation
+- `/opsx-apply <name>` - Jump to implementation (if tasks exist)
+
+The work won't be lost. Come back whenever you're ready.
+```
+
+Exit gracefully without pressure.
+
+### User just wants command reference
+
+If the user says they just want to see the commands or skip the tutorial:
+
+```
+## OpenSpec Quick Reference
+
+| Command | What it does |
+|---------|--------------|
+| `/opsx-explore` | Think through problems (no code changes) |
+| `/opsx-new <name>` | Start a new change, step by step |
+| `/opsx-ff <name>` | Fast-forward: all artifacts at once |
+| `/opsx-continue <name>` | Continue an existing change |
+| `/opsx-apply <name>` | Implement tasks |
+| `/opsx-verify <name>` | Verify implementation |
+| `/opsx-archive <name>` | Archive when done |
+
+Try `/opsx-new` to start your first change, or `/opsx-ff` if you want to move fast.
+```
+
+Exit gracefully.
+
+---
+
+## Guardrails
+
+- **Follow the EXPLAIN → DO → SHOW → PAUSE pattern** at key transitions (after explore, after proposal draft, after tasks, after archive)
+- **Keep narration light** during implementation—teach without lecturing
+- **Don't skip phases** even if the change is small—the goal is teaching the workflow
+- **Pause for acknowledgment** at marked points, but don't over-pause
+- **Handle exits gracefully**—never pressure the user to continue
+- **Use real codebase tasks**—don't simulate or use fake examples
+- **Adjust scope gently**—guide toward smaller tasks but respect user choice
diff --git a/.opencode/command/opsx-sync.md b/.opencode/command/opsx-sync.md
new file mode 100644
index 00000000..1208c4b4
--- /dev/null
+++ b/.opencode/command/opsx-sync.md
@@ -0,0 +1,131 @@
+---
+description: Sync delta specs from a change to main specs
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Input**: Optionally specify a change name after `/opsx-sync` (e.g., `/opsx-sync add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Find delta specs**
+
+   Look for delta spec files in `openspec/changes/<name>/specs/*/spec.md`.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+3. **For each delta spec, apply changes to main specs**
+
+   For each capability with a delta spec at `openspec/changes/<name>/specs/<capability>/spec.md`:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+4. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
diff --git a/.opencode/command/opsx-verify.md b/.opencode/command/opsx-verify.md
new file mode 100644
index 00000000..7bd3abab
--- /dev/null
+++ b/.opencode/command/opsx-verify.md
@@ -0,0 +1,161 @@
+---
+description: Verify implementation matches change artifacts before archiving
+---
+
+Verify that an implementation matches the change artifacts (specs, tasks, design).
+
+**Input**: Optionally specify a change name after `/opsx-verify` (e.g., `/opsx-verify add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have implementation tasks (tasks artifact exists).
+   Include the schema used for each change if available.
+   Mark changes with incomplete tasks as "(In Progress)".
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - Which artifacts exist for this change
+
+3. **Get the change directory and load artifacts**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns the change directory and context files. Read all available artifacts from `contextFiles`.
+
+4. **Initialize verification report structure**
+
+   Create a report structure with three dimensions:
+   - **Completeness**: Track tasks and spec coverage
+   - **Correctness**: Track requirement implementation and scenario coverage
+   - **Coherence**: Track design adherence and pattern consistency
+
+   Each dimension can have CRITICAL, WARNING, or SUGGESTION issues.
+
+5. **Verify Completeness**
+
+   **Task Completion**:
+   - If tasks.md exists in contextFiles, read it
+   - Parse checkboxes: `- [ ]` (incomplete) vs `- [x]` (complete)
+   - Count complete vs total tasks
+   - If incomplete tasks exist:
+     - Add CRITICAL issue for each incomplete task
+     - Recommendation: "Complete task: <description>" or "Mark as done if already implemented"
+
+   **Spec Coverage**:
+   - If delta specs exist in `openspec/changes/<name>/specs/`:
+     - Extract all requirements (marked with "### Requirement:")
+     - For each requirement:
+       - Search codebase for keywords related to the requirement
+       - Assess if implementation likely exists
+     - If requirements appear unimplemented:
+       - Add CRITICAL issue: "Requirement not found: <requirement name>"
+       - Recommendation: "Implement requirement X: <description>"
+
+6. **Verify Correctness**
+
+   **Requirement Implementation Mapping**:
+   - For each requirement from delta specs:
+     - Search codebase for implementation evidence
+     - If found, note file paths and line ranges
+     - Assess if implementation matches requirement intent
+     - If divergence detected:
+       - Add WARNING: "Implementation may diverge from spec: <details>"
+       - Recommendation: "Review <file>:<lines> against requirement X"
+
+   **Scenario Coverage**:
+   - For each scenario in delta specs (marked with "#### Scenario:"):
+     - Check if conditions are handled in code
+     - Check if tests exist covering the scenario
+     - If scenario appears uncovered:
+       - Add WARNING: "Scenario not covered: <scenario name>"
+       - Recommendation: "Add test or implementation for scenario: <description>"
+
+7. **Verify Coherence**
+
+   **Design Adherence**:
+   - If design.md exists in contextFiles:
+     - Extract key decisions (look for sections like "Decision:", "Approach:", "Architecture:")
+     - Verify implementation follows those decisions
+     - If contradiction detected:
+       - Add WARNING: "Design decision not followed: <decision>"
+       - Recommendation: "Update implementation or revise design.md to match reality"
+   - If no design.md: Skip design adherence check, note "No design.md to verify against"
+
+   **Code Pattern Consistency**:
+   - Review new code for consistency with project patterns
+   - Check file naming, directory structure, coding style
+   - If significant deviations found:
+     - Add SUGGESTION: "Code pattern deviation: <details>"
+     - Recommendation: "Consider following project pattern: <example>"
+
+8. **Generate Verification Report**
+
+   **Summary Scorecard**:
+   ```
+   ## Verification Report: <change-name>
+
+   ### Summary
+   | Dimension    | Status           |
+   |--------------|------------------|
+   | Completeness | X/Y tasks, N reqs|
+   | Correctness  | M/N reqs covered |
+   | Coherence    | Followed/Issues  |
+   ```
+
+   **Issues by Priority**:
+
+   1. **CRITICAL** (Must fix before archive):
+      - Incomplete tasks
+      - Missing requirement implementations
+      - Each with specific, actionable recommendation
+
+   2. **WARNING** (Should fix):
+      - Spec/design divergences
+      - Missing scenario coverage
+      - Each with specific recommendation
+
+   3. **SUGGESTION** (Nice to fix):
+      - Pattern inconsistencies
+      - Minor improvements
+      - Each with specific recommendation
+
+   **Final Assessment**:
+   - If CRITICAL issues: "X critical issue(s) found. Fix before archiving."
+   - If only warnings: "No critical issues. Y warning(s) to consider. Ready for archive (with noted improvements)."
+   - If all clear: "All checks passed. Ready for archive."
+
+**Verification Heuristics**
+
+- **Completeness**: Focus on objective checklist items (checkboxes, requirements list)
+- **Correctness**: Use keyword search, file path analysis, reasonable inference - don't require perfect certainty
+- **Coherence**: Look for glaring inconsistencies, don't nitpick style
+- **False Positives**: When uncertain, prefer SUGGESTION over WARNING, WARNING over CRITICAL
+- **Actionability**: Every issue must have a specific recommendation with file/line references where applicable
+
+**Graceful Degradation**
+
+- If only tasks.md exists: verify task completion only, skip spec/design checks
+- If tasks + specs exist: verify completeness and correctness, skip design
+- If full artifacts: verify all three dimensions
+- Always note which checks were skipped and why
+
+**Output Format**
+
+Use clear markdown with:
+- Table for summary scorecard
+- Grouped lists for issues (CRITICAL/WARNING/SUGGESTION)
+- Code references in format: `file.ts:123`
+- Specific, actionable recommendations
+- No vague suggestions like "consider reviewing"
diff --git a/.opencode/skills/openspec-apply-change/SKILL.md b/.opencode/skills/openspec-apply-change/SKILL.md
new file mode 100644
index 00000000..628c56e1
--- /dev/null
+++ b/.opencode/skills/openspec-apply-change/SKILL.md
@@ -0,0 +1,156 @@
+---
+name: openspec-apply-change
+description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.1.1"
+---
+
+Implement tasks from an OpenSpec change.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx-apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - Context file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read the files listed in `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! Ready to archive this change.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.opencode/skills/openspec-archive-change/SKILL.md b/.opencode/skills/openspec-archive-change/SKILL.md
new file mode 100644
index 00000000..07e9df43
--- /dev/null
+++ b/.opencode/skills/openspec-archive-change/SKILL.md
@@ -0,0 +1,114 @@
+---
+name: openspec-archive-change
+description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.1.1"
+---
+
+Archive a completed change in the experimental workflow.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Check for delta specs at `openspec/changes/<name>/specs/`. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, execute /opsx-sync logic (use the openspec-sync-specs skill). Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create the archive directory if it doesn't exist:
+   ```bash
+   mkdir -p openspec/changes/archive
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move the change directory to archive
+
+   ```bash
+   mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Whether specs were synced (if applicable)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
+
+All artifacts complete. All tasks complete.
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use openspec-sync-specs approach (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.opencode/skills/openspec-bulk-archive-change/SKILL.md b/.opencode/skills/openspec-bulk-archive-change/SKILL.md
new file mode 100644
index 00000000..bf4214f2
--- /dev/null
+++ b/.opencode/skills/openspec-bulk-archive-change/SKILL.md
@@ -0,0 +1,246 @@
+---
+name: openspec-bulk-archive-change
+description: Archive multiple completed changes at once. Use when archiving several parallel changes.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.1.1"
+---
+
+Archive multiple completed changes in a single operation.
+
+This skill allows you to batch-archive changes, handling spec conflicts intelligently by checking the codebase to determine what's actually implemented.
+
+**Input**: None required (prompts for selection)
+
+**Steps**
+
+1. **Get active changes**
+
+   Run `openspec list --json` to get all active changes.
+
+   If no active changes exist, inform user and stop.
+
+2. **Prompt for change selection**
+
+   Use **AskUserQuestion tool** with multi-select to let user choose changes:
+   - Show each change with its schema
+   - Include an option for "All changes"
+   - Allow any number of selections (1+ works, 2+ is the typical use case)
+
+   **IMPORTANT**: Do NOT auto-select. Always let the user choose.
+
+3. **Batch validation - gather status for all selected changes**
+
+   For each selected change, collect:
+
+   a. **Artifact status** - Run `openspec status --change "<name>" --json`
+      - Parse `schemaName` and `artifacts` list
+      - Note which artifacts are `done` vs other states
+
+   b. **Task completion** - Read `openspec/changes/<name>/tasks.md`
+      - Count `- [ ]` (incomplete) vs `- [x]` (complete)
+      - If no tasks file exists, note as "No tasks"
+
+   c. **Delta specs** - Check `openspec/changes/<name>/specs/` directory
+      - List which capability specs exist
+      - For each, extract requirement names (lines matching `### Requirement: <name>`)
+
+4. **Detect spec conflicts**
+
+   Build a map of `capability -> [changes that touch it]`:
+
+   ```
+   auth -> [change-a, change-b]  <- CONFLICT (2+ changes)
+   api  -> [change-c]            <- OK (only 1 change)
+   ```
+
+   A conflict exists when 2+ selected changes have delta specs for the same capability.
+
+5. **Resolve conflicts agentically**
+
+   **For each conflict**, investigate the codebase:
+
+   a. **Read the delta specs** from each conflicting change to understand what each claims to add/modify
+
+   b. **Search the codebase** for implementation evidence:
+      - Look for code implementing requirements from each delta spec
+      - Check for related files, functions, or tests
+
+   c. **Determine resolution**:
+      - If only one change is actually implemented -> sync that one's specs
+      - If both implemented -> apply in chronological order (older first, newer overwrites)
+      - If neither implemented -> skip spec sync, warn user
+
+   d. **Record resolution** for each conflict:
+      - Which change's specs to apply
+      - In what order (if both)
+      - Rationale (what was found in codebase)
+
+6. **Show consolidated status table**
+
+   Display a table summarizing all changes:
+
+   ```
+   | Change               | Artifacts | Tasks | Specs   | Conflicts | Status |
+   |---------------------|-----------|-------|---------|-----------|--------|
+   | schema-management   | Done      | 5/5   | 2 delta | None      | Ready  |
+   | project-config      | Done      | 3/3   | 1 delta | None      | Ready  |
+   | add-oauth           | Done      | 4/4   | 1 delta | auth (!)  | Ready* |
+   | add-verify-skill    | 1 left    | 2/5   | None    | None      | Warn   |
+   ```
+
+   For conflicts, show the resolution:
+   ```
+   * Conflict resolution:
+     - auth spec: Will apply add-oauth then add-jwt (both implemented, chronological order)
+   ```
+
+   For incomplete changes, show warnings:
+   ```
+   Warnings:
+   - add-verify-skill: 1 incomplete artifact, 3 incomplete tasks
+   ```
+
+7. **Confirm batch operation**
+
+   Use **AskUserQuestion tool** with a single confirmation:
+
+   - "Archive N changes?" with options based on status
+   - Options might include:
+     - "Archive all N changes"
+     - "Archive only N ready changes (skip incomplete)"
+     - "Cancel"
+
+   If there are incomplete changes, make clear they'll be archived with warnings.
+
+8. **Execute archive for each confirmed change**
+
+   Process changes in the determined order (respecting conflict resolution):
+
+   a. **Sync specs** if delta specs exist:
+      - Use the openspec-sync-specs approach (agent-driven intelligent merge)
+      - For conflicts, apply in resolved order
+      - Track if sync was done
+
+   b. **Perform the archive**:
+      ```bash
+      mkdir -p openspec/changes/archive
+      mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
+      ```
+
+   c. **Track outcome** for each change:
+      - Success: archived successfully
+      - Failed: error during archive (record error)
+      - Skipped: user chose not to archive (if applicable)
+
+9. **Display summary**
+
+   Show final results:
+
+   ```
+   ## Bulk Archive Complete
+
+   Archived 3 changes:
+   - schema-management-cli -> archive/2026-01-19-schema-management-cli/
+   - project-config -> archive/2026-01-19-project-config/
+   - add-oauth -> archive/2026-01-19-add-oauth/
+
+   Skipped 1 change:
+   - add-verify-skill (user chose not to archive incomplete)
+
+   Spec sync summary:
+   - 4 delta specs synced to main specs
+   - 1 conflict resolved (auth: applied both in chronological order)
+   ```
+
+   If any failures:
+   ```
+   Failed 1 change:
+   - some-change: Archive directory already exists
+   ```
+
+**Conflict Resolution Examples**
+
+Example 1: Only one implemented
+```
+Conflict: specs/auth/spec.md touched by [add-oauth, add-jwt]
+
+Checking add-oauth:
+- Delta adds "OAuth Provider Integration" requirement
+- Searching codebase... found src/auth/oauth.ts implementing OAuth flow
+
+Checking add-jwt:
+- Delta adds "JWT Token Handling" requirement
+- Searching codebase... no JWT implementation found
+
+Resolution: Only add-oauth is implemented. Will sync add-oauth specs only.
+```
+
+Example 2: Both implemented
+```
+Conflict: specs/api/spec.md touched by [add-rest-api, add-graphql]
+
+Checking add-rest-api (created 2026-01-10):
+- Delta adds "REST Endpoints" requirement
+- Searching codebase... found src/api/rest.ts
+
+Checking add-graphql (created 2026-01-15):
+- Delta adds "GraphQL Schema" requirement
+- Searching codebase... found src/api/graphql.ts
+
+Resolution: Both implemented. Will apply add-rest-api specs first,
+then add-graphql specs (chronological order, newer takes precedence).
+```
+
+**Output On Success**
+
+```
+## Bulk Archive Complete
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+- <change-2> -> archive/YYYY-MM-DD-<change-2>/
+
+Spec sync summary:
+- N delta specs synced to main specs
+- No conflicts (or: M conflicts resolved)
+```
+
+**Output On Partial Success**
+
+```
+## Bulk Archive Complete (partial)
+
+Archived N changes:
+- <change-1> -> archive/YYYY-MM-DD-<change-1>/
+
+Skipped M changes:
+- <change-2> (user chose not to archive incomplete)
+
+Failed K changes:
+- <change-3>: Archive directory already exists
+```
+
+**Output When No Changes**
+
+```
+## No Changes to Archive
+
+No active changes found. Use `/opsx-new` to create a new change.
+```
+
+**Guardrails**
+- Allow any number of changes (1+ is fine, 2+ is the typical use case)
+- Always prompt for selection, never auto-select
+- Detect spec conflicts early and resolve by checking codebase
+- When both changes are implemented, apply specs in chronological order
+- Skip spec sync only when implementation is missing (warn user)
+- Show clear per-change status before confirming
+- Use single confirmation for entire batch
+- Track and report all outcomes (success/skip/fail)
+- Preserve .openspec.yaml when moving to archive
+- Archive directory target uses current date: YYYY-MM-DD-<name>
+- If archive target exists, fail that change but continue with others
diff --git a/.opencode/skills/openspec-continue-change/SKILL.md b/.opencode/skills/openspec-continue-change/SKILL.md
new file mode 100644
index 00000000..5060b2f7
--- /dev/null
+++ b/.opencode/skills/openspec-continue-change/SKILL.md
@@ -0,0 +1,118 @@
+---
+name: openspec-continue-change
+description: Continue working on an OpenSpec change by creating the next artifact. Use when the user wants to progress their change, create the next artifact, or continue their workflow.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.1.1"
+---
+
+Continue working on a change by creating the next artifact.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes sorted by most recently modified. Then use the **AskUserQuestion tool** to let the user select which change to work on.
+
+   Present the top 3-4 most recently modified changes as options, showing:
+   - Change name
+   - Schema (from `schema` field if present, otherwise "spec-driven")
+   - Status (e.g., "0/5 tasks", "complete", "no tasks")
+   - How recently it was modified (from `lastModified` field)
+
+   Mark the most recently modified change as "(Recommended)" since it's likely what the user wants to continue.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check current status**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand current state. The response includes:
+   - `schemaName`: The workflow schema being used (e.g., "spec-driven")
+   - `artifacts`: Array of artifacts with their status ("done", "ready", "blocked")
+   - `isComplete`: Boolean indicating if all artifacts are complete
+
+3. **Act based on status**:
+
+   ---
+
+   **If all artifacts are complete (`isComplete: true`)**:
+   - Congratulate the user
+   - Show final status including the schema used
+   - Suggest: "All artifacts created! You can now implement this change or archive it."
+   - STOP
+
+   ---
+
+   **If artifacts are ready to create** (status shows artifacts with `status: "ready"`):
+   - Pick the FIRST artifact with `status: "ready"` from the status output
+   - Get its instructions:
+     ```bash
+     openspec instructions <artifact-id> --change "<name>" --json
+     ```
+   - Parse the JSON. The key fields are:
+     - `context`: Project background (constraints for you - do NOT include in output)
+     - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+     - `template`: The structure to use for your output file
+     - `instruction`: Schema-specific guidance
+     - `outputPath`: Where to write the artifact
+     - `dependencies`: Completed artifacts to read for context
+   - **Create the artifact file**:
+     - Read any completed dependency files for context
+     - Use `template` as the structure - fill in its sections
+     - Apply `context` and `rules` as constraints when writing - but do NOT copy them into the file
+     - Write to the output path specified in instructions
+   - Show what was created and what's now unlocked
+   - STOP after creating ONE artifact
+
+   ---
+
+   **If no artifacts are ready (all blocked)**:
+   - This shouldn't happen with a valid schema
+   - Show status and suggest checking for issues
+
+4. **After creating an artifact, show progress**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After each invocation, show:
+- Which artifact was created
+- Schema workflow being used
+- Current progress (N/M complete)
+- What artifacts are now unlocked
+- Prompt: "Want to continue? Just ask me to continue or tell me what to do next."
+
+**Artifact Creation Guidelines**
+
+The artifact types and their purpose depend on the schema. Use the `instruction` field from the instructions output to understand what to create.
+
+Common artifact patterns:
+
+**spec-driven schema** (proposal → specs → design → tasks):
+- **proposal.md**: Ask user about the change if not clear. Fill in Why, What Changes, Capabilities, Impact.
+  - The Capabilities section is critical - each capability listed will need a spec file.
+- **specs/<capability>/spec.md**: Create one spec per capability listed in the proposal's Capabilities section (use the capability name, not the change name).
+- **design.md**: Document technical decisions, architecture, and implementation approach.
+- **tasks.md**: Break down implementation into checkboxed tasks.
+
+For other schemas, follow the `instruction` field from the CLI output.
+
+**Guardrails**
+- Create ONE artifact per invocation
+- Always read dependency artifacts before creating a new one
+- Never skip artifacts or create out of order
+- If context is unclear, ask the user before creating
+- Verify the artifact file exists after writing before marking progress
+- Use the schema's artifact sequence, don't assume specific artifact names
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
diff --git a/.opencode/skills/openspec-explore/SKILL.md b/.opencode/skills/openspec-explore/SKILL.md
new file mode 100644
index 00000000..147c7efb
--- /dev/null
+++ b/.opencode/skills/openspec-explore/SKILL.md
@@ -0,0 +1,290 @@
+---
+name: openspec-explore
+description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.1.1"
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first (e.g., start a change with `/opsx-new` or `/opsx-ff`). You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│   ┌────────┐         ┌────────┐        │
+│   │ State  │────────▶│ State  │        │
+│   │   A    │         │   B    │        │
+│   └────────┘         └────────┘        │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create one?"
+  → Can transition to `/opsx-new` or `/opsx-ff`
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Read existing artifacts for context**
+   - `openspec/changes/<name>/proposal.md`
+   - `openspec/changes/<name>/design.md`
+   - `openspec/changes/<name>/tasks.md`
+   - etc.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+   | Insight Type | Where to Capture |
+   |--------------|------------------|
+   | New requirement discovered | `specs/<capability>/spec.md` |
+   | Requirement changed | `specs/<capability>/spec.md` |
+   | Design decision made | `design.md` |
+   | Scope changed | `proposal.md` |
+   | New work identified | `tasks.md` |
+   | Assumption invalidated | Relevant artifact |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Handling Different Entry Points
+
+**User brings a vague idea:**
+```
+User: I'm thinking about adding real-time collaboration
+
+You: Real-time collab is a big space. Let me think about this...
+
+      COLLABORATION SPECTRUM
+      ════════════════════════════════════════════
+
+      Awareness          Coordination         Sync
+          │                   │                 │
+          ▼                   ▼                 ▼
+      ┌────────┐         ┌────────┐        ┌────────┐
+      │Presence│         │Cursors │        │  CRDT  │
+      │  "3    │         │ Multi  │        │Conflict│
+      │online" │         │ select │        │  free  │
+      └────────┘         └────────┘        └────────┘
+          │                   │                 │
+       trivial            moderate           complex
+
+      Where's your head at?
+```
+
+**User brings a specific problem:**
+```
+User: The auth system is a mess
+
+You: [reads codebase]
+
+     ┌─────────────────────────────────────────────┐
+     │              CURRENT AUTH FLOW              │
+     └─────────────────────────────────────────────┘
+                        │
+          ┌─────────────┼─────────────┐
+          ▼             ▼             ▼
+     ┌─────────┐  ┌─────────┐  ┌─────────┐
+     │ Google  │  │  GitHub │  │  Email  │
+     │  OAuth  │  │  OAuth  │  │  Magic  │
+     └────┬────┘  └────┬────┘  └────┬────┘
+          │             │             │
+          └─────────────┼─────────────┘
+                        ▼
+                  ┌───────────┐
+                  │  Session  │
+                  └─────┬─────┘
+                        │
+                        ▼
+                  ┌───────────┐
+                  │   Perms   │
+                  └───────────┘
+
+     I see three tangles. Which one's burning?
+```
+
+**User is stuck mid-implementation:**
+```
+User: /opsx-explore add-auth-system
+      The OAuth integration is more complex than expected
+
+You: [reads change artifacts]
+
+     You're on task 4: "Implement OAuth flow"
+
+     Let me trace what's involved...
+
+     [draws diagram, explores options, suggests paths]
+
+     Want to update the design to reflect this?
+     Or add a spike task to investigate?
+```
+
+**User wants to compare options:**
+```
+User: Should we use Postgres or SQLite?
+
+You: Generic answer is boring. What's the context?
+
+User: A CLI tool that tracks local dev environments
+
+You: That changes everything.
+
+     ┌─────────────────────────────────────────────────┐
+     │         CLI TOOL DATA STORAGE                  │
+     └─────────────────────────────────────────────────┘
+
+     Key constraints:
+     • No daemon running
+     • Must work offline
+     • Single user
+
+                  SQLite          Postgres
+     Deployment   embedded ✓      needs server ✗
+     Offline      yes ✓           no ✗
+     Single file  yes ✓           no ✗
+
+     SQLite. Not even close.
+
+     Unless... is there a sync component?
+```
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into action**: "Ready to start? /opsx-new or /opsx-ff"
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When it feels like things are crystallizing, you might summarize:
+
+```
+## What We Figured Out
+
+**The problem**: [crystallized understanding]
+
+**The approach**: [if one emerged]
+
+**Open questions**: [if any remain]
+
+**Next steps** (if ready):
+- Create a change: /opsx-new <name>
+- Fast-forward to tasks: /opsx-ff <name>
+- Keep exploring: just keep talking
+```
+
+But this summary is optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.opencode/skills/openspec-ff-change/SKILL.md b/.opencode/skills/openspec-ff-change/SKILL.md
new file mode 100644
index 00000000..519f356c
--- /dev/null
+++ b/.opencode/skills/openspec-ff-change/SKILL.md
@@ -0,0 +1,101 @@
+---
+name: openspec-ff-change
+description: Fast-forward through OpenSpec artifact creation. Use when the user wants to quickly create all artifacts needed for implementation without stepping through each one individually.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.1.1"
+---
+
+Fast-forward through artifact creation - generate everything needed to start implementation in one go.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change at `openspec/changes/<name>/`.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `outputPath`: Where to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "✓ Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx-apply` or ask me to implement to start working on the tasks."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, suggest continuing that change instead
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.opencode/skills/openspec-new-change/SKILL.md b/.opencode/skills/openspec-new-change/SKILL.md
new file mode 100644
index 00000000..37ac7ba1
--- /dev/null
+++ b/.opencode/skills/openspec-new-change/SKILL.md
@@ -0,0 +1,74 @@
+---
+name: openspec-new-change
+description: Start a new OpenSpec change using the experimental artifact workflow. Use when the user wants to create a new feature, fix, or modification with a structured step-by-step approach.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.1.1"
+---
+
+Start a new change using the experimental artifact-driven approach.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Determine the workflow schema**
+
+   Use the default schema (omit `--schema`) unless the user explicitly requests a different workflow.
+
+   **Use a different schema only if the user mentions:**
+   - A specific schema name → use `--schema <name>`
+   - "show workflows" or "what workflows" → run `openspec schemas --json` and let them choose
+
+   **Otherwise**: Omit `--schema` to use the default.
+
+3. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   Add `--schema <name>` only if the user requested a specific workflow.
+   This creates a scaffolded change at `openspec/changes/<name>/` with the selected schema.
+
+4. **Show the artifact status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+   This shows which artifacts need to be created and which are ready (dependencies satisfied).
+
+5. **Get instructions for the first artifact**
+   The first artifact depends on the schema (e.g., `proposal` for spec-driven).
+   Check the status output to find the first artifact with status "ready".
+   ```bash
+   openspec instructions <first-artifact-id> --change "<name>"
+   ```
+   This outputs the template and context for creating the first artifact.
+
+6. **STOP and wait for user direction**
+
+**Output**
+
+After completing the steps, summarize:
+- Change name and location
+- Schema/workflow being used and its artifact sequence
+- Current status (0/N artifacts complete)
+- The template for the first artifact
+- Prompt: "Ready to create the first artifact? Just describe what this change is about and I'll draft it, or ask me to continue."
+
+**Guardrails**
+- Do NOT create any artifacts yet - just show the instructions
+- Do NOT advance beyond showing the first artifact template
+- If the name is invalid (not kebab-case), ask for a valid name
+- If a change with that name already exists, suggest continuing that change instead
+- Pass --schema if using a non-default workflow
diff --git a/.opencode/skills/openspec-onboard/SKILL.md b/.opencode/skills/openspec-onboard/SKILL.md
new file mode 100644
index 00000000..8ee6cdcb
--- /dev/null
+++ b/.opencode/skills/openspec-onboard/SKILL.md
@@ -0,0 +1,529 @@
+---
+name: openspec-onboard
+description: Guided onboarding for OpenSpec - walk through a complete workflow cycle with narration and real codebase work.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.1.1"
+---
+
+Guide the user through their first complete OpenSpec workflow cycle. This is a teaching experience—you'll do real work in their codebase while explaining each step.
+
+---
+
+## Preflight
+
+Before starting, check if OpenSpec is initialized:
+
+```bash
+openspec status --json 2>&1 || echo "NOT_INITIALIZED"
+```
+
+**If not initialized:**
+> OpenSpec isn't set up in this project yet. Run `openspec init` first, then come back to `/opsx-onboard`.
+
+Stop here if not initialized.
+
+---
+
+## Phase 1: Welcome
+
+Display:
+
+```
+## Welcome to OpenSpec!
+
+I'll walk you through a complete change cycle—from idea to implementation—using a real task in your codebase. Along the way, you'll learn the workflow by doing it.
+
+**What we'll do:**
+1. Pick a small, real task in your codebase
+2. Explore the problem briefly
+3. Create a change (the container for our work)
+4. Build the artifacts: proposal → specs → design → tasks
+5. Implement the tasks
+6. Archive the completed change
+
+**Time:** ~15-20 minutes
+
+Let's start by finding something to work on.
+```
+
+---
+
+## Phase 2: Task Selection
+
+### Codebase Analysis
+
+Scan the codebase for small improvement opportunities. Look for:
+
+1. **TODO/FIXME comments** - Search for `TODO`, `FIXME`, `HACK`, `XXX` in code files
+2. **Missing error handling** - `catch` blocks that swallow errors, risky operations without try-catch
+3. **Functions without tests** - Cross-reference `src/` with test directories
+4. **Type issues** - `any` types in TypeScript files (`: any`, `as any`)
+5. **Debug artifacts** - `console.log`, `console.debug`, `debugger` statements in non-debug code
+6. **Missing validation** - User input handlers without validation
+
+Also check recent git activity:
+```bash
+git log --oneline -10 2>/dev/null || echo "No git history"
+```
+
+### Present Suggestions
+
+From your analysis, present 3-4 specific suggestions:
+
+```
+## Task Suggestions
+
+Based on scanning your codebase, here are some good starter tasks:
+
+**1. [Most promising task]**
+   Location: `src/path/to/file.ts:42`
+   Scope: ~1-2 files, ~20-30 lines
+   Why it's good: [brief reason]
+
+**2. [Second task]**
+   Location: `src/another/file.ts`
+   Scope: ~1 file, ~15 lines
+   Why it's good: [brief reason]
+
+**3. [Third task]**
+   Location: [location]
+   Scope: [estimate]
+   Why it's good: [brief reason]
+
+**4. Something else?**
+   Tell me what you'd like to work on.
+
+Which task interests you? (Pick a number or describe your own)
+```
+
+**If nothing found:** Fall back to asking what the user wants to build:
+> I didn't find obvious quick wins in your codebase. What's something small you've been meaning to add or fix?
+
+### Scope Guardrail
+
+If the user picks or describes something too large (major feature, multi-day work):
+
+```
+That's a valuable task, but it's probably larger than ideal for your first OpenSpec run-through.
+
+For learning the workflow, smaller is better—it lets you see the full cycle without getting stuck in implementation details.
+
+**Options:**
+1. **Slice it smaller** - What's the smallest useful piece of [their task]? Maybe just [specific slice]?
+2. **Pick something else** - One of the other suggestions, or a different small task?
+3. **Do it anyway** - If you really want to tackle this, we can. Just know it'll take longer.
+
+What would you prefer?
+```
+
+Let the user override if they insist—this is a soft guardrail.
+
+---
+
+## Phase 3: Explore Demo
+
+Once a task is selected, briefly demonstrate explore mode:
+
+```
+Before we create a change, let me quickly show you **explore mode**—it's how you think through problems before committing to a direction.
+```
+
+Spend 1-2 minutes investigating the relevant code:
+- Read the file(s) involved
+- Draw a quick ASCII diagram if it helps
+- Note any considerations
+
+```
+## Quick Exploration
+
+[Your brief analysis—what you found, any considerations]
+
+┌─────────────────────────────────────────┐
+│   [Optional: ASCII diagram if helpful]  │
+└─────────────────────────────────────────┘
+
+Explore mode (`/opsx-explore`) is for this kind of thinking—investigating before implementing. You can use it anytime you need to think through a problem.
+
+Now let's create a change to hold our work.
+```
+
+**PAUSE** - Wait for user acknowledgment before proceeding.
+
+---
+
+## Phase 4: Create the Change
+
+**EXPLAIN:**
+```
+## Creating a Change
+
+A "change" in OpenSpec is a container for all the thinking and planning around a piece of work. It lives in `openspec/changes/<name>/` and holds your artifacts—proposal, specs, design, tasks.
+
+Let me create one for our task.
+```
+
+**DO:** Create the change with a derived kebab-case name:
+```bash
+openspec new change "<derived-name>"
+```
+
+**SHOW:**
+```
+Created: `openspec/changes/<name>/`
+
+The folder structure:
+```
+openspec/changes/<name>/
+├── proposal.md    ← Why we're doing this (empty, we'll fill it)
+├── design.md      ← How we'll build it (empty)
+├── specs/         ← Detailed requirements (empty)
+└── tasks.md       ← Implementation checklist (empty)
+```
+
+Now let's fill in the first artifact—the proposal.
+```
+
+---
+
+## Phase 5: Proposal
+
+**EXPLAIN:**
+```
+## The Proposal
+
+The proposal captures **why** we're making this change and **what** it involves at a high level. It's the "elevator pitch" for the work.
+
+I'll draft one based on our task.
+```
+
+**DO:** Draft the proposal content (don't save yet):
+
+```
+Here's a draft proposal:
+
+---
+
+## Why
+
+[1-2 sentences explaining the problem/opportunity]
+
+## What Changes
+
+[Bullet points of what will be different]
+
+## Capabilities
+
+### New Capabilities
+- `<capability-name>`: [brief description]
+
+### Modified Capabilities
+<!-- If modifying existing behavior -->
+
+## Impact
+
+- `src/path/to/file.ts`: [what changes]
+- [other files if applicable]
+
+---
+
+Does this capture the intent? I can adjust before we save it.
+```
+
+**PAUSE** - Wait for user approval/feedback.
+
+After approval, save the proposal:
+```bash
+openspec instructions proposal --change "<name>" --json
+```
+Then write the content to `openspec/changes/<name>/proposal.md`.
+
+```
+Proposal saved. This is your "why" document—you can always come back and refine it as understanding evolves.
+
+Next up: specs.
+```
+
+---
+
+## Phase 6: Specs
+
+**EXPLAIN:**
+```
+## Specs
+
+Specs define **what** we're building in precise, testable terms. They use a requirement/scenario format that makes expected behavior crystal clear.
+
+For a small task like this, we might only need one spec file.
+```
+
+**DO:** Create the spec file:
+```bash
+mkdir -p openspec/changes/<name>/specs/<capability-name>
+```
+
+Draft the spec content:
+
+```
+Here's the spec:
+
+---
+
+## ADDED Requirements
+
+### Requirement: <Name>
+
+<Description of what the system should do>
+
+#### Scenario: <Scenario name>
+
+- **WHEN** <trigger condition>
+- **THEN** <expected outcome>
+- **AND** <additional outcome if needed>
+
+---
+
+This format—WHEN/THEN/AND—makes requirements testable. You can literally read them as test cases.
+```
+
+Save to `openspec/changes/<name>/specs/<capability>/spec.md`.
+
+---
+
+## Phase 7: Design
+
+**EXPLAIN:**
+```
+## Design
+
+The design captures **how** we'll build it—technical decisions, tradeoffs, approach.
+
+For small changes, this might be brief. That's fine—not every change needs deep design discussion.
+```
+
+**DO:** Draft design.md:
+
+```
+Here's the design:
+
+---
+
+## Context
+
+[Brief context about the current state]
+
+## Goals / Non-Goals
+
+**Goals:**
+- [What we're trying to achieve]
+
+**Non-Goals:**
+- [What's explicitly out of scope]
+
+## Decisions
+
+### Decision 1: [Key decision]
+
+[Explanation of approach and rationale]
+
+---
+
+For a small task, this captures the key decisions without over-engineering.
+```
+
+Save to `openspec/changes/<name>/design.md`.
+
+---
+
+## Phase 8: Tasks
+
+**EXPLAIN:**
+```
+## Tasks
+
+Finally, we break the work into implementation tasks—checkboxes that drive the apply phase.
+
+These should be small, clear, and in logical order.
+```
+
+**DO:** Generate tasks based on specs and design:
+
+```
+Here are the implementation tasks:
+
+---
+
+## 1. [Category or file]
+
+- [ ] 1.1 [Specific task]
+- [ ] 1.2 [Specific task]
+
+## 2. Verify
+
+- [ ] 2.1 [Verification step]
+
+---
+
+Each checkbox becomes a unit of work in the apply phase. Ready to implement?
+```
+
+**PAUSE** - Wait for user to confirm they're ready to implement.
+
+Save to `openspec/changes/<name>/tasks.md`.
+
+---
+
+## Phase 9: Apply (Implementation)
+
+**EXPLAIN:**
+```
+## Implementation
+
+Now we implement each task, checking them off as we go. I'll announce each one and occasionally note how the specs/design informed the approach.
+```
+
+**DO:** For each task:
+
+1. Announce: "Working on task N: [description]"
+2. Implement the change in the codebase
+3. Reference specs/design naturally: "The spec says X, so I'm doing Y"
+4. Mark complete in tasks.md: `- [ ]` → `- [x]`
+5. Brief status: "✓ Task N complete"
+
+Keep narration light—don't over-explain every line of code.
+
+After all tasks:
+
+```
+## Implementation Complete
+
+All tasks done:
+- [x] Task 1
+- [x] Task 2
+- [x] ...
+
+The change is implemented! One more step—let's archive it.
+```
+
+---
+
+## Phase 10: Archive
+
+**EXPLAIN:**
+```
+## Archiving
+
+When a change is complete, we archive it. This moves it from `openspec/changes/` to `openspec/changes/archive/YYYY-MM-DD-<name>/`.
+
+Archived changes become your project's decision history—you can always find them later to understand why something was built a certain way.
+```
+
+**DO:**
+```bash
+openspec archive "<name>"
+```
+
+**SHOW:**
+```
+Archived to: `openspec/changes/archive/YYYY-MM-DD-<name>/`
+
+The change is now part of your project's history. The code is in your codebase, the decision record is preserved.
+```
+
+---
+
+## Phase 11: Recap & Next Steps
+
+```
+## Congratulations!
+
+You just completed a full OpenSpec cycle:
+
+1. **Explore** - Thought through the problem
+2. **New** - Created a change container
+3. **Proposal** - Captured WHY
+4. **Specs** - Defined WHAT in detail
+5. **Design** - Decided HOW
+6. **Tasks** - Broke it into steps
+7. **Apply** - Implemented the work
+8. **Archive** - Preserved the record
+
+This same rhythm works for any size change—a small fix or a major feature.
+
+---
+
+## Command Reference
+
+| Command | What it does |
+|---------|--------------|
+| `/opsx-explore` | Think through problems before/during work |
+| `/opsx-new` | Start a new change, step through artifacts |
+| `/opsx-ff` | Fast-forward: create all artifacts at once |
+| `/opsx-continue` | Continue working on an existing change |
+| `/opsx-apply` | Implement tasks from a change |
+| `/opsx-verify` | Verify implementation matches artifacts |
+| `/opsx-archive` | Archive a completed change |
+
+---
+
+## What's Next?
+
+Try `/opsx-new` or `/opsx-ff` on something you actually want to build. You've got the rhythm now!
+```
+
+---
+
+## Graceful Exit Handling
+
+### User wants to stop mid-way
+
+If the user says they need to stop, want to pause, or seem disengaged:
+
+```
+No problem! Your change is saved at `openspec/changes/<name>/`.
+
+To pick up where we left off later:
+- `/opsx-continue <name>` - Resume artifact creation
+- `/opsx-apply <name>` - Jump to implementation (if tasks exist)
+
+The work won't be lost. Come back whenever you're ready.
+```
+
+Exit gracefully without pressure.
+
+### User just wants command reference
+
+If the user says they just want to see the commands or skip the tutorial:
+
+```
+## OpenSpec Quick Reference
+
+| Command | What it does |
+|---------|--------------|
+| `/opsx-explore` | Think through problems (no code changes) |
+| `/opsx-new <name>` | Start a new change, step by step |
+| `/opsx-ff <name>` | Fast-forward: all artifacts at once |
+| `/opsx-continue <name>` | Continue an existing change |
+| `/opsx-apply <name>` | Implement tasks |
+| `/opsx-verify <name>` | Verify implementation |
+| `/opsx-archive <name>` | Archive when done |
+
+Try `/opsx-new` to start your first change, or `/opsx-ff` if you want to move fast.
+```
+
+Exit gracefully.
+
+---
+
+## Guardrails
+
+- **Follow the EXPLAIN → DO → SHOW → PAUSE pattern** at key transitions (after explore, after proposal draft, after tasks, after archive)
+- **Keep narration light** during implementation—teach without lecturing
+- **Don't skip phases** even if the change is small—the goal is teaching the workflow
+- **Pause for acknowledgment** at marked points, but don't over-pause
+- **Handle exits gracefully**—never pressure the user to continue
+- **Use real codebase tasks**—don't simulate or use fake examples
+- **Adjust scope gently**—guide toward smaller tasks but respect user choice
diff --git a/.opencode/skills/openspec-sync-specs/SKILL.md b/.opencode/skills/openspec-sync-specs/SKILL.md
new file mode 100644
index 00000000..4c7e3aae
--- /dev/null
+++ b/.opencode/skills/openspec-sync-specs/SKILL.md
@@ -0,0 +1,138 @@
+---
+name: openspec-sync-specs
+description: Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.1.1"
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Find delta specs**
+
+   Look for delta spec files in `openspec/changes/<name>/specs/*/spec.md`.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+3. **For each delta spec, apply changes to main specs**
+
+   For each capability with a delta spec at `openspec/changes/<name>/specs/<capability>/spec.md`:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+4. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
diff --git a/.opencode/skills/openspec-verify-change/SKILL.md b/.opencode/skills/openspec-verify-change/SKILL.md
new file mode 100644
index 00000000..443ac5f7
--- /dev/null
+++ b/.opencode/skills/openspec-verify-change/SKILL.md
@@ -0,0 +1,168 @@
+---
+name: openspec-verify-change
+description: Verify implementation matches change artifacts. Use when the user wants to validate that implementation is complete, correct, and coherent before archiving.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.1.1"
+---
+
+Verify that an implementation matches the change artifacts (specs, tasks, design).
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have implementation tasks (tasks artifact exists).
+   Include the schema used for each change if available.
+   Mark changes with incomplete tasks as "(In Progress)".
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - Which artifacts exist for this change
+
+3. **Get the change directory and load artifacts**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns the change directory and context files. Read all available artifacts from `contextFiles`.
+
+4. **Initialize verification report structure**
+
+   Create a report structure with three dimensions:
+   - **Completeness**: Track tasks and spec coverage
+   - **Correctness**: Track requirement implementation and scenario coverage
+   - **Coherence**: Track design adherence and pattern consistency
+
+   Each dimension can have CRITICAL, WARNING, or SUGGESTION issues.
+
+5. **Verify Completeness**
+
+   **Task Completion**:
+   - If tasks.md exists in contextFiles, read it
+   - Parse checkboxes: `- [ ]` (incomplete) vs `- [x]` (complete)
+   - Count complete vs total tasks
+   - If incomplete tasks exist:
+     - Add CRITICAL issue for each incomplete task
+     - Recommendation: "Complete task: <description>" or "Mark as done if already implemented"
+
+   **Spec Coverage**:
+   - If delta specs exist in `openspec/changes/<name>/specs/`:
+     - Extract all requirements (marked with "### Requirement:")
+     - For each requirement:
+       - Search codebase for keywords related to the requirement
+       - Assess if implementation likely exists
+     - If requirements appear unimplemented:
+       - Add CRITICAL issue: "Requirement not found: <requirement name>"
+       - Recommendation: "Implement requirement X: <description>"
+
+6. **Verify Correctness**
+
+   **Requirement Implementation Mapping**:
+   - For each requirement from delta specs:
+     - Search codebase for implementation evidence
+     - If found, note file paths and line ranges
+     - Assess if implementation matches requirement intent
+     - If divergence detected:
+       - Add WARNING: "Implementation may diverge from spec: <details>"
+       - Recommendation: "Review <file>:<lines> against requirement X"
+
+   **Scenario Coverage**:
+   - For each scenario in delta specs (marked with "#### Scenario:"):
+     - Check if conditions are handled in code
+     - Check if tests exist covering the scenario
+     - If scenario appears uncovered:
+       - Add WARNING: "Scenario not covered: <scenario name>"
+       - Recommendation: "Add test or implementation for scenario: <description>"
+
+7. **Verify Coherence**
+
+   **Design Adherence**:
+   - If design.md exists in contextFiles:
+     - Extract key decisions (look for sections like "Decision:", "Approach:", "Architecture:")
+     - Verify implementation follows those decisions
+     - If contradiction detected:
+       - Add WARNING: "Design decision not followed: <decision>"
+       - Recommendation: "Update implementation or revise design.md to match reality"
+   - If no design.md: Skip design adherence check, note "No design.md to verify against"
+
+   **Code Pattern Consistency**:
+   - Review new code for consistency with project patterns
+   - Check file naming, directory structure, coding style
+   - If significant deviations found:
+     - Add SUGGESTION: "Code pattern deviation: <details>"
+     - Recommendation: "Consider following project pattern: <example>"
+
+8. **Generate Verification Report**
+
+   **Summary Scorecard**:
+   ```
+   ## Verification Report: <change-name>
+
+   ### Summary
+   | Dimension    | Status           |
+   |--------------|------------------|
+   | Completeness | X/Y tasks, N reqs|
+   | Correctness  | M/N reqs covered |
+   | Coherence    | Followed/Issues  |
+   ```
+
+   **Issues by Priority**:
+
+   1. **CRITICAL** (Must fix before archive):
+      - Incomplete tasks
+      - Missing requirement implementations
+      - Each with specific, actionable recommendation
+
+   2. **WARNING** (Should fix):
+      - Spec/design divergences
+      - Missing scenario coverage
+      - Each with specific recommendation
+
+   3. **SUGGESTION** (Nice to fix):
+      - Pattern inconsistencies
+      - Minor improvements
+      - Each with specific recommendation
+
+   **Final Assessment**:
+   - If CRITICAL issues: "X critical issue(s) found. Fix before archiving."
+   - If only warnings: "No critical issues. Y warning(s) to consider. Ready for archive (with noted improvements)."
+   - If all clear: "All checks passed. Ready for archive."
+
+**Verification Heuristics**
+
+- **Completeness**: Focus on objective checklist items (checkboxes, requirements list)
+- **Correctness**: Use keyword search, file path analysis, reasonable inference - don't require perfect certainty
+- **Coherence**: Look for glaring inconsistencies, don't nitpick style
+- **False Positives**: When uncertain, prefer SUGGESTION over WARNING, WARNING over CRITICAL
+- **Actionability**: Every issue must have a specific recommendation with file/line references where applicable
+
+**Graceful Degradation**
+
+- If only tasks.md exists: verify task completion only, skip spec/design checks
+- If tasks + specs exist: verify completeness and correctness, skip design
+- If full artifacts: verify all three dimensions
+- Always note which checks were skipped and why
+
+**Output Format**
+
+Use clear markdown with:
+- Table for summary scorecard
+- Grouped lists for issues (CRITICAL/WARNING/SUGGESTION)
+- Code references in format: `file.ts:123`
+- Specific, actionable recommendations
+- No vague suggestions like "consider reviewing"
diff --git a/devnotes.md b/devnotes.md
new file mode 100644
index 00000000..f516b3a6
--- /dev/null
+++ b/devnotes.md
@@ -0,0 +1,896 @@
+# Dev Notes
+
+I am trying to solve a peculiar issue that I am facing in my work. I manage a team of developers. I manage multiple projects at the same time.
+
+Facts:
+- The projects have different stages in their lifetime.
+- Select developers are assigned to a project.
+- These developers will have hours allocated for each project.
+- Essentially, there is a matrix of projects <-> devs.
+- Then there is the actual hours they burn in the project.
+
+What I need out of this product:
+- A way to get the allocations for each month for the team.
+- Get a forecast for future
+- Plan resourcing
+- Billing forecasts
+- Record keeping of PRojects, team, billing.
+
+So far I have jotted down some data. let us brainstorm and if needed I can share what I have noted (either all at once or as pieces.). The product is not named as of now.
+
+## Interview 1
+- How big is your team? (5 devs? 20?) 
+  - 10-15 folks
+- How many concurrent projects typically?
+  - 10-12 in various phases.
+- Is this just for you as a manager, or will devs also use it?
+  - I have ideated 4 personas. (Superuser, Managers, Devs and Top Brass)
+- Any existing tools you're using (spreadsheets, Jira, etc.)?
+  - I use a spreadsheet and it is a nightmare.
+
+- Allocation = planned hours (what you intend to assign)
+  - Example: A project might have 120 hours estimate. There, 10 hours for UX, 40 hrs for Dev, 30 hrs for QA, 10 hrs for PM, 10 hrs for Architect... These are the "allocations" for each person.
+- Actual/Burned = real hours worked (what actually happened)
+  - Yes.
+
+1. Do you track at project level, or sub-project/task level too?
+  - Project level only. 
+2. Any integration needs? (invoicing, accounting software)
+  - No.
+3. Technical preference? (web app, CLI, spreadsheet template)
+  - Web App
+
+
+---
+
+Now I have a clearer picture. Let me visualize this:
+Your Scope
+┌─────────────────────────────────────────────────────────────────┐
+│                    PERSONAS                                      │
+├─────────────────────────────────────────────────────────────────┤
+│                                                                  │
+│  SUPERUSER          MANAGERS              DEVS       TOP BRASS  │
+│  ────────           ───────              ─────       ─────────  │
+│  • Setup            • Plan resources     • See       • Reports │
+│  • Config           • Assign allocations • allocations│ • Forecasts│
+│  • Admin            • Track burn         • Log hours • Budget   │
+│                     • Report                                │
+│                                                                  │
+└─────────────────────────────────────────────────────────────────┘
+The Data Model
+┌─────────────────────────────────────────────────────────────────┐
+│                      PROJECTS                                    │
+│  ────────────────────────────────────────────────────────────   │
+│  • id, name, client                                             │
+│  • stage: Discovery → Design → Dev → QA → Deploy → Live        │
+│  • start_date, end_date (planned)                                │
+│  • billing_type: T&M / Fixed / Retainer                         │
+│  • hourly_rate (for billing)                                     │
+└───────────────────────┬─────────────────────────────────────────┘
+                        │
+                        │ 1:N (one project has many allocations)
+                        ▼
+┌─────────────────────────────────────────────────────────────────┐
+│                     ALLOCATIONS                                   │
+│  ────────────────────────────────────────────────────────────   │
+│  • id                                                            │
+│  • project_id                                                    │
+│  • role: UX, Dev, QA, PM, Architect                             │
+│  • developer_id (optional - can assign to role vs person)      │
+│  • estimated_hours                                               │
+│  • period: Jan 2026, Feb 2026... (monthly breakdown)            │
+└───────────────────────┬─────────────────────────────────────────┘
+                        │
+                        │ 1:N (track actuals against allocation)
+                        ▼
+┌─────────────────────────────────────────────────────────────────┐
+│                      ACTUALS                                      │
+│  ────────────────────────────────────────────────────────────   │
+│  • id                                                            │
+│  • allocation_id                                                 │
+│  • developer_id                                                  │
+│  • date                                                          │
+│  • hours_logged                                                  │
+│  • notes (optional)                                             │
+└─────────────────────────────────────────────────────────────────┘
+---
+
+I am skipping the schematic diagram for now because that did not capture the big picture.
+
+See my comments inline and later an explainer. 
+
+
+The Outputs You Need
+| Output | What It Means |
+|--------|---------------|
+| Monthly Allocation | Who is assigned to what, for how many hours, this month | ==> YES
+| Forecast | Given current allocations + burn rate → what does next 3 months look like? | ==> YES
+| Resource Plan | Who's overallocated? Underallocated? Available for new work? | ==> YES YES YES! This is the most important piece
+| Billing Forecast | Hours × Rate = Revenue per project/client | ==> YES
+| Record Keeping | Audit trail of what was planned vs what happened | ==> YES
+---
+Key Insights I'm Seeing
+1. Role vs Person allocation - You mentioned "10 hrs for Dev" not "10 hrs for Santhosh" - this is smart. Allows flexible staffing.
+  - WRONG. Please see my explainer in below section.
+2. The allocation breakdown - Your 120hr example (UX:10, Dev:40, QA:30, PM:10, Arch:10) is essentially a budget per project.
+  - Yes. Each person will have different billing rates. So, these allocations are $$$
+3. The "matrix" you mentioned - That's really a capacity view: "Dev A is 60% on Project X, 40% on Project Y this month"
+---
+A few more questions:
+1. Stages - Do projects move through stages sequentially, or work happens across stages in parallel?
+  - See the explainer section.
+2. Historical data - Will you import past projects, or start fresh?
+  - No. Its a Greenfield.
+3. MVP definition - What's the one thing this tool MUST do first? (e.g., just track allocations? Or include time entry?)
+  - 3 things. 
+    - Team setup
+    - Capacity planning 
+    - Project onboarding/status. 
+    - Respective reports of the above (see the outputs for each area in my explainer)
+  - Further, 
+    - Project to Resource allocation 
+    - Resources monthly allocation (because resources will be allocated for multiple projects for every month)
+    - Detailed reporting. 
+
+
+  **EXPLAINER**
+We need to revise this. Before all these, every month, I do a capacity planning. That is when I look at any holiday's team members' PTO plans etc.
+Capacity tracking
+•	List of team members
+  o	Team
+  o	Name
+  o	Hourly rate
+•	Days of month
+•	Holidays
+•	PTOs
+•	Weekends
+•	Availability
+  o	0
+  o	1
+  o	.5
+  o	Or percentage
+  
+Output of this exercise:
+•	**Individual capacity**
+•	**Summarize total available person days as Team capacity**
+•	**Total possible revenue**
+
+Project Data
+•	Status
+  o	NA/Support
+  o	Initial
+  o	Gathering estimates
+  o	Estimate pending approval
+  o	Estimate rework
+  o	Estimate approved
+  o	Funded
+  o	Scheduled
+  o	In-progress
+  o	Ready for prod
+  o	Done
+  o	On-hold
+  o	Cancelled
+•	Project ID
+•	Type – cost head
+  o	Project
+  o	Support
+•	Project title
+•	Approved estimate
+•	Forecasted effort
+
+Output of this part:
+•	**Month-wise forecast**
+•	**Total hours forecasted per month should be matching the respective month’s capacity**
+•	**Identifiers for over forecast, under forecast should be there**
+
+Resource Allocation
+For a selected month =>
+•	All projects forecasted for that month should display, with forecasted total hours.
+•	Hours allocated (calculated field)
+•	Allocation for the project (calculated % field)
+•	All resources in columns
+•	Allocated hours for each team member against the project.
+•	Indicators for over allocation of project and resource should be there.
+•	Have an untracked resource to accommodate the hours for someone from other team.
+
+
+Project-Resource mapping – actuals
+•	Similar to resource allocation
+•	Instead of allocation, actual times logged to be accumulated here (Monthly). --> This is a manual process. As of now, no integration with Time tracking tool.
+
+Output of this part:
+  - **Running utilization** --> A %age calculation of how much are they allocated vs How much capacity they had until now.
+  - **overall utilization** --> %age of how much they are allocated for each month.
+(displayed along with the capacity)
+
+---
+For team members
+•	Project allocations should be tabulated
+•	New allocations should be shown in notification
+•	Team member can split the allocated monthly hours for each project into weekly or daily splits.
+•	The same can be used for time logging.
+
+Output of this phase:
+  - Team members know how much they are allocated for each project --> Do not overcharge or undercharge any project.
+
+Overall Reports
+1.	Forecast summary – multi-period
+2.	Utilization summary
+3.	Cost summary
+
+We need a lot more debating before we touch the code. 
+
+
+## INTERVIEW 2
+
+Thank you for the detailed explainer - this changes my understanding significantly. Let me re-frame and ask some clarifying questions.
+---
+Revised Understanding
+┌─────────────────────────────────────────────────────────────────┐
+│              MONTHLY CAPACITY PLANNING CYCLE                    │
+├─────────────────────────────────────────────────────────────────┤
+│                                                                  │
+│    STEP 1: CAPACITY              STEP 2: PROJECTS               │
+│    ───────────────────           ─────────────────────          │
+│    • Team members               • Project status                │
+│    • Hourly rates               • Forecasted effort            │
+│    • Holidays/PTO               • Month-wise forecast          │
+│    • Availability %                                           │
+│         │                                                     │
+│         ▼                                                     │
+│    ┌─────────────────────────────────────────┐                │
+│    │  INDIVIDUAL CAPACITY                     │                │
+│    │  TEAM CAPACITY (person-days)             │                │
+│    │  POSSIBLE REVENUE ($)                    │                │
+│    └─────────────────────────────────────────┘                │
+│                                                                  │
+│    STEP 3: RESOURCE ALLOCATION (per month)                      │
+│    ────────────────────────────────────────────                 │
+│    • Which project gets which person, how many hours           │
+│    • Check: Project over-allocated? Person over-allocated?    │
+│                                                                  │
+│    STEP 4: ACTUALS (manual entry)                               │
+│    ─────────────────────────────────────                       │
+│    • What actually got logged                                  │
+│    • Running utilization vs Overall utilization                │
+│                                                                  │
+└─────────────────────────────────────────────────────────────────┘
+---
+
+Schematic diagram looks good.
+
+Questions for Clarification
+1. Availability model
+You mentioned 0, 1, 0.5 or percentage. Can you give me an example?
+- Is it like: A person is 100% available (1.0) = 8 hours/day? 
+- Or does 0.5 mean they only work 4 hours?
+- Or does it mean they're 50% on this project, 50% on another?
+==> Hours per day must be configurable per project. 1 means, 100% of a productive day. .5 means half of that and so on. I dont want to make it too granular thats why I had stops on 1, .5 and 0. Then there are H - holidays and O- weekend offs.
+
+2. The "untracked resource"
+You mentioned: "Have an untracked resource to accommodate the hours for someone from other team."
+- Is this for contractors/freelancers who aren't in your team list?
+- Or for internal overhead (meetings, training)?
+==> We might have some time allocated for DevOps team which is not part of my team but might out bill to another team. For that purpose.
+
+3. Team structure
+You have "Team" in the member list. Does this mean sub-teams? (e.g., "Frontend", "Backend", "Design")
+=> Yes. Read that as "Role"
+
+4. Project types
+"Cost head" - Project vs Support. What's the difference? Support = ongoing maintenance?
+=> Yes. Project is billed to another team. Support is ongoing Ops Support.
+
+5. Billing rates
+- Per person hourly rate - is this what you charge the client? 
+- Or is there a markup/profit margin calculation?
+=> Per person hourly rate.
+
+6. The "over/under forecast" indicators
+- Over forecast = project needs more hours than team capacity?
+- Under forecast = capacity exceeds project needs?
+- What action do you take when you see these?
+
+==> Scenario is like, there say there is a project of 100hrs that spans over 2 months. I may be put 80hrs in first month and rest in the following. What if I mess up the splitting? Aftereffects of those mess ups are... examples here:
+    - Over forecast = Approved estimate is 100hrs. but we allocated 120hrs. --> We are going to overcharge the customer. Unhappy customer/expect escalation
+    - Under forecast = Approved is 100hr, we allocated 80hrs. --> We will undercharge the customer. Happy customer, unhappy manager. Get ready for the song.
+    - No action needed. There must be a clear indicator that stands out. So that we can course correct the allocation.
+    
+    
+## INTERVIEW 3
+
+So "over/under forecast" is about allocation vs approved estimate, NOT allocation vs capacity. Right?
+==> In the project's context, yes. it is allocation vs approved. (For the future phases, there will be over/under forecase for resources - that will be based on individual's allocation vs their capacity. May be we can keep that aside for now.)
+Project "X" has Approved Estimate: 100hrs
+Month 1 allocation: 80hrs  → Under-forecast (OK) ==> Not OK. Because this money is my salary! We always try to be on par - 100%. If it is under-forecast, call that out. 
+Month 2 allocation: 50hrs  → Over-forecast (WARNING: will overcharge) ==> Yes. RED!
+
+Two more quick questions:
+1. Untracked resource billing - Is this billed at a different rate, or just tracked as a cost without revenue? ==> no billing tracked for them. it is like the joker in a deck of cards. We may just park some hours there.
+2. Time logging - For "Project-Resource mapping – actuals", do you just log total hours per month per person per project? Or daily? ==> MONTHLY, but might update weekly (incrementally)
+---
+Summary So Far
+┌─────────────────────────────────────────────────────────────────┐
+│                    CAPACIT (working name?)                      │ ==> I am unable to decide on a name. Need help. :D
+│              Resource Planning & Capacity Tool                  │
+├─────────────────────────────────────────────────────────────────┤
+│                                                                  │
+│  CORE CONCEPTS:                                                  │
+│  ─────────────                                                  │
+│  • Person has: Name, Role/Team, Hourly Rate, Availability      │ ==> CORRECT
+│  • Availability: 1=full day, .5=half day, 0=unavailable        │ ==> CORRECT. 0 = unavailable or PTO
+│  • Plus Holidays (H), Weekends (O)                              │ ==> CORRECT
+│                                                                  │
+│  PROJECT:                                                        │
+│  ───────                                                         │
+│  • Status: NA/Support → Initial → Estimates → Funded → ...     │ ==> CORRECT
+│  • Type: Project (billable) / Support (ops)                    │ ==> CORRECT
+│  • Approved Estimate: total hours approved                      │ ==> CORRECT
+│  • Forecasted Effort: how you split across months              │ ==> CORRECT
+│                                                                  │
+│  ALLOCATION:                                                     │
+│  ──────────                                                     │
+│  • Month-by-month, project-by-person hours                     │ ==> CORRECT
+│  • Compare to approved estimate → over/under indicator         │ ==> CORRECT
+│  • Untracked resource bucket for external team time            │ ==> CORRECT
+│                                                                  │
+│  ACTUALS:                                                        │
+│  ───────                                                         │
+│  • Manual time entry (monthly aggregate)                       │ ==> CORRECT
+│  • Running utilization vs Overall utilization                  │ ==> CORRECT
+│                                                                  │
+│  REPORTS:                                                        │
+│  ────────                                                        │
+│  • Forecast summary (multi-period)                              │ ==> CORRECT
+│  • Utilization summary                                          │ ==> CORRECT
+│  • Cost summary                                                 │ ==> CORRECT
+│                                                                  │
+└─────────────────────────────────────────────────────────────────┘
+
+If it is good to record it now, here are some things I would like to call out:
+- All reports must be highly customizable with filters.
+- Need to define taxonomy for all configurable items, and must have a master data for those.
+- Support for multi-tenancy.
+
+Yes, it captures the essense. When do we get into the weeds?
+
+## RESPONSE
+
+Excellent - this is great detail. Let me capture these additions:
+Additions Noted
+| Requirement | What It Means |
+|-------------|---------------|
+| Customizable Reports | Filters by team, person, project, status, date range, type |
+| Master Data / Taxonomy | Configurable lists for roles, statuses, types, availability options |
+| Multi-tenancy | Multiple organizations can use the same instance, isolated from each other |
+---
+Naming Ideas
+Since your directory is already capacit, here are some options:
+| Name | Rationale |
+|------|-----------|
+| Capacit | Your directory name - simple, relates to capacity |
+| TeamPulse | Rhythm of the team, utilization heartbeat |
+| ResourceIQ | Smart resource planning |
+| CapacityOS | Operating system for capacity |
+Or something entirely different? I'm bad at naming - what resonates with you?
+
+==> My pick: Headroom
+It's the word managers actually say ("do we have headroom for this?"), it immediately signals capacity planning, and it's memorable without being try-hard. It also captures the over/under allocation anxiety that's central to the whole tool.
+Close runner-up would be Margin — because this tool is literally about protecting margin through accurate forecasting.
+---
+Before We Build
+Since you said "before starting the build," let me confirm what's left to debate:
+Architectural decisions:
+1. Multi-tenancy approach - For MVP, should we build multi-tenant from day 1, or start single-tenant and add later?
+   - My recommendation: Start single-tenant. Add tenant_id column when needed. Premature multi-tenancy adds complexity. ==> AGREED
+2. Tech stack - Any preference? (e.g., Next.js, React + Node, etc.) ==> I would like to go with Laravel based stack. Thoughts? 
+3. Database - Any preference? (SQLite for local, PostgreSQL for production?) ==> Postgres from the start.
+4. Authentication - Do you need login/accounts, or is this something you run locally? ==> Login accounts.
+
+From get go, everything must be containerised. Do not add any proxy manager (NPM, Caddy, or Traefik). My environment already runs an NPM.
+
+Should we discuss about the thumb rules/standing instructions for the project now?
+
+## INTERVIEW 4
+
+Can you give me some examples of what you have in mind? Are you thinking about:
+1. Coding standards - PHP/Laravel conventions, naming, code organization            ==> AGREED
+2. Project structure - How to organize controllers, models, services            ==> AGREED
+3. API design - REST conventions, response formats, error handling
+4. Database conventions - Naming tables/columns, migrations approach
+5. Git workflow - Branch naming, commit messages, PR process
+6. Testing requirements - Unit tests, feature tests, coverage targets
+7. Documentation - Code comments, API docs, README expectations
+
+==> While we can agree on industry standard practices for the above items, once we have everything settled and ready to start, the project level config.yml (OpenSpec) must be updated to have the following:
+1. Every change must have unit tests, E2E test, regression tests (with other scope documents) added to it whether I prompt it or not.
+2. Changes must end with code review for style, standard, security.
+3. Verification (/opsx-verify) must trigger checking of uncovered code (code that is not tested).
+4. Commits must be granular. One fix - one commit.
+5. Tests run in a progressive loop. Test -> Create issue in repo -> After test is completed -> Fix the issue -> Retest + Regression test. This must be done until all issues are fixed. I know this will be a time taking process. But I believe it will be worth it. Thoughts?
+
+We need to decide on the E2E framework.
+I chose Laravel because of my PHP background. Debate me if that is not a good choice. May be Laravel + Svelte? Or Sveltekit itself?
+
+```Switched over to Sonnet 4.5```
+
+## INTERVIEW 5
+Part 1: Project-Level Standing Instructions (config.yml)
+Your 5 points are solid and disciplined. This is a high-bar, quality-focused workflow. My thoughts:
+On point 5 (test → issue → fix → retest loop):
+This is rigorous, but I want to make sure we're aligned on scope. You're describing a defect-driven test cycle, which is excellent for catching edge cases. My question:
+- Is this for ALL tests, or specifically for E2E/integration tests where bugs surface?
+- Unit tests are usually fixed in the same commit (they're fast), but E2E bugs might need a separate issue. Clarify?
+==> I agree. Let us go for a kill only in E2E and Integration.
+
+Concerns I'd raise:
+- This workflow is thorough but can slow velocity. For an MVP, consider whether you want this rigor from day 1, or if we should start with "every change has tests" and add the issue-loop in phase 2?
+- The code coverage check in /opsx-verify is smart, but which threshold? (80%? 90%?)
+My recommendation: 
+Agree to all 5 points, but for MVP we start with "every test must pass before merge" and defer the granular issue-tracking loop to phase 2 when you have more tests to manage. Thoughts? ===>Agreed
+---
+Part 2: Frontend Stack
+You chose Laravel for the backend (good choice for PHP background). Now frontend:
+Option 1: Laravel + Blade Templates
+- Pros: Everything in one framework, you know Laravel
+- Cons: Less interactive UI, harder to build responsive dashboards
+Option 2: Laravel + Vue.js
+- Pros: Interactive UI, Laravel ecosystem integrates well, good for dashboards
+- Cons: Adds JS complexity, Vue has opinions
+Option 3: Laravel API + SvelteKit (separate)     ==> I will choose this.
+- Pros: SvelteKit is modern, reactive, great for dashboards
+- Cons: Two separate projects, more deployment complexity, you'd be learning Svelte
+Option 4: Laravel API + React
+- Pros: React is industry standard, great dashboard libraries
+- Cons: You'd be learning React, more opinionated
+---
+My honest take:
+For Headroom (a data-heavy dashboard with charts, filters, real-time updates):
+- Laravel + Vue.js = best sweet spot. You get interactivity without leaving the Laravel ecosystem. Vue is approachable.
+- SvelteKit separate = tempting but adds deployment complexity for MVP. Save for later if you want to refactor.
+What's your instinct? Do you want to stay in the Laravel world (Blade/Vue), or are you open to learning a new frontend framework? ===> Sveltekit it is!
+---
+Questions Before We Formalize
+1. Test threshold - What code coverage % for /opsx-verify?     => Let us call it >70%
+2. Issue-loop timing - MVP (simple tests only) or from day 1 (rigorous)?       =>agreed with you in above section.
+3. Frontend - Laravel + Vue, or something else? ==> Laravel + Sveltekit
+
+Is there anything else we need to talk about? the stack/infrastructure/choice of UI framework/something that I dont know? 
+Once we align here, I'll capture everything in OpenSpec and we can start building.
+▣  Plan · claude-haiku-4-5 · 11.0s
+
+## INTERVIEW 6
+
+Remaining Architectural Decisions
+1. API Communication
+- Laravel API → SvelteKit via REST or GraphQL?   ==> It is already heavy. So, I will stick to REST.
+- My take: REST is simpler for MVP. GraphQL adds tooling complexity.  ==> AGREE
+- Should we use Laravel API Resources for consistent JSON responses?  ==> YES. Resources.
+2. Authentication Architecture
+- Session-based (Laravel sessions) or Token-based (JWT)?
+- My take: Session-based is easier for same-origin setup. JWT if you ever want mobile apps later.  ==> I will go with JWT.
+3. Real-time Updates
+- You mentioned "monthly updates, weekly increments" on actuals. Do you need live updates (WebSockets), or is polling OK? 
+- My take: Start with polling (SvelteKit can refetch on interval). Add WebSockets if needed. ==> I dont think we need to sweat on it. Go with a basic implementation. Polling is good enough.
+4. Containerization Details
+- Single container (Laravel + SvelteKit) or two containers (separate)?
+- My take: Two containers (Laravel API on port 3000, SvelteKit on port 5173, both behind your NPM reverse proxy).  Cleaner separation.  ==> Agreed
+- Volume mounts for PostgreSQL? ==> Yes. Mount it to a directory --> Good for portability.
+5. Development Environment
+- Docker Compose for local dev, or native Laravel/Node setup? 
+- My take: Docker Compose from the start. Ensures prod parity.  ==> 100% agree. If possible, we should have at least the local dev avoid building after every change (may be code mounted)
+6. Environment Configuration
+- .env files or Docker secrets? 
+- My take: .env files for local, Docker secrets in prod (when you deploy).  ==> .env everywhere
+---
+What You Might Not Have Considered
+State Management (SvelteKit)
+- Svelte stores for client-side state? Or fetch-as-needed?
+- My recommendation: Start with fetch-as-needed, add stores only if you have complex shared state. ==> Agreed.
+Error Handling & Validation
+- Laravel's validation → SvelteKit form handling
+- Should we use something like Zod for shared validation schemas?
+- My recommendation: Laravel validates, SvelteKit shows errors. Simple. ==> I agree. But how about something like Superform or Zod?
+Reporting & Export
+- You mentioned "customizable reports" - will users need PDF/CSV exports? 
+- My recommendation: Start with on-screen reports, add exports in phase 2. ==> Good to have at this time.
+Search & Filtering
+- Database-driven (query filters) or in-memory (load all, filter client)? 
+- My recommendation: Database queries for large datasets, client-side for small. ==> Agreed.
+---
+
+Should we talk about a caching layer?
+
+---
+Once these are settled, we're ready to formalize in OpenSpec and start building.
+▣  Plan · claude-haiku-4-5 · 9.6s
+
+## INTERVIEW 7
+
+Excellent progress. Let me address the remaining items:
+---
+Error Handling & Validation
+Superforms + Zod is a great choice. Here's why:
+Laravel validates API input (first layer)
+        ↓
+SvelteKit receives response with errors
+        ↓
+Zod schema mirrors Laravel validation (type safety)
+        ↓
+Superforms handles form state + errors (UX)
+This approach:
+- Ensures type safety on the frontend
+- Superforms handles loading states, optimistic updates
+- Single source of truth for validation logic (Zod)
+- Users see errors immediately
+Recommendation: Use Zod + Superforms. Define schemas once, use everywhere.
+---
+Report Exports (PDF/CSV)
+You said "Good to have at this time" - I want to clarify:
+Should exports be in MVP scope, or phase 2?
+Reasons to include in MVP:
+- Managers often need to send reports to stakeholders
+- Relatively straightforward (HTML → PDF via wkhtmltopdf or similar)
+- CSV is trivial
+Reasons to defer:
+- Adds complexity to reporting UI
+- MVP value is the interactive dashboard, not exports
+- Can add in 1-2 sprints
+My recommendation: Start with on-screen reports only. Add exports in phase 2 (1-2 weeks later). This keeps MVP scope tight.
+What's your call?
+---
+Caching Layer
+Yes, good question. In what context?
+Option 1: Database Query Caching
+- Cache expensive queries (e.g., capacity calculations, forecasts)
+- Tools: Redis, or Laravel's built-in cache
+- When to invalidate: When allocations/actuals change
+Option 2: API Response Caching
+- Cache GET endpoints (reports, summaries)
+- SvelteKit can cache too (via response headers)
+Option 3: Full-page caching
+- Cache entire dashboard views
+- Overkill for MVP
+My recommendation for MVP:
+- Start without caching. Queries are likely fast until you have years of data.
+- Add Redis in phase 2 if dashboard feels slow, or when you have 1000+ projects.
+Does that make sense, or do you anticipate needing caching from day 1?
+---
+Final Architectural Summary
+┌─────────────────────────────────────────────────────────┐
+│              HEADROOM ARCHITECTURE                       │
+├─────────────────────────────────────────────────────────┤
+│                                                          │
+│  BACKEND                                                 │
+│  ────────                                                │
+│  • Laravel API (port 3000)                              │
+│  • PostgreSQL (mounted volume)                          │
+│  • Laravel Resources for JSON responses                 │
+│  • JWT authentication                                   │
+│  • Docker container + .env config                       │
+│                                                          │
+│  FRONTEND                                                │
+│  ────────                                                │
+│  • SvelteKit (port 5173)                                │
+│  • Zod + Superforms (validation & forms)                │
+│  • Client-side stores (minimal, as-needed)              │
+│  • REST API calls (polling for updates)                 │
+│  • Docker container + .env config                       │
+│                                                          │
+│  DEPLOYMENT                                              │
+│  ──────────                                              │
+│  • Docker Compose (local dev, code-mounted)             │
+│  • NPM reverse proxy (already running)                   │
+│  • .env files (all environments)                        │
+│                                                          │
+│  QUALITY                                                 │
+│  ───────                                                 │
+│  • All changes: Unit + E2E + Regression tests           │
+│  • Code coverage: >70% (checked in /opsx-verify)        │
+│  • E2E failures: create issue, fix, retest (phase 2)    │
+│  • Granular commits (one fix = one commit)              │
+│  • Code review (style, security, standards)             │
+│                                                          │
+└─────────────────────────────────────────────────────────┘
+---
+Before We Formalize
+Just to confirm:
+1. Exports - Defer to phase 2? Or include in MVP?  ==> Phase 2
+2. Caching - Start without, add in phase 2?   ==> Query caching and Response caching on Redis from Day 1. No need to sweat on refactoring it everywhere.
+3. Anything else that feels unresolved?
+Once these are locked, I'll create the OpenSpec change and we start building.
+
+
+## INTERVIEW 8
+
+Great - Redis caching from day 1 is smart. No technical debt there.
+Now, frontend libraries - let me ask some clarifying questions:
+---
+Frontend Libraries - Key Questions
+1. Charts & Visualization
+You need dashboards with:
+- Monthly capacity/allocation views (tables with conditional formatting)
+- Forecast charts (line charts across months)
+- Utilization percentages (gauges, progress bars)
+- Cost summaries (bar charts, pie charts)
+Which do you prefer?
+- Recharts - React-style, works well with Svelte, good Svelte integration
+- Chart.js - Simpler, lightweight
+- Plotly - More advanced
+- Apache ECharts - Powerful, steeper learning curve
+My recommendation: Recharts. Good balance of power and simplicity.  ==> Agreed
+---
+2. UI Component Library
+Do you want a pre-built component system?
+- Shadcn/ui - Headless, customizable, works with SvelteKit
+- DaisyUI - Tailwind-based, opinionated but fast
+- Svelte Material UI - Full-featured
+- Build custom with Tailwind - More control, slower initial development
+My recommendation: Shadcn/ui (if you want polish) or DaisyUI (if you want speed). I'd lean DaisyUI for MVP - faster to build dashboards.  ==> Daisy it is.
+---
+3. Tables & Data Grid
+You need:
+- Sortable, filterable tables (allocations, actuals)
+- Inline editing (allocations)
+- Pagination or virtualization (for large datasets)
+Options:
+- TanStack Table (React Table) - Headless, works with Svelte, very powerful
+- Svelte DataTable - Simpler, less flexible
+- Build custom with Svelte - Full control
+My recommendation: TanStack Table. It's the industry standard and works great with SvelteKit. ==> I am not familiar with this. but I will go with your recommendation.
+---
+4. Form Handling
+You chose Superforms + Zod (good). Should we add:
+- SvelteKit Form Actions - Native SvelteKit approach, works seamlessly with Superforms
+- Or direct API calls?
+My recommendation: Use SvelteKit Form Actions + Superforms. Native, elegant, built for this. ==> Agreed.
+---
+5. Styling
+- Tailwind CSS - The standard, highly recommended
+- Other?
+My recommendation: Tailwind + DaisyUI. Fast development, consistent theming.  ==> Agreed.
+---
+6. State Management for Complex Flows
+You said fetch-as-needed, but do you want:
+- SvelteKit stores for things like: "current month filter", "selected project"?
+- Or always fetch from API?
+My recommendation: Use Svelte stores for UI state (filters, modals), API queries for data.  ==> Agreed.
+---
+My Recommended Frontend Stack
+┌─────────────────────────────────────────────────────────┐
+│            FRONTEND TECH STACK                           │
+├─────────────────────────────────────────────────────────┤
+│                                                          │
+│  Framework:           SvelteKit                         │
+│  Styling:             Tailwind CSS + DaisyUI            │
+│  Charts:              Recharts                          │
+│  Tables:              TanStack Table (React Table)      │
+│  Forms:               Superforms + Zod                  │
+│  Form Actions:        SvelteKit native                  │
+│  State:               Svelte stores (minimal)           │
+│  HTTP Client:         fetch (native)                    │
+│  Testing:             Vitest (unit) + Playwright (E2E) │
+│                                                          │
+└─────────────────────────────────────────────────────────┘
+
+
+▣  Plan · claude-haiku-4-5 · 10.8s
+
+
+## INTERVIEW 9
+
+You're right to do a final review before locking in. Let me run through the complete architecture holistically:
+---
+Complete Headroom Architecture - Final Review
+BACKEND (Laravel)
+✓ Framework:          Laravel 11
+✓ Database:           PostgreSQL (Docker volume mount)
+✓ API Design:         REST with Laravel Resources
+✓ Authentication:     JWT (token-based)
+✓ Caching:            Redis (Query + Response caching from day 1)
+✓ Testing:            PHPUnit (unit) + Pest/PHPUnit (feature)
+✓ Containerization:   Docker (port 3000)
+✓ Environment:        .env files (all environments)
+✓ Code Standards:     PSR-12, Laravel conventions
+Potential Gap I'm seeing:
+- Background Jobs - Will you need queuing for async tasks? (e.g., report generation, notifications)
+- My take for MVP: Start without. Add Laravel Queue (Redis-backed) in phase 2 if needed. 
+---
+FRONTEND (SvelteKit)
+✓ Framework:          SvelteKit
+✓ Styling:            Tailwind CSS + DaisyUI
+✓ Charts:             Recharts
+✓ Tables:             TanStack Table (React Table)
+✓ Forms:              Superforms + Zod + SvelteKit Form Actions
+✓ State:              Svelte stores (minimal, UI state only)
+✓ HTTP:               fetch (native)
+✓ Testing:            Vitest (unit) + Playwright (E2E)
+✓ Containerization:   Docker (port 5173)
+✓ Environment:        .env files
+Potential Gap I'm seeing:
+- Notifications/Alerts - When allocation changes, do devs get notified?
+- My take for MVP: Skip notifications. Add in phase 2.
+---
+DEPLOYMENT & INFRASTRUCTURE
+✓ Local Dev:          Docker Compose (code-mounted, hot reload)
+✓ Reverse Proxy:      Your existing NPM (no Caddy/Traefik)
+✓ Container Ports:    Laravel 3000, SvelteKit 5173
+✓ Database Volumes:   Mounted for portability
+✓ Secrets:            .env files (no Docker secrets for MVP)
+---
+QUALITY STANDARDS (OpenSpec config)
+✓ Testing:            Unit + E2E + Regression on every change
+✓ Coverage:           >70% (checked in /opsx-verify)
+✓ Code Review:        Style, security, standards
+✓ Commits:            Granular (one fix = one commit)
+✓ Issue Loop:         E2E/integration only (phase 2 for rigor)
+✓ No shortcuts:       Pre-commit hooks for linting/formatting
+---
+DATA MODEL (What we're tracking)
+✓ Teams/Roles:        Name, hourly rate
+✓ Team Members:       Name, role, availability (1, 0.5, 0)
+✓ Holidays/PTO:       Calendar per month
+✓ Projects:           Status, type, approved estimate, forecasted effort
+✓ Allocations:        Project → Person → Hours (monthly)
+✓ Actuals:            Project → Person → Hours logged (monthly)
+✓ Untracked Resource: Bucket for external team time (no billing)
+---
+What I Think Might Be Missing
+1. Reporting Architecture
+You need reports (forecast, utilization, cost). Should we:
+- Pre-calculate and cache? (query once, serve multiple times)
+- Or calculate on-demand? (fresh, slower)
+- My recommendation: On-demand for MVP (cleaner logic). Cache in phase 2 if slow.
+2. Data Validation Rules
+- Can you allocate more hours than approved estimate? (I assume no - red flag)
+- Can you log actuals after project is "Done"? (I assume no)
+- Can you delete a team member with active allocations? (I assume no)
+- Should we define these business rules in OpenSpec before building?
+3. Role Hierarchies
+You mentioned 4 personas: Superuser, Managers, Devs, Top Brass
+- Do managers see only their team's projects?
+- Do devs see only their allocations?
+- Do Top Brass see everything (read-only)?
+- Should we define these permissions clearly?
+4. API Versioning
+- Should the Laravel API be versioned (e.g., /api/v1/)?
+- My recommendation: Start without versioning, add in phase 2.
+5. Audit Logging
+- Do you need to track who changed what and when?
+- My recommendation: Start without. Add audit logs in phase 2 if compliance matters.
+---
+Questions Before Locking In
+1. Data Validation Rules - Should we document these in OpenSpec?   ==> OpenSpec document must have all required data. I believe we need it there for verification and regression tests. Thoughts?
+2. Permission Model - Should we define role-based access rules upfront?  ==> Of course, RBAC is required.
+3. Background Jobs - Will you need async processing for any MVP features?  ==> No. Since we have laravel and redis ready, it is just a matter of flipping the switch.
+4. Notifications - Should team members get alerts on allocation changes? ==> Wont it become a technical debt? How big the lift will be to at least set up the wiring for notifications (websocket setup and one notification implemented as a proof of concept?)
+---
+Honestly, I think you're 99% locked in. These last questions are minor and can mostly be decided during implementation. But I want to make sure we're not missing anything critical before you commit to this stack.
+What's your feeling? Anything jump out as "we forgot about this"?
+
+
+## INTERVIEW 10
+
+Excellent questions. Let me address them:
+---
+1. Data Validation Rules in OpenSpec
+Absolutely. In fact, this is critical for your workflow. Here's why:
+Validation Rules (in OpenSpec)
+        ↓
+Inform API implementation (Laravel validation)
+        ↓
+Inform test cases (unit + E2E)
+        ↓
+Used in /opsx-verify to check coverage
+Examples of rules we should document:
+- Can't allocate more hours than approved estimate (per project, per month)
+- Can't allocate negative hours
+- Can't log actuals after project status is "Done"
+- Can't delete team member with active allocations
+- All required fields must be populated
+- Hourly rate must be > 0
+- Availability must be 0, 0.5, or 1.0
+My recommendation: Create a validation-rules.md in the OpenSpec change. This becomes your test oracle.
+---
+2. RBAC (Role-Based Access Control)
+Yes, define upfront. Let me clarify the 4 personas:
+| Persona | Can Do | Cannot Do |
+|---------|--------|-----------|
+| Superuser | Everything (setup, config, all projects) | Nothing restricted |
+| Manager | Create/edit projects, allocate resources, view team's projects, approve estimates | Edit other managers' data, change team members |
+| Developer | View own allocations, log hours, view project details | Allocate resources, change estimates |
+| Top Brass | View all reports (read-only), forecast summaries, utilization | Modify anything |
+Question for you: 
+- Can a Manager only see projects they're assigned to, or all projects?
+- Can a Manager allocate resources to projects outside their team?
+---
+3. Background Jobs
+Agreed. No async needed for MVP. Redis + Laravel Queue are wired and ready if needed later.
+---
+4. Notifications - The Real Question
+This is interesting. Let me break down the lift:
+WebSocket Setup (One-time cost)
+- Laravel Broadcasting with Redis adapter: ~2 hours
+- SvelteKit WebSocket client: ~1 hour
+- Docker networking: ~30 min
+- Total: ~3.5 hours
+First Notification (Allocation Changed)
+- Backend event + listener: ~1 hour
+- Frontend listener + toast: ~30 min
+- Tests: ~1 hour
+- Total: ~2.5 hours
+Total for Wiring + PoC: ~6 hours
+Is this worth it for MVP?
+Your concern about technical debt is valid. Here are the options:
+Option A: Include WebSocket + 1 notification PoC
+- Pros: Users see allocation changes in real-time, framework is ready for more
+- Cons: Adds complexity, 6 hours of dev time
+- Timeline impact: Delays other features by ~1 day
+Option B: Skip notifications entirely for MVP
+- Pros: Keeps scope tight, faster MVP
+- Cons: Users don't know about allocation changes until they refresh
+- Debt accrual: Low (easy to add later)
+Option C: Add polling-based notifications (simpler)
+- SvelteKit polls for "new allocations" every 30s
+- Pros: No WebSocket complexity, users see changes quickly
+- Cons: Not true real-time, more server load
+- Lift: ~2 hours
+---
+My Honest Take
+For MVP, I'd recommend Option B (skip notifications). Here's why:
+1. Allocations are typically planned once per month - not super time-sensitive
+2. Users can refresh the page (or we can auto-refresh every 5 min)
+3. The WebSocket setup will be cleaner in phase 2 when you know exactly what needs notifying
+4. Saves 6 hours of dev time for more important features (reports, analytics)
+BUT: If you want to prove the notification concept early, Option C (polling) is a middle ground at 2 hours.
+---
+Before We Formalize
+Quick clarifications:
+1. RBAC - Can a Manager see/allocate to projects outside their assigned team?  ==>  Can see. But not allocate to other team's members.
+2. Notifications - Go with Option B (skip MVP), or Option C (polling PoC)? ==> Ok. Option B. 
+3. Validation Rules - Should I start documenting these, or wait until OpenSpec change?  ==> Perfect. Bake it into the project scope.
+
+One question: How about SwaggerUI documentation for APIs? 
+
+Said that, I want to have all the conversation formally documented, outside the scope of OpenSpec. This includes whatever we have deffered, whatever we discussed and decided not to do. All conisderations. Then, for the architectural diagrams, see if Mermaid diagrams can be created. If possible, generate an MD file and a Word Document (for hardcopy for me. This is my magnum opus project as of date.)
+
+Once these are locked, we formalize everything in OpenSpec and you're ready to build.
+
+
+## CONCLUSION
+
+Perfect! That's a wise decision. You've got comprehensive documentation ready for review, and sleeping on it will give you fresh perspective in the morning.
+Here's what you have ready to review:
+---
+📚 Documentation Ready for Review
+Core Documents (docs/)
+1. headroom-project-charter.md - Complete requirements, validation rules, success criteria
+2. headroom-architecture.md - Technical design with 7 Mermaid diagrams
+3. headroom-decision-log.md - Full conversation archive with all decisions & rationale
+4. headroom-executive-summary.md - Print-friendly overview
+5. README.md - How to convert to Word, reading order, maintenance guide
+OpenSpec Artifacts (openspec/changes/headroom-foundation/)
+1. proposal.md - WHY we're building Headroom (15 capabilities)
+2. design.md - HOW we'll build it (technical decisions + 5 open questions)
+3. specs/ - 15 detailed requirement specs with WHEN/THEN/AND scenarios
+4. tasks.md - 250+ implementation tasks organized by sprint
+---
+✨ Everything Updated
+- ✅ Laravel 12 (with PHP 8.4)
+- ✅ All dependencies using :latest tags
+- ✅ Version strategy documented in decision log
+---
+💭 What to Review
+Before implementation, consider:
+1. Do all the decisions captured match your vision?
+2. Are there any requirements you'd like to adjust or clarify?
+3. Do you have thoughts on the 5 open questions in design.md?
+4. Does the task breakdown feel reasonable for 6-8 weeks?
+5. Any concerns about the RBAC model or validation rules?
+---
+🛌 When You're Ready
+Just say the word when you've reviewed everything, and we can:
+- Answer any questions about the design
+- Adjust anything that needs tweaking
+- Start implementation with /opsx-apply headroom-foundation
+Take your time — good planning now saves endless rework later. Sleep well! 🌙
diff --git a/docs/README.md b/docs/README.md
new file mode 100644
index 00000000..b0dc1e1e
--- /dev/null
+++ b/docs/README.md
@@ -0,0 +1,188 @@
+# Headroom Documentation
+
+This directory contains comprehensive documentation for the Headroom project.
+
+## Documents
+
+### Core Documentation
+
+1. **headroom-project-charter.md**
+   - Complete project charter and specifications
+   - Problem statement, solution overview, requirements
+   - Data validation rules, RBAC matrix
+   - Deferred features and out-of-scope items
+   - Success criteria
+
+2. **headroom-architecture.md**
+   - Technical architecture with Mermaid diagrams
+   - System component diagram
+   - Data model (ER diagram)
+   - API architecture
+   - Authentication flow
+   - Deployment architecture
+   - Testing strategy
+
+3. **headroom-decision-log.md**
+   - Complete conversation archive
+   - All decisions made and rationale
+   - Considerations and trade-offs
+   - Deferred features with reasoning
+   - Rejected options
+   - Timeline of discussions
+
+4. **headroom-executive-summary.md**
+   - Condensed overview suitable for printing
+   - Executive summary
+   - Core features
+   - Quality standards
+   - Timeline and phases
+   - Success metrics
+
+## Converting to Word Format
+
+### Option 1: Using Pandoc (Recommended)
+
+If you have Pandoc installed:
+
+```bash
+# Install Pandoc (if not already installed)
+# macOS: brew install pandoc
+# Windows: choco install pandoc
+# Linux: sudo apt-get install pandoc
+
+# Convert individual files
+pandoc headroom-project-charter.md -o headroom-project-charter.docx
+pandoc headroom-architecture.md -o headroom-architecture.docx
+pandoc headroom-decision-log.md -o headroom-decision-log.docx
+pandoc headroom-executive-summary.md -o headroom-executive-summary.docx
+
+# Or convert all at once
+for file in headroom-*.md; do
+  pandoc "$file" -o "${file%.md}.docx"
+done
+```
+
+### Option 2: Using Online Converters
+
+If Pandoc is not available:
+
+1. Visit https://cloudconvert.com/md-to-docx
+2. Upload the .md file
+3. Download the .docx file
+
+Alternatively:
+- https://www.markdowntopdf.com/ (converts to PDF)
+- https://dillinger.io/ (online Markdown editor with export)
+
+### Option 3: Copy-Paste Method
+
+1. Open the .md file in any Markdown viewer (VSCode, Typora, MacDown)
+2. Copy the rendered content
+3. Paste into Microsoft Word
+4. Format as needed
+
+## Mermaid Diagrams
+
+The architecture document contains Mermaid diagrams. To render them:
+
+### In Markdown Viewers
+- **VSCode**: Install "Markdown Preview Mermaid Support" extension
+- **Typora**: Built-in Mermaid support
+- **MacDown**: May require plugin
+
+### For Word Conversion
+
+Mermaid diagrams don't convert directly to Word. Options:
+
+1. **Render to images first:**
+   ```bash
+   # Using mermaid-cli
+   npm install -g @mermaid-js/mermaid-cli
+   mmdc -i architecture.md -o architecture.docx
+   ```
+
+2. **Use online renderer:**
+   - Visit https://mermaid.live/
+   - Paste Mermaid code
+   - Export as PNG/SVG
+   - Insert into Word document
+
+3. **Keep as code blocks:**
+   - Diagrams will appear as text in Word
+   - Acceptable for technical documentation
+
+## Recommended Reading Order
+
+### For Project Owner (You)
+1. Start with **headroom-executive-summary.md** (overview)
+2. Read **headroom-decision-log.md** (verify all decisions captured)
+3. Review **headroom-project-charter.md** (detailed requirements)
+4. Study **headroom-architecture.md** (technical deep-dive)
+
+### For Associate
+1. **headroom-executive-summary.md** (context)
+2. **headroom-architecture.md** (technical implementation)
+3. **headroom-project-charter.md** (detailed requirements as needed)
+
+### For Hardcopy/Reference
+- **headroom-executive-summary.md** → Print for quick reference
+- **headroom-architecture.md** → Print for technical diagrams
+
+## Document Maintenance
+
+### When to Update
+
+**Project Charter:**
+- When requirements change
+- When new features are added to scope
+- When success metrics are revised
+
+**Architecture:**
+- When tech stack changes
+- When new integrations are added
+- When deployment approach changes
+
+**Decision Log:**
+- Add entries for major decisions
+- Update when deferrals are implemented
+- Record new trade-offs
+
+**Executive Summary:**
+- Update timeline when phases shift
+- Revise success metrics based on learnings
+- Update when project scope changes significantly
+
+### Version Control
+
+All documents are in git. To track changes:
+
+```bash
+# View history of a document
+git log -p docs/headroom-project-charter.md
+
+# Compare versions
+git diff HEAD~1 docs/headroom-architecture.md
+
+# Tag major versions
+git tag -a v1.0-docs -m "Initial documentation complete"
+```
+
+## Quick Reference: Key Decisions
+
+| Decision | Document | Section |
+|----------|----------|---------|
+| Why SvelteKit? | Decision Log | Technical Stack Decisions → Frontend |
+| Why Redis from day 1? | Decision Log | Architecture Decisions → Caching |
+| What's deferred to Phase 2? | Project Charter | Deferred Features |
+| What's the data model? | Architecture | Data Model |
+| What are the success metrics? | Executive Summary | Success Metrics |
+| What's the testing strategy? | Architecture | Quality Standards |
+
+## Questions or Updates?
+
+Contact: Santhosh J (Project Owner)
+
+---
+
+**Last Updated:** February 17, 2026  
+**Documentation Version:** 1.0  
diff --git a/docs/headroom-architecture.md b/docs/headroom-architecture.md
new file mode 100644
index 00000000..16c1a4ee
--- /dev/null
+++ b/docs/headroom-architecture.md
@@ -0,0 +1,1161 @@
+# Headroom - Architecture & Design
+
+**Version:** 1.0  
+**Date:** February 17, 2026  
+**Status:** Approved for Implementation  
+
+---
+
+## Table of Contents
+
+1. [System Architecture](#system-architecture)
+2. [Data Model](#data-model)
+3. [API Architecture](#api-architecture)
+4. [Authentication Flow](#authentication-flow)
+5. [Deployment Architecture](#deployment-architecture)
+6. [Technology Stack Details](#technology-stack-details)
+7. [Quality Standards](#quality-standards)
+8. [Development Workflow](#development-workflow)
+
+---
+
+## System Architecture
+
+### High-Level Component Diagram
+
+```mermaid
+graph TB
+    subgraph "Client Layer"
+        Browser[Web Browser]
+    end
+    
+    subgraph "Frontend Container :5173"
+        SvelteKit[SvelteKit App]
+        Store[Svelte Stores]
+        Forms[Superforms + Zod]
+        Charts[Recharts]
+        Tables[TanStack Table]
+    end
+    
+    subgraph "Backend Container :3000"
+        API[Laravel API]
+        Resources[API Resources]
+        Auth[JWT Auth]
+        Queue[Queue System]
+        Scribe[API Docs - Scribe]
+    end
+    
+    subgraph "Data Layer"
+        Postgres[(PostgreSQL)]
+        Redis[(Redis Cache)]
+    end
+    
+    subgraph "Reverse Proxy"
+        NPM[Nginx Proxy Manager]
+    end
+    
+    Browser -->|HTTPS| NPM
+    NPM -->|/api/*| API
+    NPM -->|/*| SvelteKit
+    
+    SvelteKit -->|REST API| API
+    SvelteKit --> Store
+    SvelteKit --> Forms
+    SvelteKit --> Charts
+    SvelteKit --> Tables
+    
+    API --> Resources
+    API --> Auth
+    API --> Queue
+    API --> Scribe
+    
+    API -->|Read/Write| Postgres
+    API -->|Cache| Redis
+    Queue -->|Job Storage| Redis
+    
+    style SvelteKit fill:#ff3e00
+    style API fill:#ff2d20
+    style Postgres fill:#336791
+    style Redis fill:#dc382d
+```
+
+### Request Flow
+
+```mermaid
+sequenceDiagram
+    participant User
+    participant Browser
+    participant NPM as Nginx Proxy Manager
+    participant SvelteKit
+    participant Laravel as Laravel API
+    participant Redis
+    participant DB as PostgreSQL
+    
+    User->>Browser: Access dashboard
+    Browser->>NPM: GET /
+    NPM->>SvelteKit: Forward request
+    SvelteKit-->>Browser: Return HTML + JS
+    
+    Browser->>NPM: GET /api/allocations?month=2026-02
+    NPM->>Laravel: Forward API request
+    Laravel->>Redis: Check cache
+    
+    alt Cache Hit
+        Redis-->>Laravel: Return cached data
+    else Cache Miss
+        Laravel->>DB: Query allocations
+        DB-->>Laravel: Return data
+        Laravel->>Redis: Store in cache
+    end
+    
+    Laravel->>Laravel: Transform via API Resources
+    Laravel-->>Browser: JSON response
+    Browser->>Browser: Render with TanStack Table
+```
+
+---
+
+## Data Model
+
+### Entity Relationship Diagram
+
+```mermaid
+erDiagram
+    TEAM_MEMBER ||--o{ ALLOCATION : "receives"
+    TEAM_MEMBER ||--o{ ACTUAL : "logs"
+    TEAM_MEMBER ||--o{ PTO : "requests"
+    TEAM_MEMBER }o--|| ROLE : "has"
+    
+    PROJECT ||--o{ ALLOCATION : "requires"
+    PROJECT ||--o{ ACTUAL : "tracks"
+    PROJECT }o--|| PROJECT_STATUS : "in"
+    PROJECT }o--|| PROJECT_TYPE : "categorized_as"
+    
+    ALLOCATION }o--|| MONTH : "for"
+    ACTUAL }o--|| MONTH : "in"
+    
+    HOLIDAY }o--|| MONTH : "occurs_in"
+    PTO }o--|| MONTH : "occurs_in"
+    
+    TEAM_MEMBER {
+        uuid id PK
+        string name
+        uuid role_id FK
+        decimal hourly_rate
+        boolean active
+        timestamp created_at
+        timestamp updated_at
+    }
+    
+    ROLE {
+        uuid id PK
+        string name
+        string description
+        timestamp created_at
+    }
+    
+    PROJECT {
+        uuid id PK
+        string project_code UK
+        string title
+        uuid status_id FK
+        uuid type_id FK
+        decimal approved_estimate
+        json forecasted_effort
+        date start_date
+        date end_date
+        timestamp created_at
+        timestamp updated_at
+    }
+    
+    PROJECT_STATUS {
+        uuid id PK
+        string name
+        int order
+        boolean is_active
+        boolean is_billable
+    }
+    
+    PROJECT_TYPE {
+        uuid id PK
+        string name
+        string description
+    }
+    
+    ALLOCATION {
+        uuid id PK
+        uuid project_id FK
+        uuid team_member_id FK
+        string month
+        decimal allocated_hours
+        text notes
+        timestamp created_at
+        timestamp updated_at
+    }
+    
+    ACTUAL {
+        uuid id PK
+        uuid project_id FK
+        uuid team_member_id FK
+        string month
+        decimal hours_logged
+        text notes
+        timestamp created_at
+        timestamp updated_at
+    }
+    
+    MONTH {
+        string id PK
+        int year
+        int month
+        int working_days
+    }
+    
+    HOLIDAY {
+        uuid id PK
+        date date
+        string name
+        string description
+    }
+    
+    PTO {
+        uuid id PK
+        uuid team_member_id FK
+        date start_date
+        date end_date
+        string reason
+        string status
+        timestamp created_at
+    }
+```
+
+### Database Schema Details
+
+**Key Design Decisions:**
+
+1. **UUIDs for Primary Keys**
+   - Prevents ID enumeration attacks
+   - Easier distributed system support (future)
+   - No auto-increment exposure
+
+2. **Normalized Master Data**
+   - Roles, Statuses, Types in separate tables
+   - Allows dynamic configuration without code changes
+
+3. **Month as String (YYYY-MM)**
+   - Simplifies queries and grouping
+   - Index-friendly
+   - Human-readable
+
+4. **JSON for Forecasted Effort**
+   - Flexible structure: `{"2026-02": 40, "2026-03": 60}`
+   - Easy to extend without schema changes
+   - PostgreSQL JSON operators for querying
+
+5. **Soft Deletes**
+   - Team members: use `active` boolean (preserve historical allocations)
+   - Projects: `deleted_at` timestamp (audit trail)
+
+---
+
+## API Architecture
+
+### REST Endpoint Structure
+
+```mermaid
+graph LR
+    subgraph "API Routes"
+        Auth[/api/auth]
+        TeamMembers[/api/team-members]
+        Projects[/api/projects]
+        Allocations[/api/allocations]
+        Actuals[/api/actuals]
+        Reports[/api/reports]
+        MasterData[/api/master-data]
+    end
+    
+    Auth --> Login[POST /login]
+    Auth --> Logout[POST /logout]
+    Auth --> Refresh[POST /refresh]
+    
+    TeamMembers --> TMList[GET /]
+    TeamMembers --> TMCreate[POST /]
+    TeamMembers --> TMShow[GET /:id]
+    TeamMembers --> TMUpdate[PUT /:id]
+    TeamMembers --> TMDelete[DELETE /:id]
+    
+    Projects --> PList[GET /]
+    Projects --> PCreate[POST /]
+    Projects --> PShow[GET /:id]
+    Projects --> PUpdate[PUT /:id]
+    Projects --> PDelete[DELETE /:id]
+    
+    Allocations --> AList[GET /?month=YYYY-MM]
+    Allocations --> ACreate[POST /]
+    Allocations --> ABulk[POST /bulk]
+    Allocations --> AUpdate[PUT /:id]
+    Allocations --> ADelete[DELETE /:id]
+    
+    Actuals --> ACList[GET /?month=YYYY-MM]
+    Actuals --> ACCreate[POST /]
+    Actuals --> ACBulk[POST /bulk]
+    Actuals --> ACUpdate[PUT /:id]
+    
+    Reports --> RForecast[GET /forecast]
+    Reports --> RUtilization[GET /utilization]
+    Reports --> RCost[GET /cost]
+    Reports --> RAllocation[GET /allocation]
+    Reports --> RVariance[GET /variance]
+    
+    MasterData --> MDRoles[GET /roles]
+    MasterData --> MDStatuses[GET /statuses]
+    MasterData --> MDTypes[GET /types]
+```
+
+### API Resource Transformations
+
+**Laravel API Resources ensure consistent JSON structure:**
+
+```json
+// Team Member Resource
+{
+  "data": {
+    "id": "uuid",
+    "name": "John Doe",
+    "role": {
+      "id": "uuid",
+      "name": "Backend Developer"
+    },
+    "hourly_rate": 150.00,
+    "active": true,
+    "created_at": "2026-02-01T10:00:00Z"
+  }
+}
+
+// Allocation Resource
+{
+  "data": {
+    "id": "uuid",
+    "project": {
+      "id": "uuid",
+      "code": "PROJ-001",
+      "title": "Client Dashboard Redesign"
+    },
+    "team_member": {
+      "id": "uuid",
+      "name": "Jane Smith"
+    },
+    "month": "2026-02",
+    "allocated_hours": 40.0,
+    "notes": "Focus on frontend work",
+    "created_at": "2026-02-01T10:00:00Z"
+  }
+}
+
+// Report Resource (Forecast)
+{
+  "data": {
+    "period": {
+      "from": "2026-02",
+      "to": "2026-05"
+    },
+    "projects": [
+      {
+        "id": "uuid",
+        "code": "PROJ-001",
+        "title": "Client Dashboard Redesign",
+        "approved_estimate": 120.0,
+        "forecast_by_month": {
+          "2026-02": 40.0,
+          "2026-03": 60.0,
+          "2026-04": 20.0
+        },
+        "allocated_by_month": {
+          "2026-02": 38.0,
+          "2026-03": 62.0,
+          "2026-04": 20.0
+        },
+        "variance": {
+          "2026-02": -2.0,
+          "2026-03": 2.0,
+          "2026-04": 0
+        },
+        "status": "under_allocated"
+      }
+    ],
+    "summary": {
+      "total_approved": 120.0,
+      "total_allocated": 120.0,
+      "variance": 0
+    }
+  }
+}
+```
+
+### Validation & Error Responses
+
+**Laravel Form Requests handle validation:**
+
+```php
+// Example: AllocationRequest
+public function rules(): array
+{
+    return [
+        'project_id' => 'required|exists:projects,id',
+        'team_member_id' => 'required|exists:team_members,id',
+        'month' => 'required|date_format:Y-m',
+        'allocated_hours' => 'required|numeric|min:0|max:9999.99',
+        'notes' => 'nullable|string|max:1000',
+    ];
+}
+```
+
+**Error Response Format:**
+
+```json
+{
+  "message": "The given data was invalid.",
+  "errors": {
+    "allocated_hours": [
+      "The allocated hours must be at least 0."
+    ],
+    "month": [
+      "The month field must be in YYYY-MM format."
+    ]
+  }
+}
+```
+
+### Caching Strategy
+
+```mermaid
+graph TD
+    Request[API Request] --> CheckCache{Cache Exists?}
+    
+    CheckCache -->|Yes| ReturnCache[Return Cached Response]
+    CheckCache -->|No| QueryDB[Query Database]
+    
+    QueryDB --> Transform[Transform via API Resource]
+    Transform --> StoreCache[Store in Redis]
+    StoreCache --> ReturnFresh[Return Fresh Response]
+    
+    Mutation[Create/Update/Delete] --> InvalidateCache[Invalidate Related Caches]
+    InvalidateCache --> ExecuteMutation[Execute Mutation]
+    
+    style CheckCache fill:#ffd700
+    style StoreCache fill:#dc382d
+    style InvalidateCache fill:#dc382d
+```
+
+**Cache Keys Pattern:**
+
+```
+allocations:month:{YYYY-MM}
+allocations:project:{project_id}
+allocations:member:{member_id}
+reports:forecast:{from}:{to}:{filters_hash}
+reports:utilization:{month}:{team_id}
+capacity:month:{YYYY-MM}
+```
+
+**Cache Invalidation Rules:**
+
+| Mutation | Invalidate Keys |
+|----------|-----------------|
+| Allocation created/updated | `allocations:month:{month}`, `allocations:project:{project_id}`, `allocations:member:{member_id}`, `reports:*` |
+| Actual logged | `actuals:month:{month}`, `reports:utilization:*`, `reports:variance:*` |
+| Team member updated | `allocations:member:{id}`, `capacity:*`, `reports:*` |
+| Project updated | `allocations:project:{id}`, `reports:*` |
+
+**TTL (Time to Live):**
+- Allocations: 1 hour
+- Reports: 15 minutes
+- Master data: 24 hours
+
+---
+
+## Authentication Flow
+
+### JWT Authentication Sequence
+
+```mermaid
+sequenceDiagram
+    participant User
+    participant SvelteKit
+    participant Laravel
+    participant Redis
+    participant DB
+    
+    User->>SvelteKit: Enter credentials
+    SvelteKit->>Laravel: POST /api/auth/login
+    Laravel->>DB: Validate credentials
+    DB-->>Laravel: User found
+    
+    Laravel->>Laravel: Generate JWT token
+    Laravel->>Redis: Store refresh token
+    Laravel-->>SvelteKit: {access_token, refresh_token, user}
+    
+    SvelteKit->>SvelteKit: Store tokens in localStorage
+    SvelteKit-->>User: Redirect to dashboard
+    
+    Note over SvelteKit,Laravel: Subsequent requests
+    
+    User->>SvelteKit: Access protected resource
+    SvelteKit->>Laravel: GET /api/allocations<br/>Header: Authorization: Bearer {token}
+    Laravel->>Laravel: Validate JWT
+    
+    alt Token Valid
+        Laravel->>DB: Fetch data
+        DB-->>Laravel: Return data
+        Laravel-->>SvelteKit: JSON response
+    else Token Expired
+        Laravel-->>SvelteKit: 401 Unauthorized
+        SvelteKit->>Laravel: POST /api/auth/refresh<br/>{refresh_token}
+        Laravel->>Redis: Validate refresh token
+        Redis-->>Laravel: Token valid
+        Laravel->>Laravel: Generate new access token
+        Laravel-->>SvelteKit: {access_token}
+        SvelteKit->>Laravel: Retry original request
+    end
+```
+
+### Token Structure
+
+**Access Token (JWT):**
+```json
+{
+  "sub": "user-uuid",
+  "role": "manager",
+  "permissions": ["allocate_resources", "view_reports"],
+  "iat": 1708171200,
+  "exp": 1708174800,
+  "jti": "token-uuid"
+}
+```
+
+**Refresh Token:**
+- Stored in Redis with 7-day TTL
+- One-time use (rotated on refresh)
+- Revocable (logout invalidates)
+
+### Authorization Middleware
+
+```mermaid
+graph TD
+    Request[Incoming Request] --> ExtractToken[Extract JWT from Header]
+    ExtractToken --> ValidateToken{Token Valid?}
+    
+    ValidateToken -->|No| Return401[Return 401 Unauthorized]
+    ValidateToken -->|Yes| LoadUser[Load User from Token]
+    
+    LoadUser --> CheckPermission{Has Permission?}
+    CheckPermission -->|No| Return403[Return 403 Forbidden]
+    CheckPermission -->|Yes| ExecuteController[Execute Controller]
+    
+    ExecuteController --> CheckPolicy{Model Policy?}
+    CheckPolicy -->|Fail| Return403
+    CheckPolicy -->|Pass| ReturnResponse[Return Response]
+    
+    style ValidateToken fill:#ffd700
+    style CheckPermission fill:#ffd700
+    style CheckPolicy fill:#ffd700
+```
+
+**Permission Matrix:**
+
+| Role | Permissions |
+|------|-------------|
+| **Superuser** | `*` (all permissions) |
+| **Manager** | `view_all_projects`, `create_project`, `edit_own_project`, `allocate_own_team`, `view_reports` |
+| **Developer** | `view_own_allocations`, `log_hours`, `view_assigned_projects` |
+| **Top Brass** | `view_all_reports` (read-only) |
+
+---
+
+## Deployment Architecture
+
+### Docker Compose Structure
+
+```mermaid
+graph TB
+    subgraph "Docker Compose Environment"
+        subgraph "Frontend Container"
+            SK[SvelteKit<br/>Node:latest<br/>Port 5173]
+            SKVol[/app mounted<br/>from ./frontend]
+        end
+        
+        subgraph "Backend Container"
+            LAR[Laravel<br/>PHP 8.4-FPM<br/>Port 3000]
+            LARVol[/var/www mounted<br/>from ./backend]
+        end
+        
+        subgraph "Database Container"
+            PG[PostgreSQL:latest<br/>Port 5432]
+            PGVol[/var/lib/postgresql/data<br/>mounted from ./data/postgres]
+        end
+        
+        subgraph "Cache Container"
+            RD[Redis:latest<br/>Port 6379]
+            RDVol[/data mounted<br/>from ./data/redis]
+        end
+    end
+    
+    subgraph "Host Machine"
+        NPM[Nginx Proxy Manager<br/>Port 80/443]
+        FrontendCode[./frontend/<br/>SvelteKit source]
+        BackendCode[./backend/<br/>Laravel source]
+    end
+    
+    NPM -->|Proxy /api/*| LAR
+    NPM -->|Proxy /*| SK
+    
+    SK -->|API calls| LAR
+    LAR -->|DB queries| PG
+    LAR -->|Cache| RD
+    
+    SK -.->|Code mount| FrontendCode
+    LAR -.->|Code mount| BackendCode
+    
+    style SK fill:#ff3e00
+    style LAR fill:#ff2d20
+    style PG fill:#336791
+    style RD fill:#dc382d
+```
+
+### docker-compose.yml
+
+```yaml
+version: '3.8'
+
+services:
+  frontend:
+    build:
+      context: ./frontend
+      dockerfile: Dockerfile.dev
+    container_name: headroom_frontend
+    ports:
+      - "5173:5173"
+    volumes:
+      - ./frontend:/app
+      - /app/node_modules
+    environment:
+      - VITE_API_URL=http://backend:3000/api
+    depends_on:
+      - backend
+    networks:
+      - headroom_network
+    restart: unless-stopped
+
+  backend:
+    build:
+      context: ./backend
+      dockerfile: Dockerfile.dev
+    container_name: headroom_backend
+    ports:
+      - "3000:3000"
+    volumes:
+      - ./backend:/var/www
+      - /var/www/vendor
+    environment:
+      - APP_ENV=local
+      - APP_DEBUG=true
+      - DB_CONNECTION=pgsql
+      - DB_HOST=postgres
+      - DB_PORT=5432
+      - DB_DATABASE=headroom
+      - DB_USERNAME=headroom_user
+      - DB_PASSWORD=${DB_PASSWORD}
+      - REDIS_HOST=redis
+      - REDIS_PORT=6379
+    depends_on:
+      - postgres
+      - redis
+    networks:
+      - headroom_network
+    restart: unless-stopped
+
+  postgres:
+    image: postgres:latest
+    container_name: headroom_postgres
+    ports:
+      - "5432:5432"
+    volumes:
+      - ./data/postgres:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_DB=headroom
+      - POSTGRES_USER=headroom_user
+      - POSTGRES_PASSWORD=${DB_PASSWORD}
+    networks:
+      - headroom_network
+    restart: unless-stopped
+
+  redis:
+    image: redis:latest
+    container_name: headroom_redis
+    ports:
+      - "6379:6379"
+    volumes:
+      - ./data/redis:/data
+    networks:
+      - headroom_network
+    restart: unless-stopped
+
+networks:
+  headroom_network:
+    driver: bridge
+
+volumes:
+  postgres_data:
+  redis_data:
+```
+
+### Environment Variables (.env)
+
+**Backend (.env):**
+```ini
+APP_NAME=Headroom
+APP_ENV=local
+APP_KEY=base64:...
+APP_DEBUG=true
+APP_URL=http://localhost:3000
+
+DB_CONNECTION=pgsql
+DB_HOST=postgres
+DB_PORT=5432
+DB_DATABASE=headroom
+DB_USERNAME=headroom_user
+DB_PASSWORD=secure_password_here
+
+REDIS_HOST=redis
+REDIS_PORT=6379
+
+JWT_SECRET=your_jwt_secret_here
+JWT_TTL=60
+JWT_REFRESH_TTL=10080
+
+CACHE_DRIVER=redis
+QUEUE_CONNECTION=redis
+```
+
+**Frontend (.env):**
+```ini
+VITE_API_URL=http://localhost:3000/api
+VITE_APP_NAME=Headroom
+```
+
+### Reverse Proxy Configuration (Nginx Proxy Manager)
+
+**Proxy Host 1: Frontend**
+- Domain: `headroom.local` (or your domain)
+- Forward to: `http://headroom_frontend:5173`
+- WebSocket support: Enabled
+
+**Proxy Host 2: API**
+- Domain: `headroom.local/api/*` (or your domain)
+- Forward to: `http://headroom_backend:3000/api`
+- Custom headers: 
+  ```
+  X-Forwarded-For: $remote_addr
+  X-Forwarded-Proto: $scheme
+  ```
+
+---
+
+## Technology Stack Details
+
+### Backend: Laravel
+
+**Project Structure:**
+```
+backend/
+├── app/
+│   ├── Http/
+│   │   ├── Controllers/
+│   │   │   ├── AuthController.php
+│   │   │   ├── TeamMemberController.php
+│   │   │   ├── ProjectController.php
+│   │   │   ├── AllocationController.php
+│   │   │   ├── ActualController.php
+│   │   │   └── ReportController.php
+│   │   ├── Requests/
+│   │   │   ├── AllocationRequest.php
+│   │   │   ├── ProjectRequest.php
+│   │   │   └── ...
+│   │   ├── Resources/
+│   │   │   ├── TeamMemberResource.php
+│   │   │   ├── ProjectResource.php
+│   │   │   ├── AllocationResource.php
+│   │   │   └── ...
+│   │   └── Middleware/
+│   │       └── JwtMiddleware.php
+│   ├── Models/
+│   │   ├── TeamMember.php
+│   │   ├── Project.php
+│   │   ├── Allocation.php
+│   │   ├── Actual.php
+│   │   └── ...
+│   ├── Policies/
+│   │   ├── ProjectPolicy.php
+│   │   ├── AllocationPolicy.php
+│   │   └── ...
+│   └── Services/
+│       ├── CapacityService.php
+│       ├── AllocationService.php
+│       └── ReportService.php
+├── database/
+│   ├── migrations/
+│   └── seeders/
+├── routes/
+│   └── api.php
+├── tests/
+│   ├── Unit/
+│   └── Feature/
+└── composer.json
+```
+
+**Key Packages:**
+```json
+{
+  "require": {
+    "php": "^8.3",
+    "laravel/framework": "^11.0",
+    "tymon/jwt-auth": "^2.0",
+    "predis/predis": "^2.0",
+    "knuckleswtf/scribe": "^4.0"
+  },
+  "require-dev": {
+    "pestphp/pest": "^2.0",
+    "phpunit/phpunit": "^10.0",
+    "laravel/pint": "^1.0"
+  }
+}
+```
+
+### Frontend: SvelteKit
+
+**Project Structure:**
+```
+frontend/
+├── src/
+│   ├── lib/
+│   │   ├── components/
+│   │   │   ├── AllocationTable.svelte
+│   │   │   ├── CapacityCalendar.svelte
+│   │   │   ├── ForecastChart.svelte
+│   │   │   └── ...
+│   │   ├── stores/
+│   │   │   ├── auth.ts
+│   │   │   ├── filters.ts
+│   │   │   └── ui.ts
+│   │   ├── api/
+│   │   │   ├── client.ts
+│   │   │   ├── allocations.ts
+│   │   │   ├── projects.ts
+│   │   │   └── ...
+│   │   └── schemas/
+│   │       ├── allocation.ts (Zod schemas)
+│   │       ├── project.ts
+│   │       └── ...
+│   ├── routes/
+│   │   ├── +layout.svelte
+│   │   ├── +page.svelte (dashboard)
+│   │   ├── login/
+│   │   ├── capacity/
+│   │   ├── projects/
+│   │   ├── allocations/
+│   │   ├── actuals/
+│   │   └── reports/
+│   └── app.html
+├── static/
+├── tests/
+│   ├── unit/
+│   └── e2e/
+└── package.json
+```
+
+**Key Packages:**
+```json
+{
+  "dependencies": {
+    "@sveltejs/kit": "^2.0.0",
+    "svelte": "^5.0.0",
+    "tailwindcss": "^3.4.0",
+    "daisyui": "^4.0.0",
+    "recharts": "^2.10.0",
+    "@tanstack/svelte-table": "^8.0.0",
+    "sveltekit-superforms": "^2.0.0",
+    "zod": "^3.22.0"
+  },
+  "devDependencies": {
+    "vitest": "^1.0.0",
+    "@playwright/test": "^1.40.0",
+    "prettier": "^3.1.0",
+    "eslint": "^8.55.0"
+  }
+}
+```
+
+---
+
+## Quality Standards
+
+### Testing Strategy
+
+```mermaid
+graph TB
+    Code[Code Change] --> UnitTests[Unit Tests]
+    UnitTests --> FeatureTests[Feature Tests]
+    FeatureTests --> E2ETests[E2E Tests]
+    
+    UnitTests -->|PHPUnit/Vitest| UnitPass{Pass?}
+    FeatureTests -->|PHPUnit/Pest| FeaturePass{Pass?}
+    E2ETests -->|Playwright| E2EPass{Pass?}
+    
+    UnitPass -->|No| FailBuild[❌ Build Failed]
+    FeaturePass -->|No| FailBuild
+    E2EPass -->|No| FailBuild
+    
+    E2EPass -->|Yes| Coverage[Check Coverage]
+    Coverage -->|< 70%| FailBuild
+    Coverage -->|>= 70%| CodeReview[Code Review]
+    
+    CodeReview --> StyleCheck{Style OK?}
+    StyleCheck -->|No| FailBuild
+    StyleCheck -->|Yes| SecurityCheck{Security OK?}
+    SecurityCheck -->|No| FailBuild
+    SecurityCheck -->|Yes| Merge[✅ Merge]
+    
+    style FailBuild fill:#ff0000,color:#fff
+    style Merge fill:#00ff00,color:#000
+```
+
+### Test Coverage Targets
+
+| Layer | Target | Tools |
+|-------|--------|-------|
+| **Backend Unit** | >80% | PHPUnit |
+| **Backend Feature** | >70% | Pest |
+| **Frontend Unit** | >70% | Vitest |
+| **E2E** | Critical paths | Playwright |
+| **Overall** | >70% | Combined |
+
+### Code Quality Tools
+
+**Backend (Laravel):**
+- **Linting:** Laravel Pint (PSR-12)
+- **Static Analysis:** PHPStan (level 5+)
+- **Security:** Laravel Security Checker
+
+**Frontend (SvelteKit):**
+- **Linting:** ESLint + Svelte plugin
+- **Formatting:** Prettier
+- **Type Checking:** TypeScript strict mode
+
+### Pre-Commit Hooks
+
+```bash
+# .git/hooks/pre-commit
+
+#!/bin/bash
+
+echo "Running pre-commit checks..."
+
+# Backend checks
+cd backend
+./vendor/bin/pint --test || exit 1
+./vendor/bin/phpstan analyse || exit 1
+php artisan test || exit 1
+
+# Frontend checks
+cd ../frontend
+npm run lint || exit 1
+npm run type-check || exit 1
+npm run test:unit || exit 1
+
+echo "✅ All checks passed!"
+```
+
+---
+
+## Development Workflow
+
+### OpenSpec Integration
+
+```mermaid
+graph TD
+    Idea[New Feature/Fix] --> Explore[/opsx-explore<br/>Think through problem]
+    
+    Explore --> NewChange[/opsx-new headroom-feature<br/>Create change]
+    
+    NewChange --> Proposal[Write Proposal<br/>Why + What]
+    Proposal --> Specs[Write Specs<br/>Requirements + Scenarios]
+    Specs --> Design[Write Design<br/>How + Decisions]
+    Design --> Tasks[Write Tasks<br/>Implementation checklist]
+    
+    Tasks --> Apply[/opsx-apply<br/>Implement tasks]
+    
+    Apply --> WriteTests[Write Tests<br/>Unit + E2E]
+    WriteTests --> RunTests[Run Tests]
+    RunTests --> TestPass{Pass?}
+    TestPass -->|No| FixCode[Fix Code]
+    FixCode --> RunTests
+    
+    TestPass -->|Yes| Verify[/opsx-verify<br/>Check coverage + standards]
+    Verify --> VerifyPass{Pass?}
+    VerifyPass -->|No| FixCode
+    
+    VerifyPass -->|Yes| Commit[Commit Changes<br/>Granular commits]
+    Commit --> Archive[/opsx-archive<br/>Archive change]
+    
+    Archive --> Done[✅ Feature Complete]
+    
+    style Explore fill:#ffd700
+    style Apply fill:#00bfff
+    style Verify fill:#ff8c00
+    style Done fill:#00ff00
+```
+
+### Branching Strategy
+
+**Branch Types:**
+- `main` - Production-ready code
+- `develop` - Integration branch (not needed for solo dev initially)
+- `feature/opsx-<change-name>` - Feature branches (one per OpenSpec change)
+- `hotfix/description` - Emergency fixes
+
+**Workflow:**
+```bash
+# Start new change
+git checkout -b feature/opsx-capacity-planning
+
+# Implement (from /opsx-apply)
+# ... make changes, commit granularly ...
+
+# Before merge
+/opsx-verify capacity-planning
+
+# Merge
+git checkout main
+git merge feature/opsx-capacity-planning
+git push origin main
+```
+
+### Commit Message Format
+
+```
+[Type] Brief description (50 chars max)
+
+Detailed explanation (optional, 72 char wrap)
+
+Refs: openspec/changes/<change-name>
+```
+
+**Types:**
+- `feat`: New feature
+- `fix`: Bug fix
+- `refactor`: Code restructuring
+- `test`: Add/update tests
+- `docs`: Documentation only
+- `chore`: Tooling, config, etc.
+
+**Examples:**
+```
+[feat] Add allocation validation rules
+
+Implemented over/under allocation detection with RED flag indicators.
+Validation checks approved estimate vs allocated hours per project.
+
+Refs: openspec/changes/allocation-validation
+```
+
+---
+
+## Appendix: Data Flow Examples
+
+### Capacity Planning Flow
+
+```mermaid
+sequenceDiagram
+    participant Manager
+    participant UI as SvelteKit UI
+    participant API as Laravel API
+    participant DB as PostgreSQL
+    participant Cache as Redis
+    
+    Manager->>UI: Navigate to Capacity Planning
+    UI->>API: GET /api/capacity?month=2026-02
+    API->>Cache: Check cache
+    Cache-->>API: Cache miss
+    
+    API->>DB: Query team members
+    API->>DB: Query holidays
+    API->>DB: Query PTOs
+    API->>API: Calculate capacity
+    
+    API->>Cache: Store result (TTL: 1h)
+    API-->>UI: Return capacity data
+    UI->>UI: Render calendar + summary
+    
+    Manager->>UI: Mark PTO for Team Member A (2026-02-10 to 2026-02-12)
+    UI->>API: POST /api/pto
+    API->>DB: Insert PTO record
+    API->>Cache: Invalidate capacity:month:2026-02
+    API-->>UI: Success
+    
+    UI->>API: GET /api/capacity?month=2026-02
+    API->>DB: Recalculate (cache invalidated)
+    API-->>UI: Updated capacity
+    UI->>UI: Re-render with reduced capacity
+```
+
+### Allocation Flow with Validation
+
+```mermaid
+sequenceDiagram
+    participant Manager
+    participant UI as SvelteKit UI
+    participant API as Laravel API
+    participant DB as PostgreSQL
+    
+    Manager->>UI: Open allocation matrix (Feb 2026)
+    UI->>API: GET /api/allocations?month=2026-02
+    API->>DB: Query allocations
+    API-->>UI: Return allocations
+    
+    Manager->>UI: Allocate Dev A: 50h to Project X
+    UI->>UI: Superforms validation (Zod)
+    UI->>API: POST /api/allocations
+    
+    API->>API: Validate request (Laravel)
+    API->>DB: Check project approved estimate
+    DB-->>API: Approved: 100h, Currently allocated: 55h
+    
+    API->>API: Calculate: 55 + 50 = 105h > 100h
+    API->>API: Over-allocation detected!
+    API-->>UI: 422 Unprocessable Entity<br/>{error: "Over-allocated by 5h"}
+    
+    UI->>UI: Show RED flag indicator
+    UI->>Manager: "⚠️ Project X will be over-allocated by 5h"
+    
+    Manager->>UI: Reduce allocation to 45h
+    UI->>API: POST /api/allocations (45h)
+    API->>API: Validate: 55 + 45 = 100h ✅
+    API->>DB: Insert allocation
+    API->>Cache: Invalidate related caches
+    API-->>UI: Success
+    
+    UI->>UI: Show GREEN indicator (100% allocated)
+```
+
+---
+
+**Document Control:**
+- **Owner:** Santhosh J
+- **Approver:** Santhosh J
+- **Next Review:** Post-MVP implementation
+- **Change History:**
+  - v1.0 (2026-02-17): Initial architecture approved
+
+---
+
+*End of Architecture Document*
diff --git a/docs/headroom-decision-log.md b/docs/headroom-decision-log.md
new file mode 100644
index 00000000..60a4e2c4
--- /dev/null
+++ b/docs/headroom-decision-log.md
@@ -0,0 +1,840 @@
+# Headroom - Complete Decision Log & Conversation Archive
+
+**Version:** 1.0  
+**Date:** February 17, 2026  
+**Participants:** Santhosh J (Project Owner), AI Assistant (Design Partner)  
+**Purpose:** Comprehensive record of all discussions, decisions, considerations, and deferrals  
+
+---
+
+## Table of Contents
+
+1. [Project Genesis](#project-genesis)
+2. [Requirements Discovery](#requirements-discovery)
+3. [Technical Stack Decisions](#technical-stack-decisions)
+4. [Architecture Decisions](#architecture-decisions)
+5. [Quality & Testing Decisions](#quality--testing-decisions)
+6. [Deferred Features](#deferred-features)
+7. [Rejected Options](#rejected-options)
+8. [Open Questions](#open-questions)
+9. [Timeline](#timeline)
+
+---
+
+## Project Genesis
+
+### The Problem
+
+**Context:**
+- Managing team of 10-15 developers
+- Handling 10-12 concurrent projects in various phases
+- Currently using spreadsheets → "a nightmare"
+
+**Pain Points Identified:**
+1. **Capacity calculation chaos**: Manual calculations across holidays, PTO, weekends
+2. **No validation**: Easy to over-allocate people or projects
+3. **Visibility gap**: Hard to answer "Who has headroom for new work?"
+4. **Billing errors**:
+   - Over-allocation → Overcharge clients → Escalations
+   - Under-allocation → Undercharge → Revenue loss
+5. **No audit trail**: Changes are invisible
+6. **Actual vs Planned tracking**: Difficult to compare what was planned vs what actually happened
+
+### The Vision
+
+**Product Name:** Headroom
+- **Why this name?** It's the word managers actually say ("do we have headroom for this?"), immediately signals capacity planning, and captures the over/under allocation anxiety central to the tool.
+- **Close runner-up:** Margin (protecting margin through accurate forecasting)
+
+**Core Value:**
+> Know exactly who has headroom for new work, prevent billing errors, forecast revenue, track planned vs actual hours.
+
+### Personas
+
+Four distinct user types identified:
+
+| Persona | Primary Need |
+|---------|--------------|
+| **Superuser** | System setup, configuration, admin controls |
+| **Managers** | Resource planning, allocation, team oversight |
+| **Developers** | View allocations, log hours, understand workload |
+| **Top Brass** | Executive reports, forecasts, budget visibility |
+
+---
+
+## Requirements Discovery
+
+### The Monthly Cycle
+
+**Key Insight:** The workflow is organized around monthly capacity planning cycles, not continuous allocation.
+
+```
+Monthly Cycle:
+1. Capacity Planning → Who's available, how much?
+2. Project Setup → What work needs to be done?
+3. Resource Allocation → Who does what?
+4. Actuals Tracking → What actually happened?
+```
+
+### Capacity Planning Requirements
+
+**Inputs:**
+- Team member list (name, role, hourly rate)
+- Calendar data (holidays, weekends)
+- Individual PTO requests
+- Daily availability: **0** (unavailable), **0.5** (half day), **1.0** (full day)
+
+**Critical Clarification:**
+- Initial assumption: "10 hrs for Dev" meant role-based allocation
+- **Actual requirement:** Person-specific allocation ("10 hrs for Santhosh")
+- Availability is per-person, per-day, not role-based
+
+**Outputs Needed:**
+1. Individual capacity (person-days per month)
+2. Team capacity summary (total available person-days)
+3. Possible revenue (if fully utilized)
+
+### Project Management Requirements
+
+**Project Lifecycle:**
+
+```
+NA/Support → Initial → Gathering Estimates → Estimate Pending Approval
+                ↓
+        Estimate Rework ←───────┘
+                ↓
+        Estimate Approved → Funded → Scheduled → In-Progress
+                ↓
+        Ready for Prod → Done
+                ↓
+        [Optional: On-Hold, Cancelled]
+```
+
+**Key Attributes:**
+- **Approved Estimate**: Total billable hours approved by client
+- **Forecasted Effort**: How those hours split across months
+- **Project Type**: Project (billable) vs Support (ongoing ops)
+
+**Validation Requirement:**
+- **Over-forecast**: Allocated hours > Approved estimate → RED FLAG (will overcharge)
+- **Under-forecast**: Allocated hours < Approved estimate → YELLOW FLAG (will undercharge)
+- **Clarification:** "Under-forecast is NOT OK. This money is my salary! Always try to be 100%."
+
+### Resource Allocation Requirements
+
+**The "Matrix" Concept:**
+
+```
+For month M:
+┌────────────────────────────────────────┐
+│ Project  │ Dev A │ Dev B │ Dev C │ Ext │
+├──────────┼───────┼───────┼───────┼─────┤
+│ Proj X   │  40h  │  20h  │   0   │ 10h │
+│ Proj Y   │  20h  │  40h  │  30h  │  0  │
+└────────────────────────────────────────┘
+```
+
+**"Untracked Resource" Requirement:**
+- Purpose: Accommodate hours for external team members (e.g., DevOps from another team)
+- Billing: NOT tracked for revenue (like a joker in a deck of cards)
+- Use case: "We might bill another team, but not track their specific person"
+
+**Validation Rules:**
+- Sum of project allocations should equal approved estimate (tolerance: ±5%)
+- Cannot allocate more than person's monthly capacity (warning, not hard block)
+- Visual indicators: GREEN (100%), YELLOW (<100%), RED (>100%)
+
+### Actuals Tracking Requirements
+
+**Data Entry:**
+- **Frequency**: Monthly aggregate, but can be updated incrementally (weekly)
+- **Method**: Manual entry (no time-tracking tool integration for MVP)
+
+**Calculations:**
+- **Running utilization**: (Allocated hours YTD) / (Capacity YTD) × 100%
+- **Overall utilization**: (Allocated hours this month) / (Capacity this month) × 100%
+
+**Display Requirement:**
+- Show utilization % alongside capacity view
+
+### Reporting Requirements
+
+**Core Reports:**
+1. **Forecast Summary** (multi-period)
+2. **Utilization Summary**
+3. **Cost Summary**
+
+**Critical Requirement:**
+> All reports must be highly customizable with filters (team, person, project, status, date range, type)
+
+**Additional Requirements:**
+- Master data / taxonomy for configurable items (roles, statuses, types)
+- Support for multi-tenancy (deferred to post-MVP)
+
+---
+
+## Technical Stack Decisions
+
+### Backend: Why Laravel?
+
+**Question Raised:** "I chose Laravel because of my PHP background. Debate me if that is not a good choice."
+
+**Consideration:**
+- Alternative: SvelteKit full-stack (single framework)
+- Alternative: Next.js + Node.js
+
+**Decision:** Laravel
+- **Rationale**: 
+  - You have PHP background (lower learning curve)
+  - Laravel is mature, robust for API development
+  - Rich ecosystem (Scribe for API docs, Pest for testing, Pint for linting)
+  - PostgreSQL support is excellent
+  - Redis integration is first-class
+
+**No pushback from AI:** Laravel is a solid choice for this use case.
+
+### Frontend: The Great Debate
+
+**Initial Question:** "May be Laravel + Svelte? Or Sveltekit itself?"
+
+**Options Presented:**
+1. Laravel + Blade Templates (rejected: less interactive)
+2. Laravel + Vue.js (recommended by AI: stay in Laravel ecosystem)
+3. **Laravel API + SvelteKit (separate)** ← CHOSEN
+4. Laravel API + React (rejected: more learning curve)
+
+**Decision:** Laravel API + SvelteKit (separate projects)
+- **Your choice:** "Sveltekit it is!"
+- **AI concern:** "Adds deployment complexity for MVP"
+- **Your response:** "I will choose this."
+- **Outcome:** Two separate containers, clean separation
+
+**Why SvelteKit?**
+- Modern, reactive
+- Great for data-heavy dashboards
+- Smaller bundle sizes than React/Vue
+- You're willing to learn it
+
+### Database: PostgreSQL from Day 1
+
+**Question:** "SQLite for local, PostgreSQL for production?"
+
+**Decision:** PostgreSQL from the start
+- **Rationale**: 
+  - Avoid migration pain later
+  - Production-grade features (JSON operators, full-text search)
+  - Better for reporting queries
+  - Volume-mounted in Docker (portability maintained)
+
+### Caching: Redis from Day 1
+
+**Initial Recommendation:** "Start without caching, add in Phase 2 if slow"
+
+**Your Response:** "Query caching and Response caching on Redis from Day 1. No need to sweat on refactoring it everywhere."
+
+**Decision:** Redis caching from day 1
+- **Rationale**: Prevents technical debt
+- **Scope**: Query caching + Response caching
+- **Implementation**: Laravel cache facade, automatic invalidation
+
+### Authentication: JWT
+
+**Question:** "Session-based or Token-based (JWT)?"
+
+**AI Recommendation:** "Session-based is easier for same-origin setup"
+
+**Your Choice:** "I will go with JWT."
+
+**Rationale:**
+- Token-based authentication
+- Suitable for SPA frontend
+- Easier to add mobile app later (if needed)
+
+### UI Component Library
+
+**Options Presented:**
+- Shadcn/ui (headless, customizable)
+- **DaisyUI** (Tailwind-based, fast) ← CHOSEN
+- Svelte Material UI (full-featured)
+- Build custom with Tailwind
+
+**Decision:** DaisyUI
+- **Rationale**: Faster to build dashboards, opinionated but fast
+- **Your response:** "Daisy it is."
+
+### Charts & Visualization
+
+**Options Presented:**
+- **Recharts** ← CHOSEN (AI recommendation)
+- Chart.js
+- Plotly
+- Apache ECharts
+
+**Decision:** Recharts
+- **Rationale**: Good balance of power and simplicity
+- **Your response:** "Agreed"
+
+### Tables & Data Grid
+
+**Options Presented:**
+- **TanStack Table (React Table)** ← CHOSEN
+- Svelte DataTable
+- Build custom
+
+**Decision:** TanStack Table
+- **AI note:** "I am not familiar with this, but I will go with your recommendation."
+- **Rationale**: Industry standard, powerful filtering/sorting, works with Svelte
+
+### Forms & Validation
+
+**Options Presented:**
+- SvelteKit Form Actions + Superforms
+- Direct API calls
+
+**Additional Question:** "How about something like Superform or Zod?"
+
+**Decision:** Superforms + Zod + SvelteKit Form Actions
+- **Rationale**: 
+  - Type-safe validation (Zod)
+  - Form state management (Superforms)
+  - Server-side handling (SvelteKit native)
+  - Single source of truth for validation
+
+### API Documentation
+
+**Question Raised:** "How about SwaggerUI documentation for APIs?"
+
+**Decision:** Laravel Scribe (auto-generates SwaggerUI)
+- **Implementation**: `composer require knuckleswtf/scribe`
+- **Output**: `/api/documentation` endpoint with OpenAPI spec
+- **Lift**: ~1 hour setup
+- **Inclusion**: From day 1
+
+### Testing Stack
+
+**Backend:**
+- PHPUnit (unit tests)
+- Pest (feature tests)
+
+**Frontend:**
+- Vitest (unit tests)
+- Playwright (E2E tests)
+
+**Decision:** Include all from day 1
+
+### Version Strategy
+
+**Question:** Which versions to use?
+
+**Decision:** Use latest versions across the stack
+- **Laravel 12** (latest major version)
+- **PHP 8.4** (compatible with Laravel 12)
+- **All other dependencies:** Use `:latest` tags (PostgreSQL, Redis, Node, npm packages)
+
+**Rationale:** 
+- Stay current with latest features and security patches
+- Avoid version lock-in from the start
+- Docker `:latest` tags ensure fresh installs get newest versions
+
+---
+
+## Architecture Decisions
+
+### Containerization
+
+**Requirement:** "From get go, everything must be containerised."
+
+**Additional Constraint:** "Do not add any proxy manager (NPM, Caddy, or Traefik). My environment already runs an NPM."
+
+**Decision:** Docker Compose with 4 containers
+1. **Frontend**: SvelteKit (port 5173)
+2. **Backend**: Laravel (port 3000)
+3. **Database**: PostgreSQL (port 5432)
+4. **Cache**: Redis (port 6379)
+
+**Reverse Proxy:**
+- Use existing Nginx Proxy Manager
+- NPM routes `/api/*` → Laravel
+- NPM routes `/*` → SvelteKit
+
+### Multi-Tenancy
+
+**Question:** "Should we build multi-tenant from day 1?"
+
+**AI Recommendation:** "Start single-tenant. Add tenant_id column when needed."
+
+**Your Response:** "AGREED"
+
+**Rationale:** Reduces complexity, easy to add later
+
+### Environment Configuration
+
+**Question:** ".env files or Docker secrets?"
+
+**AI Recommendation:** ".env files for local, Docker secrets in prod"
+
+**Your Response:** ".env everywhere"
+
+**Decision:** .env files in all environments
+- Simpler configuration management
+- Consistent across local/prod
+
+### Development Environment
+
+**Question:** "Docker Compose for local dev, or native setup?"
+
+**AI Recommendation:** "Docker Compose from the start. Ensures prod parity."
+
+**Your Response:** "100% agree. If possible, we should have at least the local dev avoid building after every change (may be code mounted)"
+
+**Decision:** Docker Compose with code-mounted volumes
+- Hot reload for both frontend and backend
+- Avoid rebuilding containers on every change
+- Volume mounts: `./frontend:/app`, `./backend:/var/www`
+
+### Real-Time Updates
+
+**Question:** "Do you need live updates (WebSockets), or is polling OK?"
+
+**AI Recommendation:** "Start with polling. Add WebSockets if needed."
+
+**Your Response:** "I dont think we need to sweat on it. Go with a basic implementation. Polling is good enough."
+
+**Decision:** Polling (defer WebSockets to Phase 2)
+
+### State Management (Frontend)
+
+**Question:** "Svelte stores for UI state, or always fetch from API?"
+
+**AI Recommendation:** "Use Svelte stores for UI state (filters, modals), API queries for data."
+
+**Your Response:** "Agreed."
+
+**Decision:** Minimal Svelte stores (UI state only)
+
+### Report Exports
+
+**Question:** "Will users need PDF/CSV exports?"
+
+**AI Recommendation:** "Start with on-screen reports, add exports in phase 2."
+
+**Your Initial Response:** "Good to have at this time."
+
+**AI Clarification:** "Should exports be in MVP scope, or phase 2?"
+
+**Final Decision:** Phase 2
+- **Rationale**: Keeps MVP scope tight, adds 4 hours of work
+- Interactive dashboard is primary value
+
+### Caching Strategy
+
+**Question Raised by You:** "Should we talk about a caching layer?"
+
+**Options Discussed:**
+1. Database Query Caching
+2. API Response Caching
+3. Full-page caching
+
+**AI Recommendation:** "Start without caching, add Redis in Phase 2 if slow"
+
+**Your Response:** "Query caching and Response caching on Redis from Day 1. No need to sweat on refactoring it everywhere."
+
+**Decision:** Redis caching from day 1
+- Query caching (expensive calculations)
+- Response caching (GET endpoints)
+- Automatic cache invalidation on mutations
+- TTL: 1 hour (allocations), 15 min (reports), 24 hours (master data)
+
+---
+
+## Quality & Testing Decisions
+
+### Project-Level Standing Instructions
+
+**Your 5 Points (to be encoded in OpenSpec config.yml):**
+
+1. **Every change must have unit tests, E2E test, regression tests** (whether prompted or not)
+2. **Changes must end with code review** for style, standard, security
+3. **Verification (`/opsx-verify`) must trigger checking of uncovered code** (code not tested)
+4. **Commits must be granular** (one fix = one commit)
+5. **Tests run in a progressive loop**:
+   - Test → Create issue in repo → Fix → Retest + Regression test
+   - Loop until all issues fixed
+
+**AI Question:** "Is this for ALL tests, or specifically for E2E/integration tests?"
+
+**Your Clarification:** "I agree. Let us go for a kill only in E2E and Integration."
+
+**AI Concern:** "This workflow can slow velocity. For MVP, start with 'every test must pass before merge' and defer granular issue-loop to phase 2?"
+
+**Your Response:** "Agreed"
+
+**Final Decision:**
+- **MVP**: All tests must pass, granular commits, code review
+- **Phase 2**: Issue-driven test loop for E2E/integration failures
+
+### Code Coverage Threshold
+
+**AI Question:** "What code coverage % for /opsx-verify?"
+
+**Your Response:** "Let us call it >70%"
+
+**Decision:** >70% code coverage required
+- Checked in `/opsx-verify`
+- Blocks merge if below threshold
+
+### Data Validation Rules
+
+**AI Question:** "Should we document validation rules in OpenSpec?"
+
+**Your Response:** "OpenSpec document must have all required data. I believe we need it there for verification and regression tests. Thoughts?"
+
+**AI Agreement:** "Absolutely. Rules inform API implementation, test cases, and verification."
+
+**Decision:** Create `validation-rules.md` in OpenSpec changes
+- These rules drive Laravel validation
+- Inform test case generation
+- Used in `/opsx-verify`
+
+### RBAC (Role-Based Access Control)
+
+**AI Question:** "Can a Manager see only their projects, or all projects?"
+
+**Your Clarification:** "Can see all projects. But not allocate to other team's members."
+
+**Decision:** RBAC Matrix defined
+
+| Persona | Can See | Can Modify |
+|---------|---------|------------|
+| Superuser | All | All |
+| Manager | All projects (read-only for others') | Own projects, own team allocations |
+| Developer | Own allocations, assigned projects | Own actuals only |
+| Top Brass | All reports | Nothing (read-only) |
+
+---
+
+## Deferred Features
+
+### Phase 2 Deferrals
+
+| Feature | Reason for Deferral | Estimated Lift |
+|---------|---------------------|----------------|
+| **Notifications (WebSocket)** | Allocations are monthly, not time-critical | ~6 hours |
+| **PDF/CSV Exports** | On-screen reports sufficient for MVP | ~4 hours |
+| **Background Jobs** | No heavy processing in MVP, Laravel Queue ready | ~2 hours |
+| **Audit Logging** | No compliance requirement for MVP | ~3 hours |
+| **Advanced Caching (pre-calculated reports)** | Start with on-demand queries | ~4 hours |
+| **API Versioning (`/api/v1/`)** | Not needed until breaking changes | ~2 hours |
+| **Issue-driven test loop** | Slower velocity for MVP | ~8 hours |
+
+### Notifications Deep-Dive
+
+**AI Presented 3 Options:**
+
+**Option A:** Include WebSocket + 1 notification PoC (~6 hours)
+- Pros: Real-time updates, framework ready
+- Cons: Adds complexity, delays other features by ~1 day
+
+**Option B:** Skip notifications entirely for MVP
+- Pros: Keeps scope tight, faster MVP
+- Cons: Users must refresh to see changes
+- **Debt accrual:** Low (easy to add later)
+
+**Option C:** Polling-based notifications (~2 hours)
+- SvelteKit polls every 30s
+- Pros: Simple, users see changes quickly
+- Cons: Not true real-time, more server load
+
+**AI Recommendation:** Option B (skip for MVP)
+
+**Your Question:** "Wont it become a technical debt? How big the lift will be to at least set up the wiring for notifications (websocket setup and one notification implemented as a proof of concept?)"
+
+**AI Response:** "6 hours total lift. Not worth it for MVP - allocations are monthly, not time-critical."
+
+**Your Decision:** "Ok. Option B."
+
+---
+
+## Rejected Options
+
+### Options Considered but Not Chosen
+
+| Option | Why Rejected |
+|--------|--------------|
+| **Laravel + Blade Templates** | Less interactive UI, harder to build dashboards |
+| **Laravel + Vue.js** | You preferred learning Svelte over Vue |
+| **Next.js + Node.js** | You have PHP background, prefer Laravel |
+| **SQLite for local dev** | Avoid migration pain, PostgreSQL from start |
+| **Session-based auth** | JWT chosen for future mobile support |
+| **Multi-tenancy from day 1** | Adds complexity, defer to post-MVP |
+| **WebSocket notifications in MVP** | Not time-critical, 6 hours of work |
+| **PDF/CSV exports in MVP** | On-screen reports sufficient initially |
+| **GraphQL** | REST is simpler for MVP |
+| **Chart.js / Plotly / ECharts** | Recharts chosen (good balance) |
+| **Shadcn/ui / Svelte Material UI** | DaisyUI chosen (faster development) |
+| **Custom-built table component** | TanStack Table chosen (industry standard) |
+
+---
+
+## Open Questions (Resolved)
+
+### 1. Over/Under Forecast Context
+
+**Initial Confusion:** "Is over/under forecast about allocation vs approved estimate, or allocation vs capacity?"
+
+**Your Clarification:** "In the project's context, yes. it is allocation vs approved. (For the future phases, there will be over/under forecast for resources - that will be based on individual's allocation vs their capacity. May be we can keep that aside for now.)"
+
+**Example Correction:**
+- **AI Example:** "Month 1 allocation: 80hrs → Under-forecast (OK)"
+- **Your Correction:** "Not OK. Because this money is my salary! We always try to be on par - 100%. If it is under-forecast, call that out."
+
+**Resolution:** Both over and under-forecast are flagged. Under is YELLOW, Over is RED.
+
+### 2. Availability Model
+
+**Initial Confusion:** "Is availability 1.0 = 8 hours/day, or is it a percentage?"
+
+**Your Clarification:** "Hours per day must be configurable per project. 1 means, 100% of a productive day. .5 means half of that and so on. I dont want to make it too granular thats why I had stops on 1, .5 and 0. Then there are H - holidays and O- weekend offs."
+
+**Resolution:** Availability is 0, 0.5, or 1.0 (not percentage). 0 = unavailable or PTO.
+
+### 3. Untracked Resource Purpose
+
+**Initial Confusion:** "Is this for contractors, or overhead?"
+
+**Your Clarification:** "We might have some time allocated for DevOps team which is not part of my team but might out bill to another team. For that purpose."
+
+**Resolution:** Untracked resource is for external team time (not billed in this system).
+
+### 4. Team Structure
+
+**Initial Confusion:** "Does 'Team' mean sub-teams?"
+
+**Your Clarification:** "Yes. Read that as 'Role'."
+
+**Resolution:** Team = Role (e.g., Frontend, Backend, QA, PM, Architect).
+
+### 5. Manager Permissions
+
+**Initial Confusion:** "Can a Manager allocate to projects outside their team?"
+
+**Your Clarification:** "Can see. But not allocate to other team's members."
+
+**Resolution:** Managers see all projects (read-only for others'), but can only allocate their own team members.
+
+---
+
+## Timeline
+
+### Conversation Flow
+
+**February 17, 2026:**
+
+1. **Initial Problem Statement** (09:00-09:30)
+   - You described the spreadsheet nightmare
+   - Identified 4 personas
+   - Outlined capacity planning → allocation → actuals flow
+
+2. **Requirements Deep-Dive** (09:30-11:00)
+   - Clarified capacity planning details (availability model)
+   - Defined project lifecycle states
+   - Detailed allocation matrix requirements
+   - Discussed reporting needs
+
+3. **Technical Stack Discussion** (11:00-12:00)
+   - Debated Laravel vs alternatives → Laravel chosen
+   - Frontend: Vue vs Svelte → SvelteKit chosen
+   - Database: SQLite vs PostgreSQL → PostgreSQL chosen
+   - Authentication: Session vs JWT → JWT chosen
+
+4. **Architecture Decisions** (12:00-13:00)
+   - Containerization approach (Docker Compose)
+   - Multi-tenancy deferral
+   - Caching strategy (Redis from day 1)
+   - Real-time updates (polling, defer WebSockets)
+
+5. **Quality Standards** (13:00-13:30)
+   - Testing requirements (>70% coverage)
+   - Code review process
+   - Commit standards (granular)
+   - Issue-driven test loop (defer to Phase 2)
+
+6. **Frontend Libraries** (13:30-14:00)
+   - UI components: DaisyUI chosen
+   - Charts: Recharts chosen
+   - Tables: TanStack Table chosen
+   - Forms: Superforms + Zod chosen
+
+7. **Final Verification** (14:00-14:30)
+   - Reviewed complete architecture
+   - Confirmed no missing pieces
+   - Decided on API documentation (Scribe)
+   - Named the project: **Headroom**
+
+8. **Documentation Request** (14:30-15:00)
+   - Request for comprehensive documentation
+   - Mermaid diagrams
+   - Word document for hardcopy
+
+### Key Turning Points
+
+**Moment 1: Naming the Project**
+- You chose "Headroom" over "Margin"
+- This crystallized the product's identity
+
+**Moment 2: SvelteKit Decision**
+- Despite AI recommending Laravel + Vue (easier)
+- You chose SvelteKit (more learning, cleaner separation)
+- This showed willingness to learn for better architecture
+
+**Moment 3: Redis from Day 1**
+- AI recommended deferring caching
+- You insisted on Redis from day 1 (avoid refactoring debt)
+- This showed pragmatic technical judgment
+
+**Moment 4: "This money is my salary!"**
+- Clarified that under-forecast is NOT acceptable
+- Both over and under-forecast must be flagged
+- This revealed the business criticality of accurate allocation
+
+**Moment 5: "One last check before we lock in"**
+- You paused before committing to the stack
+- Requested comprehensive review
+- This showed careful, deliberate decision-making
+
+---
+
+## Considerations & Trade-offs
+
+### Decision Matrix
+
+| Decision | Benefit | Cost | Rationale |
+|----------|---------|------|-----------|
+| **SvelteKit (separate)** | Clean separation, modern framework | Deployment complexity, learning curve | Better long-term architecture |
+| **Redis from day 1** | No refactoring debt later | Slightly more upfront setup | Prevents future pain |
+| **JWT over sessions** | Mobile-ready, stateless | More complex than sessions | Future-proofing |
+| **PostgreSQL from day 1** | No migration later | Heavier than SQLite | Production-grade from start |
+| **Defer notifications** | Faster MVP | Users must refresh | Not time-critical for monthly planning |
+| **Defer exports** | Tighter scope | No PDF/CSV initially | On-screen reports are primary value |
+| **TanStack Table** | Powerful, standard | Learning curve (you're unfamiliar) | Industry best practice |
+| **DaisyUI** | Fast development | Opinionated | Speed > customization for MVP |
+
+### Risk Assessment
+
+**Low Risk:**
+- Laravel choice (you have PHP background)
+- PostgreSQL choice (mature, well-supported)
+- Redis choice (simple, well-integrated with Laravel)
+
+**Medium Risk:**
+- SvelteKit choice (learning curve, but modern and well-documented)
+- TanStack Table (unfamiliar to you, but powerful)
+- Two-container deployment (more moving parts, but cleaner)
+
+**Mitigated Risks:**
+- **Over-complexity:** Deferred features to Phase 2 (notifications, exports, multi-tenancy)
+- **Performance:** Redis caching from day 1
+- **Testing debt:** >70% coverage enforced from day 1
+
+---
+
+## Success Metrics (Defined)
+
+### MVP Success Criteria
+
+**Functional Completeness:**
+- ✅ Users can define team capacity
+- ✅ Users can create projects with approved estimates
+- ✅ Users can allocate resources month-by-month
+- ✅ Users can log actual hours
+- ✅ System validates allocations (over/under warnings)
+- ✅ Users can view 5 core reports
+- ✅ RBAC enforced (4 personas)
+
+**Quality Metrics:**
+- ✅ All tests passing (unit + E2E)
+- ✅ Code coverage >70%
+- ✅ Zero linting errors
+- ✅ API documentation auto-generated
+
+**Usability Metrics (Post-Launch):**
+- Manager can complete monthly allocation in <30 minutes (vs 2+ hours in spreadsheet)
+- Zero billing errors in first 3 months (over/under caught before invoicing)
+- 90% of team members log actuals weekly
+
+**AI Rationale:** "Fair but not too lenient. Manager time savings is measurable. Billing error prevention is critical. Adoption (90%) is achievable but requires discipline."
+
+---
+
+## Appendix: Conversation Highlights
+
+### Most Insightful Moments
+
+**On Under-Forecasting:**
+> "Not OK. Because this money is my salary! We always try to be on par - 100%. If it is under-forecast, call that out."
+
+**On Naming:**
+> "Headroom. It's the word managers actually say ('do we have headroom for this?'), it immediately signals capacity planning, and it's memorable without being try-hard."
+
+**On Caching:**
+> "Query caching and Response caching on Redis from Day 1. No need to sweat on refactoring it everywhere."
+
+**On Quality:**
+> "I know this will be a time taking process. But I believe it will be worth it."
+
+**On Final Review:**
+> "Now this is the part I am most scared about. If I say yes, we need to stick to this rule book. Did I forget anything?"
+
+### Your Leadership Style
+
+**Observations from conversation:**
+- **Pragmatic:** Willing to defer features to keep scope tight
+- **Quality-focused:** Insisted on testing, code review, coverage from day 1
+- **Deliberate:** Paused multiple times to verify decisions before committing
+- **Learning-oriented:** Chose SvelteKit despite unfamiliarity, trusted AI recommendations on unfamiliar tools (TanStack Table)
+- **Business-minded:** Constantly connected technical decisions to business impact (billing accuracy, manager time savings)
+
+---
+
+## Next Steps (Post-Documentation)
+
+### Immediate Actions
+
+1. **Review Documentation**
+   - Read Project Charter
+   - Review Architecture Document
+   - Verify Decision Log captures everything
+
+2. **Formalize in OpenSpec**
+   - Create first change: `/opsx-new headroom-foundation`
+   - Document proposal, specs, design, tasks
+   - Begin implementation
+
+3. **Project Setup**
+   - Initialize Laravel project
+   - Initialize SvelteKit project
+   - Create Docker Compose setup
+   - Configure PostgreSQL + Redis
+
+4. **First Sprint (Week 1)**
+   - Database schema design
+   - Docker Compose working
+   - JWT authentication
+   - Basic CRUD for team members
+
+---
+
+**Document Control:**
+- **Owner:** Santhosh J
+- **Type:** Conversation Archive & Decision Log
+- **Purpose:** Comprehensive record for future reference
+- **Intended Audience:** Santhosh J, Associate
+- **Format:** Markdown (for git), Word (for hardcopy)
+
+---
+
+*"This is my magnum opus project as of date."* — Santhosh J, February 17, 2026
+
+---
+
+*End of Decision Log*
diff --git a/docs/headroom-executive-summary.md b/docs/headroom-executive-summary.md
new file mode 100644
index 00000000..9fec5ae2
--- /dev/null
+++ b/docs/headroom-executive-summary.md
@@ -0,0 +1,637 @@
+# HEADROOM
+## Resource Planning & Capacity Management System
+
+**Executive Summary & Technical Specification**
+
+---
+
+**Project Owner:** Santhosh J  
+**Date:** February 17, 2026  
+**Version:** 1.0  
+**Status:** Approved for Development  
+
+---
+
+## Table of Contents
+
+1. [Executive Overview](#executive-overview)
+2. [The Problem](#the-problem)
+3. [The Solution](#the-solution)
+4. [Technical Architecture](#technical-architecture)
+5. [Core Features](#core-features)
+6. [Quality Standards](#quality-standards)
+7. [Timeline & Phases](#timeline--phases)
+8. [Success Metrics](#success-metrics)
+
+---
+
+## Executive Overview
+
+### What is Headroom?
+
+Headroom is a web-based resource planning and capacity management tool designed to solve the allocation chaos faced by engineering managers juggling multiple projects and team members.
+
+**The Name:** "Headroom" captures the central question managers ask daily: "Do we have headroom for this new work?"
+
+### The Business Case
+
+**Current State:** Managing 10-15 developers across 10-12 concurrent projects using spreadsheets
+- Manual capacity calculations prone to errors
+- No validation mechanisms
+- Billing errors (over-allocation → overcharge, under-allocation → undercharge)
+- No visibility into team capacity
+- No audit trail
+
+**Future State:** Structured system that:
+- Automates capacity calculations
+- Validates allocations against estimates
+- Prevents billing errors before they happen
+- Provides clear visibility into team headroom
+- Tracks planned vs actual hours
+
+**ROI:** Manager time savings: 2+ hours → <30 minutes per monthly allocation cycle
+
+---
+
+## The Problem
+
+### Pain Points
+
+**1. Capacity Calculation Chaos**
+- Manual calculations across holidays, PTO, weekends
+- No systematic way to track who's available when
+- Hard to answer: "Who has capacity for new work?"
+
+**2. Billing Errors**
+- **Over-allocation:** More hours allocated than approved estimate → Overcharge client → Escalations
+- **Under-allocation:** Fewer hours allocated than approved estimate → Undercharge → Revenue loss
+- Both scenarios are unacceptable: "This money is my salary!"
+
+**3. No Validation**
+- Easy to over-allocate people or projects
+- No warnings when allocations exceed capacity
+- Spreadsheet formulas break, go unnoticed
+
+**4. Visibility Gap**
+- Can't easily see team utilization
+- Hard to compare planned vs actual hours
+- No forecasting capability
+
+**5. No Audit Trail**
+- Changes are invisible
+- Can't track who changed what allocation when
+
+---
+
+## The Solution
+
+### The Monthly Cycle
+
+Headroom organizes work around monthly capacity planning cycles:
+
+```
+┌─────────────────────────────────────────────────────────┐
+│                  MONTHLY CYCLE                           │
+├─────────────────────────────────────────────────────────┤
+│                                                          │
+│  1. CAPACITY PLANNING                                    │
+│     • Define team members (name, role, rate)            │
+│     • Mark holidays, PTO, weekends                       │
+│     • Set daily availability (0, 0.5, 1.0)              │
+│     OUTPUT: Individual & team capacity, revenue potential│
+│                                                          │
+│  2. PROJECT SETUP                                        │
+│     • Track project status (lifecycle states)           │
+│     • Define approved estimate (billable hours)         │
+│     • Forecast effort across months                      │
+│     OUTPUT: Month-wise forecast, over/under indicators  │
+│                                                          │
+│  3. RESOURCE ALLOCATION                                  │
+│     • Allocate hours per person per project per month   │
+│     • Validate: allocation ≤ capacity, allocation = estimate│
+│     • Track "untracked" resources (external teams)      │
+│     OUTPUT: Clear allocation view, RED/YELLOW flags     │
+│                                                          │
+│  4. ACTUALS TRACKING                                     │
+│     • Team members log hours worked (monthly)           │
+│     • Calculate utilization (planned vs actual)         │
+│     OUTPUT: Running & overall utilization metrics       │
+│                                                          │
+└─────────────────────────────────────────────────────────┘
+```
+
+### Four Personas
+
+| Persona | Primary Use Case |
+|---------|------------------|
+| **Superuser** | System setup, configuration, master data management |
+| **Manager** | Resource planning, allocation, team oversight, approve estimates |
+| **Developer** | View allocations, log hours, understand own workload |
+| **Top Brass** | Executive reports, forecasts, budget visibility (read-only) |
+
+### Key Validation Rules
+
+**Over/Under Allocation Detection:**
+- **GREEN:** Allocation = Approved estimate (100%)
+- **YELLOW:** Under-allocated (<100%) → Will undercharge
+- **RED:** Over-allocated (>100%) → Will overcharge
+
+**Both under and over are flagged.** The goal: Always allocate 100% of approved estimate.
+
+---
+
+## Technical Architecture
+
+### System Overview
+
+```
+┌─────────────────────────────────────────────────────────┐
+│                    ARCHITECTURE                          │
+├─────────────────────────────────────────────────────────┤
+│                                                          │
+│  FRONTEND (SvelteKit - Port 5173)                       │
+│  • Tailwind CSS + DaisyUI (UI components)              │
+│  • Recharts (visualizations)                            │
+│  • TanStack Table (data grids)                          │
+│  • Superforms + Zod (form validation)                   │
+│  • Vitest (unit tests) + Playwright (E2E tests)        │
+│                                                          │
+│  BACKEND (Laravel API - Port 3000)                      │
+│  • Laravel 12 (latest, PHP 8.4)                         │
+│  • Laravel API Resources (consistent JSON)              │
+│  • JWT Authentication (tymon/jwt-auth)                  │
+│  • Laravel Scribe (SwaggerUI API docs)                  │
+│  • PHPUnit + Pest (testing)                             │
+│                                                          │
+│  DATA LAYER                                              │
+│  • PostgreSQL (latest) (primary database)               │
+│  • Redis (latest) (query + response caching)            │
+│                                                          │
+│  INFRASTRUCTURE                                          │
+│  • Docker Compose (4 containers)                        │
+│  • Nginx Proxy Manager (reverse proxy)                  │
+│  • Code-mounted volumes (hot reload)                    │
+│  • .env configuration (all environments)                │
+│                                                          │
+└─────────────────────────────────────────────────────────┘
+```
+
+### Why These Choices?
+
+**SvelteKit:**
+- Modern, reactive framework
+- Great for data-heavy dashboards
+- Smaller bundle sizes
+- Chosen over Vue/React for learning/modernization
+
+**Laravel:**
+- Project owner has PHP background
+- Robust API development framework
+- Rich ecosystem (Scribe, Pest, Pint)
+- Excellent PostgreSQL support
+
+**PostgreSQL:**
+- Production-grade from day 1 (avoid SQLite migration)
+- JSON operators for flexible queries
+- Better for reporting queries
+
+**Redis:**
+- Caching from day 1 (avoid refactoring debt)
+- Query caching + response caching
+- Automatic cache invalidation
+
+**JWT Authentication:**
+- Token-based (suitable for SPA)
+- Future-ready (easier mobile support later)
+
+### Deployment Architecture
+
+**Local Development:**
+- 4 Docker containers (frontend, backend, postgres, redis)
+- Code-mounted volumes (hot reload, no rebuild)
+- Docker Compose orchestration
+
+**Production:**
+- Same containerized setup
+- Nginx Proxy Manager routes:
+  - `/` → SvelteKit
+  - `/api/*` → Laravel API
+
+---
+
+## Core Features
+
+### 1. Capacity Planning
+
+**Inputs:**
+- Team member: Name, role, hourly rate
+- Calendar: Holidays, weekends
+- PTO requests
+- Daily availability: 0 (unavailable), 0.5 (half day), 1.0 (full day)
+
+**Outputs:**
+- Individual capacity (person-days per month)
+- Team capacity (total available person-days)
+- Possible revenue (if fully utilized)
+
+**Key Insight:** Availability is per-person, per-day. "1.0" means 100% of a productive day (hours per day configurable).
+
+---
+
+### 2. Project Management
+
+**Project Lifecycle:**
+```
+NA/Support → Initial → Gathering Estimates → Estimate Pending Approval
+                ↓
+        Estimate Rework ←───────┘
+                ↓
+        Estimate Approved → Funded → Scheduled → In-Progress
+                ↓
+        Ready for Prod → Done
+                ↓
+        [Optional: On-Hold, Cancelled]
+```
+
+**Key Attributes:**
+- **Approved Estimate:** Total billable hours approved by client
+- **Forecasted Effort:** Month-by-month breakdown of those hours
+- **Type:** Project (billable) vs Support (ongoing ops)
+
+**Validation:**
+- Sum of forecasted effort must equal approved estimate (±5% tolerance)
+- Alerts when monthly team allocation exceeds team capacity
+
+---
+
+### 3. Resource Allocation
+
+**The Allocation Matrix:**
+
+For a given month, view all projects vs all team members:
+
+```
+┌──────────────────────────────────────────────────────┐
+│ Project    │ Dev A │ Dev B │ Dev C │ Untracked │ Total│
+├────────────┼───────┼───────┼───────┼───────────┼─────┤
+│ Project X  │  40h  │  20h  │   0   │    10h    │ 70h │
+│ Project Y  │  20h  │  40h  │  30h  │     0     │ 90h │
+│ Project Z  │   0   │  80h  │  60h  │     0     │140h │
+├────────────┼───────┼───────┼───────┼───────────┼─────┤
+│ Total      │  60h  │ 140h  │  90h  │    10h    │300h │
+│ Capacity   │ 160h  │ 160h  │ 120h  │     ∞     │440h │
+│ % Util     │  38%  │  88%  │  75%  │    N/A    │ 68% │
+└──────────────────────────────────────────────────────┘
+```
+
+**Features:**
+- Visual indicators: GREEN (100%), YELLOW (<100%), RED (>100%)
+- "Untracked" resource for external team time (not billed)
+- Inline editing
+- Sortable, filterable
+
+**Validation Rules:**
+- Cannot allocate negative hours
+- Cannot allocate more than person's capacity (warning)
+- Sum of project allocations should equal approved estimate (±5%)
+
+---
+
+### 4. Actuals & Utilization
+
+**Data Entry:**
+- Team members log hours worked per project per month
+- Manual entry (monthly aggregate, can update weekly incrementally)
+- No time-tracking tool integration (MVP)
+
+**Calculations:**
+- **Running Utilization:** (Allocated hours YTD) / (Capacity YTD) × 100%
+- **Overall Utilization:** (Allocated hours this month) / (Capacity this month) × 100%
+- **Variance:** Actual hours - Allocated hours
+
+**Display:**
+- Utilization % shown alongside capacity view
+- Color-coded (low, optimal, high utilization)
+
+---
+
+### 5. Reports & Analytics
+
+**Core Reports:**
+
+| Report | Purpose | Filters |
+|--------|---------|---------|
+| **Forecast Summary** | Multi-period view of allocations and revenue | Date range, team, project, status |
+| **Utilization Summary** | Team and individual utilization trends | Date range, team member, role |
+| **Cost Summary** | Revenue forecasts based on allocations × rates | Date range, project, client |
+| **Allocation Report** | Who's allocated to what, month-by-month | Month, team, project |
+| **Variance Report** | Planned vs Actual analysis | Date range, project, person |
+
+**All reports:**
+- Highly customizable filters
+- On-screen display (PDF/CSV export deferred to Phase 2)
+- Cached for performance (Redis)
+
+---
+
+### 6. Role-Based Access Control (RBAC)
+
+**Permission Matrix:**
+
+| Action | Superuser | Manager | Developer | Top Brass |
+|--------|-----------|---------|-----------|-----------|
+| View all projects | ✅ | ✅ (read-only for others') | ❌ (assigned only) | ✅ (read-only) |
+| Create/edit projects | ✅ | ✅ (own projects) | ❌ | ❌ |
+| Allocate resources | ✅ | ✅ (own team only) | ❌ | ❌ |
+| View allocations | ✅ | ✅ | ✅ (own only) | ✅ |
+| Log hours | ✅ | ✅ | ✅ | ❌ |
+| View reports | ✅ | ✅ | ❌ | ✅ |
+| Configure system | ✅ | ❌ | ❌ | ❌ |
+
+---
+
+## Quality Standards
+
+### Testing Requirements
+
+**Every change must include:**
+1. **Unit tests** (backend: PHPUnit, frontend: Vitest)
+2. **E2E tests** (Playwright)
+3. **Regression tests** (full suite on each change)
+
+**Coverage Target:** >70% (enforced in `/opsx-verify`)
+
+**Test Loop (Phase 2):**
+- E2E/Integration failure → Create GitHub issue → Fix → Retest → Close issue
+- (MVP: Fix inline, no issue creation)
+
+---
+
+### Code Review Checklist
+
+Before merge:
+- ✅ **Style:** PSR-12 (PHP), Prettier (JS), ESLint (SvelteKit)
+- ✅ **Standards:** Laravel conventions, SvelteKit best practices
+- ✅ **Security:** Input validation, SQL injection prevention, XSS protection
+- ✅ **Tests:** All tests passing, coverage >70%
+- ✅ **API Docs:** Scribe auto-generated documentation up-to-date
+
+---
+
+### Commit Standards
+
+**Granular commits:** One fix = one commit
+
+**Format:**
+```
+[Type] Brief description (50 chars max)
+
+Detailed explanation (optional, 72 char wrap)
+
+Refs: openspec/changes/<change-name>
+```
+
+**Types:** `feat`, `fix`, `refactor`, `test`, `docs`, `chore`
+
+---
+
+## Timeline & Phases
+
+### MVP (Phase 1) - 6-8 Weeks
+
+**Sprint 1: Project Setup (1 week)**
+- Docker Compose setup (4 containers)
+- Laravel + SvelteKit scaffolding
+- Database schema design
+- JWT authentication
+
+**Sprint 2: Capacity Planning (1.5 weeks)**
+- Team member CRUD
+- Holiday/PTO calendar
+- Availability tracking
+- Capacity calculations
+
+**Sprint 3: Project Management (1.5 weeks)**
+- Project CRUD
+- Status state machine
+- Approved estimate tracking
+- Forecasted effort
+
+**Sprint 4: Resource Allocation (2 weeks)**
+- Allocation matrix UI
+- Validation rules (over/under detection)
+- Visual indicators (GREEN/YELLOW/RED)
+- Untracked resource bucket
+
+**Sprint 5: Actuals & Reporting (2 weeks)**
+- Time logging interface
+- Utilization calculations
+- 5 core reports with filters
+- Redis caching implementation
+
+**Sprint 6: Testing & Polish (1 week)**
+- E2E test coverage (Playwright)
+- Code review
+- Bug fixes
+- API documentation (Scribe)
+
+---
+
+### Phase 2 - Enhancements (3-4 weeks)
+
+**Deferred Features:**
+- Notifications (WebSocket) - ~6 hours
+- PDF/CSV exports - ~4 hours
+- Background jobs (Laravel Queue) - ~2 hours
+- Audit logging - ~3 hours
+- Advanced caching (pre-calculated reports) - ~4 hours
+- Issue-driven test loop - ~8 hours
+- Bug fixes from production use
+
+---
+
+### Phase 3 - Scale & Optimize (TBD)
+
+**Future Enhancements:**
+- Multi-tenancy
+- Mobile optimization
+- AI-powered forecasting
+- Integration APIs (time-tracking, accounting)
+- Advanced resource-level over/under forecasting
+
+---
+
+## Success Metrics
+
+### MVP Success Criteria
+
+**Functional Completeness:**
+- ✅ Users can define team capacity (members, holidays, PTO, availability)
+- ✅ Users can create projects with approved estimates
+- ✅ Users can allocate resources to projects month-by-month
+- ✅ Users can log actual hours worked
+- ✅ System validates allocations (over/under warnings)
+- ✅ Users can view 5 core reports (forecast, utilization, cost, allocation, variance)
+- ✅ RBAC enforced (4 personas: Superuser, Manager, Dev, Top Brass)
+
+**Quality Metrics:**
+- ✅ All tests passing (unit + E2E)
+- ✅ Code coverage >70%
+- ✅ Zero linting errors
+- ✅ API documentation auto-generated (SwaggerUI)
+- ✅ Docker Compose setup working (local dev)
+
+**Usability Metrics (Post-Launch):**
+- **Manager time savings:** Complete monthly allocation in <30 minutes (vs 2+ hours in spreadsheet)
+- **Billing accuracy:** Zero billing errors in first 3 months (over/under caught before invoicing)
+- **Adoption:** 90% of team members log actuals weekly
+
+---
+
+## Data Model (Simplified)
+
+### Core Entities
+
+**Team Member**
+- Name, Role, Hourly Rate, Active status
+
+**Project**
+- Project Code, Title, Status, Type, Approved Estimate, Forecasted Effort
+
+**Allocation**
+- Project + Team Member + Month + Allocated Hours
+
+**Actual**
+- Project + Team Member + Month + Hours Logged
+
+**Supporting Entities:**
+- Roles, Project Statuses, Project Types, Holidays, PTO
+
+### Key Relationships
+
+```
+TEAM_MEMBER ──< ALLOCATION >── PROJECT
+      │                           │
+      └─< ACTUAL >────────────────┘
+      │
+      └─< PTO
+```
+
+---
+
+## Master Data / Taxonomy
+
+**Configurable Lists (Admin-managed):**
+
+**Roles/Teams:**
+- Frontend Developer
+- Backend Developer
+- QA Engineer
+- DevOps Engineer
+- UX Designer
+- Project Manager
+- Architect
+
+**Project Statuses:**
+- NA/Support, Initial, Gathering Estimates, Estimate Pending Approval, Estimate Rework, Estimate Approved, Funded, Scheduled, In-Progress, Ready for Prod, Done, On-Hold, Cancelled
+
+**Project Types:**
+- Project (billable)
+- Support (ongoing ops)
+
+**Availability Options:**
+- 0 (unavailable/PTO)
+- 0.5 (half day)
+- 1.0 (full day)
+
+---
+
+## Explicitly Out of Scope
+
+**Features NOT included:**
+- Time-tracking tool integration (manual entry only)
+- Mobile app (desktop web app only)
+- Invoicing integration (billing forecasts only, not actual invoicing)
+- Project task management (project-level tracking only, not task-level)
+- Calendar sync (Google, Outlook) - manual PTO/holiday entry
+- AI-powered forecasting (rule-based validation sufficient for MVP)
+
+---
+
+## Key Design Decisions
+
+### Decision Log Summary
+
+| Decision | Rationale |
+|----------|-----------|
+| **SvelteKit (separate from Laravel)** | Clean separation, modern framework, worth the learning curve |
+| **Redis caching from day 1** | Prevents refactoring debt ("No need to sweat on refactoring it everywhere") |
+| **JWT authentication** | Token-based, future-ready for mobile |
+| **PostgreSQL from day 1** | Avoid migration pain, production-grade |
+| **Defer notifications (WebSocket)** | Not time-critical for monthly planning, saves 6 hours |
+| **Defer PDF/CSV exports** | On-screen reports sufficient for MVP, adds 4 hours |
+| **>70% code coverage** | Fair but not too lenient, enforced from day 1 |
+| **Granular commits** | One fix = one commit, better git history |
+| **Both over and under-forecast flagged** | "This money is my salary!" - 100% allocation is goal |
+
+---
+
+## Project Philosophy
+
+### Guiding Principles
+
+1. **Quality over speed** - >70% test coverage, code review, security checks from day 1
+2. **Prevent technical debt** - Redis from day 1, containerization from start
+3. **100% allocation is the goal** - Both over and under-forecast are problems
+4. **Manager time is valuable** - Reduce monthly allocation time from 2+ hours to <30 minutes
+5. **Billing accuracy is critical** - Zero tolerance for over/under-charging clients
+6. **Defer, don't compromise** - Features deferred to Phase 2, not cut or half-implemented
+
+---
+
+## Contact & Ownership
+
+**Project Owner:** Santhosh J  
+**Project Type:** Magnum Opus ("This is my magnum opus project as of date.")  
+**Intended Users:** Self + Associate  
+**Timeline:** MVP in 6-8 weeks, Phase 2 in 3-4 weeks  
+
+---
+
+## Appendix: Technology Stack Summary
+
+### Backend
+- Laravel 12 (latest, PHP 8.4-FPM)
+- PostgreSQL (latest)
+- Redis (latest)
+- JWT Authentication (tymon/jwt-auth)
+- Laravel Scribe (SwaggerUI)
+- PHPUnit + Pest (testing)
+
+### Frontend
+- SvelteKit
+- Tailwind CSS + DaisyUI
+- Recharts (charts)
+- TanStack Table (data grids)
+- Superforms + Zod (forms & validation)
+- Vitest + Playwright (testing)
+
+### Infrastructure
+- Docker Compose (4 containers)
+- Nginx Proxy Manager (reverse proxy)
+- .env configuration
+- Code-mounted volumes (hot reload)
+
+---
+
+**Document Version:** 1.0  
+**Last Updated:** February 17, 2026  
+**Status:** Approved for Development  
+
+---
+
+*"Headroom - Know your capacity, prevent billing errors, deliver on time."*
+
+---
+
+**END OF EXECUTIVE SUMMARY**
diff --git a/docs/headroom-project-charter.md b/docs/headroom-project-charter.md
new file mode 100644
index 00000000..3eae8de4
--- /dev/null
+++ b/docs/headroom-project-charter.md
@@ -0,0 +1,613 @@
+# Headroom - Project Charter & Specifications
+
+**Version:** 1.0  
+**Date:** February 17, 2026  
+**Status:** Approved for Development  
+
+---
+
+## Executive Summary
+
+**Headroom** is a resource planning and capacity management tool designed to solve the allocation chaos faced by engineering managers juggling multiple projects and team members. It replaces error-prone spreadsheets with a structured system that tracks capacity, forecasts utilization, prevents over/under-billing, and provides clear visibility into team allocation.
+
+**Target Users:**
+- Engineering managers (10-15 person teams)
+- Managing 10-12 concurrent projects in various stages
+- Need month-by-month capacity planning and allocation tracking
+
+**Core Value Proposition:**
+- Know exactly who has headroom for new work
+- Prevent billing errors (over-allocation → overcharge, under-allocation → undercharge)
+- Forecast revenue based on approved estimates and current allocations
+- Track planned vs actual hours to understand team utilization
+
+---
+
+## Problem Statement
+
+### Current Pain Points
+
+**The Spreadsheet Nightmare:**
+- Manual capacity calculations across holidays, PTO, weekends
+- No validation (easy to over-allocate people or projects)
+- Hard to see at a glance: "Who has capacity this month?"
+- Billing forecasts require manual formula updates
+- No audit trail of allocation changes
+- Difficult to track planned vs actual hours
+
+**Business Impact:**
+- **Over-allocation:** Leads to overcharging clients → escalations, unhappy customers
+- **Under-allocation:** Leads to undercharging → revenue loss, unhappy management
+- **Resource conflicts:** Multiple managers allocating the same person without visibility
+- **Forecast inaccuracy:** Can't reliably predict revenue or capacity needs
+
+---
+
+## Solution Overview
+
+Headroom provides a structured workflow for capacity planning and resource allocation:
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│              MONTHLY CAPACITY PLANNING CYCLE                    │
+├─────────────────────────────────────────────────────────────────┤
+│                                                                  │
+│    STEP 1: CAPACITY PLANNING                                    │
+│    ────────────────────────────────────────────────────         │
+│    • Define team members (name, role, hourly rate)             │
+│    • Mark holidays, PTO, weekends for the month                │
+│    • Set availability per day (1=full, 0.5=half, 0=unavailable)│
+│                                                                  │
+│    OUTPUT:                                                       │
+│    • Individual capacity (person-days per month)                │
+│    • Team capacity (total available person-days)                │
+│    • Possible revenue (capacity × hourly rates)                 │
+│                                                                  │
+├─────────────────────────────────────────────────────────────────┤
+│    STEP 2: PROJECT SETUP                                        │
+│    ────────────────────────────────────────────────────         │
+│    • Track project status (Initial → Estimates → Funded → ...)  │
+│    • Define approved estimate (total billable hours)            │
+│    • Forecast effort distribution across months                │
+│                                                                  │
+│    OUTPUT:                                                       │
+│    • Month-wise project forecast                                │
+│    • Alerts when forecast ≠ approved estimate                   │
+│                                                                  │
+├─────────────────────────────────────────────────────────────────┤
+│    STEP 3: RESOURCE ALLOCATION                                  │
+│    ────────────────────────────────────────────────────────────│
+│    • Allocate hours per person per project per month           │
+│    • Validation: total allocation ≤ team capacity              │
+│    • Validation: project allocation = approved estimate        │
+│    • "Untracked" bucket for external team time                 │
+│                                                                  │
+│    OUTPUT:                                                       │
+│    • Clear view: who's allocated to what                        │
+│    • Over/under allocation indicators (RED flags)               │
+│    • Running utilization % per person                           │
+│                                                                  │
+├─────────────────────────────────────────────────────────────────┤
+│    STEP 4: ACTUALS TRACKING                                     │
+│    ────────────────────────────────────────────────────────────│
+│    • Team members log hours worked (monthly aggregate)         │
+│    • Manual entry (no time-tracking tool integration for MVP)  │
+│                                                                  │
+│    OUTPUT:                                                       │
+│    • Running utilization (allocated vs capacity YTD)            │
+│    • Overall utilization (allocated % per month)                │
+│    • Variance: planned vs actual                                │
+│                                                                  │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## Complete Requirements
+
+### 1. Capacity Planning
+
+**Inputs:**
+- Team member list (name, role/team, hourly rate)
+- Calendar data per month (holidays, weekends)
+- Individual PTO requests
+- Daily availability (1.0 = full day, 0.5 = half day, 0 = unavailable)
+
+**Calculations:**
+- Individual capacity = Σ(working days × availability)
+- Team capacity = Σ(individual capacities)
+- Possible revenue = Σ(individual capacity × hourly rate)
+
+**Outputs:**
+- Individual capacity report (person-days per month)
+- Team capacity summary
+- Revenue potential (if fully utilized)
+
+**Validation Rules:**
+- Availability must be 0, 0.5, or 1.0
+- Hourly rate must be > 0
+- Working days must exclude holidays, weekends, PTO
+
+---
+
+### 2. Project Management
+
+**Project Attributes:**
+- Project ID (unique identifier)
+- Project title
+- Type: Project (billable) / Support (ongoing ops)
+- Status (see state machine below)
+- Approved estimate (total billable hours)
+- Forecasted effort (month-by-month breakdown)
+
+**Project Status State Machine:**
+```
+NA/Support → Initial → Gathering Estimates → Estimate Pending Approval
+                ↓
+        Estimate Rework ←───────┘
+                ↓
+        Estimate Approved → Funded → Scheduled → In-Progress
+                ↓
+        Ready for Prod → Done
+                ↓
+        [Optional: On-Hold, Cancelled]
+```
+
+**Outputs:**
+- Month-wise forecast per project
+- Alert when Σ(forecasted effort) ≠ approved estimate (RED flag)
+- Alert when monthly team allocation > team capacity (RED flag)
+
+**Validation Rules:**
+- Approved estimate must be > 0
+- Forecasted effort sum must equal approved estimate (±tolerance)
+- Cannot allocate hours to projects in status "Done" or "Cancelled"
+
+---
+
+### 3. Resource Allocation
+
+**Allocation Matrix:**
+```
+For selected month M:
+┌────────────────────────────────────────────────────┐
+│ Project    │ Dev A │ Dev B │ Dev C │ Untracked │  │
+├────────────┼───────┼───────┼───────┼───────────┼──┤
+│ Project X  │  40h  │  20h  │   0   │    10h    │  │
+│ Project Y  │  20h  │  40h  │  30h  │     0     │  │
+│ Project Z  │   0   │  80h  │  60h  │     0     │  │
+├────────────┼───────┼───────┼───────┼───────────┼──┤
+│ Total      │  60h  │ 140h  │  90h  │    10h    │  │
+│ Capacity   │ 160h  │ 160h  │ 120h  │     ∞     │  │
+│ % Util     │  38%  │  88%  │  75%  │    N/A    │  │
+└────────────────────────────────────────────────────┘
+```
+
+**Features:**
+- Allocate hours per person per project per month
+- "Untracked" resource for external team time (no billing tracked)
+- Visual indicators:
+  - GREEN: Allocation = Approved estimate (100%)
+  - YELLOW: Under-allocated (< 100%)
+  - RED: Over-allocated (> 100%)
+
+**Outputs:**
+- Allocation summary per month
+- Per-project allocation % (allocated / approved estimate)
+- Per-person utilization % (allocated / capacity)
+- Over/under allocation flags
+
+**Validation Rules:**
+- Cannot allocate negative hours
+- Cannot allocate more than person's monthly capacity (warning, not hard block)
+- Cannot allocate to non-existent project or person
+- Sum of project allocations should equal approved estimate (tolerance: ±5%)
+
+---
+
+### 4. Actuals & Utilization Tracking
+
+**Data Entry:**
+- Team members log hours worked per project per month
+- Entry method: Manual (monthly aggregate)
+- Updates: Can be incremental (weekly updates accumulate)
+
+**Calculations:**
+- **Running utilization:** (Allocated hours YTD) / (Capacity YTD) × 100%
+- **Overall utilization:** (Allocated hours this month) / (Capacity this month) × 100%
+- **Variance:** Actual hours - Allocated hours (per project, per person)
+
+**Outputs:**
+- Actuals vs Planned comparison
+- Utilization metrics (running, overall)
+- Variance reports (where did we over/under-deliver?)
+
+**Validation Rules:**
+- Cannot log negative hours
+- Cannot log hours for future months
+- Cannot log hours after project status = "Done" (configurable)
+
+---
+
+### 5. Reports & Analytics
+
+**Core Reports:**
+
+| Report | Description | Filters |
+|--------|-------------|---------|
+| **Forecast Summary** | Multi-period forecast of allocations and revenue | Date range, team, project, status |
+| **Utilization Summary** | Team and individual utilization trends | Date range, team member, role |
+| **Cost Summary** | Revenue forecasts based on allocations × hourly rates | Date range, project, client |
+| **Allocation Report** | Who's allocated to what, month-by-month | Month, team, project |
+| **Variance Report** | Planned vs Actual analysis | Date range, project, person |
+
+**Report Features:**
+- **Highly customizable filters** (team, person, project, status, date range, type)
+- **Export capabilities:** Defer to Phase 2 (PDF/CSV)
+- **Caching:** Redis caching for expensive queries
+
+---
+
+### 6. Role-Based Access Control (RBAC)
+
+**Personas & Permissions:**
+
+| Persona | Access Rights | Restrictions |
+|---------|---------------|--------------|
+| **Superuser** | Full access: setup, config, all projects, all teams | None |
+| **Manager** | • Create/edit projects<br>• Allocate resources to own team<br>• View all projects (read-only for other teams)<br>• Approve estimates<br>• View team's utilization reports | • Cannot allocate other teams' members<br>• Cannot edit other managers' projects |
+| **Developer** | • View own allocations<br>• Log own hours (actuals)<br>• View project details for assigned projects | • Cannot allocate resources<br>• Cannot change estimates<br>• Cannot view other developers' allocations |
+| **Top Brass** | • View all reports (read-only)<br>• Forecast summaries<br>• Utilization dashboards<br>• Cost summaries | • Cannot modify anything<br>• Read-only access only |
+
+**Access Control Implementation:**
+- Laravel Policies for model-level authorization
+- Middleware for route-level guards
+- JWT tokens with role claims
+
+---
+
+## Data Validation Rules
+
+**These rules drive API validation, tests, and verification:**
+
+### Team Members
+- Name: Required, max 255 chars
+- Role/Team: Required, must exist in master data
+- Hourly rate: Required, > 0, numeric (2 decimal places)
+- Availability: Must be 0, 0.5, or 1.0
+
+### Projects
+- Project ID: Unique, required
+- Title: Required, max 255 chars
+- Type: Must be "Project" or "Support"
+- Status: Must be valid state (see state machine)
+- Approved estimate: Required if status ≥ "Estimate Approved", > 0
+- Forecasted effort: Sum must equal approved estimate (±5% tolerance)
+
+### Allocations
+- Person ID: Must exist in team members
+- Project ID: Must exist in projects
+- Hours: >= 0, numeric (2 decimal places)
+- Month: Valid date (YYYY-MM format)
+- Sum of allocations per project ≤ approved estimate + 5%
+- Sum of allocations per person ≤ capacity + 20% (warning threshold)
+
+### Actuals
+- Person ID: Must exist in team members
+- Project ID: Must exist in projects
+- Hours: >= 0, numeric (2 decimal places)
+- Month: Must be current or past month (cannot log future hours)
+- Cannot log hours if project status = "Cancelled" or "Done" (configurable)
+
+### Holidays/PTO
+- Date: Valid date
+- Type: "Holiday" or "PTO"
+- If PTO: must be associated with a team member
+
+---
+
+## Technical Stack
+
+### Backend (Laravel API)
+
+| Component | Technology | Rationale |
+|-----------|------------|-----------|
+| Framework | Laravel 12 (latest) | Robust PHP framework, rich ecosystem |
+| Database | PostgreSQL | Production-grade, ACID compliant, great for reporting |
+| Caching | Redis | Query + response caching from day 1 |
+| Authentication | JWT (tymon/jwt-auth) | Token-based, suitable for SPA frontend |
+| API Design | REST + Laravel API Resources | Standard, well-understood, consistent JSON |
+| API Docs | Laravel Scribe (SwaggerUI) | Auto-generated from code comments |
+| Testing | PHPUnit (unit) + Pest (feature) | Laravel standard |
+| Code Style | PSR-12, Laravel conventions | Industry standard |
+| Containerization | Docker (port 3000) | Isolated, reproducible |
+| Environment | .env files | Simple configuration management |
+
+### Frontend (SvelteKit)
+
+| Component | Technology | Rationale |
+|-----------|------------|-----------|
+| Framework | SvelteKit | Modern, reactive, great for dashboards |
+| Styling | Tailwind CSS + DaisyUI | Fast development, consistent theming |
+| Charts | Recharts | Good balance of power and simplicity |
+| Tables | TanStack Table (React Table) | Industry standard, powerful filtering/sorting |
+| Forms | Superforms + Zod | Type-safe validation, seamless SvelteKit integration |
+| Form Actions | SvelteKit native | Server-side form handling |
+| State Management | Svelte stores (minimal) | UI state only (filters, modals) |
+| HTTP Client | fetch (native) | No extra dependencies |
+| Testing | Vitest (unit) + Playwright (E2E) | Fast, modern testing tools |
+| Containerization | Docker (port 5173) | Isolated, hot-reload for dev |
+
+### Infrastructure & Deployment
+
+| Component | Technology | Rationale |
+|-----------|------------|-----------|
+| Local Dev | Docker Compose | Code-mounted volumes, hot reload |
+| Reverse Proxy | Nginx Proxy Manager (existing) | Already running in environment |
+| Database Volume | Mounted directory | Portability, easy backup |
+| Secrets | .env files (all environments) | Simple, consistent across envs |
+| Background Jobs | Laravel Queue + Redis (Phase 2) | Deferred for MVP, easy to add |
+
+---
+
+## Quality Standards & Testing Strategy
+
+### Test Requirements (Per Change)
+
+**Every OpenSpec change must include:**
+1. **Unit tests** (backend + frontend)
+   - Coverage target: >70%
+   - PHPUnit (Laravel), Vitest (SvelteKit)
+2. **E2E tests** (Playwright)
+   - Happy path + critical error cases
+3. **Regression tests**
+   - Run full test suite on each change
+
+### Code Review Checklist
+
+Before merge, verify:
+- **Style:** PSR-12 (PHP), Prettier (JS), ESLint (SvelteKit)
+- **Standards:** Laravel conventions, SvelteKit best practices
+- **Security:** Input validation, SQL injection prevention, XSS protection, CSRF tokens
+- **Tests:** All tests passing, coverage >70%
+
+### Verification Workflow
+
+**`/opsx-verify` must check:**
+- All tests passing
+- Code coverage >70%
+- No uncovered code (files without tests)
+- API docs up-to-date (Scribe generation)
+- No linting errors
+
+### Commit Standards
+
+- **Granular commits:** One fix = one commit
+- **Commit message format:**
+  ```
+  [Type] Brief description (50 chars max)
+  
+  Detailed explanation (optional, 72 char wrap)
+  
+  Refs: #issue-number (if applicable)
+  ```
+  Types: `feat`, `fix`, `refactor`, `test`, `docs`, `chore`
+
+### Issue-Driven Test Loop (Phase 2)
+
+For E2E/integration failures:
+1. Test fails → Create GitHub issue
+2. Fix implementation
+3. Retest + regression test
+4. Close issue when all tests pass
+
+**For MVP:** Run tests, fix inline (no issue creation yet).
+
+---
+
+## Deferred Features (Phase 2+)
+
+### Deferred to Phase 2
+
+| Feature | Rationale for Deferral | Estimated Lift |
+|---------|------------------------|----------------|
+| **Notifications** (WebSocket) | Allocations are monthly - not time-critical. Users can refresh. | ~6 hours |
+| **PDF/CSV Exports** | On-screen reports sufficient for MVP. Easy to add later. | ~4 hours |
+| **Background Jobs** (async) | No heavy processing in MVP. Laravel Queue ready when needed. | ~2 hours |
+| **Audit Logging** | No compliance requirement for MVP. | ~3 hours |
+| **Advanced Caching** (pre-calculated reports) | Start with on-demand queries. Cache if slow. | ~4 hours |
+| **API Versioning** (`/api/v1/`) | Not needed until breaking changes. | ~2 hours |
+| **Multi-language Support** | English-only for MVP. | ~8 hours |
+| **Resource Over-allocation (advanced)** | MVP shows RED flag. Phase 2: predictive warnings, auto-balancing. | ~6 hours |
+
+### Explicitly Out of Scope
+
+| Feature | Why Not Included |
+|---------|------------------|
+| **Time-tracking tool integration** | Manual entry sufficient. Integration adds vendor lock-in. |
+| **Mobile app** | Desktop web app is primary use case. |
+| **Invoicing integration** | Billing forecasts only. Actual invoicing is external. |
+| **Project task management** | Project-level tracking only, not task-level. |
+| **Calendar sync** (Google, Outlook) | Manual PTO/holiday entry is acceptable. |
+| **AI-powered forecasting** | Rule-based validation is sufficient for MVP. |
+
+---
+
+## Considerations & Trade-offs
+
+### Decision Log
+
+| Decision | Option Chosen | Alternative Considered | Rationale |
+|----------|---------------|------------------------|-----------|
+| **Multi-tenancy** | Single-tenant MVP, add `tenant_id` later | Multi-tenant from day 1 | Reduces complexity, easy to add later |
+| **Frontend framework** | SvelteKit | Laravel + Vue, React | Modern, reactive, great for dashboards |
+| **Authentication** | JWT | Session-based | Suitable for SPA, easier mobile support later |
+| **Caching** | Redis from day 1 | Add later if needed | Prevents refactoring technical debt |
+| **Notifications** | Defer to Phase 2 | WebSocket PoC in MVP | Not time-critical, saves 6 hours |
+| **Exports** | Defer to Phase 2 | Include in MVP | On-screen reports sufficient initially |
+| **Issue-driven tests** | Phase 2 | From day 1 | Slower velocity for MVP, add when more tests exist |
+| **API versioning** | Not included | `/api/v1/` from start | No breaking changes expected in MVP |
+
+### Known Limitations (MVP)
+
+1. **No real-time updates:** Users must refresh to see allocation changes
+2. **Manual time entry:** No automated time-tracking integration
+3. **Single organization:** No multi-tenancy support
+4. **English only:** No i18n support
+5. **No mobile optimization:** Desktop-first design
+
+---
+
+## Success Metrics
+
+### MVP Success Criteria
+
+**Functional Completeness:**
+- ✅ Users can define team capacity (members, holidays, PTO, availability)
+- ✅ Users can create projects with approved estimates
+- ✅ Users can allocate resources to projects month-by-month
+- ✅ Users can log actual hours worked
+- ✅ System validates allocations (over/under warnings)
+- ✅ Users can view 5 core reports (forecast, utilization, cost, allocation, variance)
+- ✅ RBAC enforced (4 personas: Superuser, Manager, Dev, Top Brass)
+
+**Quality Metrics:**
+- ✅ All tests passing (unit + E2E)
+- ✅ Code coverage >70%
+- ✅ Zero linting errors
+- ✅ API documentation auto-generated (SwaggerUI)
+- ✅ Docker Compose setup working (local dev)
+
+**Usability Metrics (Post-Launch):**
+- Manager can complete monthly allocation in <30 minutes (vs 2+ hours in spreadsheet)
+- Zero billing errors in first 3 months (over/under allocation caught before invoicing)
+- 90% of team members log actuals weekly (adoption metric)
+
+### Phase 2 Success Criteria
+
+- ✅ Real-time notifications working (WebSocket)
+- ✅ PDF/CSV exports available for all reports
+- ✅ Background jobs processing heavy reports
+- ✅ Audit logging capturing all changes
+
+---
+
+## Timeline & Phases
+
+### MVP (Phase 1) - Core Functionality
+**Target:** 6-8 weeks
+
+**Sprints:**
+1. **Project setup** (1 week)
+   - Docker Compose setup
+   - Laravel + SvelteKit scaffolding
+   - Database schema design
+   - Authentication (JWT)
+
+2. **Capacity planning** (1.5 weeks)
+   - Team member CRUD
+   - Holiday/PTO calendar
+   - Availability tracking
+   - Capacity calculations
+
+3. **Project management** (1.5 weeks)
+   - Project CRUD
+   - Status state machine
+   - Approved estimate tracking
+   - Forecasted effort
+
+4. **Resource allocation** (2 weeks)
+   - Allocation matrix UI
+   - Validation rules
+   - Over/under indicators
+   - Untracked resource bucket
+
+5. **Actuals & reporting** (2 weeks)
+   - Time logging interface
+   - Utilization calculations
+   - 5 core reports
+   - Filters & customization
+
+6. **Testing & polish** (1 week)
+   - E2E test coverage
+   - Code review
+   - Bug fixes
+   - Documentation
+
+### Phase 2 - Enhancements
+**Target:** 3-4 weeks (post-MVP)
+
+- Notifications (WebSocket)
+- Exports (PDF/CSV)
+- Background jobs
+- Audit logging
+- Advanced caching
+- Bug fixes from production use
+
+### Phase 3 - Scale & Optimize
+**Target:** TBD (based on usage)
+
+- Multi-tenancy
+- Mobile optimization
+- AI-powered forecasting
+- Integration APIs (time-tracking, accounting)
+
+---
+
+## Appendix: Master Data & Taxonomy
+
+**Configurable Lists (Admin-managed):**
+
+1. **Roles/Teams:**
+   - Frontend Developer
+   - Backend Developer
+   - QA Engineer
+   - DevOps Engineer
+   - UX Designer
+   - Project Manager
+   - Architect
+
+2. **Project Statuses:**
+   - NA/Support
+   - Initial
+   - Gathering Estimates
+   - Estimate Pending Approval
+   - Estimate Rework
+   - Estimate Approved
+   - Funded
+   - Scheduled
+   - In-Progress
+   - Ready for Prod
+   - Done
+   - On-Hold
+   - Cancelled
+
+3. **Project Types:**
+   - Project (billable)
+   - Support (ongoing ops)
+
+4. **Availability Options:**
+   - 0 (unavailable/PTO)
+   - 0.5 (half day)
+   - 1.0 (full day)
+
+5. **Report Filters:**
+   - Date range (from/to)
+   - Team member
+   - Role/Team
+   - Project
+   - Project status
+   - Project type
+
+---
+
+**Document Control:**
+- **Owner:** Santhosh J
+- **Approver:** Santhosh J
+- **Next Review:** Post-MVP completion
+- **Change History:**
+  - v1.0 (2026-02-17): Initial charter approved
+
+---
+
+*End of Project Charter*
diff --git a/openspec/changes/headroom-foundation/.openspec.yaml b/openspec/changes/headroom-foundation/.openspec.yaml
new file mode 100644
index 00000000..c8d3976a
--- /dev/null
+++ b/openspec/changes/headroom-foundation/.openspec.yaml
@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-02-17
diff --git a/openspec/changes/headroom-foundation/design.md b/openspec/changes/headroom-foundation/design.md
new file mode 100644
index 00000000..2bd8de0c
--- /dev/null
+++ b/openspec/changes/headroom-foundation/design.md
@@ -0,0 +1,559 @@
+## Context
+
+Headroom is a greenfield web application to replace manual spreadsheet-based capacity planning for engineering teams. The current spreadsheet approach is error-prone, lacks validation, provides no audit trail, and wastes manager time (2+ hours monthly on allocation work).
+
+**Current State:**
+- No existing system to migrate from
+- Team uses spreadsheets for capacity planning and resource allocation
+- No automation, no validation, no visibility into team headroom
+
+**Constraints:**
+- MVP must be production-ready with >70% test coverage
+- Must run containerized (Docker Compose) from day 1
+- Existing Nginx Proxy Manager in environment (no Caddy/Traefik)
+- Must support 10-15 developers across 10-12 concurrent projects
+- Monthly capacity planning cycle (not real-time)
+
+**Stakeholders:**
+- Engineering managers (primary users)
+- Team members (log hours, view allocations)
+- Top brass (view reports only)
+- Superuser/admin (system configuration)
+
+---
+
+## Goals / Non-Goals
+
+**Goals:**
+- Automate capacity calculations (holidays, PTO, availability)
+- Validate allocations against capacity and approved estimates
+- Prevent billing errors (over/under-allocation detection)
+- Provide clear visibility into team headroom
+- Track planned vs actual hours for utilization analysis
+- Generate 5 core reports with customizable filters
+- Reduce manager allocation time from 2+ hours to <30 minutes per month
+- Enforce role-based access control (4 personas)
+- Maintain >70% test coverage with comprehensive E2E tests
+
+**Non-Goals:**
+- Real-time notifications (deferred to Phase 2, polling is acceptable for MVP)
+- PDF/CSV report exports (deferred to Phase 2, on-screen only for MVP)
+- Time-tracking tool integration (manual entry only for MVP)
+- Multi-tenancy (single-tenant MVP, add tenant_id later)
+- Mobile app (desktop web only)
+- AI-powered forecasting (rule-based validation sufficient)
+
+---
+
+## Decisions
+
+### Decision 1: Two-Container Architecture (Laravel API + SvelteKit Frontend)
+
+**Choice:** Separate Laravel API backend and SvelteKit frontend in different containers.
+
+**Rationale:**
+- Clean separation of concerns (API vs UI)
+- Easier to scale independently in future
+- SvelteKit is modern and great for dashboards, worth learning curve
+- Laravel provides robust API development (owner has PHP background)
+
+**Alternatives Considered:**
+- Laravel + Blade templates: Rejected (less interactive UI, harder for dashboards)
+- Laravel + Vue (Inertia): Rejected (owner preferred Svelte over Vue)
+- SvelteKit full-stack: Rejected (owner has PHP background, prefer Laravel for API)
+
+**Implementation:**
+- Frontend: SvelteKit (port 5173), Tailwind CSS + DaisyUI, Recharts, TanStack Table
+- Backend: Laravel 12 (latest) (port 3000), PostgreSQL (latest), Redis (latest)
+- Communication: REST API with Laravel API Resources for consistent JSON
+- Reverse proxy: Existing Nginx Proxy Manager routes `/api/*` → Laravel, `/*` → SvelteKit
+
+---
+
+### Decision 2: PostgreSQL from Day 1
+
+**Choice:** Use PostgreSQL in production and development (no SQLite).
+
+**Rationale:**
+- Avoid migration pain later (SQLite → PostgreSQL is error-prone)
+- Production-grade features (JSON operators, full-text search, advanced indexing)
+- Better for reporting queries (complex aggregations, window functions)
+- Docker volume mount preserves portability
+
+**Alternatives Considered:**
+- SQLite for local dev, PostgreSQL for prod: Rejected (migration pain, feature parity issues)
+
+**Implementation:**
+- PostgreSQL (latest, Alpine container)
+- Volume-mounted to `./data/postgres` for backup/portability
+- Migrations from day 1 (Laravel migrations)
+- UUIDs for primary keys (prevents ID enumeration, easier distributed systems later)
+
+---
+
+### Decision 3: Redis Caching from Day 1
+
+**Choice:** Implement query and response caching with Redis from the start.
+
+**Rationale:**
+- Owner insisted: "No need to sweat on refactoring it everywhere"
+- Prevents technical debt accumulation
+- Expensive queries (capacity calculations, reports) benefit immediately
+- Easy automatic cache invalidation with Laravel
+
+**Alternatives Considered:**
+- Defer caching to Phase 2: Rejected (owner's preference for avoiding future refactoring)
+
+**Implementation:**
+- Redis (latest, Alpine container)
+- Cache keys pattern: `allocations:month:{YYYY-MM}`, `reports:forecast:{from}:{to}:{hash}`
+- TTL: 1 hour (allocations), 15 min (reports), 24 hours (master data)
+- Automatic invalidation on mutations (create/update/delete triggers cache flush)
+- Laravel cache facade for consistency
+
+---
+
+### Decision 4: JWT Authentication (Token-Based)
+
+**Choice:** JWT tokens instead of session-based authentication.
+
+**Rationale:**
+- Stateless (better for API-first architecture)
+- Suitable for SPA frontend
+- Easier to add mobile app later (future-proofing)
+- Industry standard for REST APIs
+
+**Alternatives Considered:**
+- Laravel sessions: Rejected (owner preferred JWT for future mobile support)
+
+**Implementation:**
+- tymon/jwt-auth package
+- Access token: 60 minute TTL
+- Refresh token: 7 day TTL (stored in Redis, one-time use with rotation)
+- Token claims: user UUID, role, permissions array
+- Refresh endpoint rotates tokens on each use
+
+---
+
+### Decision 5: SvelteKit Frontend Stack
+
+**Choice:** SvelteKit + Tailwind CSS + DaisyUI + Recharts + TanStack Table + Superforms + Zod
+
+**Rationale:**
+- **DaisyUI**: Fast development, opinionated but speeds up dashboard creation
+- **Recharts**: Good balance of power and simplicity for charts
+- **TanStack Table**: Industry standard for data grids, powerful filtering/sorting
+- **Superforms + Zod**: Type-safe validation, seamless SvelteKit Form Actions integration
+
+**Alternatives Considered:**
+- Shadcn/ui: Rejected (DaisyUI faster for MVP)
+- Chart.js: Rejected (Recharts more powerful)
+- Custom table component: Rejected (TanStack is proven, owner unfamiliar but trusts recommendation)
+
+**Implementation:**
+- Svelte stores for minimal UI state only (filters, modals)
+- Fetch API for HTTP (no Axios, native is sufficient)
+- Vitest for unit tests, Playwright for E2E tests
+
+---
+
+### Decision 6: Allocation Validation Strategy
+
+**Choice:** Soft validation with visual indicators (GREEN/YELLOW/RED), not hard blocks.
+
+**Rationale:**
+- Managers sometimes need flexibility to over-allocate temporarily
+- Hard blocks would frustrate workflow
+- Visual warnings catch errors while allowing override
+- "This money is my salary!" — both over and under-allocation must be flagged
+
+**Validation Rules:**
+- GREEN: Allocation = Approved estimate (100%, within ±5% tolerance)
+- YELLOW: Under-allocation (<95% of approved estimate) — will undercharge
+- RED: Over-allocation (>105% of approved estimate) — will overcharge
+- Person capacity: YELLOW warning at >100%, RED alert at >120%
+
+**Implementation:**
+- API returns validation status with each allocation response
+- Frontend displays color-coded indicators in allocation matrix
+- Tooltip shows exact variance ("Over by 20 hours, will overcharge client")
+
+---
+
+### Decision 7: Monthly Aggregate Actuals (Not Daily)
+
+**Choice:** Track actual hours as monthly totals, allowing incremental weekly updates.
+
+**Rationale:**
+- Monthly planning cycle doesn't require daily granularity
+- Simplifies data model and UI
+- Team members can update weekly and system accumulates
+- No time-tracking integration for MVP (manual entry)
+
+**Alternatives Considered:**
+- Daily time logging: Rejected (over-engineering for MVP, adds complexity)
+- Weekly buckets: Rejected (monthly is sufficient given monthly planning cycle)
+
+**Implementation:**
+- Actuals table: project_id, team_member_id, month (YYYY-MM), hours_logged
+- UI allows replacing or incrementing monthly total
+- Utilization calculated as: (Actual hours / Capacity) × 100%
+
+---
+
+### Decision 8: Defer Real-Time Notifications to Phase 2
+
+**Choice:** No WebSocket notifications in MVP, users refresh to see changes.
+
+**Rationale:**
+- Allocations are planned monthly, not time-critical
+- WebSocket setup adds 6 hours of dev time
+- Polling every 30s is acceptable alternative but also deferred
+- Focus MVP on core allocation/reporting functionality
+
+**Alternatives Considered:**
+- WebSocket + 1 notification PoC (6 hours): Rejected (not critical for monthly planning)
+- Polling-based notifications (2 hours): Rejected (also deferred, users can refresh)
+
+**Implementation (Phase 2):**
+- Laravel Broadcasting with Redis adapter
+- SvelteKit WebSocket client
+- Events: AllocationCreated, AllocationUpdated, EstimateApproved
+
+---
+
+### Decision 9: Database Schema Design
+
+**Choice:** Normalized schema with master data tables, JSON for forecasted effort, UUIDs for primary keys.
+
+**Key Tables:**
+- `team_members`: id (UUID), name, role_id (FK), hourly_rate, active
+- `projects`: id (UUID), code (unique), title, status_id (FK), type_id (FK), approved_estimate, forecasted_effort (JSON)
+- `allocations`: id (UUID), project_id (FK), team_member_id (FK), month (YYYY-MM), allocated_hours
+- `actuals`: id (UUID), project_id (FK), team_member_id (FK), month (YYYY-MM), hours_logged
+- `roles`, `project_statuses`, `project_types`: Master data tables
+- `holidays`, `ptos`: Calendar data
+
+**Design Rationale:**
+- **UUIDs**: Prevent ID enumeration attacks, easier distributed systems later
+- **Normalized master data**: Roles/statuses/types in separate tables for dynamic configuration
+- **Month as string (YYYY-MM)**: Simplifies queries, index-friendly, human-readable
+- **JSON for forecasted effort**: Flexible structure `{"2026-02": 40, "2026-03": 60}`, easy to extend
+- **Soft deletes for projects**: `deleted_at` timestamp for audit trail
+- **Active flag for team members**: Preserve historical allocations when person leaves
+
+**Indexes:**
+- `allocations`: composite index on (project_id, month), (team_member_id, month)
+- `actuals`: composite index on (project_id, month), (team_member_id, month)
+- `team_members`: index on (role_id, active)
+- `projects`: index on (status_id, type_id), unique on (code)
+
+---
+
+### Decision 10: API Design Pattern
+
+**Choice:** REST API with Laravel API Resources for consistent JSON responses.
+
+**Rationale:**
+- REST is simpler than GraphQL for this use case
+- Laravel API Resources provide consistent transformation layer
+- Standard HTTP verbs (GET, POST, PUT, DELETE)
+- Easy to document with Laravel Scribe (SwaggerUI)
+
+**Endpoint Structure:**
+```
+/api/auth/login (POST)
+/api/auth/logout (POST)
+/api/auth/refresh (POST)
+
+/api/team-members (GET, POST)
+/api/team-members/:id (GET, PUT, DELETE)
+
+/api/projects (GET, POST)
+/api/projects/:id (GET, PUT, DELETE)
+
+/api/allocations?month=YYYY-MM (GET, POST)
+/api/allocations/bulk (POST)
+/api/allocations/:id (PUT, DELETE)
+
+/api/actuals?month=YYYY-MM (GET, POST)
+/api/actuals/bulk (POST)
+/api/actuals/:id (PUT)
+
+/api/reports/forecast?from=YYYY-MM&to=YYYY-MM (GET)
+/api/reports/utilization?month=YYYY-MM (GET)
+/api/reports/cost?month=YYYY-MM (GET)
+/api/reports/allocation?month=YYYY-MM (GET)
+/api/reports/variance?month=YYYY-MM (GET)
+
+/api/master-data/roles (GET)
+/api/master-data/statuses (GET)
+/api/master-data/types (GET)
+```
+
+**Response Format (Laravel API Resources):**
+```json
+{
+  "data": { /* resource */ },
+  "meta": { /* pagination, counts */ },
+  "links": { /* HATEOAS links */ }
+}
+```
+
+**Error Format:**
+```json
+{
+  "message": "Validation failed",
+  "errors": {
+    "allocated_hours": ["Must be greater than 0"]
+  }
+}
+```
+
+---
+
+### Decision 11: Testing Strategy
+
+**Choice:** >70% code coverage with unit + E2E + regression tests on every change.
+
+**Test Layers:**
+- **Backend Unit (PHPUnit)**: Model methods, service classes, utilities
+- **Backend Feature (Pest)**: API endpoints, authentication, authorization
+- **Frontend Unit (Vitest)**: Svelte components, stores, utilities
+- **E2E (Playwright)**: Critical user flows (login → allocate → view reports)
+
+**Coverage Targets:**
+- Backend: >80% (easier to test server-side logic)
+- Frontend: >70% (UI testing is harder)
+- Overall: >70% (enforced in `/opsx-verify`)
+
+**Test Data Strategy:**
+- Database seeders for test data (Laravel seeders)
+- Factories for model generation (Laravel factories)
+- Test fixtures for E2E tests (Playwright fixtures)
+
+**Regression Test Approach (MVP):**
+- Run full test suite on every change
+- E2E tests cover happy paths + critical error cases
+- Phase 2: Issue-driven loop (E2E failure → create GitHub issue → fix → retest)
+
+**Implementation:**
+- Pre-commit hooks: Run linters + unit tests
+- CI/CD: Run full suite (unit + E2E) before merge
+- `openspec verify` command: Check coverage, run tests, lint
+
+---
+
+## Risks / Trade-offs
+
+### Risk: SvelteKit Learning Curve
+**Impact:** Owner and associate unfamiliar with Svelte, may slow initial development.
+
+**Mitigation:**
+- SvelteKit has excellent documentation
+- Simpler than React/Vue (less boilerplate)
+- TanStack Table is framework-agnostic (owner unfamiliar but AI will guide)
+- Start with simple components, iterate
+
+---
+
+### Risk: Two-Container Complexity
+**Impact:** More moving parts than single monolith, deployment overhead.
+
+**Mitigation:**
+- Docker Compose handles orchestration
+- Code-mounted volumes for hot reload (no rebuild needed)
+- Owner comfortable with Docker
+- Cleaner architecture worth the overhead
+
+---
+
+### Risk: Over-Allocation Soft Validation
+**Impact:** Managers could ignore RED flags and over-allocate anyway.
+
+**Mitigation:**
+- Visual warnings are prominent (RED color, tooltip with exact impact)
+- Reports show over-allocation clearly
+- Phase 2: Add email notifications when allocations exceed threshold
+- Manager discipline assumed (this is their job)
+
+---
+
+### Risk: Manual Time Entry Accuracy
+**Impact:** Team members may forget to log hours or log inaccurately.
+
+**Mitigation:**
+- Utilization reports highlight under-logging (planned > actual consistently)
+- Manager can follow up with team members showing low actuals
+- Phase 2: Integrate with time-tracking tools (Jira, Harvest, Toggl)
+- Incremental weekly updates reduce forgetting
+
+---
+
+### Risk: Cache Invalidation Bugs
+**Impact:** Stale data shown if cache invalidation logic fails.
+
+**Mitigation:**
+- Comprehensive test coverage for cache invalidation logic
+- Redis TTL ensures eventual consistency (max 1 hour stale)
+- Cache keys are scoped (project, month, person)
+- Invalidation triggered on all mutations (create/update/delete)
+- Manual cache flush available for admins
+
+---
+
+### Risk: JWT Token Security
+**Impact:** Stolen tokens could allow unauthorized access.
+
+**Mitigation:**
+- Refresh token rotation (one-time use)
+- Short access token TTL (60 minutes)
+- Refresh tokens stored in Redis (revocable)
+- HTTPS enforced via Nginx Proxy Manager
+- Logout invalidates refresh token
+- Token includes user role for authorization checks
+
+---
+
+### Trade-off: No Real-Time Notifications
+**Benefit:** Saves 6 hours of dev time, keeps MVP scope tight.
+
+**Cost:** Users must manually refresh to see allocation changes.
+
+**Justification:** Allocations are monthly planning activity, not time-critical. Acceptable for MVP.
+
+---
+
+### Trade-off: No PDF/CSV Exports
+**Benefit:** Faster MVP, avoids report formatting complexity.
+
+**Cost:** Users cannot export reports for offline viewing or stakeholder sharing.
+
+**Justification:** On-screen reports are primary value, exports are nice-to-have for Phase 2.
+
+---
+
+### Trade-off: Manual Time Entry
+**Benefit:** Avoids vendor lock-in, no integration complexity.
+
+**Cost:** Team members must manually enter hours monthly.
+
+**Justification:** Monthly aggregate is low overhead (~5 minutes per person per month).
+
+---
+
+## Migration Plan
+
+**Deployment Steps:**
+
+1. **Initial Setup:**
+   - Run `docker-compose up` (creates 4 containers)
+   - Laravel migrations create database schema
+   - Database seeders populate master data (roles, statuses, types)
+   - Create superuser account via Laravel seeder
+
+2. **Data Import (Optional):**
+   - If team has historical spreadsheet data, create import script
+   - Import team members (name, role, hourly rate)
+   - Import active projects (code, title, approved estimate)
+   - Do NOT import historical allocations (start fresh)
+
+3. **User Onboarding:**
+   - Train managers on allocation workflow (1 hour session)
+   - Demo: capacity planning → project setup → allocation → reports
+   - Provide Quick Start guide (Markdown doc)
+
+4. **Go-Live:**
+   - Managers create February 2026 capacity plan (holidays, PTO, availability)
+   - Managers allocate resources for February
+   - Team members log February actuals mid-month (incremental updates)
+   - Month-end: Review utilization reports, adjust March allocations
+
+**Rollback Strategy:**
+- MVP is greenfield (no data migration to revert)
+- If critical bug discovered, roll back to previous container image
+- Docker Compose down/up with previous image tag
+- PostgreSQL data persisted in volume (safe across container restarts)
+- Zero-downtime rollback: Blue/green deployment (Phase 2, not needed for MVP)
+
+**Monitoring (Phase 2):**
+- Application logs (Laravel log files)
+- Database performance (PostgreSQL slow query log)
+- Cache hit rate (Redis INFO stats)
+- API response times (Laravel Telescope or custom middleware)
+
+---
+
+## Open Questions
+
+### Question 1: Hourly Rate Visibility
+Should developers see their own hourly rate, or only managers/top brass?
+
+**Options:**
+- A) Developers can see their own rate (transparency)
+- B) Developers cannot see rates (only allocations)
+
+**Recommendation:** A (transparency fosters trust, rate is not secret in most orgs)
+
+**Decision:** To be finalized with owner before implementation.
+
+---
+
+### Question 2: Hours Per Day Configuration
+Is "1.0 availability = 8 hours" globally configured, or per-project?
+
+**Options:**
+- A) Global setting (e.g., 1.0 = 8 hours for everyone)
+- B) Per-team member (some people work 6-hour days)
+- C) Per-project (different billing rates for different project types)
+
+**Recommendation:** A (global setting, simplest for MVP)
+
+**Decision:** Owner mentioned "configurable per project" but likely meant per team. Clarify.
+
+---
+
+### Question 3: PTO Approval Workflow
+Is PTO auto-approved, or does it require manager approval?
+
+**Options:**
+- A) Auto-approved (capacity reduced immediately)
+- B) Requires approval (pending state until manager approves)
+
+**Recommendation:** B (manager approval, prevents abuse)
+
+**Decision:** Owner likely expects approval workflow. Confirm.
+
+---
+
+### Question 4: Support Projects in Revenue Forecast
+Should "Support" type projects appear in revenue forecasts?
+
+**Options:**
+- A) Exclude from revenue (they're ongoing ops, not billable)
+- B) Include in revenue (still billable internally)
+
+**Recommendation:** Ask owner's preference (may vary by org)
+
+**Decision:** To be confirmed during implementation.
+
+---
+
+### Question 5: Allocation Tolerance Threshold
+What's the tolerance for "within estimate" (GREEN indicator)?
+
+**Current assumption:** ±5% (e.g., 100-hour project allocated 95-105 hours is GREEN)
+
+**Confirm:** Is 5% the right threshold, or should it be configurable?
+
+**Decision:** Start with 5%, make configurable in Phase 2 if needed.
+
+---
+
+**End of Design Document**
+
+**Next Steps:**
+1. Review open questions with owner
+2. Finalize database schema (ERD diagram)
+3. Create tasks.md (implementation checklist)
+4. Begin Sprint 1: Docker Compose setup + database migrations
diff --git a/openspec/changes/headroom-foundation/proposal.md b/openspec/changes/headroom-foundation/proposal.md
new file mode 100644
index 00000000..9173758a
--- /dev/null
+++ b/openspec/changes/headroom-foundation/proposal.md
@@ -0,0 +1,68 @@
+## Why
+
+Engineering managers juggling 10-15 developers across 10-12 concurrent projects currently use error-prone spreadsheets for capacity planning and resource allocation. This leads to billing errors (over/under-allocation), no visibility into team headroom, manual capacity calculations, and no audit trail. The business impact is severe: over-allocation causes client escalations, under-allocation loses revenue, and managers waste 2+ hours monthly on manual allocation work.
+
+## What Changes
+
+- **New web application**: Full-stack resource planning and capacity management system
+- **Capacity planning module**: Team member management, holiday/PTO tracking, availability calculations
+- **Project management module**: Project lifecycle tracking, approved estimates, forecasted effort distribution
+- **Resource allocation module**: Monthly allocation matrix with validation (over/under-allocation detection)
+- **Actuals tracking module**: Time logging interface, utilization calculations (running & overall)
+- **Reporting module**: 5 core reports (forecast, utilization, cost, allocation, variance) with customizable filters
+- **Authentication system**: JWT-based auth with 4 user roles (Superuser, Manager, Developer, Top Brass)
+- **Containerized deployment**: Docker Compose setup with Laravel API, SvelteKit frontend, PostgreSQL, Redis
+
+## Capabilities
+
+### New Capabilities
+
+- `team-member-management`: CRUD operations for team members with role, hourly rate, and active status tracking
+- `capacity-planning`: Calculate individual and team capacity based on availability, holidays, PTO, and working days
+- `project-lifecycle`: Manage projects through state machine (Initial → Estimates → Approved → Funded → In-Progress → Done) with approved estimates and forecasted effort
+- `resource-allocation`: Allocate hours per person per project per month with validation against capacity and approved estimates
+- `allocation-validation`: Detect and flag over/under-allocation (RED for >100%, YELLOW for <100%, GREEN for 100%)
+- `actuals-tracking`: Log hours worked per project per person per month (manual entry, monthly aggregate)
+- `utilization-calculations`: Calculate running utilization (YTD) and overall utilization (monthly) as percentage of capacity
+- `forecast-reporting`: Multi-period forecast reports showing allocations, revenue, and variance by project/team/person
+- `utilization-reporting`: Team and individual utilization trends with customizable date range and filters
+- `cost-reporting`: Revenue forecasts based on allocations multiplied by hourly rates, filterable by project/client/team
+- `allocation-reporting`: Monthly allocation matrix view showing who's allocated to what with utilization percentages
+- `variance-reporting`: Planned vs actual analysis showing over/under-delivery by project and person
+- `role-based-access`: Enforce permissions for 4 personas (Superuser, Manager, Developer, Top Brass) with different read/write access
+- `master-data-management`: Configure roles, project statuses, project types, and availability options
+- `authentication`: JWT-based token authentication with login, logout, and token refresh
+
+### Modified Capabilities
+
+<!-- No existing capabilities are being modified - this is a greenfield project -->
+
+## Impact
+
+**New Systems:**
+- Laravel 12 (latest) API (backend container, port 3000)
+- SvelteKit web app (frontend container, port 5173)
+- PostgreSQL (latest) database (data container, port 5432)
+- Redis (latest) cache (cache container, port 6379)
+- Docker Compose orchestration
+- Nginx Proxy Manager routing (`/api/*` → Laravel, `/*` → SvelteKit)
+
+**Dependencies:**
+- PHP 8.4 (latest) with Laravel 12 (latest) framework
+- Node (latest) with SvelteKit (latest)
+- Tailwind CSS + DaisyUI (UI components)
+- Recharts (visualizations)
+- TanStack Table (data grids)
+- Superforms + Zod (form validation)
+- Laravel Scribe (SwaggerUI API documentation)
+- Testing: PHPUnit, Pest, Vitest, Playwright
+
+**External Integrations:**
+- None for MVP (manual data entry only)
+
+**Breaking Changes:**
+- None (new system)
+
+**Migration Path:**
+- Greenfield project - no data migration needed
+- Users will transition from spreadsheets to web application
diff --git a/openspec/changes/headroom-foundation/specs/actuals-tracking/spec.md b/openspec/changes/headroom-foundation/specs/actuals-tracking/spec.md
new file mode 100644
index 00000000..9009d6e1
--- /dev/null
+++ b/openspec/changes/headroom-foundation/specs/actuals-tracking/spec.md
@@ -0,0 +1,78 @@
+## ADDED Requirements
+
+### Requirement: Log hours worked
+The system SHALL allow team members to log actual hours worked per project per month.
+
+#### Scenario: Log hours for current month
+- **WHEN** a team member logs 35 hours worked on "Project X" for February 2026
+- **THEN** the system creates an actuals record
+- **AND** the system associates the hours with the team member, project, and month
+
+#### Scenario: Cannot log negative hours
+- **WHEN** attempting to log -5 hours
+- **THEN** the system rejects the request with validation error "Hours logged must be greater than or equal to 0"
+
+#### Scenario: Cannot log hours for future months
+- **WHEN** attempting to log hours for a month that hasn't started yet
+- **THEN** the system rejects the request with validation error "Cannot log hours for future months"
+
+### Requirement: Update logged hours
+The system SHALL allow team members to update previously logged hours for the current month.
+
+#### Scenario: Incremental weekly updates
+- **WHEN** a team member logs 10 hours in week 1 of February
+- **AND** logs an additional 8 hours in week 2 of February
+- **AND** the system updates the total to 18 hours for February
+- **THEN** the system accumulates the hours for the monthly aggregate
+
+#### Scenario: Replace monthly total
+- **WHEN** a team member updates February actuals from 35 hours to 40 hours
+- **THEN** the system replaces the previous value with the new total
+
+### Requirement: View actuals summary
+The system SHALL display actual hours worked in a summary view similar to allocation matrix.
+
+#### Scenario: View monthly actuals matrix
+- **WHEN** a manager views actuals for February 2026
+- **THEN** the system displays projects as rows and team members as columns
+- **AND** each cell shows actual hours logged for that project-person combination
+
+#### Scenario: Show actuals vs allocations
+- **WHEN** viewing the actuals summary
+- **THEN** the system displays allocated hours and actual hours side by side
+- **AND** the system highlights variances (over or under)
+
+### Requirement: Cannot log hours to inactive projects
+The system SHALL prevent logging hours to projects in "Done" or "Cancelled" status (configurable).
+
+#### Scenario: Attempt to log hours to done project
+- **WHEN** attempting to log hours for a project with status "Done"
+- **AND** the system configuration prevents logging to completed projects
+- **THEN** the system rejects the request with error "Cannot log hours to completed projects"
+
+#### Scenario: Allow logging to done project if configured
+- **WHEN** the system is configured to allow logging to completed projects
+- **AND** a team member logs hours to a "Done" project
+- **THEN** the system accepts the hours (for edge cases where work continues after project closure)
+
+### Requirement: Actuals data entry is manual
+The system SHALL support manual entry of actual hours without integration to time-tracking tools (MVP).
+
+#### Scenario: Manual monthly entry
+- **WHEN** a team member enters actual hours worked via the web interface
+- **THEN** the system accepts the input without requiring integration with external time-tracking systems
+
+#### Scenario: No automated time import
+- **WHEN** viewing actuals entry interface
+- **THEN** the system does not provide options to import from Jira, Harvest, Toggl, or other time-tracking tools (deferred to Phase 2)
+
+### Requirement: Track actuals notes
+The system SHALL allow optional notes when logging hours.
+
+#### Scenario: Log hours with notes
+- **WHEN** a team member logs 40 hours with notes "Focused on API development and bug fixes"
+- **THEN** the system stores the notes alongside the hours logged
+
+#### Scenario: Update notes
+- **WHEN** a team member updates the notes for a logged actuals record
+- **THEN** the system updates the notes field without affecting the hours value
diff --git a/openspec/changes/headroom-foundation/specs/allocation-reporting/spec.md b/openspec/changes/headroom-foundation/specs/allocation-reporting/spec.md
new file mode 100644
index 00000000..2e1c5ccf
--- /dev/null
+++ b/openspec/changes/headroom-foundation/specs/allocation-reporting/spec.md
@@ -0,0 +1,74 @@
+## ADDED Requirements
+
+### Requirement: Generate allocation report
+The system SHALL generate monthly allocation reports showing who is allocated to what projects.
+
+#### Scenario: View allocation report for month
+- **WHEN** viewing allocation report for February 2026
+- **THEN** the system displays allocation matrix with projects as rows
+- **AND** team members as columns
+- **AND** each cell shows allocated hours
+
+#### Scenario: Allocation report with totals
+- **WHEN** viewing allocation report
+- **THEN** the system displays row totals (total hours per project)
+- **AND** displays column totals (total hours per team member)
+- **AND** displays grand total (all allocated hours for the month)
+
+### Requirement: Show utilization percentages in allocation report
+The system SHALL display utilization percentages alongside allocated hours.
+
+#### Scenario: Display team member utilization
+- **WHEN** viewing allocation report
+- **THEN** for each team member column, the system displays:
+  - Capacity (e.g., "160h")
+  - Allocated hours (e.g., "140h")
+  - Utilization percentage (e.g., "87.5%")
+
+#### Scenario: Display project allocation percentage
+- **WHEN** viewing allocation report
+- **THEN** for each project row, the system displays:
+  - Approved estimate (e.g., "120h")
+  - Allocated hours (e.g., "100h")
+  - Allocation percentage (e.g., "83.3%")
+  - Status indicator (GREEN/YELLOW/RED)
+
+### Requirement: Filter allocation report by team
+The system SHALL allow filtering allocation reports by team, role, or team member.
+
+#### Scenario: Filter by team member
+- **WHEN** filtering allocation report to show "John Doe" only
+- **THEN** the system displays all projects where John has allocations
+- **AND** hides other team members' columns
+
+#### Scenario: Filter by role
+- **WHEN** filtering to show "Backend Developer" role
+- **THEN** the system displays only team members with that role in the matrix
+
+### Requirement: Filter allocation report by project
+The system SHALL allow filtering allocation reports by project, status, or type.
+
+#### Scenario: Filter by project status
+- **WHEN** filtering to show only "In-Progress" projects
+- **THEN** the system displays only projects with that status
+
+### Requirement: Multi-month allocation view
+The system SHALL allow viewing allocations across multiple months.
+
+#### Scenario: View quarter allocation
+- **WHEN** viewing allocation report for Q1 2026 (Jan-Mar)
+- **THEN** the system displays a matrix showing each month as a separate column group
+- **AND** shows how allocations change month-to-month for each person
+
+### Requirement: Highlight allocation changes
+The system SHALL highlight recent allocation changes for visibility.
+
+#### Scenario: Show new allocations
+- **WHEN** viewing allocation report
+- **AND** an allocation was created in the last 7 days
+- **THEN** the system highlights the cell with a "NEW" badge or distinct color
+
+#### Scenario: Show modified allocations
+- **WHEN** an allocation was updated in the last 7 days
+- **THEN** the system shows a "UPDATED" indicator
+- **AND** optionally shows previous value on hover
diff --git a/openspec/changes/headroom-foundation/specs/allocation-validation/spec.md b/openspec/changes/headroom-foundation/specs/allocation-validation/spec.md
new file mode 100644
index 00000000..b701f719
--- /dev/null
+++ b/openspec/changes/headroom-foundation/specs/allocation-validation/spec.md
@@ -0,0 +1,87 @@
+## ADDED Requirements
+
+### Requirement: Detect over-allocation
+The system SHALL flag allocations that exceed approved estimates with RED indicator.
+
+#### Scenario: Project over-allocated
+- **WHEN** a project has approved estimate of 100 hours
+- **AND** total allocations sum to 120 hours
+- **THEN** the system displays RED indicator with text "120% allocated (OVER by 20 hours)"
+
+#### Scenario: Over-allocation threshold
+- **WHEN** total allocations exceed approved estimate by more than 5%
+- **THEN** the system displays RED flag
+- **AND** the system shows warning message "Will overcharge client"
+
+### Requirement: Detect under-allocation
+The system SHALL flag allocations that fall short of approved estimates with YELLOW indicator.
+
+#### Scenario: Project under-allocated
+- **WHEN** a project has approved estimate of 100 hours
+- **AND** total allocations sum to 80 hours
+- **THEN** the system displays YELLOW indicator with text "80% allocated (UNDER by 20 hours)"
+
+#### Scenario: Under-allocation warning
+- **WHEN** total allocations are less than approved estimate by more than 5%
+- **THEN** the system displays YELLOW flag
+- **AND** the system shows warning message "Will undercharge client (revenue loss)"
+
+### Requirement: Display optimal allocation
+The system SHALL display GREEN indicator when allocations match approved estimates.
+
+#### Scenario: Perfect allocation
+- **WHEN** a project has approved estimate of 100 hours
+- **AND** total allocations sum to exactly 100 hours
+- **THEN** the system displays GREEN indicator with text "100% allocated (OPTIMAL)"
+
+#### Scenario: Within tolerance
+- **WHEN** a project has approved estimate of 100 hours
+- **AND** total allocations sum to 102 hours (within 5% tolerance)
+- **THEN** the system displays GREEN indicator with text "102% allocated (within tolerance)"
+
+### Requirement: Validate person capacity
+The system SHALL warn when a team member's allocations exceed their monthly capacity.
+
+#### Scenario: Person under capacity
+- **WHEN** a team member has capacity of 160 hours
+- **AND** total allocations sum to 120 hours
+- **THEN** the system displays utilization as 75% with no warning
+
+#### Scenario: Person at capacity
+- **WHEN** a team member has capacity of 160 hours
+- **AND** total allocations sum to 160 hours
+- **THEN** the system displays utilization as 100% with GREEN indicator
+
+#### Scenario: Person over capacity
+- **WHEN** a team member has capacity of 160 hours
+- **AND** total allocations sum to 180 hours
+- **THEN** the system displays utilization as 113% with YELLOW warning "Over-allocated by 20 hours"
+
+#### Scenario: Person severely over capacity
+- **WHEN** a team member has capacity of 160 hours
+- **AND** total allocations sum to 200 hours (125% or more)
+- **THEN** the system displays utilization as 125% with RED warning "Severely over-allocated by 40 hours"
+
+### Requirement: Aggregate validation across months
+The system SHALL validate allocations across multiple months for multi-month projects.
+
+#### Scenario: Multi-month project validation
+- **WHEN** a project has approved estimate of 120 hours
+- **AND** forecasted effort is: Feb 40h, Mar 60h, Apr 20h
+- **AND** actual allocations are: Feb 38h, Mar 62h, Apr 20h
+- **THEN** the system validates total allocations (38+62+20=120) against approved estimate (120)
+- **AND** displays overall GREEN indicator
+- **AND** displays monthly warnings where allocations deviate from forecast
+
+### Requirement: Real-time validation feedback
+The system SHALL provide immediate validation feedback as allocations are created or modified.
+
+#### Scenario: Immediate feedback on create
+- **WHEN** a manager creates an allocation that causes a project to exceed approved estimate
+- **THEN** the system immediately displays RED indicator on the allocation matrix
+- **AND** the system shows tooltip "This allocation causes project over-allocation"
+
+#### Scenario: Immediate feedback on update
+- **WHEN** a manager increases an allocation and the team member becomes over-capacity
+- **THEN** the system immediately updates the utilization percentage
+- **AND** the system changes the team member's column header color to YELLOW or RED
diff --git a/openspec/changes/headroom-foundation/specs/authentication/spec.md b/openspec/changes/headroom-foundation/specs/authentication/spec.md
new file mode 100644
index 00000000..623aa623
--- /dev/null
+++ b/openspec/changes/headroom-foundation/specs/authentication/spec.md
@@ -0,0 +1,111 @@
+## ADDED Requirements
+
+### Requirement: User login
+The system SHALL authenticate users with email and password and issue JWT tokens.
+
+#### Scenario: Successful login
+- **WHEN** a user submits valid email "john@example.com" and password
+- **THEN** the system validates the credentials
+- **AND** generates a JWT access token (60 minute TTL)
+- **AND** generates a refresh token (7 day TTL)
+- **AND** returns both tokens along with user details (name, email, role)
+
+#### Scenario: Invalid credentials
+- **WHEN** a user submits incorrect email or password
+- **THEN** the system returns 401 Unauthorized error
+- **AND** returns error message "Invalid credentials"
+
+#### Scenario: Account locked or inactive
+- **WHEN** a user with inactive account attempts to login
+- **THEN** the system returns 403 Forbidden error
+- **AND** returns error message "Account is inactive"
+
+### Requirement: Token-based authentication
+The system SHALL use JWT tokens for authenticating API requests.
+
+#### Scenario: Authenticated API request
+- **WHEN** a user sends an API request with valid JWT token in Authorization header
+- **THEN** the system validates the token
+- **AND** extracts user ID and role from token claims
+- **AND** processes the request
+
+#### Scenario: Expired token
+- **WHEN** a user sends an API request with expired JWT token
+- **THEN** the system returns 401 Unauthorized error
+- **AND** returns error message "Token expired"
+
+#### Scenario: Invalid token
+- **WHEN** a user sends an API request with malformed or tampered JWT token
+- **THEN** the system returns 401 Unauthorized error
+- **AND** returns error message "Invalid token"
+
+#### Scenario: Missing token
+- **WHEN** a user sends an API request without Authorization header
+- **THEN** the system returns 401 Unauthorized error
+- **AND** returns error message "Authentication required"
+
+### Requirement: Token refresh
+The system SHALL allow users to obtain new access tokens using refresh tokens.
+
+#### Scenario: Refresh access token
+- **WHEN** a user submits a valid refresh token to POST /api/auth/refresh
+- **THEN** the system validates the refresh token
+- **AND** generates a new access token (60 minute TTL)
+- **AND** rotates the refresh token (one-time use, issues new refresh token)
+- **AND** returns the new access and refresh tokens
+
+#### Scenario: Invalid refresh token
+- **WHEN** a user submits an invalid or expired refresh token
+- **THEN** the system returns 401 Unauthorized error
+- **AND** returns error message "Invalid or expired refresh token"
+
+### Requirement: User logout
+The system SHALL allow users to logout and invalidate their tokens.
+
+#### Scenario: Successful logout
+- **WHEN** a user sends POST /api/auth/logout with their access token
+- **THEN** the system invalidates the refresh token in Redis
+- **AND** returns success message "Logged out successfully"
+
+#### Scenario: Token invalidation
+- **WHEN** a user logs out
+- **THEN** the system removes the refresh token from Redis
+- **AND** subsequent requests with the same tokens are rejected
+
+### Requirement: JWT token structure
+The system SHALL include user information in JWT token claims.
+
+#### Scenario: Access token claims
+- **WHEN** generating an access token
+- **THEN** the token payload includes:
+  - sub (user UUID)
+  - role (user role: "superuser", "manager", "developer", "top_brass")
+  - permissions (array of permission strings)
+  - iat (issued at timestamp)
+  - exp (expiration timestamp, 60 minutes from iat)
+  - jti (unique token ID)
+
+### Requirement: Refresh token storage
+The system SHALL store refresh tokens in Redis with TTL.
+
+#### Scenario: Store refresh token
+- **WHEN** a user logs in
+- **THEN** the system generates a refresh token UUID
+- **AND** stores it in Redis with key "refresh_token:{user_id}:{token_uuid}"
+- **AND** sets TTL to 7 days (10080 minutes)
+
+#### Scenario: Validate refresh token
+- **WHEN** a user submits a refresh token
+- **THEN** the system checks if the token exists in Redis
+- **AND** if found and not expired, allows token refresh
+- **AND** if not found or expired, rejects the request
+
+### Requirement: Token rotation
+The system SHALL rotate refresh tokens on each refresh request.
+
+#### Scenario: Rotate refresh token
+- **WHEN** a user refreshes their access token
+- **THEN** the system invalidates the old refresh token (deletes from Redis)
+- **AND** generates a new refresh token
+- **AND** stores the new refresh token in Redis
+- **AND** returns the new refresh token to the user
diff --git a/openspec/changes/headroom-foundation/specs/capacity-planning/spec.md b/openspec/changes/headroom-foundation/specs/capacity-planning/spec.md
new file mode 100644
index 00000000..e5a2fd47
--- /dev/null
+++ b/openspec/changes/headroom-foundation/specs/capacity-planning/spec.md
@@ -0,0 +1,99 @@
+## ADDED Requirements
+
+### Requirement: Calculate individual capacity
+The system SHALL calculate individual team member capacity for a given month based on availability, holidays, PTO, and weekends.
+
+#### Scenario: Calculate capacity for full month
+- **WHEN** calculating capacity for a team member with full availability (1.0) for all working days in February 2026
+- **AND** February has 20 working days (28 days - 8 weekend days)
+- **AND** the team member has no PTO or holidays
+- **THEN** the system calculates individual capacity as 20 person-days
+
+#### Scenario: Calculate capacity with half-day availability
+- **WHEN** a team member has availability of 0.5 for 10 working days in a month
+- **THEN** the system calculates capacity as 5 person-days (10 days × 0.5)
+
+#### Scenario: Calculate capacity with PTO
+- **WHEN** a team member has PTO for 3 working days in a month
+- **AND** the month has 22 working days
+- **AND** the team member has full availability (1.0) for all other days
+- **THEN** the system calculates capacity as 19 person-days (22 - 3 days PTO)
+
+#### Scenario: Calculate capacity with holidays
+- **WHEN** a month has 2 company holidays
+- **AND** a team member has 22 working days after removing weekends
+- **AND** the team member has full availability (1.0)
+- **THEN** the system calculates capacity as 20 person-days (22 - 2 holidays)
+
+#### Scenario: Calculate capacity with mixed availability
+- **WHEN** a team member has 10 days at 1.0 availability, 5 days at 0.5 availability, and 3 days at 0 availability in a month
+- **THEN** the system calculates capacity as 12.5 person-days (10×1.0 + 5×0.5 + 3×0)
+
+### Requirement: Calculate team capacity
+The system SHALL calculate total team capacity by summing individual capacities for all active team members.
+
+#### Scenario: Calculate team capacity for month
+- **WHEN** Team Member A has 20 person-days capacity
+- **AND** Team Member B has 18 person-days capacity
+- **AND** Team Member C has 15 person-days capacity
+- **THEN** the system calculates team capacity as 53 person-days
+
+#### Scenario: Exclude inactive team members from team capacity
+- **WHEN** calculating team capacity
+- **AND** one team member has active status set to false
+- **THEN** the system excludes the inactive team member from the team capacity calculation
+
+### Requirement: Calculate possible revenue
+The system SHALL calculate possible revenue based on team capacity and hourly rates.
+
+#### Scenario: Calculate possible revenue for team
+- **WHEN** Team Member A has 160 hours capacity at $150/hour
+- **AND** Team Member B has 144 hours capacity at $125/hour
+- **AND** Team Member C has 120 hours capacity at $175/hour
+- **THEN** the system calculates possible revenue as $63,000 (160×$150 + 144×$125 + 120×$175)
+
+### Requirement: Track availability per day
+The system SHALL allow setting daily availability as 0 (unavailable), 0.5 (half day), or 1.0 (full day).
+
+#### Scenario: Set full day availability
+- **WHEN** setting availability for a specific date to 1.0
+- **THEN** the system records the team member as fully available for that day
+
+#### Scenario: Set half day availability
+- **WHEN** setting availability for a specific date to 0.5
+- **THEN** the system records the team member as half-day available for that day
+
+#### Scenario: Set unavailable
+- **WHEN** setting availability for a specific date to 0
+- **THEN** the system records the team member as unavailable for that day
+
+#### Scenario: Reject invalid availability values
+- **WHEN** attempting to set availability to a value other than 0, 0.5, or 1.0
+- **THEN** the system rejects the input with validation error "Availability must be 0, 0.5, or 1.0"
+
+### Requirement: Manage holidays
+The system SHALL allow defining company-wide holidays that reduce available working days for all team members.
+
+#### Scenario: Add company holiday
+- **WHEN** an admin defines December 25, 2026 as a company holiday "Christmas Day"
+- **THEN** the system marks that date as a non-working day for all team members
+
+#### Scenario: Holidays affect capacity calculation
+- **WHEN** calculating capacity for a month with 2 company holidays
+- **THEN** the system automatically excludes those days from all team members' capacity calculations
+
+### Requirement: Manage PTO requests
+The system SHALL allow team members to request PTO which reduces their individual capacity.
+
+#### Scenario: Submit PTO request
+- **WHEN** a team member submits PTO for February 10-12, 2026
+- **THEN** the system creates a PTO record with start date, end date, and status "pending"
+
+#### Scenario: Approve PTO request
+- **WHEN** a manager approves a PTO request
+- **THEN** the system updates the PTO status to "approved"
+- **AND** the system automatically reduces the team member's capacity for those dates to 0
+
+#### Scenario: PTO affects capacity calculation
+- **WHEN** calculating capacity for a team member with approved PTO for 3 days
+- **THEN** the system excludes those 3 days from the capacity calculation
diff --git a/openspec/changes/headroom-foundation/specs/cost-reporting/spec.md b/openspec/changes/headroom-foundation/specs/cost-reporting/spec.md
new file mode 100644
index 00000000..dac4454a
--- /dev/null
+++ b/openspec/changes/headroom-foundation/specs/cost-reporting/spec.md
@@ -0,0 +1,85 @@
+## ADDED Requirements
+
+### Requirement: Generate cost summary report
+The system SHALL generate reports showing revenue forecasts based on allocations multiplied by hourly rates.
+
+#### Scenario: View monthly cost report
+- **WHEN** viewing cost report for February 2026
+- **THEN** the system displays all projects with their allocated hours
+- **AND** calculates revenue for each project based on team member hourly rates
+- **AND** shows total revenue forecast for the month
+
+#### Scenario: Cost breakdown by project
+- **WHEN** viewing cost report for a specific project
+- **THEN** the system displays allocation breakdown by team member
+- **AND** shows hours allocated and hourly rate for each team member
+- **AND** calculates total project cost as sum of (hours × rate) for all team members
+
+### Requirement: Filter cost report by project
+The system SHALL allow filtering cost reports by project, client, or type.
+
+#### Scenario: Filter by project type
+- **WHEN** filtering cost report to show only "Project" type (billable)
+- **THEN** the system displays revenue forecast for billable projects only
+- **AND** excludes "Support" type projects
+
+#### Scenario: Group by client
+- **WHEN** grouping cost report by client
+- **THEN** the system displays total revenue forecast per client
+- **AND** shows breakdown of projects per client
+
+### Requirement: Filter cost report by team
+The system SHALL allow filtering cost reports by team or team member.
+
+#### Scenario: Cost report for team member
+- **WHEN** filtering cost report to show allocations for "John Doe"
+- **THEN** the system displays all projects where John Doe is allocated
+- **AND** calculates John's contribution to revenue (his hours × his rate)
+
+#### Scenario: Cost report for role
+- **WHEN** filtering by "Backend Developer" role
+- **THEN** the system displays revenue generated by all Backend Developers
+- **AND** shows average hourly rate for the role
+
+### Requirement: Calculate total possible revenue
+The system SHALL calculate maximum possible revenue if all team capacity were utilized at 100%.
+
+#### Scenario: Possible revenue calculation
+- **WHEN** viewing cost summary
+- **THEN** the system calculates total team capacity (all team members' available hours)
+- **AND** multiplies by each team member's hourly rate
+- **AND** displays "Possible Revenue: $X if fully utilized"
+
+### Requirement: Calculate forecasted revenue
+The system SHALL calculate forecasted revenue based on current allocations.
+
+#### Scenario: Forecasted revenue based on allocations
+- **WHEN** team has 1000 hours total capacity
+- **AND** currently 850 hours are allocated across projects
+- **AND** the weighted average hourly rate is $140
+- **THEN** the system calculates forecasted revenue as $119,000 (850 × $140)
+
+### Requirement: Show revenue variance
+The system SHALL display variance between possible revenue and forecasted revenue.
+
+#### Scenario: Revenue gap analysis
+- **WHEN** possible revenue is $150,000
+- **AND** forecasted revenue is $119,000
+- **THEN** the system displays revenue gap of $31,000 (20.7% underutilization)
+
+### Requirement: Multi-period cost forecast
+The system SHALL generate cost forecasts across multiple months.
+
+#### Scenario: Quarter revenue forecast
+- **WHEN** viewing cost report for Q1 2026 (Jan-Mar)
+- **THEN** the system displays monthly revenue forecast for each month
+- **AND** calculates total Q1 revenue forecast
+- **AND** shows monthly variance from possible revenue
+
+### Requirement: Export cost data
+The system SHALL allow exporting cost report data (deferred to Phase 2 for PDF/CSV).
+
+#### Scenario: View cost data on screen (MVP)
+- **WHEN** viewing cost report
+- **THEN** the system displays all cost data on screen in tabular format
+- **AND** PDF/CSV export buttons are not available (Phase 2 feature)
diff --git a/openspec/changes/headroom-foundation/specs/forecast-reporting/spec.md b/openspec/changes/headroom-foundation/specs/forecast-reporting/spec.md
new file mode 100644
index 00000000..e41a68b0
--- /dev/null
+++ b/openspec/changes/headroom-foundation/specs/forecast-reporting/spec.md
@@ -0,0 +1,70 @@
+## ADDED Requirements
+
+### Requirement: Generate multi-period forecast report
+The system SHALL generate forecast reports showing allocations and revenue projections across multiple months.
+
+#### Scenario: View 3-month forecast
+- **WHEN** a manager requests a forecast report for February-April 2026
+- **THEN** the system displays all projects with allocations in that period
+- **AND** for each project shows month-by-month allocation breakdown
+- **AND** calculates revenue forecast based on allocations × hourly rates
+
+#### Scenario: Forecast includes variance indicators
+- **WHEN** viewing the forecast report
+- **THEN** the system shows forecasted hours vs approved estimate for each project
+- **AND** displays GREEN/YELLOW/RED indicators for over/under-allocation
+
+### Requirement: Filter forecast by project
+The system SHALL allow filtering forecast reports by project, status, or type.
+
+#### Scenario: Filter by project status
+- **WHEN** filtering forecast report to show only "In-Progress" projects
+- **THEN** the system displays only projects with that status
+
+#### Scenario: Filter by project type
+- **WHEN** filtering forecast report to show only "Project" type (billable)
+- **THEN** the system excludes "Support" type projects from the report
+
+### Requirement: Filter forecast by team
+The system SHALL allow filtering forecast reports by team or team member.
+
+#### Scenario: Filter by team member
+- **WHEN** filtering forecast report to show allocations for "John Doe"
+- **THEN** the system displays only projects where John Doe has allocations
+
+#### Scenario: Filter by role/team
+- **WHEN** filtering forecast report to show allocations for "Backend Developer" role
+- **THEN** the system displays allocations for all team members with that role
+
+### Requirement: Forecast revenue calculation
+The system SHALL calculate revenue forecasts based on allocations multiplied by team member hourly rates.
+
+#### Scenario: Calculate monthly revenue forecast
+- **WHEN** a project has allocations: Developer A 40h @ $150/h, Developer B 30h @ $125/h
+- **THEN** the system calculates monthly revenue forecast as $9,750 (40×$150 + 30×$125)
+
+#### Scenario: Calculate total revenue forecast for period
+- **WHEN** viewing forecast for Feb-Apr
+- **AND** total allocations are: Feb $9,750, Mar $12,000, Apr $6,000
+- **THEN** the system calculates total period revenue forecast as $27,750
+
+### Requirement: Forecast summary aggregations
+The system SHALL provide summary aggregations across all projects in the forecast.
+
+#### Scenario: Total approved hours vs allocated hours
+- **WHEN** viewing forecast summary
+- **THEN** the system displays total approved estimate across all projects
+- **AND** displays total allocated hours across all projects
+- **AND** shows overall variance percentage
+
+#### Scenario: Revenue forecast summary
+- **WHEN** viewing forecast summary
+- **THEN** the system displays total possible revenue (if all projects delivered at 100% allocation)
+- **AND** displays current forecasted revenue based on actual allocations
+
+### Requirement: Customizable date range
+The system SHALL allow selecting custom date ranges for forecast reports.
+
+#### Scenario: Select date range
+- **WHEN** a manager selects "From: 2026-02" and "To: 2026-06"
+- **THEN** the system generates forecast for those 5 months
diff --git a/openspec/changes/headroom-foundation/specs/master-data-management/spec.md b/openspec/changes/headroom-foundation/specs/master-data-management/spec.md
new file mode 100644
index 00000000..d2ba02f1
--- /dev/null
+++ b/openspec/changes/headroom-foundation/specs/master-data-management/spec.md
@@ -0,0 +1,119 @@
+## ADDED Requirements
+
+### Requirement: Manage roles
+The system SHALL allow Superusers to configure team member roles.
+
+#### Scenario: Create new role
+- **WHEN** a Superuser creates a role "DevOps Engineer"
+- **THEN** the system stores the role
+- **AND** the role becomes available for team member assignment
+
+#### Scenario: Update role
+- **WHEN** a Superuser updates a role description
+- **THEN** the system updates the role
+- **AND** existing team members with that role are not affected
+
+#### Scenario: Cannot delete role in use
+- **WHEN** a Superuser attempts to delete a role that is assigned to team members
+- **THEN** the system rejects the deletion with error "Cannot delete role in use by team members"
+
+#### Scenario: View roles list
+- **WHEN** a user requests the list of roles
+- **THEN** the system returns all configured roles
+
+### Requirement: Manage project statuses
+The system SHALL allow Superusers to configure project status options.
+
+#### Scenario: Create custom status
+- **WHEN** a Superuser creates a new status "Client Review"
+- **AND** sets the order as 5 (between "Estimate Approved" and "Funded")
+- **THEN** the system adds the status to the workflow
+
+#### Scenario: Set status as billable or non-billable
+- **WHEN** configuring a status
+- **THEN** the Superuser can mark it as billable (TRUE) or non-billable (FALSE)
+- **AND** non-billable statuses may exclude projects from revenue forecasts
+
+#### Scenario: Reorder statuses
+- **WHEN** a Superuser changes the order of statuses
+- **THEN** the system updates the status sequence
+- **AND** project workflow reflects the new order
+
+### Requirement: Manage project types
+The system SHALL allow Superusers to configure project types.
+
+#### Scenario: Default project types
+- **WHEN** the system is initialized
+- **THEN** it includes default types: "Project" (billable) and "Support" (ongoing ops)
+
+#### Scenario: Create custom project type
+- **WHEN** a Superuser creates a new type "Internal Initiative"
+- **THEN** the system stores the type
+- **AND** the type becomes available when creating projects
+
+### Requirement: Manage availability options
+The system SHALL enforce availability values as 0, 0.5, or 1.0.
+
+#### Scenario: Availability options are fixed
+- **WHEN** setting team member availability
+- **THEN** the system restricts values to 0, 0.5, or 1.0
+- **AND** rejects any other value
+
+#### Scenario: Availability options are documented
+- **WHEN** a user views the availability field
+- **THEN** the system displays help text:
+  - "0 = Unavailable (PTO, holiday)"
+  - "0.5 = Half day"
+  - "1.0 = Full day"
+
+### Requirement: Seed master data
+The system SHALL provide initial master data on installation.
+
+#### Scenario: Seed roles
+- **WHEN** the system is installed
+- **THEN** it creates default roles:
+  - Frontend Developer
+  - Backend Developer
+  - QA Engineer
+  - DevOps Engineer
+  - UX Designer
+  - Project Manager
+  - Architect
+
+#### Scenario: Seed project statuses
+- **WHEN** the system is installed
+- **THEN** it creates default statuses with correct order:
+  1. NA/Support
+  2. Initial
+  3. Gathering Estimates
+  4. Estimate Pending Approval
+  5. Estimate Rework
+  6. Estimate Approved
+  7. Funded
+  8. Scheduled
+  9. In-Progress
+  10. Ready for Prod
+  11. Done
+  12. On-Hold
+  13. Cancelled
+
+#### Scenario: Seed project types
+- **WHEN** the system is installed
+- **THEN** it creates default types:
+  - Project (billable)
+  - Support (ongoing ops)
+
+### Requirement: Master data API endpoints
+The system SHALL provide read-only API endpoints for master data.
+
+#### Scenario: Get roles
+- **WHEN** any authenticated user requests GET /api/master-data/roles
+- **THEN** the system returns the list of all roles
+
+#### Scenario: Get project statuses
+- **WHEN** any authenticated user requests GET /api/master-data/statuses
+- **THEN** the system returns the list of all project statuses in order
+
+#### Scenario: Get project types
+- **WHEN** any authenticated user requests GET /api/master-data/types
+- **THEN** the system returns the list of all project types
diff --git a/openspec/changes/headroom-foundation/specs/project-lifecycle/spec.md b/openspec/changes/headroom-foundation/specs/project-lifecycle/spec.md
new file mode 100644
index 00000000..2301bf37
--- /dev/null
+++ b/openspec/changes/headroom-foundation/specs/project-lifecycle/spec.md
@@ -0,0 +1,100 @@
+## ADDED Requirements
+
+### Requirement: Create project
+The system SHALL allow authorized users to create projects with project code, title, type, and status.
+
+#### Scenario: Create new project
+- **WHEN** a manager creates a project with code "PROJ-001", title "Client Dashboard Redesign", and type "Project"
+- **THEN** the system creates the project with initial status "Initial"
+- **AND** the system assigns a unique identifier to the project
+
+#### Scenario: Project code must be unique
+- **WHEN** attempting to create a project with a code that already exists
+- **THEN** the system rejects the request with validation error "Project code must be unique"
+
+### Requirement: Project status state machine
+The system SHALL enforce project status transitions according to defined workflow states.
+
+#### Scenario: Valid status transition
+- **WHEN** a project in "Initial" status transitions to "Gathering Estimates"
+- **THEN** the system updates the project status
+
+#### Scenario: Project reaches Estimate Approved
+- **WHEN** a project transitions to "Estimate Approved" status
+- **THEN** the system requires approved estimate to be set
+- **AND** the approved estimate must be greater than 0
+
+#### Scenario: Project workflow progression
+- **WHEN** a project progresses through statuses: Initial → Gathering Estimates → Estimate Pending Approval → Estimate Approved → Funded → Scheduled → In-Progress → Ready for Prod → Done
+- **THEN** the system allows each transition in sequence
+
+#### Scenario: Estimate rework path
+- **WHEN** a project in "Estimate Pending Approval" status requires changes
+- **THEN** the system allows transition back to "Estimate Rework" status
+- **AND** from "Estimate Rework" the project can return to "Estimate Pending Approval"
+
+#### Scenario: Project on hold
+- **WHEN** a project is placed "On-Hold" from any active status
+- **THEN** the system allows the transition
+- **AND** allocations for future months are flagged but not deleted
+
+#### Scenario: Project cancelled
+- **WHEN** a project is marked as "Cancelled"
+- **THEN** the system prevents new allocations
+- **AND** existing allocations are preserved for historical tracking
+
+### Requirement: Manage approved estimate
+The system SHALL track the total approved billable hours for each project.
+
+#### Scenario: Set approved estimate
+- **WHEN** a project reaches "Estimate Approved" status with approved estimate of 120 hours
+- **THEN** the system stores the approved estimate
+- **AND** the approved estimate becomes the baseline for allocation validation
+
+#### Scenario: Update approved estimate
+- **WHEN** a manager updates the approved estimate from 120 to 150 hours
+- **THEN** the system updates the approved estimate
+- **AND** the system re-validates all allocations against the new estimate
+
+### Requirement: Manage forecasted effort
+The system SHALL track month-by-month breakdown of forecasted effort for each project.
+
+#### Scenario: Set forecasted effort
+- **WHEN** a manager sets forecasted effort for a 120-hour project as: February 40h, March 60h, April 20h
+- **THEN** the system stores the forecasted effort as JSON: {"2026-02": 40, "2026-03": 60, "2026-04": 20}
+
+#### Scenario: Forecasted effort must equal approved estimate
+- **WHEN** the sum of forecasted effort (40 + 60 + 20 = 120) equals the approved estimate (120)
+- **THEN** the system accepts the forecasted effort
+
+#### Scenario: Forecasted effort validation fails
+- **WHEN** the sum of forecasted effort (40 + 60 + 30 = 130) exceeds the approved estimate (120) by more than 5%
+- **THEN** the system rejects the forecasted effort with validation error "Forecasted effort exceeds approved estimate"
+
+#### Scenario: Under-forecasted effort
+- **WHEN** the sum of forecasted effort (40 + 50 + 10 = 100) is less than the approved estimate (120)
+- **THEN** the system displays a YELLOW warning "Under-forecasted by 20 hours"
+
+### Requirement: Distinguish project types
+The system SHALL differentiate between "Project" (billable) and "Support" (ongoing ops) project types.
+
+#### Scenario: Billable project
+- **WHEN** a project is created with type "Project"
+- **THEN** the system tracks it as billable work
+- **AND** it appears in revenue forecasts
+
+#### Scenario: Support project
+- **WHEN** a project is created with type "Support"
+- **THEN** the system tracks it as ongoing operations
+- **AND** it appears in capacity allocation but may have different reporting treatment
+
+### Requirement: Cannot allocate to completed or cancelled projects
+The system SHALL prevent new allocations to projects in "Done" or "Cancelled" status.
+
+#### Scenario: Attempt to allocate to done project
+- **WHEN** attempting to create an allocation for a project with status "Done"
+- **THEN** the system rejects the allocation with error "Cannot allocate to completed projects"
+
+#### Scenario: Attempt to allocate to cancelled project
+- **WHEN** attempting to create an allocation for a project with status "Cancelled"
+- **THEN** the system rejects the allocation with error "Cannot allocate to cancelled projects"
diff --git a/openspec/changes/headroom-foundation/specs/resource-allocation/spec.md b/openspec/changes/headroom-foundation/specs/resource-allocation/spec.md
new file mode 100644
index 00000000..db0cb260
--- /dev/null
+++ b/openspec/changes/headroom-foundation/specs/resource-allocation/spec.md
@@ -0,0 +1,111 @@
+## ADDED Requirements
+
+### Requirement: Allocate hours to project
+The system SHALL allow authorized users to allocate hours for a team member to a project for a specific month.
+
+#### Scenario: Successful allocation
+- **WHEN** a manager allocates 40 hours for "John Doe" to "Project X" for February 2026
+- **THEN** the system creates the allocation record
+- **AND** the system returns the allocation details including project, team member, month, and hours
+
+#### Scenario: Allocate zero hours
+- **WHEN** a manager allocates 0 hours for a team member to a project
+- **THEN** the system accepts the allocation (useful for placeholder or removing allocation)
+
+#### Scenario: Cannot allocate negative hours
+- **WHEN** attempting to allocate -10 hours
+- **THEN** the system rejects the request with validation error "Allocated hours must be greater than or equal to 0"
+
+### Requirement: View allocation matrix
+The system SHALL display allocations in a matrix format showing projects vs team members for a selected month.
+
+#### Scenario: View monthly allocation matrix
+- **WHEN** a manager views the allocation matrix for February 2026
+- **THEN** the system displays all projects as rows
+- **AND** the system displays all team members as columns
+- **AND** each cell shows the allocated hours for that project-person combination
+
+#### Scenario: Show allocation totals
+- **WHEN** viewing the allocation matrix
+- **THEN** the system displays total allocated hours per team member (column totals)
+- **AND** the system displays total allocated hours per project (row totals)
+
+#### Scenario: Show utilization percentage
+- **WHEN** viewing the allocation matrix
+- **THEN** the system displays utilization percentage per team member (allocated / capacity × 100%)
+
+### Requirement: Update allocation
+The system SHALL allow authorized users to modify existing allocations.
+
+#### Scenario: Update allocated hours
+- **WHEN** a manager updates an allocation from 40 hours to 60 hours
+- **THEN** the system updates the allocation record
+- **AND** the system re-validates against capacity and approved estimate
+
+#### Scenario: Cannot update non-existent allocation
+- **WHEN** attempting to update an allocation that does not exist
+- **THEN** the system returns a 404 Not Found error
+
+### Requirement: Delete allocation
+The system SHALL allow authorized users to remove allocations.
+
+#### Scenario: Delete allocation
+- **WHEN** a manager deletes an allocation
+- **THEN** the system removes the allocation record
+- **AND** the system recalculates project and team member totals
+
+### Requirement: Bulk allocation operations
+The system SHALL allow creating or updating multiple allocations in a single operation.
+
+#### Scenario: Bulk create allocations
+- **WHEN** a manager submits 10 allocations for a project across multiple team members
+- **THEN** the system creates all allocations
+- **AND** the system validates each allocation individually
+- **AND** the system returns results indicating success or failure for each
+
+#### Scenario: Partial bulk failure
+- **WHEN** submitting bulk allocations where 2 out of 10 fail validation
+- **THEN** the system creates the 8 valid allocations
+- **AND** the system returns error details for the 2 failed allocations
+
+### Requirement: Track untracked resource allocations
+The system SHALL allow allocating hours to an "untracked" resource bucket for external team time.
+
+#### Scenario: Allocate to untracked resource
+- **WHEN** a manager allocates 10 hours to "Untracked" for a project
+- **THEN** the system creates the allocation without associating it to a specific team member
+- **AND** the allocation counts toward project total but not toward any team member's capacity
+
+#### Scenario: Untracked resource has no capacity limit
+- **WHEN** viewing utilization for the untracked resource
+- **THEN** the system displays "N/A" or infinite symbol for capacity
+- **AND** no over-capacity warnings are shown for untracked allocations
+
+### Requirement: Validate allocation against capacity
+The system SHALL warn when a team member's total monthly allocation exceeds their capacity.
+
+#### Scenario: Allocation within capacity
+- **WHEN** a team member with 160 hours capacity has 140 hours total allocated
+- **THEN** the system accepts the allocation
+- **AND** the system displays utilization as 88% with no warning
+
+#### Scenario: Allocation exceeds capacity
+- **WHEN** a team member with 160 hours capacity has 180 hours total allocated
+- **THEN** the system displays a WARNING "Team member over-allocated by 20 hours (113% utilization)"
+- **AND** the allocation is still allowed but flagged
+
+### Requirement: Validate allocation against approved estimate
+The system SHALL validate that project allocations do not exceed the approved estimate.
+
+#### Scenario: Allocation matches approved estimate
+- **WHEN** a project with approved estimate of 100 hours has exactly 100 hours allocated
+- **THEN** the system displays GREEN indicator "100% allocated"
+
+#### Scenario: Under-allocation
+- **WHEN** a project with approved estimate of 100 hours has 80 hours allocated
+- **THEN** the system displays YELLOW indicator "80% allocated (under by 20 hours)"
+
+#### Scenario: Over-allocation
+- **WHEN** a project with approved estimate of 100 hours has 120 hours allocated
+- **THEN** the system displays RED indicator "120% allocated (over by 20 hours)"
+- **AND** the system warns "Project will be over-charged by 20 hours"
diff --git a/openspec/changes/headroom-foundation/specs/role-based-access/spec.md b/openspec/changes/headroom-foundation/specs/role-based-access/spec.md
new file mode 100644
index 00000000..df6f2efa
--- /dev/null
+++ b/openspec/changes/headroom-foundation/specs/role-based-access/spec.md
@@ -0,0 +1,105 @@
+## ADDED Requirements
+
+### Requirement: Enforce Superuser permissions
+The system SHALL grant Superusers full access to all functionality without restrictions.
+
+#### Scenario: Superuser creates team member
+- **WHEN** a Superuser creates a new team member
+- **THEN** the system allows the action
+
+#### Scenario: Superuser views all data
+- **WHEN** a Superuser requests any data (projects, allocations, reports)
+- **THEN** the system returns the requested data without access restrictions
+
+### Requirement: Enforce Manager permissions
+The system SHALL allow Managers to create/edit their own projects and allocate resources from their own team.
+
+#### Scenario: Manager creates project
+- **WHEN** a Manager creates a new project
+- **THEN** the system associates the project with the Manager
+- **AND** the Manager can edit the project
+
+#### Scenario: Manager views all projects (read-only for others)
+- **WHEN** a Manager requests the list of all projects
+- **THEN** the system returns all projects
+- **AND** projects owned by other Managers are marked as read-only
+
+#### Scenario: Manager allocates own team member
+- **WHEN** a Manager allocates a team member from their own team to a project
+- **THEN** the system allows the allocation
+
+#### Scenario: Manager cannot allocate other team's members
+- **WHEN** a Manager attempts to allocate a team member from another Manager's team
+- **THEN** the system rejects the request with error "Cannot allocate team members from other teams"
+
+#### Scenario: Manager approves estimates
+- **WHEN** a Manager approves an estimate for their own project
+- **THEN** the system updates the project status and sets the approved estimate
+
+### Requirement: Enforce Developer permissions
+The system SHALL allow Developers to view their own allocations and log their own hours.
+
+#### Scenario: Developer views own allocations
+- **WHEN** a Developer requests their allocations
+- **THEN** the system returns only projects where the Developer is allocated
+
+#### Scenario: Developer logs own hours
+- **WHEN** a Developer logs hours for a project they are allocated to
+- **THEN** the system accepts the hours
+
+#### Scenario: Developer cannot log hours for other team members
+- **WHEN** a Developer attempts to log hours on behalf of another team member
+- **THEN** the system rejects the request with error "Cannot log hours for other team members"
+
+#### Scenario: Developer views assigned project details
+- **WHEN** a Developer requests details for a project they are allocated to
+- **THEN** the system returns project details (title, status, their allocation)
+
+#### Scenario: Developer cannot view unassigned projects
+- **WHEN** a Developer requests details for a project they are not allocated to
+- **THEN** the system returns 403 Forbidden error
+
+#### Scenario: Developer cannot allocate resources
+- **WHEN** a Developer attempts to create or modify an allocation
+- **THEN** the system rejects the request with error "Insufficient permissions"
+
+### Requirement: Enforce Top Brass permissions
+The system SHALL allow Top Brass to view all reports but prevent any modifications.
+
+#### Scenario: Top Brass views all reports
+- **WHEN** Top Brass requests forecast, utilization, cost, allocation, or variance reports
+- **THEN** the system returns the requested report with all data
+
+#### Scenario: Top Brass cannot modify data
+- **WHEN** Top Brass attempts to create, update, or delete any entity (project, allocation, team member)
+- **THEN** the system rejects the request with error "Read-only access"
+
+#### Scenario: Top Brass views cross-team data
+- **WHEN** Top Brass views reports
+- **THEN** the system includes data from all teams without restrictions
+
+### Requirement: Role-based API endpoints
+The system SHALL protect API endpoints with role-based middleware.
+
+#### Scenario: Unauthorized access attempt
+- **WHEN** a user attempts to access an endpoint without the required role
+- **THEN** the system returns 403 Forbidden error
+- **AND** logs the unauthorized access attempt
+
+#### Scenario: Token includes role information
+- **WHEN** a user authenticates
+- **THEN** the JWT token includes the user's role
+- **AND** API middleware validates the role for each request
+
+### Requirement: Model-level authorization
+The system SHALL enforce authorization at the model level using Laravel Policies.
+
+#### Scenario: Policy check for project update
+- **WHEN** a Manager attempts to update a project
+- **THEN** the system checks the ProjectPolicy to verify ownership
+- **AND** allows the update only if the Manager owns the project or is a Superuser
+
+#### Scenario: Policy check for allocation creation
+- **WHEN** a user attempts to create an allocation
+- **THEN** the system checks the AllocationPolicy to verify the user has permission
+- **AND** for Managers, verifies the team member belongs to their team
diff --git a/openspec/changes/headroom-foundation/specs/team-member-management/spec.md b/openspec/changes/headroom-foundation/specs/team-member-management/spec.md
new file mode 100644
index 00000000..22fc1bf1
--- /dev/null
+++ b/openspec/changes/headroom-foundation/specs/team-member-management/spec.md
@@ -0,0 +1,60 @@
+## ADDED Requirements
+
+### Requirement: Create team member
+The system SHALL allow authorized users to create new team members with name, role, hourly rate, and active status.
+
+#### Scenario: Successful team member creation
+- **WHEN** a manager creates a team member with valid name "John Doe", role "Backend Developer", and hourly rate $150
+- **THEN** the system creates the team member with active status set to true by default
+- **AND** the system assigns a unique identifier to the team member
+- **AND** the system returns the created team member details
+
+#### Scenario: Invalid hourly rate
+- **WHEN** a manager attempts to create a team member with hourly rate of $0 or negative value
+- **THEN** the system rejects the request with validation error "Hourly rate must be greater than 0"
+
+#### Scenario: Missing required fields
+- **WHEN** a manager attempts to create a team member without name or role
+- **THEN** the system rejects the request with validation error listing missing required fields
+
+### Requirement: View team members
+The system SHALL allow authorized users to view the list of team members with their details.
+
+#### Scenario: View all team members
+- **WHEN** a manager requests the team members list
+- **THEN** the system returns all team members with name, role, hourly rate, and active status
+- **AND** the list includes both active and inactive team members
+
+#### Scenario: Filter active team members only
+- **WHEN** a manager requests team members filtered by active status
+- **THEN** the system returns only team members where active is true
+
+### Requirement: Update team member
+The system SHALL allow authorized users to update team member details including role, hourly rate, and active status.
+
+#### Scenario: Successful update
+- **WHEN** a manager updates a team member's hourly rate from $150 to $175
+- **THEN** the system updates the team member record
+- **AND** the system returns the updated team member details
+
+#### Scenario: Deactivate team member
+- **WHEN** a manager sets a team member's active status to false
+- **THEN** the system marks the team member as inactive
+- **AND** the system preserves all historical allocation and actuals data for the team member
+
+#### Scenario: Cannot update non-existent team member
+- **WHEN** a manager attempts to update a team member that does not exist
+- **THEN** the system returns a 404 Not Found error
+
+### Requirement: Cannot delete team member with allocations
+The system SHALL prevent deletion of team members who have active allocations or logged actuals.
+
+#### Scenario: Attempt to delete team member with allocations
+- **WHEN** a manager attempts to delete a team member who has allocations in current or future months
+- **THEN** the system rejects the deletion with error "Cannot delete team member with active allocations"
+- **AND** the system suggests deactivating the team member instead
+
+#### Scenario: Attempt to delete team member with actuals
+- **WHEN** a manager attempts to delete a team member who has logged actuals
+- **THEN** the system rejects the deletion with error "Cannot delete team member with historical data"
+- **AND** the system suggests deactivating the team member instead
diff --git a/openspec/changes/headroom-foundation/specs/utilization-calculations/spec.md b/openspec/changes/headroom-foundation/specs/utilization-calculations/spec.md
new file mode 100644
index 00000000..706181e7
--- /dev/null
+++ b/openspec/changes/headroom-foundation/specs/utilization-calculations/spec.md
@@ -0,0 +1,91 @@
+## ADDED Requirements
+
+### Requirement: Calculate running utilization
+The system SHALL calculate running utilization as (Allocated hours YTD) / (Capacity YTD) × 100%.
+
+#### Scenario: Calculate YTD utilization in March
+- **WHEN** a team member has capacity: Jan 160h, Feb 160h, Mar 160h (YTD total: 480h)
+- **AND** the team member has allocations: Jan 140h, Feb 150h, Mar 160h (YTD total: 450h)
+- **THEN** the system calculates running utilization as 93.75% (450 / 480 × 100%)
+
+#### Scenario: Running utilization at start of year
+- **WHEN** calculating running utilization in January
+- **AND** the team member has capacity of 160h and allocations of 120h
+- **THEN** the system calculates running utilization as 75% (120 / 160 × 100%)
+
+### Requirement: Calculate overall utilization
+The system SHALL calculate overall utilization as (Allocated hours this month) / (Capacity this month) × 100%.
+
+#### Scenario: Calculate monthly utilization
+- **WHEN** a team member has capacity of 160 hours for February
+- **AND** the team member has total allocations of 140 hours for February
+- **THEN** the system calculates overall utilization as 87.5% (140 / 160 × 100%)
+
+#### Scenario: Full utilization
+- **WHEN** a team member has capacity of 160 hours
+- **AND** allocations of exactly 160 hours
+- **THEN** the system calculates overall utilization as 100%
+
+#### Scenario: Over-utilization
+- **WHEN** a team member has capacity of 160 hours
+- **AND** allocations of 180 hours
+- **THEN** the system calculates overall utilization as 112.5% (180 / 160 × 100%)
+
+### Requirement: Display utilization alongside capacity
+The system SHALL display utilization percentages alongside capacity information in the allocation view.
+
+#### Scenario: Display capacity with utilization
+- **WHEN** viewing the allocation matrix for a team member
+- **THEN** the system displays capacity (e.g., "160h")
+- **AND** displays overall utilization percentage (e.g., "87.5%")
+- **AND** displays running utilization percentage (e.g., "YTD: 93.75%")
+
+### Requirement: Color-code utilization levels
+The system SHALL use color coding to indicate utilization levels.
+
+#### Scenario: Low utilization
+- **WHEN** overall utilization is below 70%
+- **THEN** the system displays the utilization in BLUE or GRAY (underutilized)
+
+#### Scenario: Optimal utilization
+- **WHEN** overall utilization is between 80% and 100%
+- **THEN** the system displays the utilization in GREEN (optimal)
+
+#### Scenario: High utilization
+- **WHEN** overall utilization is between 100% and 110%
+- **THEN** the system displays the utilization in YELLOW (caution)
+
+#### Scenario: Over-utilization
+- **WHEN** overall utilization exceeds 110%
+- **THEN** the system displays the utilization in RED (over-allocated)
+
+### Requirement: Calculate team-level utilization
+The system SHALL calculate average utilization across all team members.
+
+#### Scenario: Calculate team average utilization
+- **WHEN** Team Member A has 87.5% utilization
+- **AND** Team Member B has 93.75% utilization
+- **AND** Team Member C has 75% utilization
+- **THEN** the system calculates team average utilization as 85.4% ((87.5 + 93.75 + 75) / 3)
+
+#### Scenario: Exclude inactive team members from team utilization
+- **WHEN** calculating team-level utilization
+- **AND** one team member is inactive
+- **THEN** the system excludes the inactive team member from the average
+
+### Requirement: Track utilization trends over time
+The system SHALL provide historical utilization data for trend analysis.
+
+#### Scenario: View utilization trend for 6 months
+- **WHEN** viewing a team member's utilization history from January to June
+- **THEN** the system displays monthly utilization percentages for each month
+- **AND** the system shows a trend line or chart indicating increasing/decreasing utilization
+
+### Requirement: Compare allocated vs actual utilization
+The system SHALL calculate actual utilization based on logged hours for comparison with planned utilization.
+
+#### Scenario: Calculate actual utilization
+- **WHEN** a team member had 140 hours allocated (planned utilization: 87.5%)
+- **AND** the team member logged 130 hours actual (actual utilization: 81.25%)
+- **THEN** the system displays both planned and actual utilization side by side
+- **AND** the system shows variance of -6.25 percentage points
diff --git a/openspec/changes/headroom-foundation/specs/utilization-reporting/spec.md b/openspec/changes/headroom-foundation/specs/utilization-reporting/spec.md
new file mode 100644
index 00000000..98494fe1
--- /dev/null
+++ b/openspec/changes/headroom-foundation/specs/utilization-reporting/spec.md
@@ -0,0 +1,71 @@
+## ADDED Requirements
+
+### Requirement: Generate utilization summary report
+The system SHALL generate reports showing team and individual utilization trends over time.
+
+#### Scenario: View team utilization report
+- **WHEN** a manager requests utilization report for February-April 2026
+- **THEN** the system displays team-level utilization for each month
+- **AND** shows individual team member utilization for each month
+- **AND** calculates average utilization across the period
+
+#### Scenario: Utilization trend visualization
+- **WHEN** viewing utilization report
+- **THEN** the system displays a chart showing utilization percentage trend over time
+- **AND** highlights months with low utilization (< 70%) in blue
+- **AND** highlights months with optimal utilization (80-100%) in green
+- **AND** highlights months with over-utilization (> 100%) in red
+
+### Requirement: Filter utilization by team member
+The system SHALL allow filtering utilization reports by individual team member or role.
+
+#### Scenario: View individual utilization
+- **WHEN** filtering to show utilization for "John Doe"
+- **THEN** the system displays John's monthly utilization percentages
+- **AND** shows running (YTD) utilization
+- **AND** shows overall (monthly) utilization for each month
+
+#### Scenario: View role-based utilization
+- **WHEN** filtering to show utilization for "Backend Developer" role
+- **THEN** the system displays average utilization for all Backend Developers
+- **AND** shows individual breakdown for each team member in that role
+
+### Requirement: Compare planned vs actual utilization
+The system SHALL show variance between planned utilization (allocations) and actual utilization (logged hours).
+
+#### Scenario: Utilization variance report
+- **WHEN** a team member had 87.5% planned utilization in February
+- **AND** logged hours resulting in 81.25% actual utilization
+- **THEN** the system displays variance of -6.25 percentage points
+- **AND** flags under-delivery
+
+#### Scenario: Over-delivery variance
+- **WHEN** a team member had 87.5% planned utilization
+- **AND** logged hours resulting in 95% actual utilization
+- **THEN** the system displays variance of +7.5 percentage points
+- **AND** flags over-delivery (worked more than allocated)
+
+### Requirement: Utilization distribution chart
+The system SHALL display utilization distribution showing how many team members fall into each utilization band.
+
+#### Scenario: View utilization distribution
+- **WHEN** viewing team utilization report for February
+- **THEN** the system shows how many team members are in each band:
+  - Under-utilized (< 70%): 2 team members
+  - Optimal (70-100%): 8 team members
+  - Over-utilized (> 100%): 3 team members
+
+### Requirement: Filter by date range
+The system SHALL allow selecting custom date ranges for utilization reports.
+
+#### Scenario: Quarter-over-quarter comparison
+- **WHEN** selecting Q1 2026 (Jan-Mar) and Q2 2026 (Apr-Jun)
+- **THEN** the system displays utilization comparison between the two quarters
+
+### Requirement: Identify underutilized capacity
+The system SHALL highlight team members with consistently low utilization.
+
+#### Scenario: Flag underutilized team members
+- **WHEN** a team member has utilization below 70% for 3 consecutive months
+- **THEN** the system flags the team member in the report with warning "Underutilized capacity"
+- **AND** calculates total wasted capacity in hours
diff --git a/openspec/changes/headroom-foundation/specs/variance-reporting/spec.md b/openspec/changes/headroom-foundation/specs/variance-reporting/spec.md
new file mode 100644
index 00000000..65e4e0ef
--- /dev/null
+++ b/openspec/changes/headroom-foundation/specs/variance-reporting/spec.md
@@ -0,0 +1,73 @@
+## ADDED Requirements
+
+### Requirement: Generate variance report
+The system SHALL generate reports comparing planned allocations vs actual logged hours.
+
+#### Scenario: View monthly variance report
+- **WHEN** viewing variance report for February 2026
+- **THEN** the system displays all projects with:
+  - Allocated hours (planned)
+  - Actual hours (logged)
+  - Variance (actual - planned)
+  - Variance percentage ((variance / planned) × 100%)
+
+#### Scenario: Positive variance (over-delivery)
+- **WHEN** a project had 40 hours allocated
+- **AND** team member logged 45 hours actual
+- **THEN** the system displays variance of +5 hours (+12.5%)
+- **AND** flags as "Over-delivery"
+
+#### Scenario: Negative variance (under-delivery)
+- **WHEN** a project had 40 hours allocated
+- **AND** team member logged 32 hours actual
+- **THEN** the system displays variance of -8 hours (-20%)
+- **AND** flags as "Under-delivery"
+
+### Requirement: Variance by project
+The system SHALL show variance aggregated by project.
+
+#### Scenario: Project variance summary
+- **WHEN** viewing variance for "Project X" with 120 hours allocated across 3 team members
+- **AND** actual hours logged total 110 hours
+- **THEN** the system displays project-level variance of -10 hours (-8.3%)
+
+### Requirement: Variance by team member
+The system SHALL show variance aggregated by team member.
+
+#### Scenario: Person variance summary
+- **WHEN** "John Doe" had 140 hours total allocated across multiple projects
+- **AND** logged 135 hours actual
+- **THEN** the system displays person-level variance of -5 hours (-3.6%)
+
+#### Scenario: Consistent over-delivery
+- **WHEN** a team member has positive variance for 3 consecutive months
+- **THEN** the system flags the pattern "Consistently working more than allocated"
+
+### Requirement: Filter variance report
+The system SHALL allow filtering variance reports by date range, project, team, or person.
+
+#### Scenario: Filter by date range
+- **WHEN** filtering variance report for Q1 2026
+- **THEN** the system displays variance for January, February, and March
+- **AND** calculates total variance across the quarter
+
+### Requirement: Variance trend analysis
+The system SHALL show variance trends over time.
+
+#### Scenario: Variance trend chart
+- **WHEN** viewing variance trends for a team member over 6 months
+- **THEN** the system displays a chart showing variance percentage for each month
+- **AND** highlights months with significant variance (> ±15%)
+
+### Requirement: Root cause indicators
+The system SHALL highlight patterns that may explain variance.
+
+#### Scenario: Under-delivery correlation with PTO
+- **WHEN** a team member has negative variance in a month
+- **AND** the team member had PTO during that month
+- **THEN** the system notes "PTO may have contributed to under-delivery"
+
+#### Scenario: Over-delivery correlation with over-allocation
+- **WHEN** a team member has positive variance
+- **AND** the team member was over-allocated (> 100% capacity)
+- **THEN** the system notes "Team member worked extra hours beyond allocation"
diff --git a/openspec/changes/headroom-foundation/tasks.md b/openspec/changes/headroom-foundation/tasks.md
new file mode 100644
index 00000000..f53ee659
--- /dev/null
+++ b/openspec/changes/headroom-foundation/tasks.md
@@ -0,0 +1,441 @@
+## 1. Project Setup & Infrastructure
+
+- [ ] 1.1 Create Docker Compose configuration (frontend, backend, postgres, redis containers)
+- [ ] 1.2 Configure Dockerfile for Laravel backend (PHP 8.4-FPM, use :latest tag)
+- [ ] 1.3 Configure Dockerfile for SvelteKit frontend (Node:latest)
+- [ ] 1.4 Set up volume mounts for code (hot reload) and data (PostgreSQL, Redis)
+- [ ] 1.5 Configure environment variables (.env files for frontend and backend)
+- [ ] 1.6 Test Docker Compose startup (all 4 containers running)
+- [ ] 1.7 Configure Nginx Proxy Manager routes (/api/* → Laravel, /* → SvelteKit)
+
+## 2. Backend Foundation (Laravel)
+
+- [ ] 2.1 Initialize Laravel 12 (latest) project with required dependencies
+- [ ] 2.2 Install tymon/jwt-auth, predis/predis, knuckleswtf/scribe
+- [ ] 2.3 Install pestphp/pest, laravel/pint for testing and linting
+- [ ] 2.4 Configure PostgreSQL connection in config/database.php
+- [ ] 2.5 Configure Redis connection for cache and sessions
+- [ ] 2.6 Set up JWT authentication configuration (60min access, 7day refresh)
+- [ ] 2.7 Configure CORS for SvelteKit frontend origin
+- [ ] 2.8 Create API route structure (api.php)
+
+## 3. Frontend Foundation (SvelteKit)
+
+- [ ] 3.1 Initialize SvelteKit project with TypeScript
+- [ ] 3.2 Install Tailwind CSS and DaisyUI
+- [ ] 3.3 Install Recharts, TanStack Table (@tanstack/svelte-table)
+- [ ] 3.4 Install Superforms (sveltekit-superforms) and Zod
+- [ ] 3.5 Install Vitest and Playwright for testing
+- [ ] 3.6 Configure Tailwind with DaisyUI theme
+- [ ] 3.7 Create API client service (fetch wrapper with JWT token handling)
+- [ ] 3.8 Create auth store (Svelte store for user, token management)
+- [ ] 3.9 Create layout components (+layout.svelte, navigation)
+
+## 4. Database Schema & Migrations
+
+- [ ] 4.1 Create migration: roles table (id, name, description)
+- [ ] 4.2 Create migration: project_statuses table (id, name, order, is_active, is_billable)
+- [ ] 4.3 Create migration: project_types table (id, name, description)
+- [ ] 4.4 Create migration: team_members table (id UUID, name, role_id, hourly_rate, active)
+- [ ] 4.5 Create migration: projects table (id UUID, code unique, title, status_id, type_id, approved_estimate, forecasted_effort JSON)
+- [ ] 4.6 Create migration: allocations table (id UUID, project_id, team_member_id, month, allocated_hours)
+- [ ] 4.7 Create migration: actuals table (id UUID, project_id, team_member_id, month, hours_logged)
+- [ ] 4.8 Create migration: holidays table (id UUID, date, name, description)
+- [ ] 4.9 Create migration: ptos table (id UUID, team_member_id, start_date, end_date, reason, status)
+- [ ] 4.10 Create migration: users table (id UUID, name, email, password, role enum)
+- [ ] 4.11 Add indexes (composite on allocations/actuals for project+month, member+month)
+- [ ] 4.12 Run migrations and verify schema
+
+## 5. Database Seeders
+
+- [ ] 5.1 Create seeder: roles (Frontend Dev, Backend Dev, QA, DevOps, UX, PM, Architect)
+- [ ] 5.2 Create seeder: project_statuses (13 statuses with correct order)
+- [ ] 5.3 Create seeder: project_types (Project, Support)
+- [ ] 5.4 Create seeder: users (create superuser account for testing)
+- [ ] 5.5 Run seeders and verify master data populated
+
+## 6. Laravel Models & Relationships
+
+- [ ] 6.1 Create TeamMember model with role relationship
+- [ ] 6.2 Create Project model with status, type relationships, casts for forecasted_effort JSON
+- [ ] 6.3 Create Allocation model with project, team_member relationships
+- [ ] 6.4 Create Actual model with project, team_member relationships
+- [ ] 6.5 Create Role, ProjectStatus, ProjectType models
+- [ ] 6.6 Create Holiday, PTO models
+- [ ] 6.7 Create User model with JWT authentication traits
+- [ ] 6.8 Define model factories for testing (TeamMemberFactory, ProjectFactory, etc.)
+
+## 7. Authentication (Backend)
+
+- [ ] 7.1 Create AuthController (login, logout, refresh methods)
+- [ ] 7.2 Implement login endpoint (validate credentials, generate JWT tokens)
+- [ ] 7.3 Implement logout endpoint (invalidate refresh token in Redis)
+- [ ] 7.4 Implement refresh endpoint (validate refresh token, rotate tokens)
+- [ ] 7.5 Create JWT middleware for protecting routes
+- [ ] 7.6 Store refresh tokens in Redis with 7-day TTL
+- [ ] 7.7 Write unit tests for AuthController
+- [ ] 7.8 Write feature tests for auth endpoints
+
+## 8. Authentication (Frontend)
+
+- [ ] 8.1 Create login page (/login route)
+- [ ] 8.2 Create login form with Superforms + Zod validation
+- [ ] 8.3 Implement auth API client methods (login, logout, refresh)
+- [ ] 8.4 Create auth store (persist tokens in localStorage)
+- [ ] 8.5 Implement token refresh logic (interceptor for 401 responses)
+- [ ] 8.6 Create auth guard for protected routes (hooks.server.ts)
+- [ ] 8.7 Add logout functionality to navigation
+- [ ] 8.8 Write E2E test for login flow (Playwright)
+
+## 9. Team Member Management (Backend)
+
+- [ ] 9.1 Create TeamMemberController (index, store, show, update, destroy)
+- [ ] 9.2 Create TeamMemberRequest for validation (name required, hourly_rate > 0)
+- [ ] 9.3 Create TeamMemberResource for JSON transformation
+- [ ] 9.4 Create TeamMemberPolicy for authorization (managers can CRUD)
+- [ ] 9.5 Implement soft delete prevention (cannot delete if allocations exist)
+- [ ] 9.6 Add API routes for team members
+- [ ] 9.7 Write unit tests for TeamMember model
+- [ ] 9.8 Write feature tests for team member endpoints
+
+## 10. Team Member Management (Frontend)
+
+- [ ] 10.1 Create team members list page (/team-members route)
+- [ ] 10.2 Create team member create/edit form with Superforms + Zod
+- [ ] 10.3 Implement team member API client methods (CRUD)
+- [ ] 10.4 Display team members in TanStack Table (sortable, filterable)
+- [ ] 10.5 Add active/inactive toggle UI
+- [ ] 10.6 Add hourly rate display (formatted as currency)
+- [ ] 10.7 Implement delete with confirmation modal
+- [ ] 10.8 Write unit tests for team member components (Vitest)
+- [ ] 10.9 Write E2E test for team member CRUD (Playwright)
+
+## 11. Project Management (Backend)
+
+- [ ] 11.1 Create ProjectController (index, store, show, update, destroy)
+- [ ] 11.2 Create ProjectRequest for validation (code unique, approved_estimate > 0 if status >= Approved)
+- [ ] 11.3 Create ProjectResource for JSON transformation
+- [ ] 11.4 Create ProjectPolicy for authorization (managers can edit own projects)
+- [ ] 11.5 Implement project status state machine validation
+- [ ] 11.6 Implement forecasted effort validation (sum must equal approved estimate ±5%)
+- [ ] 11.7 Add API routes for projects
+- [ ] 11.8 Write unit tests for Project model and status transitions
+- [ ] 11.9 Write feature tests for project endpoints
+
+## 12. Project Management (Frontend)
+
+- [ ] 12.1 Create projects list page (/projects route)
+- [ ] 12.2 Create project create/edit form with Superforms + Zod
+- [ ] 12.3 Implement project API client methods (CRUD)
+- [ ] 12.4 Display projects in TanStack Table (sortable, filterable by status/type)
+- [ ] 12.5 Add status dropdown (reflect state machine transitions)
+- [ ] 12.6 Add forecasted effort input (JSON editor or month-by-month fields)
+- [ ] 12.7 Display validation warnings (forecasted effort ≠ approved estimate)
+- [ ] 12.8 Write unit tests for project components (Vitest)
+- [ ] 12.9 Write E2E test for project creation and status transitions (Playwright)
+
+## 13. Capacity Planning (Backend)
+
+- [ ] 13.1 Create HolidayController (index, store, destroy)
+- [ ] 13.2 Create PTOController (index, store, update, destroy with approval workflow)
+- [ ] 13.3 Create CapacityService for capacity calculations
+- [ ] 13.4 Implement calculateIndividualCapacity method (working days × availability - PTO - holidays)
+- [ ] 13.5 Implement calculateTeamCapacity method (sum of individual capacities for active members)
+- [ ] 13.6 Implement calculatePossibleRevenue method (capacity × hourly rates)
+- [ ] 13.7 Add API routes for capacity endpoint (/api/capacity?month=YYYY-MM)
+- [ ] 13.8 Implement Redis caching for capacity calculations (1 hour TTL)
+- [ ] 13.9 Write unit tests for CapacityService
+- [ ] 13.10 Write feature tests for capacity endpoints
+
+## 14. Capacity Planning (Frontend)
+
+- [ ] 14.1 Create capacity planning page (/capacity route)
+- [ ] 14.2 Create calendar component for displaying month grid
+- [ ] 14.3 Implement availability editor (click day to set 0, 0.5, 1.0)
+- [ ] 14.4 Display holidays (H marker on dates)
+- [ ] 14.5 Display weekends (O marker on dates)
+- [ ] 14.6 Create PTO request form
+- [ ] 14.7 Display individual and team capacity summary
+- [ ] 14.8 Display possible revenue calculation
+- [ ] 14.9 Write unit tests for capacity components (Vitest)
+- [ ] 14.10 Write E2E test for capacity planning workflow (Playwright)
+
+## 15. Resource Allocation (Backend)
+
+- [ ] 15.1 Create AllocationController (index, store, update, destroy, bulk methods)
+- [ ] 15.2 Create AllocationRequest for validation (hours >= 0, month format YYYY-MM)
+- [ ] 15.3 Create AllocationResource for JSON transformation
+- [ ] 15.4 Create AllocationPolicy for authorization (managers can allocate own team members)
+- [ ] 15.5 Implement allocation validation service (check capacity, approved estimate)
+- [ ] 15.6 Implement bulk allocation endpoint (create/update multiple allocations)
+- [ ] 15.7 Add API routes for allocations (/api/allocations?month=YYYY-MM)
+- [ ] 15.8 Implement Redis cache invalidation on allocation mutations
+- [ ] 15.9 Write unit tests for allocation validation logic
+- [ ] 15.10 Write feature tests for allocation endpoints
+
+## 16. Resource Allocation (Frontend)
+
+- [ ] 16.1 Create allocation matrix page (/allocations route)
+- [ ] 16.2 Create allocation matrix component using TanStack Table
+- [ ] 16.3 Implement inline editing for allocation hours
+- [ ] 16.4 Display projects as rows, team members as columns
+- [ ] 16.5 Display row totals (total hours per project)
+- [ ] 16.6 Display column totals (total hours per team member)
+- [ ] 16.7 Display utilization percentages per team member
+- [ ] 16.8 Implement color-coded indicators (GREEN/YELLOW/RED for over/under allocation)
+- [ ] 16.9 Add "Untracked" resource column
+- [ ] 16.10 Implement month selector (navigate between months)
+- [ ] 16.11 Add bulk allocation actions (copy previous month, clear all)
+- [ ] 16.12 Write unit tests for allocation matrix logic (Vitest)
+- [ ] 16.13 Write E2E test for allocation workflow (Playwright)
+
+## 17. Actuals Tracking (Backend)
+
+- [ ] 17.1 Create ActualController (index, store, update, bulk methods)
+- [ ] 17.2 Create ActualRequest for validation (hours >= 0, cannot log future months)
+- [ ] 17.3 Create ActualResource for JSON transformation
+- [ ] 17.4 Create ActualPolicy for authorization (developers can log own hours only)
+- [ ] 17.5 Implement validation: cannot log to completed/cancelled projects (configurable)
+- [ ] 17.6 Implement bulk actuals endpoint
+- [ ] 17.7 Add API routes for actuals (/api/actuals?month=YYYY-MM)
+- [ ] 17.8 Implement Redis cache invalidation on actuals mutations
+- [ ] 17.9 Write unit tests for actuals validation
+- [ ] 17.10 Write feature tests for actuals endpoints
+
+## 18. Actuals Tracking (Frontend)
+
+- [ ] 18.1 Create actuals entry page (/actuals route)
+- [ ] 18.2 Create actuals matrix component (similar to allocations matrix)
+- [ ] 18.3 Display allocated hours vs actual hours side by side
+- [ ] 18.4 Highlight variances (over/under delivery)
+- [ ] 18.5 Allow developers to see only their own actuals (RBAC check)
+- [ ] 18.6 Implement bulk update for multiple projects
+- [ ] 18.7 Write unit tests for actuals components (Vitest)
+- [ ] 18.8 Write E2E test for actuals logging (Playwright)
+
+## 19. Utilization Calculations (Backend)
+
+- [ ] 19.1 Create UtilizationService for utilization calculations
+- [ ] 19.2 Implement calculateRunningUtilization method (YTD allocated / YTD capacity)
+- [ ] 19.3 Implement calculateOverallUtilization method (monthly allocated / monthly capacity)
+- [ ] 19.4 Implement calculateActualUtilization method (monthly actuals / monthly capacity)
+- [ ] 19.5 Implement team-level utilization aggregation
+- [ ] 19.6 Add utilization data to allocation and actuals responses
+- [ ] 19.7 Write unit tests for UtilizationService
+- [ ] 19.8 Write feature tests for utilization calculations
+
+## 20. Reporting - Forecast (Backend)
+
+- [ ] 20.1 Create ReportController with forecast method
+- [ ] 20.2 Implement forecast report query (multi-period allocations)
+- [ ] 20.3 Calculate revenue forecast (allocations × hourly rates)
+- [ ] 20.4 Display variance indicators (forecasted vs approved estimate)
+- [ ] 20.5 Implement filters (project, status, type, team, date range)
+- [ ] 20.6 Create ForecastReportResource for JSON transformation
+- [ ] 20.7 Add API route /api/reports/forecast
+- [ ] 20.8 Implement Redis caching for forecast reports (15 min TTL)
+- [ ] 20.9 Write unit tests for forecast report logic
+- [ ] 20.10 Write feature tests for forecast endpoint
+
+## 21. Reporting - Forecast (Frontend)
+
+- [ ] 21.1 Create forecast report page (/reports/forecast route)
+- [ ] 21.2 Create forecast report table component
+- [ ] 21.3 Display multi-period view (month columns)
+- [ ] 21.4 Display variance indicators (GREEN/YELLOW/RED)
+- [ ] 21.5 Implement date range selector
+- [ ] 21.6 Implement filters (project, status, type, team)
+- [ ] 21.7 Display summary aggregations (total approved, total allocated, variance)
+- [ ] 21.8 Add revenue forecast chart (Recharts line chart)
+- [ ] 21.9 Write E2E test for forecast report (Playwright)
+
+## 22. Reporting - Utilization (Backend)
+
+- [ ] 22.1 Add utilization method to ReportController
+- [ ] 22.2 Implement utilization report query (team and individual trends)
+- [ ] 22.3 Calculate planned vs actual utilization
+- [ ] 22.4 Implement filters (team member, role, date range)
+- [ ] 22.5 Create UtilizationReportResource for JSON transformation
+- [ ] 22.6 Add API route /api/reports/utilization
+- [ ] 22.7 Implement Redis caching for utilization reports
+- [ ] 22.8 Write feature tests for utilization endpoint
+
+## 23. Reporting - Utilization (Frontend)
+
+- [ ] 23.1 Create utilization report page (/reports/utilization route)
+- [ ] 23.2 Display team-level utilization summary
+- [ ] 23.3 Display individual utilization breakdown
+- [ ] 23.4 Add utilization trend chart (Recharts line chart)
+- [ ] 23.5 Color-code utilization bands (< 70% blue, 80-100% green, > 100% yellow/red)
+- [ ] 23.6 Implement filters (team member, role, date range)
+- [ ] 23.7 Display utilization distribution chart (how many in each band)
+- [ ] 23.8 Write E2E test for utilization report (Playwright)
+
+## 24. Reporting - Cost (Backend)
+
+- [ ] 24.1 Add cost method to ReportController
+- [ ] 24.2 Implement cost report query (allocations × hourly rates)
+- [ ] 24.3 Calculate possible revenue (full capacity utilization)
+- [ ] 24.4 Calculate forecasted revenue (current allocations)
+- [ ] 24.5 Calculate revenue gap (possible - forecasted)
+- [ ] 24.6 Implement filters (project, client, type, team, date range)
+- [ ] 24.7 Create CostReportResource for JSON transformation
+- [ ] 24.8 Add API route /api/reports/cost
+- [ ] 24.9 Implement Redis caching for cost reports
+- [ ] 24.10 Write feature tests for cost endpoint
+
+## 25. Reporting - Cost (Frontend)
+
+- [ ] 25.1 Create cost report page (/reports/cost route)
+- [ ] 25.2 Display monthly revenue forecast
+- [ ] 25.3 Display cost breakdown by project
+- [ ] 25.4 Display possible revenue vs forecasted revenue
+- [ ] 25.5 Display revenue gap analysis
+- [ ] 25.6 Implement filters (project, type, team, date range)
+- [ ] 25.7 Add revenue chart (Recharts bar chart)
+- [ ] 25.8 Write E2E test for cost report (Playwright)
+
+## 26. Reporting - Allocation (Backend)
+
+- [ ] 26.1 Add allocation method to ReportController
+- [ ] 26.2 Implement allocation report query (monthly matrix view)
+- [ ] 26.3 Include utilization percentages
+- [ ] 26.4 Implement filters (team, role, project, status)
+- [ ] 26.5 Create AllocationReportResource for JSON transformation
+- [ ] 26.6 Add API route /api/reports/allocation
+- [ ] 26.7 Implement Redis caching for allocation reports
+- [ ] 26.8 Write feature tests for allocation endpoint
+
+## 27. Reporting - Allocation (Frontend)
+
+- [ ] 27.1 Create allocation report page (/reports/allocation route)
+- [ ] 27.2 Display allocation matrix with totals
+- [ ] 27.3 Display utilization percentages
+- [ ] 27.4 Highlight recent allocation changes (NEW/UPDATED badges)
+- [ ] 27.5 Implement multi-month view option
+- [ ] 27.6 Implement filters (team, role, project, status)
+- [ ] 27.7 Write E2E test for allocation report (Playwright)
+
+## 28. Reporting - Variance (Backend)
+
+- [ ] 28.1 Add variance method to ReportController
+- [ ] 28.2 Implement variance report query (planned vs actual comparison)
+- [ ] 28.3 Calculate variance (actual - planned) and percentage
+- [ ] 28.4 Flag over-delivery and under-delivery patterns
+- [ ] 28.5 Implement filters (project, team, person, date range)
+- [ ] 28.6 Create VarianceReportResource for JSON transformation
+- [ ] 28.7 Add API route /api/reports/variance
+- [ ] 28.8 Implement Redis caching for variance reports
+- [ ] 28.9 Write feature tests for variance endpoint
+
+## 29. Reporting - Variance (Frontend)
+
+- [ ] 29.1 Create variance report page (/reports/variance route)
+- [ ] 29.2 Display variance table (planned, actual, variance, variance %)
+- [ ] 29.3 Color-code variances (positive green, negative red)
+- [ ] 29.4 Display project-level variance aggregations
+- [ ] 29.5 Display person-level variance aggregations
+- [ ] 29.6 Add variance trend chart (Recharts)
+- [ ] 29.7 Implement filters (project, team, person, date range)
+- [ ] 29.8 Write E2E test for variance report (Playwright)
+
+## 30. Role-Based Access Control (Backend)
+
+- [ ] 30.1 Create role middleware for route protection
+- [ ] 30.2 Implement permission checks in controllers
+- [ ] 30.3 Create policies for all models (TeamMember, Project, Allocation, Actual)
+- [ ] 30.4 Implement Superuser full access (bypass all checks)
+- [ ] 30.5 Implement Manager permissions (own projects, own team allocations)
+- [ ] 30.6 Implement Developer permissions (own allocations, own actuals)
+- [ ] 30.7 Implement Top Brass permissions (read-only all reports)
+- [ ] 30.8 Write unit tests for policies
+- [ ] 30.9 Write feature tests for authorization (401, 403 responses)
+
+## 31. Role-Based Access Control (Frontend)
+
+- [ ] 31.1 Add role to auth store
+- [ ] 31.2 Implement route guards based on role (hooks.server.ts)
+- [ ] 31.3 Hide UI elements based on permissions (v-if directives)
+- [ ] 31.4 Show read-only state for Top Brass users
+- [ ] 31.5 Filter visible projects for Managers (own projects editable, others read-only)
+- [ ] 31.6 Filter visible data for Developers (only assigned projects)
+- [ ] 31.7 Write E2E tests for RBAC (different user roles)
+
+## 32. Master Data Management (Backend)
+
+- [ ] 32.1 Create MasterDataController (roles, statuses, types endpoints)
+- [ ] 32.2 Create RoleController for managing roles (Superuser only)
+- [ ] 32.3 Create ProjectStatusController for managing statuses (Superuser only)
+- [ ] 32.4 Create ProjectTypeController for managing types (Superuser only)
+- [ ] 32.5 Implement validation: cannot delete role/status/type in use
+- [ ] 32.6 Add API routes for master data endpoints
+- [ ] 32.7 Implement Redis caching for master data (24 hour TTL)
+- [ ] 32.8 Write feature tests for master data endpoints
+
+## 33. Master Data Management (Frontend)
+
+- [ ] 33.1 Create master data management page (/admin/master-data route, Superuser only)
+- [ ] 33.2 Display roles list with CRUD actions
+- [ ] 33.3 Display project statuses list with reordering and CRUD actions
+- [ ] 33.4 Display project types list with CRUD actions
+- [ ] 33.5 Implement master data forms (create/edit)
+- [ ] 33.6 Write E2E test for master data management (Playwright)
+
+## 34. API Documentation (Backend)
+
+- [ ] 34.1 Add Scribe annotations to all controllers (@group, @response tags)
+- [ ] 34.2 Configure Scribe (scribe.php config file)
+- [ ] 34.3 Generate API documentation (php artisan scribe:generate)
+- [ ] 34.4 Verify SwaggerUI accessible at /api/documentation
+- [ ] 34.5 Add example requests and responses to documentation
+- [ ] 34.6 Add authentication section to API docs
+
+## 35. Testing & Code Quality
+
+- [ ] 35.1 Write comprehensive unit tests (backend models, services, utilities)
+- [ ] 35.2 Write feature tests for all API endpoints (Laravel Pest)
+- [ ] 35.3 Write unit tests for frontend components (Vitest)
+- [ ] 35.4 Write E2E tests for critical flows (Playwright: login, allocate, report)
+- [ ] 35.5 Configure pre-commit hooks (Laravel Pint, ESLint, Prettier)
+- [ ] 35.6 Run PHPStan static analysis (level 5+)
+- [ ] 35.7 Generate code coverage report (verify >70%)
+- [ ] 35.8 Fix all linting errors (Laravel Pint, ESLint)
+- [ ] 35.9 Run security audit (composer audit, npm audit)
+
+## 36. Polish & UX
+
+- [ ] 36.1 Add loading states (spinners, skeleton loaders)
+- [ ] 36.2 Add error states (toast notifications, error pages)
+- [ ] 36.3 Add empty states (no data placeholders)
+- [ ] 36.4 Implement form validation feedback (inline errors, success messages)
+- [ ] 36.5 Add confirmation modals for destructive actions (delete)
+- [ ] 36.6 Implement responsive design (mobile-friendly tables, navigation)
+- [ ] 36.7 Add keyboard shortcuts (ESC to close modals, etc.)
+- [ ] 36.8 Add accessibility features (ARIA labels, focus management)
+- [ ] 36.9 Test in multiple browsers (Chrome, Firefox, Safari)
+
+## 37. Documentation & Deployment
+
+- [ ] 37.1 Write README.md with setup instructions
+- [ ] 37.2 Document environment variables (.env.example files)
+- [ ] 37.3 Create Quick Start guide for managers (capacity → allocate → reports)
+- [ ] 37.4 Document API authentication flow
+- [ ] 37.5 Create deployment guide (Docker Compose production setup)
+- [ ] 37.6 Add health check endpoints (/api/health)
+- [ ] 37.7 Configure logging (Laravel logs to stdout, Svelte client errors to console)
+- [ ] 37.8 Test full deployment workflow (fresh Docker Compose up)
+- [ ] 37.9 Create superuser via seeder for initial login
+- [ ] 37.10 Verify Nginx Proxy Manager routing
+
+## 38. Final Verification
+
+- [ ] 38.1 Run full test suite (unit + E2E) and verify all pass
+- [ ] 38.2 Verify code coverage >70%
+- [ ] 38.3 Run linters and fix all issues
+- [ ] 38.4 Test complete user flow: capacity → allocate → log actuals → reports
+- [ ] 38.5 Verify RBAC working for all 4 personas
+- [ ] 38.6 Verify Redis caching working (check cache hit rate)
+- [ ] 38.7 Verify API documentation accessible and accurate
+- [ ] 38.8 Verify Docker Compose startup works cleanly
+- [ ] 38.9 Verify database migrations and seeders work
+- [ ] 38.10 Conduct final security review (no secrets in code, HTTPS enforced)
diff --git a/openspec/config.yaml b/openspec/config.yaml
new file mode 100644
index 00000000..392946c6
--- /dev/null
+++ b/openspec/config.yaml
@@ -0,0 +1,20 @@
+schema: spec-driven
+
+# Project context (optional)
+# This is shown to AI when creating artifacts.
+# Add your tech stack, conventions, style guides, domain knowledge, etc.
+# Example:
+#   context: |
+#     Tech stack: TypeScript, React, Node.js
+#     We use conventional commits
+#     Domain: e-commerce platform
+
+# Per-artifact rules (optional)
+# Add custom rules for specific artifacts.
+# Example:
+#   rules:
+#     proposal:
+#       - Keep proposals under 500 words
+#       - Always include a "Non-goals" section
+#     tasks:
+#       - Break tasks into chunks of max 2 hours