# Quality Gate Review — Phase 2 Architecture (Round 3)

**Project:** leocrm
**Date:** 2026-06-28
**Reviewer:** Quality Reviewer (automated)
**Scope:** v1/v2 separation fix verification after Round 2

---

## VERDICT: APPROVED_WITH_SUGGESTIONS

| Severity | Count |
|----------|-------|
| Critical | 0 |
| Major | 1 |
| Minor | 3 |
| Suggestion | 2 |

---

## 1. V1/V2 SEPARATION — ✅ PASS

**Methodology:** Extracted all `requirement_ids` from each v1 task (T01, T02, T03, T07, T09, T10) and cross-checked against v2 feature prefixes (F-CAL-*, F-DMS-, F-FILE*, F-FILEUI-*, F-LINK-*, F-MAIL-*, F-PERM-*, F-TAG-*).

**Result:** No v2 feature IDs appear in any v1 task.

| Task | Scope | V2 Features Found |
|------|-------|-------------------|
| T01 | v1 | ✓ None |
| T02 | v1 | ✓ None |
| T03 | v1 | ✓ None |
| T07 | v1 | ✓ None |
| T09 | v1 | ✓ None |
| T10 | v1 | ✓ None |

**Feature ID extraction per v1 task:**
- T01: F-CORE-*, F-AUTH-*, F-SEC-*, F-INFRA-*, F-INT-*, F-SCHED-*, F-TEST-01 (25 reqs)
- T02: F-COMP-*, F-CONT-*, F-DATA-*, F-MIG-*, F-CORE-*, F-SEARCH-*, F-TEST-01 (25 reqs)
- T03: F-PLUGIN-*, F-CORE-*, F-TEST-01 (7 reqs)
- T07: F-AUTH-*, F-COMP-*, F-CONT-*, F-CORE-*, F-SEARCH-*, F-A11Y-*, F-INT-*, F-NAV-*, F-SET-*, F-UI-*, F-DATA-*, F-TEST-01 (38 reqs)
- T09: F-AI-01, F-WF-01, F-CORE-*, F-TEST-01 (5 reqs)
- T10: F-INFRA-*, F-PERF-01, F-DOC-01, F-ENV-01, F-TEST-01 (8 reqs)

---

## 2. V1 FEATURE COVERAGE — ✅ PASS

**Methodology:** Extracted 73 v1 features from requirements.md (70 with `[v1]` header markers + 3 F-A11Y features marked `[v1]`). Cross-checked against architecture.md and task_graph.json.

### Architecture Coverage
- **V1 features in architecture.md:** 73/73 ✅
- All v1 features are referenced in the architecture document.

### Task Graph Coverage
- **V1 features assigned to v1 tasks:** 73/73 ✅
- Zero v1 features missing from task assignments.
- The task_graph contains 3 additional IDs (F-A11Y-01, F-A11Y-02, F-A11Y-03) in T07 that are correctly marked `[v1]` in requirements.md.

**Feature count reconciliation:**
- Requirements.md: 73 v1 features (marked `[v1]`) + 70 v2 features (marked `[v2-Plugin]` or unmarked) = 143 total
- Wait — our regex found 140 unique header features (73 v1 + 67 v2 headers). However, 3 v2 features (F-A11Y-01/02/03) are actually v1. The `[v2-Plugin]` marker on some features was not caught by the initial `[v1]`/`[v2]` regex because it uses `[v2-Plugin]` format. This does not affect the review outcome — all 73 v1 features are accounted for.

---

## 3. DEPENDENCY CHAIN — ✅ PASS

**Methodology:** Extracted `dependencies` field from all v1 tasks and verified no v2 task appears as a dependency.

| V1 Task | Dependencies | All V1? |
|---------|-------------|---------|
| T01 | [] | ✓ (no deps) |
| T02 | [T01] | ✓ |
| T03 | [T01] | ✓ |
| T07 | [T01, T02] | ✓ |
| T09 | [T01, T02] | ✓ |
| T10 | [T01, T02] | ✓ |

**Critical check:** T10 does NOT depend on T08, T08a, T08b, T08c, or any v2 task. ✅

**V2 task dependencies (for reference):**
- T04: [T01, T03] — v1 deps only ✅
- T05: [T01, T03] — v1 deps only ✅
- T06: [T01, T03] — v1 deps only ✅
- T08a: [T04, T07] — v2+v1 deps (expected) ✅
- T08b: [T05, T07] — v2+v1 deps (expected) ✅
- T08c: [T06, T07] — v2+v1 deps (expected) ✅
- T11: [T01, T03] — v1 deps only ✅

**Conclusion:** V1 tasks can execute independently without any v2 task. The dependency chain is clean.

---

## 4. TASK SIZING — ✅ PASS

**Methodology:** Counted `requirement_ids` and `acceptance_criteria` per task. Threshold: ≤40 each.

| Task | Reqs | ACs | Overloaded? |
|------|------|-----|-------------|
| T01 | 25 | 26 | ✅ No |
| T02 | 25 | 24 | ✅ No |
| T03 | 7 | 14 | ✅ No |
| T04 | 11 | 26 | ✅ No |
| T05 | 19 | 30 | ✅ No |
| T06 | 20 | 40 | ✅ No (at limit) |
| T07 | 38 | 32 | ✅ No |
| T08a | 23 | 12 | ✅ No |
| T08b | 13 | 11 | ✅ No |
| T08c | 16 | 18 | ✅ No |
| T09 | 5 | 22 | ✅ No |
| T10 | 8 | 18 | ✅ No |
| T11 | 16 | 14 | ✅ No |

**Note:** T06 has exactly 40 ACs (at the limit) and T07 has 38 reqs (close to limit). Recommend monitoring during implementation but not blocking.

---

## 5. ARCHITECTURE V1/V2 MARKERS — ⚠️ PARTIAL

**Methodology:** Searched architecture.md for section headers containing v2 domain names with v2/Plugin Phase markers.

### V2 Section Markers Found
| Domain | V2-Marked Sections | Status |
|--------|-------------------|--------|
| DMS | 2 | ✅ `### DMS Plugin Tables (v2 — Plugin Phase)`, `### DMS Plugin Endpoints (v2 — Plugin Phase)` |
| Calendar | 1 | ✅ `### Calendar Plugin Tables (v2 — Plugin Phase)` |
| Mail | 1 | ✅ `### Mail Plugin Tables (v2 — Plugin Phase)` |
| Tag | 0 | ⚠️ Missing v2 marker |
| Permission | 0 | ⚠️ Missing v2 marker |
| File | 0 | ⚠️ Missing v2 marker |

### V1 Feature References in Architecture
- **73/73 v1 features referenced** ✅
- All v1 feature IDs (including F-A11Y-01/02/03) appear in architecture.md.

### V2 Feature References in Architecture
- **48/70 v2 features explicitly referenced** (22 missing)
- Missing v2 feature IDs in architecture.md:
  - F-CAL-06, F-CAL-07, F-CAL-08, F-CAL-12, F-CAL-14, F-CAL-15
  - F-FILE-01, F-FILE-02, F-FILE-03, F-FILE-04
  - F-FILEUI-02, F-FILEUI-03, F-FILEUI-05, F-FILEUI-06
  - F-LINK-02, F-LINK-03, F-LINK-04, F-LINK-06
  - F-PERM-01, F-PERM-02, F-PERM-04
  - F-TAG-03

**Assessment:** The missing v2 feature references in architecture.md are a MINOR issue. The architecture document covers the plugin system architecture generically (plugin manifest, plugin DB migrations, UI plugin framework). Individual v2 feature IDs are more relevant at the task/implementation level. However, the missing v2 section markers for Tag, Permission, and File domains should be added for completeness.

---

## 6. AGENTS.md COMPLETENESS — ✅ PASS

**Methodology:** Verified all 13 task IDs (T01-T11, T08a, T08b, T08c) are referenced in AGENTS.md.

| Task ID | In AGENTS.md |
|---------|-------------|
| T01 | ✅ |
| T02 | ✅ |
| T03 | ✅ |
| T04 | ✅ |
| T05 | ✅ |
| T06 | ✅ |
| T07 | ✅ |
| T08a | ✅ |
| T08b | ✅ |
| T08c | ✅ |
| T09 | ✅ |
| T10 | ✅ |
| T11 | ✅ |

- V1 phase mentioned: ✅ (18 occurrences of 'v1')
- V2 phase mentioned: ✅ (16 occurrences of 'v2')
- Phase plan shows v1 and v2 phases separately: ✅

---

## 7. ORIGINAL 10 CRITERIA (from Round 1/2) — ✅ ALL PASS

| # | Criterion | Status | Evidence |
|---|-----------|--------|----------|
| a | F-AI-01 referenced in architecture | ✅ PASS | Found in architecture.md |
| b | F-WF-01 referenced in architecture | ✅ PASS | Found in architecture.md |
| c | Redis session storage (ADR-05) consistent | ✅ PASS | ADR-05 present: "Server-side sessions in Redis (primary store for fast lookup)" |
| d | All 19 traceability IDs present in task_graph | ✅ PASS | 19/19 found, zero missing |
| e | F-DOC-01 covered | ✅ PASS | In T10 requirement_ids |
| f | F-INFRA-04 covered | ✅ PASS | In T10 requirement_ids |
| g | F-PERF-01 covered | ✅ PASS | In T10 requirement_ids |
| h | F-CONT-08 (phantom) NOT in task_graph | ✅ PASS | Confirmed absent — F-CONT-08 does not exist in requirements.md or task_graph |
| i | CSP header mentioned | ✅ PASS | Content-Security-Policy / CSP found in architecture.md |
| j | api_tokens mentioned | ✅ PASS | api_tokens / API token found in architecture.md |

---

## DETAILED FINDINGS

### Finding 1 — MAJOR: 6 V2 Features Unassigned to Any Task

**Severity:** Major
**Artifact:** task_graph.json
**Location:** T04 (DMS), T08a (DMS UI)
**Issue:** The following 6 v2 features have no `requirement_ids` entry in any task:
- F-FILE-01: Datei-Explorer (DMS plugin)
- F-FILE-02: Datei-Sharing (DMS plugin)
- F-FILE-03: PDF-Preview (DMS plugin)
- F-FILE-04: OnlyOffice-Integration (DMS plugin)
- F-FILEUI-05: Upload-Progress-Anzeige (DMS plugin)
- F-FILEUI-06: Drag & Drop zwischen Ordnern (DMS plugin)

**Impact:** These requirements exist in requirements.md but have no task ownership. They may be implicitly covered by T04 (DMS backend) and T08a (DMS UI), but without explicit `requirement_ids` entries, there is no traceability and risk of implementation gaps.

**Recommendation:** Add F-FILE-01 through F-FILE-04 to T04's `requirement_ids` and F-FILEUI-05, F-FILEUI-06 to T08a's `requirement_ids`. Alternatively, create a dedicated T08d task for the file-explorer UI features if T08a is already at capacity (23 reqs).

---

### Finding 2 — MINOR: Missing V2 Section Markers for Tag, Permission, and File Domains

**Severity:** Minor
**Artifact:** architecture.md
**Location:** Section headers
**Issue:** Three v2 domains lack explicit "v2 — Plugin Phase" section markers:
- Tag: No v2-marked section header found
- Permission: No v2-marked section header found
- File (DMS File Explorer): No v2-marked section header found

The architecture document has v2 markers for DMS, Calendar, and Mail tables/endpoints, but not for Tag, Permission, or File-specific sections.

**Recommendation:** Add v2 section markers for:
- `### Tag Plugin Tables (v2 — Plugin Phase)`
- `### Tag Plugin Endpoints (v2 — Plugin Phase)`
- `### Permission Plugin Tables (v2 — Plugin Phase)`
- `### Permission Plugin Endpoints (v2 — Plugin Phase)`
- `### File Explorer (DMS) (v2 — Plugin Phase)`

---

### Finding 3 — MINOR: 22 V2 Features Not Explicitly Referenced in Architecture.md

**Severity:** Minor
**Artifact:** architecture.md
**Location:** Feature ID references
**Issue:** 22 of 70 v2 features are not explicitly referenced by feature ID in architecture.md. While the architectural concepts (plugin system, DMS tables, etc.) are described, individual feature-level traceability is missing for these 22 features.

**Impact:** Low — v2 is the plugin phase and the architecture covers the plugin system generically. Individual feature IDs are more relevant at implementation time. However, adding references improves traceability.

**Recommendation:** Add feature ID references to the relevant architecture sections for the 22 missing v2 features listed in Section 5 above.

---

### Finding 4 — MINOR: T06 at AC Limit (40/40)

**Severity:** Minor
**Artifact:** task_graph.json
**Location:** T06 (Mail Plugin)
**Issue:** T06 has exactly 40 acceptance criteria, hitting the threshold limit. While not exceeding, this is a large task that may be difficult to implement and test in a single block.

**Recommendation:** Consider splitting T06 into T06a (core mail: F-MAIL-01 through F-MAIL-10) and T06b (advanced mail: F-MAIL-11 through F-MAIL-19) if implementation proves unwieldy.

---

### Finding 5 — SUGGESTION: T07 Has 38 Requirements (Near Limit)

**Severity:** Suggestion
**Artifact:** task_graph.json
**Location:** T07 (Frontend SPA)
**Issue:** T07 has 38 requirements, close to the 40 limit. This is the frontend SPA task covering all v1 UI features.

**Recommendation:** Monitor during implementation. If T07 becomes too large, consider splitting into T07a (layout, navigation, core UI) and T07b (company/contact UI, search, data tables).

---

### Finding 6 — SUGGESTION: V2 Feature Marker Format Inconsistency

**Severity:** Suggestion
**Artifact:** requirements.md
**Location:** Feature headers
**Issue:** V1 features use `[v1]` marker format, but v2 features use `[v2-Plugin]` format. The regex `\[v2\]` does not match `[v2-Plugin]`, which initially caused 0 v2 features to be detected. This is a formatting inconsistency.

**Recommendation:** Standardize marker format — either all use `[v1]`/`[v2]` or all use `[v1-Core]`/`[v2-Plugin]`. This improves automated parsing reliability.

---

## SUMMARY TABLE

| Verification Item | Result |
|-------------------|--------|
| 1. V1/V2 Separation (no v2 in v1 tasks) | ✅ PASS |
| 2. V1 Feature Coverage (73/73 in arch + tasks) | ✅ PASS |
| 3. Dependency Chain (v1 independent from v2) | ✅ PASS |
| 4. Task Sizing (≤40 reqs, ≤40 ACs) | ✅ PASS |
| 5. Architecture V1/V2 Markers | ⚠️ PARTIAL (3 domains missing v2 markers) |
| 6. AGENTS.md Completeness (13/13 tasks) | ✅ PASS |
| 7a. F-AI-01 in architecture | ✅ PASS |
| 7b. F-WF-01 in architecture | ✅ PASS |
| 7c. Redis session storage (ADR-05) | ✅ PASS |
| 7d. 19 traceability IDs in task_graph | ✅ PASS (19/19) |
| 7e. F-DOC-01 covered | ✅ PASS |
| 7f. F-INFRA-04 covered | ✅ PASS |
| 7g. F-PERF-01 covered | ✅ PASS |
| 7h. F-CONT-08 phantom absent | ✅ PASS |
| 7i. CSP header mentioned | ✅ PASS |
| 7j. api_tokens mentioned | ✅ PASS |

---

## NEXT STEPS

1. **MAJOR — Fix before v2 implementation:** Add F-FILE-01 through F-FILE-04 and F-FILEUI-05, F-FILEUI-06 to appropriate v2 task `requirement_ids` in task_graph.json.
2. **MINOR — Improve before v2 implementation:** Add v2 section markers for Tag, Permission, and File domains in architecture.md.
3. **MINOR — Improve traceability:** Add the 22 missing v2 feature ID references to architecture.md sections.
4. **Non-blocking:** T06 at AC limit and T07 near req limit — monitor during implementation.

**Phase Gate Decision:** The v1 scope is clean, complete, and correctly separated from v2. The dependency chain allows independent v1 execution. All 10 original criteria pass. The single MAJOR issue (6 unassigned v2 features) does not block v1 implementation but should be resolved before v2 work begins.

**This phase gate is APPROVED WITH SUGGESTIONS. V1 implementation may proceed.**
