docs(sdd): authorize frontend implementation

AGENTS.md

@@ -2,7 +2,7 @@
 
 ## Phase gate
 
-This repository is in specification mode. Do not scaffold SvelteKit, install packages, or implement UI until the dashboard capability spec is explicitly approved.
+This repository is authorized for SDD Phase 4 implementation as of 2026-08-20. Follow `tasks/todo.md` in dependency order and keep the approved dashboard, UX, design, API, and deployment contracts authoritative. New capabilities or contract changes still require specification and approval before implementation.
 
 For frontend work, invoke and follow `sveltekit-svelte5-tailwind-skill` before editing. Use the skill's indexed research workflow and read only the relevant sections. Use `persian-writing` for user-facing Persian copy, and apply the accessibility and interaction rules in `DESIGN.md`.
 
@@ -29,4 +29,3 @@ For frontend work, invoke and follow `sveltekit-svelte5-tailwind-skill` before e
 - Track specs, design tokens, component contracts, tests, fixtures that contain no sensitive source data, and visual-regression baselines.
 - API contracts are generated/shared through an approved machine-readable interface rather than duplicated ad hoc types.
 - Required verification after implementation includes formatting, lint, `svelte-check`, unit/component tests, Playwright critical flows, production build, responsive/RTL checks, accessibility checks, and reduced-motion checks.
-

DESIGN.md

@@ -1,6 +1,6 @@
 # Design System — ZarinPal Merchant Analytics
 
-- Status: Approved baseline — implementation not yet authorized
+- Status: Approved baseline — implementation authorized 2026-08-20
 - Version: 0.3.3
 - Last updated: 2026-08-20
 - Direction: Persian-first RTL

README.md

@@ -2,11 +2,11 @@
 
 Persian RTL merchant analytics panel built with SvelteKit 2, Svelte 5, strict TypeScript, and Tailwind CSS v4.
 
-Current state: design/specification only. No frontend scaffold or runtime code has been approved yet.
+Current state: design, specifications, implementation plan, and task list are approved. Phase 4 frontend implementation is authorized.
 
 - [`DESIGN.md`](DESIGN.md): visual language, interaction rules, responsive behavior, and current design-system state.
 - [`docs/DASHBOARD-SPEC.md`](docs/DASHBOARD-SPEC.md): approved product requirements and acceptance criteria for implementation planning.
 - [`docs/DASHBOARD-UX-SPEC.md`](docs/DASHBOARD-UX-SPEC.md): detailed screen map, RTL layouts, async states, data presentation, accessibility, and authorized export workflows.
 - [`tasks/plan.md`](tasks/plan.md): approved SDD Phase 2 dependency order, risk spikes, vertical slices, and approval gates.
-- [`tasks/todo.md`](tasks/todo.md): approved SDD Phase 3 task list; implementation remains explicitly paused and unauthorized.
+- [`tasks/todo.md`](tasks/todo.md): approved SDD Phase 3 task list and dependency order for authorized Phase 4 implementation.
 - [`AGENTS.md`](AGENTS.md): durable rules for future coding agents and contributors.

docs/DASHBOARD-SPEC.md

@@ -1,6 +1,6 @@
 # Merchant Dashboard Capability Spec
 
-- Status: Approved product specification — implementation planning authorized; implementation not yet authorized
+- Status: Approved product specification — implementation authorized 2026-08-20
 - Capability: Merchant dashboard
 - Last updated: 2026-08-20
 

docs/DASHBOARD-UX-SPEC.md

@@ -1,6 +1,6 @@
 # Dashboard UX Specification
 
-- Status: Approved UX specification — implementation planning authorized; implementation is not yet authorized
+- Status: Approved UX specification — implementation authorized 2026-08-20
 - Product: ZarinPal Merchant Analytics hackathon dashboard
 - Audience: non-technical Persian-speaking merchants, hackathon judges, finance/legal handoff recipients
 - Direction: Persian-first RTL
@@ -8,7 +8,7 @@
 
 ## 1. Purpose and authority
 
-This document defines the visible structure, interaction behavior, content rules, responsive layouts, accessibility requirements, and asynchronous states of the merchant analytics dashboard. It is an implementation-neutral UX contract. It does not authorize Svelte components, API clients, backend changes, export endpoints, or deployment work.
+This document defines the visible structure, interaction behavior, content rules, responsive layouts, accessibility requirements, and asynchronous states of the merchant analytics dashboard. It is the implementation-neutral UX contract for the authorized frontend task list; backend, API, and deployment ownership boundaries remain unchanged.
 
 The following sources are authoritative, in precedence order:
 
@@ -769,7 +769,7 @@ Persian digits are applied to rendered variable values. Technical identifiers in
 - Screen readers receive page structure, exact KPI meaning, chart alternatives, restrained async status, and associated errors.
 - 360/768/1024/1440 px layouts and 320 CSS px reflow preserve core tasks; reduced-motion mode removes nonessential movement.
 
-## 20. Implementation handoff checklist (after approval only)
+## 20. Implementation handoff checklist
 
 - Generate transport types only from approved backend `docs/openapi.yaml` version `1.0.0` and fail checks on drift.
 - Resolve static adapter/Nginx fallback behavior.
@@ -778,7 +778,7 @@ Persian digits are applied to rendered variable values. Technical identifiers in
 - Build contract fixtures containing no sensitive source data, payer tokens, credentials, or peer rows.
 - Verify formatting, lint, strict typing, `svelte-check`, unit/component tests, Playwright critical flows, production build, responsive RTL, both themes, accessibility, and reduced motion.
 
-No implementation work begins until the dashboard capability and this UX specification are explicitly approved.
+The dashboard capability, this UX specification, plan, and task list were approved for implementation on 2026-08-20.
 
 ## 21. Resolved implementation handoff
 

tasks/plan.md

@@ -1,9 +1,9 @@
 # Phase 2 Implementation Plan — Merchant Analytics Dashboard
 
-- Status: Approved
-- SDD phase: 2 — Plan approved; Phase 3 task list approved
+- Status: Approved — Phase 4 implementation authorized 2026-08-20
+- SDD phase: 4 — Plan and task list approved; implementation authorized
 - Capability: Merchant dashboard
-- Implementation authorization: Not granted
+- Implementation authorization: Granted by user on 2026-08-20
 - Approved task list: `tasks/todo.md`
 - Last updated: 2026-08-20
 
@@ -11,7 +11,7 @@
 
 Build the approved Persian RTL merchant analytics dashboard as a statically built SvelteKit application behind Nginx. The browser authenticates with the backend-owned server session, consumes the same-origin merchant API, renders the four analytics sections independently through snapshot/SSE delivery, provides safe merchant-owned detail views and CSV export, and meets the approved responsive, theme, privacy, and WCAG 2.2 AA contracts.
 
-This plan does not authorize scaffolding, dependency installation, Svelte components, API code, or deployment changes. After approval, SDD Phase 3 converts each work package into small tasks with explicit acceptance criteria, verification, dependencies, and no more than approximately five files per task.
+Implementation is authorized through the approved Phase 3 task list. Each work package remains constrained by its acceptance criteria, verification, dependencies, and approximately five-file limit.
 
 ## 2. Approved inputs
 
@@ -23,9 +23,9 @@ This plan does not authorize scaffolding, dependency installation, Svelte compon
 | Backend `IDENTITY-SPEC.md` | Approved | Session, login, logout, CSRF, throttle, and tenant boundary |
 | Backend `ANALYTICS-SPEC.md` | Approved | Metric lifecycle, partial delivery, retries, thresholds, and privacy |
 | Backend `METRIC-CATALOGUE.md` `0.4.0` | Approved definitions | Metric semantics and formatting evidence |
-| Backend `API-SPEC.md` | Draft | Proposed REST/SSE/CSV behavior; cannot yet authorize implementation |
-| Backend `docs/openapi.yaml` `0.1.0-draft` | Draft | Proposed generated types and operation contracts |
-| Nginx/static routing contract | Unresolved | Required before production/static-host verification |
+| Backend `API-SPEC.md` | Approved | REST/SSE/CSV behavior and provider boundary |
+| Backend `docs/openapi.yaml` `1.0.0` | Approved | Generated types and operation contracts |
+| Nginx/static routing contract | Approved | Production/static-host verification contract |
 
 ## 3. Planning assumptions
 
@@ -50,9 +50,9 @@ Implementation cannot start until all items in Gate A are approved. Foundation w
 - [x] CSV limits/encoding, audit retention, terminal-reference presentation, and the production Problem Details URI namespace are approved.
 - [x] UX export states are reconciled with synchronous CSV delivery and error handling.
 - [x] Nginx serves history fallback only for frontend routes; `/api/v1` and reserved operational paths never fall through to `index.html`.
-- [ ] Obtain a separate explicit instruction to begin implementation.
-- [ ] Confirm `merchant.displayName` from `AuthSession` is the shell/export display authority.
-- [ ] Confirm whether visible chart-data tables are sufficient or chart-data downloads are also required.
+- [x] Separate explicit instruction to begin implementation received on 2026-08-20.
+- [x] `merchant.displayName` from `AuthSession` is the shell/export display authority.
+- [x] Visible semantic chart-data tables are sufficient; chart-data download is not a separate MVP export.
 
 ### Gate B — scaffold verification
 
@@ -436,14 +436,14 @@ No Phase 3 task may say merely “build the dashboard” or combine a foundation
 
 Approved on 2026-08-20:
 
-1. Build order and the hard rule that implementation cannot consume `openapi.yaml` while it remains `0.1.0-draft`.
-2. Synchronous CSV defaults: 100,000 rows, 50 MiB, 60 seconds, 3 requests/10 minutes with burst 1, UTF-8 BOM, and ASCII `snake_case` headers.
-3. Thirty-day analytics/export audit retention for the hackathon.
+1. Build order and the hard rule that implementation consumes only the approved backend `openapi.yaml` version `1.0.0` from a recorded immutable source revision.
+2. Synchronous CSV defaults: 100,000 rows, 50 MiB, 60 seconds, 3 requests/10 minutes with burst 1, UTF-8 BOM, and the approved stable Persian headers.
+3. Ninety-day analytics/export audit retention for the hackathon; minimal demo-authentication audit retention remains 30 days.
 4. Display/export of the existing approved opaque terminal reference.
 5. `merchant.displayName` as the shell and CSV-preflight merchant name.
 6. Early SSE, CSV-delivery, and chart risk spikes before committing their implementation patterns or dependencies.
 
-Still external contract inputs: the production Problem Details base URI and the exact Nginx deep-link/static fallback plus `/api/v1` proxy behavior.
+Resolved external contracts: the production Problem Details base URI is owned by the backend contract, and the exact Nginx deep-link/static fallback plus `/api/v1` proxy behavior is owned by the deployment contract.
 
 ## 16. Official implementation references
 

tasks/todo.md

@@ -1,15 +1,15 @@
 # Phase 3 Task List — Merchant Analytics Dashboard
 
-- Status: Approved task list — implementation explicitly paused
-- SDD phase: 3 — Tasks approved; Phase 4 not authorized
+- Status: Approved — Phase 4 implementation authorized 2026-08-20
+- SDD phase: 4 — Tasks approved and ready to execute
 - Source plan: [`plan.md`](plan.md)
-- Implementation authorization: Not granted
+- Implementation authorization: Granted by user on 2026-08-20
 - Approved by user: 2026-08-20
 - Last updated: 2026-08-20
 
 Tasks are ordered by dependency. Each implementation task must satisfy its acceptance criteria plus the Definition of Done in `tasks/plan.md`. Likely files are planning targets and may be adjusted before work begins, but a task must be split if it would exceed approximately five files or one focused session.
 
-Approval of this task list closes the SDD Phase 3 review gate only. It does not authorize starting any task, scaffolding the application, installing dependencies, editing application code, or otherwise entering Phase 4. Implementation begins only after a separate explicit user instruction.
+The user approved this task list and explicitly authorized Phase 4 implementation on 2026-08-20. Execute tasks in dependency order and stop at their named review checkpoints.
 
 Commands named below are established by Task 4. Before then, verification uses the scaffold's generated commands and read-only contract checks.
 
@@ -21,7 +21,7 @@ Commands named below are established by Task 4. Before then, verification uses t
 
 **Acceptance criteria:**
 - [ ] Backend `API-SPEC.md` and `openapi.yaml` identify an approved matching version.
-- [ ] Approved CSV defaults, 30-day analytics/export audit retention, opaque terminal reference, and stable Problem Details base URI are recorded by the provider.
+- [ ] Approved CSV defaults, 90-day analytics/export audit retention, 30-day demo-authentication audit retention, opaque terminal reference, and stable Problem Details base URI are recorded by the provider.
 - [ ] A checksum or immutable commit hash is recorded for frontend generation.
 
 **Verification:**