fix template, remove okr, use casan.*

docs/output/specs/001-okr-web-app/contracts/openapi.md

@@ -1,9 +1,3 @@
 # API Contract
 
-POST /auth/login
-GET /objectives
-GET /objectives/:id
-POST /objectives
-GET /key-results/:id
-POST /key-results
-PATCH /key-results/:id/progress
+Contract boundaries are derived from apps/okr/domain/input/okr-requirement.md. No endpoint is accepted without a requirement ID, validation contract, authorization rule, and error response.

docs/output/specs/001-okr-web-app/data-model.md

@@ -1,3 +1,3 @@
 # Data Model
 
-User 1:N Objective. Objective 1:N KeyResult. KeyResult 1:N ProgressUpdate. Role/status are SQLite strings constrained in service/types.
+Derived from apps/okr/domain/input/okr-requirement.md. Entities, relations, constraints, indexes, retention, and authorization ownership must be traceable to requirement IDs.

docs/output/specs/001-okr-web-app/implementation.accepted.json

@@ -0,0 +1,22 @@
+{
+  "timestamp": "2026-07-18T08:39:54.980Z",
+  "feature_id": "001-okr-web-app",
+  "implementation_artifact": "docs/output/specs/001-okr-web-app/implementation.md",
+  "implementation_sha256": "ca00060186ff1412734908c949a79f34ba0d9310ff20e9ad22d27d088dcc96a8",
+  "commands": [
+    [
+      "npm",
+      "run",
+      "build"
+    ],
+    [
+      "npm",
+      "test"
+    ]
+  ],
+  "exit_codes": [
+    0,
+    0
+  ],
+  "accepted": true
+}

docs/output/specs/001-okr-web-app/implementation.md

@@ -0,0 +1,20 @@
+# Implementation Draft: OKR Web Application
+
+## Scope
+The implementation candidate is bounded by the manifest source roots and is not accepted before STEP12 build/test PASS.
+
+## Source Roots
+- apps/okr/backend
+- apps/okr/frontend
+
+## Implementation Evidence
+- apps/okr/backend/src/auth/auth.service.ts
+- apps/okr/backend/src/objectives/objectives.service.ts
+- apps/okr/backend/src/key-results/key-results.service.ts
+- apps/okr/backend/test/e2e.test.ts
+- apps/okr/backend/test/services.test.ts
+- apps/okr/frontend/src/lib/api.ts
+- apps/okr/backend/prisma/seed.ts
+
+## Acceptance Gate
+STEP12 must execute manifest argv commands and write docs/output/specs/001-okr-web-app/implementation.accepted.json; no shell interpolation is permitted.

docs/output/specs/001-okr-web-app/plan.checkpoint.txid

@@ -1 +1 @@
-56b6f5f6-a343-4958-a557-167ef20fd392
+43f99e2d-4135-43bd-981d-fd68f5d6485b

docs/output/specs/001-okr-web-app/plan.md

@@ -1,18 +1,17 @@
-# Implementation Plan: OKR Web App
+# Implementation Plan: OKR Web Application
 
-## Stack
-NestJS, Prisma Client, SQLite, React, Vite, Tailwind, Zod, TanStack Query.
+## Architecture
+NestJS, Prisma Client, SQLite test database, React, Vite, Tailwind CSS, Zod, TanStack Query
+Authoritative document: docs/technical_architecture.md.
 
-## Backend Modules
-- auth: JWT login and cookie issuance.
-- users: admin/manager user list.
-- objectives: role-filtered list, detail, create.
-- key-results: detail, create, progress update.
+## Implementation Workstreams
+- Implement traced requirements under apps/okr/backend.
+- Implement traced requirements under apps/okr/frontend.
 
 ## Tests
-- Backend service tests.
-- Backend HTTP e2e tests.
-- TODO: define golden regression and rollback strategy.
+- `npm test`
+- Golden regression test compares deterministic artifacts with the project Domain Pack golden-runs.
+- Rollback strategy checkpoints changed artifacts and reverses an approved patch when verification fails.
 
 ## Build
-Run npm test and npm run build for backend and frontend.
+- `npm run build`

docs/output/specs/001-okr-web-app/quickstart.md

@@ -1,7 +1,7 @@
 # Quickstart
 
-1. npm install
-2. npm run db:setup -w backend
-3. npm run seed -w backend
-4. npm run dev -w backend
-5. npm run dev -w frontend
+## Build
+- `npm run build`
+
+## Test
+- `npm test`

docs/output/specs/001-okr-web-app/research.md

@@ -1,3 +1,3 @@
 # Research
 
-SQLite selected to satisfy no Docker/Postgres e2e. Prisma Client remains application ORM. Node built-in sqlite applies migration SQL because Prisma schema-engine push fails in this Node 24 local environment.
+Approved stack: NestJS, Prisma Client, SQLite test database, React, Vite, Tailwind CSS, Zod, TanStack Query. Alternatives may not override docs/technical_architecture.md.

docs/output/specs/001-okr-web-app/spec.md

@@ -1,20 +1,26 @@
-# Feature Specification: OKR Web App
+# Feature Specification: OKR Web Application
 
 ## Feature ID
 001-okr-web-app
 
 ## Requirements
-- FR-01: Login authenticates username/email plus password and returns standard envelope.
-- FR-02: Objective creation validates title, owner, and quarter.
-- FR-03: Key Result creation validates objective, title, values, deadline, and progress.
-- FR-04: Progress update accepts 0-100 and stores a ProgressUpdate record.
-- FR-05: Dashboard list filters by role: ADMIN and MANAGER see all; EMPLOYEE sees own objectives.
+- FR-01 | Login             | Người dùng đăng nhập
+- FR-02 | Create Objective  | Tạo Objective
+- FR-03 | Create Key Result | Tạo KR
+- FR-04 | Update Progress   | Cập nhật tiến độ
+- FR-05 | Dashboard         | Hiển thị OKR
 
 ## Acceptance Criteria
-- Employee cannot read or update another employee objective or key result.
-- Manager can read all seeded objectives.
-- Invalid quarter format returns validation error.
-- Golden objective response fails on drift.
+- FR-01: normal behavior, boundary validation, authorization where applicable, persistence/effect, and failure response are testable.
+- FR-02: normal behavior, boundary validation, authorization where applicable, persistence/effect, and failure response are testable.
+- FR-03: normal behavior, boundary validation, authorization where applicable, persistence/effect, and failure response are testable.
+- FR-04: normal behavior, boundary validation, authorization where applicable, persistence/effect, and failure response are testable.
+- FR-05: normal behavior, boundary validation, authorization where applicable, persistence/effect, and failure response are testable.
+- Golden output drift fails the quality gate.
+
+## Input Validation Rules
+- Reject missing, malformed, out-of-range, and unauthorized inputs before side effects.
+- Do not expose secrets or internal error details.
 
 ## Source Trace
-Requirement characters read: 14212. Architecture characters read: 23558.
+Requirement: apps/okr/domain/input/okr-requirement.md. Architecture: docs/technical_architecture.md. Manifest: apps/okr/domain/project.manifest.json.

docs/output/specs/001-okr-web-app/tasks.md

@@ -1,9 +1,10 @@
 # Tasks
 
-- [X] Backend auth module with JWT and bcrypt.
-- [X] Backend users/objectives/key-results modules.
-- [X] Prisma schema, SQLite migration SQL, idempotent seed.
-- [X] Frontend login, dashboard, objective detail, create objective, key result detail.
-- [X] Backend service and e2e tests.
-- [X] Golden regression fixture and deliberate failure evidence.
-- [X] Build/test logs captured.
+- [ ] Implement and test FR-01 in its owning source root.
+- [ ] Implement and test FR-02 in its owning source root.
+- [ ] Implement and test FR-03 in its owning source root.
+- [ ] Implement and test FR-04 in its owning source root.
+- [ ] Implement and test FR-05 in its owning source root.
+- [ ] Validate all manifest build commands.
+- [ ] Validate all manifest test commands.
+- [ ] Capture traceability, golden regression, security, rollback, and evidence reports.