# Definition of Done

A story / PR is "done" only when every box is checked.

## Code

- [ ] Implements only what was asked. No speculative features.
- [ ] Follows `CLAUDE.md` conventions + the relevant skill/blueprint.
- [ ] No new ESLint / TypeScript / C# nullable warnings.
- [ ] No hardcoded UI strings (i18n keys in `en` + `th`).
- [ ] No hardcoded colors/spacing (design tokens only).
- [ ] No `HttpClient` in Angular components (route via `BaseApiService`).
- [ ] No DB mocks in integration tests — Testcontainers / real DB.

## Tests

- [ ] New behavior has a failing-then-passing test.
- [ ] Validator failures + authz denials covered.
- [ ] Coverage holds at or above 70% lines / 60% branches.

## Security

- [ ] Every mutating endpoint authorized.
- [ ] Inputs validated at the trust boundary (Zod / FluentValidation).
- [ ] No secrets committed; gitleaks pre-commit + CI passed.
- [ ] If sensitive: an audit event is emitted.

## Database (if touched)

- [ ] Prisma migration committed + reversible (or two-deploy path documented).
- [ ] EF Core entity + configuration updated.
- [ ] SQL Server mirror migration in `database/migrations/`.
- [ ] Indexes for the new access patterns.
- [ ] Seeds idempotent.

## API contract (if touched)

- [ ] `packages/api-contracts/` updated.
- [ ] Both consumers (Angular + Next + .NET) still typecheck.
- [ ] OpenAPI regenerated.

## UI (if touched)

- [ ] Keyboard reachable + visible focus.
- [ ] axe-core: no violations.
- [ ] Works in dark + light mode.
- [ ] Mobile (Pixel 7 / responsive) layout sane.

## Observability

- [ ] Logs use the project logger (Serilog / pino); no `console.log` in prod paths.
- [ ] Correlation-id flows.
- [ ] Sensitive data (Confidential/Restricted) is never logged.
- [ ] Audit event on every mutation.

## Documentation

- [ ] README updated for new folders.
- [ ] `docs/onboarding/` updated if Day-1 flow changed.
- [ ] ADR written for any load-bearing decision.

## Process

- [ ] Commit messages are Conventional Commits.
- [ ] PR description includes a test plan.
- [ ] Linked to the ticket / ADR.
- [ ] Reviewer + (if UI) `accessibility-agent` + (if mutation) `security-agent` had a look.
