Expand claude md with TDD and other config

.claude/architecture.md

@@ -0,0 +1,25 @@
+# Architecture
+
+The system is a **modular monolith**: a single deployable unit divided into cohesive modules with explicit boundaries. Modules communicate through well-defined interfaces (ports); never by directly referencing each other's internals. A module maps to a bounded context.
+
+## Default: Clean (Onion) Architecture
+
+Apply when domain logic is non-trivial:
+
+- **Domain layer** (center): entities, value objects, aggregates, domain events, domain services. Zero dependencies on anything outside this layer.
+- **Application layer**: use cases / command & query handlers (CQRS). Orchestrates domain objects. No infrastructure dependencies — depends on domain interfaces only.
+- **Infrastructure layer**: persistence, messaging, external APIs. Implements interfaces defined inward. Never referenced by domain or application.
+- **Presentation layer**: API controllers, CLI. Thin — validates input, delegates to application layer, maps response.
+- Dependencies point **inward only**. Enforce with architecture tests (e.g., ArchUnit, NetArchTest).
+
+## Alternative: Vertical Slice Architecture
+
+Prefer vertical slices when a feature is CRUD-heavy with little shared domain logic and minimal interaction with other domain concepts. Each slice owns its request, handler, validation, and response — fully self-contained. When logic is shared across slices, extract it to the domain layer.
+
+## Domain-Driven Design
+
+- Use **ubiquitous language** everywhere: class names, methods, variables, and tests must use domain terminology, never technical jargon.
+- **Bounded contexts** align with module boundaries. Each module owns its domain model. Shared concepts are translated at the boundary via an anti-corruption layer — never leaked directly.
+- **Aggregates** protect invariants. Only the aggregate root is reachable from outside; enforce consistency within the aggregate boundary.
+- **Value objects** for concepts defined by value, not identity (e.g., `Money`, `Email`, `DateRange`). Make them immutable.
+- **Domain events** for cross-context communication. Never call another bounded context's internals directly.

.claude/commands/pr.md

@@ -0,0 +1,90 @@
+# Create PR with AI Code Review
+
+Create a pull request and post an AI code review to GitHub with line-specific comments.
+
+## Steps
+
+1. **Check for uncommitted changes**
+   - Run `git status` to check for staged/unstaged changes
+   - If there are uncommitted changes:
+     - Run `git diff` to understand what changed
+     - Ask the user if they want to commit first, suggesting a commit message based on the changes
+     - Use AskUserQuestion with options like:
+       - "Yes, commit with suggested message" (show the suggestion)
+       - "Yes, but let me provide the message"
+       - "No, I'll handle it myself"
+     - If yes, stage and commit the changes
+
+2. **Check branch state**
+   - Run `git branch --show-current` to get current branch
+   - If on master/main:
+     - Analyze the changes to suggest a branch name (e.g., `feature/add-user-auth`, `fix/login-validation`)
+     - Ask the user for the branch name using AskUserQuestion with options:
+       - The suggested branch name (recommended)
+       - "Let me type a different name"
+     - Create the branch: `git checkout -b <branch-name>`
+   - Run `git log origin/master..HEAD --oneline` to see commits for PR
+   - Push branch if not yet pushed: `git push -u origin HEAD`
+
+3. **Analyze changes**
+   - Run `git diff origin/master...HEAD` to see all changes
+   - Understand what the PR accomplishes
+
+4. **Create the PR**
+   - Use `gh pr create` with a clear title and summary
+   - Format body as:
+     ```
+     ## Summary
+     <bullet points of what changed>
+
+     ## Test plan
+     <how to verify the changes>
+     ```
+
+5. **Perform code review**
+   Review the diff for:
+   - Bugs or logic errors
+   - Security issues (injection, secrets, auth)
+   - Missing error handling
+   - Performance concerns
+   - Anti-patterns (e.g., `catch (Exception ex) { throw ex; }` instead of `throw;`)
+
+   Be pragmatic - this is a hackathon. Flag real issues, not nitpicks.
+
+6. **Post line-specific comments**
+   For each issue found, post a comment on the specific line:
+   ```bash
+   # Get PR number and commit SHA
+   PR_NUMBER=$(gh pr view --json number --jq '.number')
+   COMMIT_SHA=$(gh pr view --json headRefOid --jq '.headRefOid')
+   REPO=$(gh repo view --json nameWithOwner --jq '.nameWithOwner')
+
+   # Post comment on specific line
+   gh api repos/$REPO/pulls/$PR_NUMBER/comments \
+     --method POST \
+     --field body="Your comment here" \
+     --field commit_id="$COMMIT_SHA" \
+     --field path="path/to/file.cs" \
+     --field line=42 \
+     --field side="RIGHT"
+   ```
+
+   Common issues to flag:
+   - `throw ex;` → "Use `throw;` to preserve stack trace"
+   - `catch (Exception) { }` → "Empty catch block swallows errors"
+   - Hardcoded secrets → "Move to configuration/environment variables"
+   - Missing null checks → "Potential NullReferenceException"
+   - SQL concatenation → "Use parameterized queries to prevent SQL injection"
+
+7. **Post summary review**
+   After line comments, post overall review:
+   ```bash
+   gh pr review --comment --body "AI Review: Found N issues - see inline comments."
+   ```
+
+   Or if no issues:
+   ```bash
+   gh pr review --approve --body "AI Review: Code looks good."
+   ```
+
+8. **Return the PR URL** so the user can view it.

.claude/frontend.md

@@ -0,0 +1,47 @@
+# Frontend (React)
+
+## React Version & Patterns
+
+- Before implementing any React feature, consult **[react.dev](https://react.dev)** to verify the current recommended approach. Use `WebFetch` on react.dev when in doubt — never rely solely on training data for React APIs.
+- Use **React Server Components (RSC)** for data fetching and server-side logic by default. Mark components `"use client"` only when interactivity or browser APIs require it.
+- Use **hooks exclusively** — no class components, no legacy lifecycle methods.
+- Prefer modern built-in hooks: `use()`, `useActionState`, `useOptimistic`, `useFormStatus`. Avoid legacy workarounds they replace.
+- Never use patterns marked deprecated on react.dev. Migrate proactively on major releases.
+- Avoid `useEffect` for data fetching; use RSC or Suspense-compatible data fetching instead.
+
+## Component Design
+
+- **Composition over configuration**: small, single-purpose components composed together.
+- Keep components **pure**: no side effects during render. Side effects belong in event handlers or `useEffect` (sparingly).
+- Colocate state as close as possible to where it is used. Lift only when siblings genuinely share it.
+- The React Compiler handles most memoization — do not manually add `useMemo`/`useCallback`/`React.memo` unless profiling proves it necessary.
+
+## State Management
+
+- **Local state first** (`useState`, `useReducer`). Lift to shared context only when needed.
+- Use `useContext` for low-frequency global state (theme, current user). For high-frequency updates, use Zustand or Jotai.
+- **Server state belongs server-side**: RSC or TanStack Query — not `useState` + `useEffect`.
+- Avoid Redux unless already established in the project.
+
+## Accessibility
+
+- Use **semantic HTML** elements. Never use a `<div>` or `<span>` where a semantic element exists.
+- Every interactive element must be keyboard-navigable and have an accessible label.
+- Use ARIA attributes only when semantic HTML is insufficient.
+- Accessibility violations are bugs. Include axe-core checks in the E2E suite.
+
+## TDD for Frontend
+
+- Use **React Testing Library + Vitest** for component and hook tests.
+- Test **behaviour, not implementation**: query by role, label, or text — never by CSS class or component internals.
+- Never assert on internal state directly.
+- Mock at the **network boundary using MSW** (Mock Service Worker), not at the module level.
+- One failing test at a time — same hard rules as backend TDD apply.
+
+## E2E Testing with Playwright
+
+- E2E tests cover **complete user journeys**: happy path + critical error paths.
+- Use **Page Object Model (POM)** to encapsulate selectors and interactions.
+- Prefer semantic selectors: `getByRole` → `getByLabel` → `getByText` → `data-testid`.
+- Run Playwright tests in CI against a real running application, not mocks.
+- Include **axe-core accessibility checks** (`@axe-core/playwright`) on every critical page.

.claude/settings.json

@@ -0,0 +1,52 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(bun install)",
+      "Bash(bun run *)",
+      "Bash(bun add *)",
+      "Bash(bun remove *)",
+      "Bash(dotnet build*)",
+      "Bash(dotnet test*)",
+      "Bash(dotnet run*)",
+      "Bash(dotnet watch*)",
+      "Bash(dotnet format*)",
+      "Bash(dotnet ef migrations*)",
+      "Bash(dotnet restore*)",
+      "Bash(docker compose*)",
+      "Bash(git status*)",
+      "Bash(git diff*)",
+      "Bash(git log*)",
+      "Bash(git branch*)",
+      "Bash(git checkout*)",
+      "Bash(git switch*)",
+      "Bash(git add*)",
+      "Bash(git commit*)",
+      "Bash(git pull*)",
+      "Bash(git fetch*)",
+      "Bash(git stash*)",
+      "Bash(git merge*)",
+      "Bash(git rebase*)",
+      "Bash(npx playwright*)",
+      "Bash(npx vitest*)",
+      "Bash(ls *)",
+      "Bash(dir *)",
+      "Bash(pwd)",
+      "Bash(cat *)",
+      "Bash(head *)",
+      "Bash(tail *)"
+    ],
+    "deny": [
+      "Bash(rm -rf /)",
+      "Bash(rm -rf ~)",
+      "Bash(rm -rf .)",
+      "Bash(git push --force*)",
+      "Bash(git push -f *)",
+      "Bash(git reset --hard*)",
+      "Bash(git clean -fd*)",
+      "Bash(git checkout -- .)",
+      "Bash(git restore .)",
+      "Bash(: > *)",
+      "Bash(truncate *)"
+    ]
+  }
+}

.claude/tdd.md

@@ -0,0 +1,17 @@
+# Test-Driven Development
+
+Work **one test at a time** through the red-green-refactor cycle:
+
+1. **Red** — write one failing test for a single acceptance criterion. Run tests; confirm it fails for the right reason (not a compile error or wrong assertion).
+2. **Green** — write the minimum code to make it pass. Fake it (hardcode a return value) if that suffices; only generalize when a new test forces it. Run tests; confirm green.
+3. **Refactor** — improve structure and clarity without changing behaviour. Run tests; confirm still green.
+4. Repeat for the next requirement.
+
+## Hard Rules
+
+- Never write production code without a currently failing test that requires it.
+- Never have more than one failing test at a time.
+- Never refactor while any test is red.
+- Each test validates exactly one acceptance criterion — name it accordingly.
+
+For new features or non-trivial changes, always invoke the `tdd-guide` skill to drive the cycle. Skip only for trivial changes (typos, config, renaming).

.github/workflows/build.yml

@@ -0,0 +1,96 @@
+name: Build & Test
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  backend:
+    name: Backend Build
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: Itenium.SkillForge/backend
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Authenticate to GitHub Packages
+        run: dotnet nuget update source itenium --username laoujin --password ${{ secrets.NUGET_AUTH_TOKEN }} --store-password-in-clear-text
+
+      - name: Restore dependencies
+        run: dotnet restore
+
+      - name: Build
+        run: dotnet build --no-restore
+
+      - name: Format check
+        run: dotnet format --verify-no-changes --no-restore
+
+      - name: Test
+        run: dotnet test --no-build --verbosity normal
+
+      - name: Vulnerability scan
+        run: dotnet list package --vulnerable --include-transitive 2>&1 | tee /dev/stderr | grep -q "no vulnerable packages" || (echo "::error::Vulnerable packages found" && exit 1)
+
+  frontend:
+    name: Frontend Build
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: Itenium.SkillForge/frontend
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Authenticate to GitHub Packages (npm)
+        run: |
+          echo "@itenium-forge:registry=https://npm.pkg.github.com" >> .npmrc
+          echo "//npm.pkg.github.com/:_authToken=${{ secrets.NUGET_AUTH_TOKEN }}" >> .npmrc
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Format check
+        run: bun run format:check
+
+      - name: Lint
+        run: bun run lint
+
+      - name: Type check
+        run: bun run typecheck
+
+      - name: Unit tests
+        run: bun run test
+
+      - name: Build
+        run: bun run build
+
+      - name: Vulnerability scan
+        run: bun audit --production || true
+
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps chromium
+
+      - name: Run E2E tests
+        run: bun run test:e2e
+        env:
+          NUGET_USER: ${{ github.actor }}
+          NUGET_TOKEN: ${{ secrets.NUGET_AUTH_TOKEN }}

.gitignore

@@ -0,0 +1,4 @@
+~$Bootcamp-AI.pptx
+_bmad
+.claude/settings.local.json
+.claude/commands/bmad*