docs(sdd): authorize backend implementation

AGENTS.md

@@ -2,9 +2,9 @@
 
 ## Phase gate
 
-This repository is in specification mode. Do not create `go.mod`, application packages, migrations, containers, or executable code until the relevant capability spec is approved.
+This repository is authorized for SDD Phase 4 implementation as of 2026-08-20. Follow `tasks/todo.md` in dependency order and keep the approved capability specs authoritative. New capabilities or changes outside those contracts still require specification and approval before implementation.
 
-For every Go-related task, always invoke and follow the `golang-how-to` skill, then the secondary Go skills it routes to. Before creating the Go project layout, ask the user to approve the architecture style and dependency-injection approach in that order.
+For every Go-related task, always invoke and follow the `golang-how-to` skill, then the secondary Go skills it routes to. The capability-oriented modular-monolith architecture and manual-constructor dependency injection are approved; changing either requires a new ADR and user approval.
 
 ## Product invariants
 

README.md

@@ -2,7 +2,7 @@
 
 Go backend for merchant identity, dataset ingestion, deterministic analytics, authenticated APIs, and later AvalAI integration.
 
-Current state: specification bootstrap only. There is intentionally no Go module or application scaffold yet because the architecture and dependency-injection choices still require approval.
+Current state: specifications, architecture, implementation plan, and task list are approved. Phase 4 implementation is authorized; the Go scaffold begins with Task F1.
 
 ## Local dataset input
 
@@ -14,7 +14,7 @@ data/incoming/challenge_data.csv.gz
 
 The entire `data/incoming/` payload is ignored by Git. The one-time bootstrap importer will read from this location (or an explicitly supplied path), stream the compressed CSV, validate it, and write an import manifest containing the source checksum, schema version, row counts, quality results, and importer revision. It is an administrative bootstrap/recovery command, not a scheduled ingestion job. The hackathon MVP does not mutate payment facts after this import; any future ZarinPal live-write integration is outside this project's current scope. The raw file and resulting PostgreSQL data are not committed.
 
-The proposed first-server Docker flow and Bash entrypoint are specified in [`docs/IMPORT-WORKFLOW-SPEC.md`](docs/IMPORT-WORKFLOW-SPEC.md). No importer script or application code exists until that specification is approved and implementation is separately authorized.
+The proposed first-server Docker flow and Bash entrypoint are specified in [`docs/IMPORT-WORKFLOW-SPEC.md`](docs/IMPORT-WORKFLOW-SPEC.md). Implementation is authorized and must follow the dependency order in [`tasks/todo.md`](tasks/todo.md).
 
 ## Planned runnable boundaries
 
@@ -26,7 +26,7 @@ One repository may expose several small `cmd/` entry points while sharing domain
 - HTTP API with authenticated SSE analytics delivery
 - on-demand analytics worker that calculates dashboard sections in parallel and caches versioned results in Redis
 
-The exact package layout is deferred until the Go architecture and DI decisions are approved.
+The approved package-layout and manual-constructor decisions are implemented through the scaffold and provider tasks.
 
 ## Merchant API contract
 

docs/ANALYTICS-SPEC.md

@@ -1,6 +1,6 @@
 # Analytics Engine Capability Spec
 
-- Status: Approved specification — implementation not yet authorized
+- Status: Approved specification — implementation authorized 2026-08-20
 - Capability: Analytics engine
 - Depends on: Approved Data Foundation specification
 - Last updated: 2026-08-20

docs/API-SPEC.md

@@ -1,6 +1,6 @@
 # Merchant Analytics API Capability Spec
 
-- Status: Approved specification — implementation not yet authorized
+- Status: Approved specification — implementation authorized 2026-08-20
 - Capability: Merchant API
 - Depends on: Approved Identity, Data Foundation, and Analytics Engine specifications
 - Interface source of truth: `docs/openapi.yaml`

docs/DATA-FOUNDATION-SPEC.md

@@ -1,7 +1,7 @@
 # Data Foundation Capability Spec
 
 - Status: Approved specification
-- Implementation authorization: Not granted
+- Implementation authorization: Granted by user on 2026-08-20
 - Capability: Data foundation
 - Last updated: 2026-08-20
 

docs/IDENTITY-SPEC.md

@@ -1,7 +1,7 @@
 # Identity and Access Capability Spec
 
 - Status: Approved specification
-- Implementation authorization: Not granted
+- Implementation authorization: Granted by user on 2026-08-20
 - Capability: Identity and access
 - Depends on: Approved Data Foundation specification
 - Last updated: 2026-08-20

docs/IMPORT-VALIDATION-RECOVERY-SPEC.md

@@ -1,9 +1,9 @@
 # Import Validation, Rejection, and Recovery Specification
 
-- Status: Approved specification — implementation not yet authorized
+- Status: Approved specification — implementation authorized 2026-08-20
 - Capability: Data foundation bootstrap integrity
 - Depends on: Approved physical schema and one-time Docker import workflow
-- Implementation authorization: Not granted
+- Implementation authorization: Granted by user on 2026-08-20
 - Last updated: 2026-08-20
 
 ## Objective

docs/IMPORT-WORKFLOW-SPEC.md

@@ -1,9 +1,9 @@
 # One-Time CSV-to-PostgreSQL Import Workflow Specification
 
-- Status: Approved specification — implementation not yet authorized
+- Status: Approved specification — implementation authorized 2026-08-20
 - Capability: Data foundation bootstrap
 - Depends on: Approved PostgreSQL physical schema
-- Implementation authorization: Not granted
+- Implementation authorization: Granted by user on 2026-08-20
 - Last updated: 2026-08-20
 
 ## Objective

docs/METRIC-CATALOGUE.md

@@ -1,6 +1,6 @@
 # Analytics Metric Catalogue
 
-- Status: Approved specification — implementation not yet authorized
+- Status: Approved specification — implementation authorized 2026-08-20
 - Version: 0.4.0
 - Last updated: 2026-08-20
 

docs/PHYSICAL-SCHEMA-PROPOSAL.md

@@ -1,8 +1,8 @@
 # PostgreSQL Physical Schema Specification
 
-- Status: Approved specification — implementation not yet authorized
+- Status: Approved specification — implementation authorized 2026-08-20
 - Scope: Data foundation, demo identity persistence, and immutable dataset cache identity
-- Implementation authorization: Not granted
+- Implementation authorization: Granted by user on 2026-08-20
 - Last updated: 2026-08-20
 - Visual companion: [`PHYSICAL-SCHEMA-ERD.html`](./PHYSICAL-SCHEMA-ERD.html)
 

tasks/plan.md

@@ -1,6 +1,6 @@
 # Implementation Plan: ZarinPal Merchant Analytics Backend
 
-- Status: Expanded implementation plan ready for stakeholder review — implementation not authorized
+- Status: Approved — Phase 4 implementation authorized 2026-08-20
 - Capabilities: Data foundation, demo identity, analytics engine, and Merchant API
 - Approved contracts: physical schema, import workflow/validation, Identity, Analytics, metric catalogue `0.4.0`, API, and OpenAPI `1.0.0`
 - Task list: `tasks/todo.md`
@@ -14,8 +14,8 @@ Build the complete Go capability-oriented modular monolith needed by the dashboa
 
 - The approved Identity, Data Foundation, physical schema, importer, Analytics Engine, API, ADR, metric, and data-guide decisions remain authoritative.
 - Architecture and dependency injection are already approved: capability-oriented modular monolith with manual constructor wiring in thin `cmd/` composition roots.
-- This plan does not authorize `go.mod`, packages, generated files, dependencies, migrations, containers, or executable code.
-- Implementation starts only after the plan and task list are approved and the user separately authorizes implementation.
+- The user approved this plan and task list and authorized implementation on 2026-08-20.
+- Implementation proceeds through `tasks/todo.md` in dependency order, starting with Task F1.
 - The API work depends on implementation-ready provider interfaces from Identity and Analytics. Internal provider signatures may be refined without changing the approved HTTP contract.
 - Any OpenAPI generator, validator, router, rate-limiter, or CSV dependency must be version-pinned, checked against official documentation, security-reviewed, and approved before addition.
 
@@ -202,7 +202,7 @@ Approved OpenAPI --> HTTP boundary --> auth/period/run/SSE/detail/CSV
 ## Implementation gates, not product questions
 
 - Select and approve exact pinned OpenAPI generation/validation tooling before adding dependencies.
-- Confirm repository-wide build/test/lint command wrappers when the separately authorized Go scaffold is created.
+- Confirm repository-wide build/test/lint command wrappers when the authorized Go scaffold is created.
 - Confirm the hosting mechanism that makes `https://zarinpal.amiirkhl.ir/docs/errors/{error-slug}` dereferenceable; the URI namespace and content responsibility are already approved.
 
 ## Product questions

tasks/todo.md

@@ -1,6 +1,6 @@
 # ZarinPal Merchant Analytics Backend Task List
 
-- Status: Expanded task breakdown ready for stakeholder review — implementation not authorized
+- Status: Approved — Phase 4 implementation authorized 2026-08-20
 - Plan: `tasks/plan.md`
 - Contract: `docs/API-SPEC.md` and `docs/openapi.yaml` version `1.0.0`