docs: ratify project constitution v1.0.0 and propagate to speckit templates

Adds the .specify/ speckit directory with:
- constitution.md v1.0.0: five principles (Framework Independence,
  Component Lifecycle Discipline, Test-First, YAGNI, Security by Default)
  plus Development Standards, Adapter Contract, and Governance sections
- plan-template.md: Constitution Check stub replaced with an 11-row
  gate table covering all five principles
- tasks-template.md: "Tests OPTIONAL" language updated to reflect the
  mandatory test-first requirement from Principle III
- All supporting speckit templates and PowerShell setup scripts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: fsecada01

.specify/memory/constitution.md

@@ -0,0 +1,180 @@
+<!--
+SYNC IMPACT REPORT
+==================
+Version change: n/a → 1.0.0 (initial ratification — first fill of template)
+
+Modified principles: n/a (all new)
+
+Added sections:
+  - I. Framework Independence
+  - II. Component Lifecycle Discipline
+  - III. Test-First Development
+  - IV. Minimal Footprint / YAGNI
+  - V. Security by Default
+  - Development Standards
+  - Adapter Contract
+  - Governance
+
+Removed sections: n/a
+
+Template propagation:
+  ✅ .specify/templates/tasks-template.md — updated "Tests are OPTIONAL" note
+     to reflect Principle III (test-first is mandatory; waiver requires explicit
+     documented rationale in the feature spec)
+  ✅ .specify/templates/plan-template.md — Constitution Check stub updated to
+     enumerate the five principle gates explicitly
+  ✅ .specify/templates/spec-template.md — no structural changes required;
+     existing mandatory sections already align with constitution requirements
+
+Follow-up TODOs:
+  - TODO(RATIFICATION_DATE): Using 2026-02-22 (first session this constitution
+    was authored). Confirm this is acceptable or update to formal project date.
+-->
+
+# Component Framework Constitution
+
+## Core Principles
+
+### I. Framework Independence
+
+The `component_framework/core/` package MUST NOT import from any web framework
+(`fastapi`, `django`, `flask`, `litestar`, `jinjax`, `uvicorn`, or any adapter
+module). All framework-specific code belongs exclusively in `adapters/`.
+
+Every web framework adapter MUST be declared as an optional extras group in
+`pyproject.toml`. The only mandatory runtime dependency is `pydantic`. No user
+who installs the base package should receive framework code they did not
+explicitly request.
+
+No adapter module MAY import from another adapter module.
+
+**Rationale**: A Django developer must not receive FastAPI as a transitive
+dependency, and vice versa. Strict layering keeps the core independently
+testable, auditable, and portable to frameworks not yet written.
+
+### II. Component Lifecycle Discipline
+
+All components MUST:
+- Extend the `Component` base class.
+- Be registered via `@registry.register("name")`.
+- Manage state exclusively through `self.state` (a JSON-serializable `dict`).
+- Follow the canonical lifecycle: `mount → hydrate → handle_event → render → dehydrate`.
+- Name event handlers with the `on_<event>` convention.
+
+Components MUST NOT contain domain logic. Business rules belong in models and
+service classes; components are thin orchestration shells.
+
+**Rationale**: Consistent lifecycle ordering guarantees predictable state
+transitions across frameworks and prevents subtle rendering or state-corruption
+bugs caused by out-of-order hook execution.
+
+### III. Test-First Development (NON-NEGOTIABLE)
+
+Tests MUST be written and confirmed to fail before implementation begins.
+The Red-Green-Refactor cycle is mandatory.
+
+Components MUST be testable as pure Python — no live HTTP server, no real
+renderer, no database — using mock renderers and `ComponentTestCase`.
+
+The full test suite (`just test`) MUST pass before any PR is merged. No
+exceptions without a documented, reviewed waiver in the PR description.
+
+**Rationale**: Pure-Python testability is a direct consequence of Principle I.
+Enforcing it as a hard gate ensures the lifecycle interface and adapter
+boundaries remain clean and that regressions are caught immediately.
+
+### IV. Minimal Footprint / YAGNI
+
+New features MUST follow this layering order:
+`core/` → `adapters/` → `examples/` → `docs/` → `tests/`
+
+No abstraction layer, helper utility, or shared module may be introduced
+without at least two concrete, present use-cases in the codebase. The default
+answer to "should we add this?" is **no** until a second real need appears.
+
+Complexity deviating from this principle MUST be explicitly justified in a
+"Complexity Tracking" table in the feature's `plan.md`.
+
+**Rationale**: The library is embedded in downstream stacks. Every byte of
+unnecessary complexity compounds across every project that depends on it.
+
+### V. Security by Default
+
+The following controls are NON-NEGOTIABLE:
+
+- **CSRF**: All state-mutating endpoints MUST be CSRF-protected at the adapter
+  layer. WebSocket connections require manual token validation (noted as a
+  known limitation until automated).
+- **Input validation**: ALL user input MUST pass through a Pydantic schema
+  before touching component state. Raw request data MUST NOT be placed into
+  `self.state` directly.
+- **Client state**: State received from the client MUST be treated as
+  untrusted. Re-validate on the server before acting.
+- **Permissions**: Every mutable endpoint MUST apply a permission check via
+  `permission_classes` (CBV) or an FBV decorator. Unauthenticated access MUST
+  return JSON 401/403 — never a redirect.
+- **Output escaping**: The renderer MUST escape output by default. Components
+  MUST NOT produce raw HTML strings that bypass the renderer.
+- **Rate limiting**: Production deployments SHOULD apply `RateLimitMixin` to
+  components that trigger side effects.
+
+**Rationale**: Components manage server-side state shared across requests. A
+compromised component can affect all users sharing that process, making
+defense-in-depth a hard requirement rather than a best-effort concern.
+
+## Development Standards
+
+These rules apply to all code in this repository regardless of feature or
+adapter:
+
+- **Formatter**: `ruff format` — line length 100, `quote-style = "double"`
+- **Linter**: `ruff check` — rule sets E, F, I, N, W, UP; no ignores without
+  an inline comment explaining the rationale
+- **Type checker**: `ty` — public APIs MUST carry type hints; `ty` warnings
+  are treated as errors in CI
+- **Docstrings**: REQUIRED for all public classes and public methods; OPTIONAL
+  for private helpers
+- **Pre-commit gate**: `just check` (ruff + ty) MUST pass; enforced by
+  pre-commit hooks via `prek`
+- **Commit discipline**: Each commit SHOULD represent one logical unit of work
+  and pass `just check` independently
+
+## Adapter Contract
+
+A conforming adapter MUST provide:
+
+1. A `Renderer` subclass in `adapters/<framework>.py` implementing the
+   `Renderer` interface from `core/renderer.py`
+2. An HTTP endpoint handler that dispatches events to the component registry
+3. (Optional) A WebSocket handler following the same event protocol as the
+   HTTP handler
+4. An optional extras group in `pyproject.toml`
+   (e.g., `[project.optional-dependencies] flask = [...]`)
+5. At least one working example in `examples/`
+6. pdoc-compatible docstrings on all public symbols
+
+No adapter MAY import from another adapter's module.
+
+## Governance
+
+This constitution supersedes all informal practices, README guidance, and
+prior conventions. Any amendment requires:
+
+1. A GitHub issue describing the proposed change and its rationale, opened
+   before implementation begins.
+2. A version bump following semantic versioning:
+   - **MAJOR**: Backward-incompatible governance change, principle removal, or
+     redefinition that breaks existing compliant code.
+   - **MINOR**: New principle or section added; materially expanded guidance.
+   - **PATCH**: Clarifications, wording improvements, typo fixes, or
+     non-semantic refinements.
+3. Updates to all dependent templates in `.specify/templates/` included in the
+   same PR as the constitution change.
+4. A compliance review verifying no existing test, example, or core module
+   violates the amended principles.
+
+All feature plans MUST include a Constitution Check section confirming
+compliance with Principles I–V before Phase 0 research begins, and again after
+Phase 1 design.
+
+**Version**: 1.0.0 | **Ratified**: 2026-02-22 | **Last Amended**: 2026-02-22

.specify/scripts/powershell/check-prerequisites.ps1

@@ -0,0 +1,148 @@
+#!/usr/bin/env pwsh
+
+# Consolidated prerequisite checking script (PowerShell)
+#
+# This script provides unified prerequisite checking for Spec-Driven Development workflow.
+# It replaces the functionality previously spread across multiple scripts.
+#
+# Usage: ./check-prerequisites.ps1 [OPTIONS]
+#
+# OPTIONS:
+#   -Json               Output in JSON format
+#   -RequireTasks       Require tasks.md to exist (for implementation phase)
+#   -IncludeTasks       Include tasks.md in AVAILABLE_DOCS list
+#   -PathsOnly          Only output path variables (no validation)
+#   -Help, -h           Show help message
+
+[CmdletBinding()]
+param(
+    [switch]$Json,
+    [switch]$RequireTasks,
+    [switch]$IncludeTasks,
+    [switch]$PathsOnly,
+    [switch]$Help
+)
+
+$ErrorActionPreference = 'Stop'
+
+# Show help if requested
+if ($Help) {
+    Write-Output @"
+Usage: check-prerequisites.ps1 [OPTIONS]
+
+Consolidated prerequisite checking for Spec-Driven Development workflow.
+
+OPTIONS:
+  -Json               Output in JSON format
+  -RequireTasks       Require tasks.md to exist (for implementation phase)
+  -IncludeTasks       Include tasks.md in AVAILABLE_DOCS list
+  -PathsOnly          Only output path variables (no prerequisite validation)
+  -Help, -h           Show this help message
+
+EXAMPLES:
+  # Check task prerequisites (plan.md required)
+  .\check-prerequisites.ps1 -Json
+  
+  # Check implementation prerequisites (plan.md + tasks.md required)
+  .\check-prerequisites.ps1 -Json -RequireTasks -IncludeTasks
+  
+  # Get feature paths only (no validation)
+  .\check-prerequisites.ps1 -PathsOnly
+
+"@
+    exit 0
+}
+
+# Source common functions
+. "$PSScriptRoot/common.ps1"
+
+# Get feature paths and validate branch
+$paths = Get-FeaturePathsEnv
+
+if (-not (Test-FeatureBranch -Branch $paths.CURRENT_BRANCH -HasGit:$paths.HAS_GIT)) { 
+    exit 1 
+}
+
+# If paths-only mode, output paths and exit (support combined -Json -PathsOnly)
+if ($PathsOnly) {
+    if ($Json) {
+        [PSCustomObject]@{
+            REPO_ROOT    = $paths.REPO_ROOT
+            BRANCH       = $paths.CURRENT_BRANCH
+            FEATURE_DIR  = $paths.FEATURE_DIR
+            FEATURE_SPEC = $paths.FEATURE_SPEC
+            IMPL_PLAN    = $paths.IMPL_PLAN
+            TASKS        = $paths.TASKS
+        } | ConvertTo-Json -Compress
+    } else {
+        Write-Output "REPO_ROOT: $($paths.REPO_ROOT)"
+        Write-Output "BRANCH: $($paths.CURRENT_BRANCH)"
+        Write-Output "FEATURE_DIR: $($paths.FEATURE_DIR)"
+        Write-Output "FEATURE_SPEC: $($paths.FEATURE_SPEC)"
+        Write-Output "IMPL_PLAN: $($paths.IMPL_PLAN)"
+        Write-Output "TASKS: $($paths.TASKS)"
+    }
+    exit 0
+}
+
+# Validate required directories and files
+if (-not (Test-Path $paths.FEATURE_DIR -PathType Container)) {
+    Write-Output "ERROR: Feature directory not found: $($paths.FEATURE_DIR)"
+    Write-Output "Run /speckit.specify first to create the feature structure."
+    exit 1
+}
+
+if (-not (Test-Path $paths.IMPL_PLAN -PathType Leaf)) {
+    Write-Output "ERROR: plan.md not found in $($paths.FEATURE_DIR)"
+    Write-Output "Run /speckit.plan first to create the implementation plan."
+    exit 1
+}
+
+# Check for tasks.md if required
+if ($RequireTasks -and -not (Test-Path $paths.TASKS -PathType Leaf)) {
+    Write-Output "ERROR: tasks.md not found in $($paths.FEATURE_DIR)"
+    Write-Output "Run /speckit.tasks first to create the task list."
+    exit 1
+}
+
+# Build list of available documents
+$docs = @()
+
+# Always check these optional docs
+if (Test-Path $paths.RESEARCH) { $docs += 'research.md' }
+if (Test-Path $paths.DATA_MODEL) { $docs += 'data-model.md' }
+
+# Check contracts directory (only if it exists and has files)
+if ((Test-Path $paths.CONTRACTS_DIR) -and (Get-ChildItem -Path $paths.CONTRACTS_DIR -ErrorAction SilentlyContinue | Select-Object -First 1)) { 
+    $docs += 'contracts/' 
+}
+
+if (Test-Path $paths.QUICKSTART) { $docs += 'quickstart.md' }
+
+# Include tasks.md if requested and it exists
+if ($IncludeTasks -and (Test-Path $paths.TASKS)) { 
+    $docs += 'tasks.md' 
+}
+
+# Output results
+if ($Json) {
+    # JSON output
+    [PSCustomObject]@{ 
+        FEATURE_DIR = $paths.FEATURE_DIR
+        AVAILABLE_DOCS = $docs 
+    } | ConvertTo-Json -Compress
+} else {
+    # Text output
+    Write-Output "FEATURE_DIR:$($paths.FEATURE_DIR)"
+    Write-Output "AVAILABLE_DOCS:"
+    
+    # Show status of each potential document
+    Test-FileExists -Path $paths.RESEARCH -Description 'research.md' | Out-Null
+    Test-FileExists -Path $paths.DATA_MODEL -Description 'data-model.md' | Out-Null
+    Test-DirHasFiles -Path $paths.CONTRACTS_DIR -Description 'contracts/' | Out-Null
+    Test-FileExists -Path $paths.QUICKSTART -Description 'quickstart.md' | Out-Null
+    
+    if ($IncludeTasks) {
+        Test-FileExists -Path $paths.TASKS -Description 'tasks.md' | Out-Null
+    }
+}