Phase 3.1 — Master Task Backlog Change Log

Audit Phase: Phase 3.1 — Human Review Preparation and Master Backlog Critique
Repository HEAD: 715873b2ecc3a72ba974bb2a2be87c5ba82bd4e7

Task Modifications Log

Old Task Specification: "storing JWT access token in localStorage / memory".
Change: Updated storage architecture recommendation to strictly warn against localStorage due to XSS vulnerabilities. Recommended storing JWT access token in-memory in Zustand state / Axios request header interceptor, with architectural guidance for HttpOnly cookies in production.
Reason: Storing JWT in localStorage allows any client-side XSS script to exfiltrate access tokens.
Evidence: src/services/authService.ts line 59, src/services/api.ts line 14.
Impact: Hardens storefront authentication state against token theft vulnerabilities.

Old Task Specification: "Validate product existence, inventory availability, and stock deduction inside Prisma transaction."
Change: Removed inventory availability and stock deduction requirements from core task scope.
Reason: Product model in backend/prisma/schema.prisma does not have a stock or inventory column. Adding inventory checking was unsupported scope creep.
Evidence: backend/prisma/schema.prisma lines 64-90 (Product model schema).
Impact: Keeps TASK-FIN-001 tightly focused on monetary Decimal precision (BE-001) and N+1 query batching (BE-002).

Old Classification: Listed as an active blocked item under MASTER-TASK-BACKLOG.md.
Change: Reclassified from active backlog blocker to FUTURE_SCOPE and removed from canonical remediation task dependencies.
Reason: No verified finding or active implementation task requires live payment gateway provider integration.
Evidence: docs/audit/20-verified-findings-index.json (0 findings related to payment gateways).
Impact: Prevents unevidenced product requirements from blocking core audit remediation.

Old Task Specification: "100% of tests pass".
Change: Replaced generic text with explicit, behavior-oriented verification assertions across Authentication, Security, Financial, Quality, and Frontend domains.
Reason: Generic acceptance criteria fail to specify actual runtime behavior to test.
Evidence: docs/audit/phase3.1-backlog-review.md Section 11.
Impact: Provides concrete, unambiguous test cases for post-remediation verification.

Old Task Specification: General secret and CSPRNG assertions.
Change: Added explicit minimum length checks (>= 32 chars) and immediate process.exit(1) startup failure requirements for TASK-SEC-001, and rate-limiting / expiration boundaries for TASK-SEC-002.
Reason: Hardening defense-in-depth security defaults.
Evidence: backend/src/auth/jwt.strategy.ts line 12, backend/src/auth/auth.service.ts line 19.
Impact: Ensures fail-closed security behavior in production environments.

Old Execution Plan: TASK-BUILD-001 placed in Wave 1 after Wave 0.
Change: Formally highlighted TASK-BUILD-001 as the immediate prerequisite for TASK-DEVOPS-001 (CI Pipeline).
Reason: CI pipeline execution (npx tsc --noEmit and npm run test) will fail until compiler diagnostic errors and spec assertions are remediated.
Evidence: backend/prisma/seed.ts, backend/src/common/metrics.controller.ts, spec files.
Impact: Establishes correct dependency order for DevOps pipeline enablement.