[jacksonsr451]

Summary

Closes #30

Implements priority management, Service Level Agreements (SLA), WorkItem dependencies, and notifications in the EventFlow Work Management bounded context.

The implementation extends the existing Consultation → Triage → Proposal → Approval → WorkItem → BoardCard workflow while preserving authorization, tenant isolation, idempotency, auditability, and established domain invariants.

A subsequent hardening pass addresses notification concurrency, sensitive-content redaction, SLA business-calendar calculations, dependency graph concurrency, and authorization coverage.

Changes

1. Priority Management

Introduces impact- and urgency-based priority management integrated with the existing Work Management domain.

Key capabilities:

• Priority evaluation based on business impact and urgency.
• Separation between business priority and technical bug severity.
• Authorized priority updates and overrides.
• Priority consistency across the existing workflow.
• Auditability of priority changes.
• Domain validation and explicit API contracts.

The implementation preserves the existing Priority contract rather than introducing an incompatible parallel priority model.

2. SLA Management

Introduces configurable SLA policies and lifecycle management.

Capabilities include:

• SLA policy configuration.
• SLA policy versioning.
• Policy activation.
• SLA tracking for WorkItems.
• Deadline calculation.
• Business-calendar-aware time calculations.
• Timezone handling.
• Calendar exclusions.
• SLA pause adjustments.
• SLA warning and fulfillment notifications.
• SLA-related authorization and tenant isolation.

Business-Calendar Hardening

SLA warning calculations now use elapsed business minutes instead of a wall-clock fraction of the adjusted deadline window.

This improves consistency when calculating warnings across:

• Non-working hours.
• Weekends.
• Calendar exclusions.
• Timezone boundaries.
• Paused SLA periods.

The implementation also emits the documented sla.fulfilled notification when an SLA completes without a breach.

3. WorkItem Dependencies

Introduces dependency management integrated with the existing WorkItem and board workflow.

Capabilities include:

• Dependency creation and removal.
• Direct and transitive cycle prevention.
• Workspace-scoped dependency validation.
• Authorization enforcement.
• Dependency-aware workflow behavior.
• Concurrency protection.
• Auditability.

Concurrency Hardening

Added PostgreSQL integration coverage for concurrent dependency operations.

Direct and transitive concurrency scenarios were verified against the existing Workspace advisory-locking strategy.

Dependency operations preserve the established approval and WorkItem creation invariants.

4. Notifications

Introduces Work Management notifications for relevant domain events.

Capabilities include:

• Notification persistence.
• Notification retrieval and state management.
• Notification preferences.
• SLA-related notifications.
• Dependency-related notifications.
• Priority-related notifications.
• Notification deduplication.
• Workspace isolation.
• Recipient authorization.

Notification Reliability

The hardening pass addresses concurrent duplicate notification emission and strengthens database-backed deduplication behavior.

Sequential retry safety remains supported.

Sensitive-Content Protection

Notification content for security-category WorkItems is redacted to reduce the risk of exposing sensitive information through notification payloads.

Existing broader WorkItem read-authorization policies remain outside this PR's scope.

5. API and Contract Updates

Updated the Work Management OpenAPI and JSON Schema contracts.

The changes cover:

• SLA policies and policy versions.
• SLA activation.
• WorkItem priority management.
• WorkItem dependencies.
• Notification resources.
• Notification preferences.
• Request and response validation.
• Authorization requirements.
• Error responses.
• Idempotency declarations.

Added contract examples:

• create-sla-policy.request.json
• dependencies.response.json
• notifications.page.json
• override-priority.request.json
• work-item-sla.response.json

Contract Consistency Fixes

Removed Idempotency-Key declarations from notification mark-read and identical notification-preference writes where the implemented operations rely on natural idempotency rather than explicit key-based replay.

Updated the corresponding contract and security tests.

6. Browser Client Compatibility

Updated API behavior to support browser-based clients.

Changes include:

• Allowing PUT requests through CORS for notification preferences.
• Exposing ETag headers.
• Exposing Location headers.

These changes support integration with the Web client while preserving compatibility with VS Code and Desktop clients.

7. Authorization and Tenant Isolation

The implementation extends existing Work Management authorization policies.

Security validation covers:

• SLA policy creation permissions.
• SLA policy version management.
• SLA activation permissions.
• Cross-Workspace isolation.
• Project visibility.
• Viewer read permissions.
• Notification privacy.
• Security-category notification redaction.

Workspace and Project boundaries remain authoritative.

8. Documentation

Updated the relevant documentation covering:

• Work Management API.
• Workflow behavior.
• Persistence architecture.
• SLA lifecycle.
• Business-calendar semantics.
• Dependency handling.
• Notification behavior.
• Authorization.
• Architectural decisions.

Updated ADR-008 to reflect the persistence changes.

Testing

All reported local validation checks passed.

Main Test Suites

Suite	Passed	Failed	Skipped
Work Management	214	0	1
Root contracts/security	114	0	0
Total	328	0	1

Additional Targeted Validation

Suite	Passed
Targeted contract/security	55
Integration concurrency/security/RBAC/idempotency	10
Priority/SLA unit tests	11

Targeted test runs are reported separately and are not added to the main suite total.

Quality Gates

• Work Management test suite passed.
• Root contract/security suite passed.
• Targeted security and contract tests passed.
• PostgreSQL concurrency tests passed.
• SLA RBAC tests passed.
• Priority/SLA unit tests passed.
• OpenAPI validation passed.
• Contract validation passed.
• Pre-commit hooks passed.
• git diff --check passed.
• Remote CI pending.
• Pull Request review pending.

The Work Management suite reported one existing skipped test and one Starlette/httpx deprecation warning.

No test failures were reported.

Acceptance Criteria

• Priority management integrated with Work Management.
• Business priority and bug severity treated independently.
• Authorized priority operations.
• SLA policies and lifecycle implemented.
• SLA business-calendar calculations.
• SLA warning and fulfillment notifications.
• WorkItem dependencies implemented.
• Dependency cycle prevention.
• Concurrent dependency operations tested.
• Notifications and preferences implemented.
• Notification deduplication hardened.
• Security-category notification redaction.
• SLA RBAC tested.
• Cross-Workspace isolation tested.
• Project visibility tested.
• API contracts updated.
• Contract examples added.
• Architecture documentation updated.
• Regression tests passed.
• Pre-commit checks passed.
• Remote CI verification.
• Code review and approval.

Known Limitations

Email Delivery

Email delivery is not available in this implementation.

Notification functionality must not be interpreted as proof of external email delivery.

Concurrent Preference Updates

Concurrent identical notification-preference PUT operations are not explicitly serialized.

Sequential idempotency is covered.

Security WorkItem Read Authorization

Security-category notification content is redacted.

Broader read-access rules for security-category WorkItems remain part of the pre-existing authorization scope.

Existing Deprecation Warning

The Work Management test suite reports an existing Starlette/httpx TestClient deprecation warning.

This warning is unrelated to Issue #30.

Review Focus

Please review:

1. Priority evaluation and override authorization.
2. SLA policy lifecycle and versioning.
3. Business-calendar deadline and warning calculations.
4. SLA pause and fulfillment semantics.
5. Dependency graph integrity.
6. Concurrent dependency cycle prevention.
7. Notification deduplication under concurrency.
8. Notification recipient isolation.
9. Security-category notification redaction.
10. API idempotency contract consistency.
11. Workspace and Project RBAC.
12. Backward compatibility with existing Work Management workflows.

Git Information

Branch: feat/30-priority-sla-dependencies-notifications

Commits:

781610e — feat(work-management): implement priority SLA dependencies and notifications (#30)

2a93266 — fix(work-management): harden SLA dependencies and notification reliability (#30)

Latest commit:

2a932669f16fafecbe96694bcbf4239099f7f87a

Working tree: Clean.

Local validation: 328 passed, 0 failed, 1 skipped.

Final Status

READY FOR PR

Issue #30 has been implemented, hardened, and verified locally.

The implementation provides priority management, SLA tracking, WorkItem dependency controls, and durable notification capabilities while preserving the existing EventFlow Work Management architecture.

Remote CI validation and code review remain pending.