PoC Forge UI Mockup

PoC Forge

+ New Idea
Slack-like realtime messaging SaaS with AI moderation
3f2a1b4c-8e91…
approve_waiting
CC 85 new_project · 6 docs 2m ago
View Docs Approve →
JWT auth microservice with refresh token rotation
a1b2c3d4-5e6f…
Generating task_list…
new_project just now
View Live →
E-commerce product catalog with full-text search
9c8d7e6f-1a2b…
done
CC 72 new_project · repaired ×2 1h ago
← Dashboard

Submit New Idea

Idea → Docs → Review → Approve → Claude Code (from scratch)

← Dashboard / a1b2c3d4-5e6f… / Generated Docs
Generating task_list… Approve (pending…)
Generating task_list… 67%
4 / 6 docs
Pipeline
✓ Intake → ✓ Assumption Map → ✓ Domain Model → ✓ API Contract → ~ Task / PRD / Test → Review → Approve
⚠️ Assumption Map
1,248 chars

Assumption Map

Riskiest Assumptions

  • JWT secret rotation will not invalidate active user sessions unexpectedly
  • Refresh token storage in httpOnly cookies is sufficient for OWASP compliance
  • PostgreSQL row-level security adequately scopes multi-tenant token data

Validated Assumptions

  • Node.js v20 LTS is the target runtime
  • Redis available for token revocation blacklist

Out-of-Scope

  • OAuth 2.0 / SSO integration
  • Admin user management portal
  • Multi-region failover
← Dashboard / 3f2a1b4c-8e91… / Generated Docs
Ready for review CC 85 Go to Approve →
All documents generated 100%
6 / 6 docs
Pipeline
✓ Intake → ✓ Assumption Map → ✓ Domain Model → ✓ API Contract → ✓ Task / PRD / Test → ✓ Review → Approve
Review Results
3 pass 2 warn 1 fail
⚠
Senior Software Architect
1 issue ▼
✓
Security Engineer
No issues
✗
Claude Code Readiness Expert
2 issues ▼
⚠
Senior Product Manager
1 issue ▼
✓
QA / Test Strategy Lead
No issues
✓
Regression Analyst
No issues
✅Task List
3,412 chars

Task List

T001Bootstrap project structure

Why: Establishes monorepo layout, linting, and CI pipeline before any feature work.

Acceptance criteria:

  • npm run build exits 0
  • ESLint + TypeScript pass
  • GitHub Actions workflow runs
T002Implement user registration & login

Why: Core auth foundation — all other tasks depend on session management.

Acceptance criteria:

  • POST /api/auth/register returns 201 + JWT pair
  • POST /api/auth/login returns access + refresh tokens
  • Passwords stored as bcrypt hash (cost ≥ 12)
T003JWT refresh token rotation

Why: Enables sliding sessions without re-authentication.

Acceptance criteria:

  • POST /api/auth/refresh rotates token and blacklists old one
  • Redis TTL matches token expiry
T004Token revocation & logout

Why: Security requirement — active sessions must be terminable.

  • POST /api/auth/logout invalidates refresh token in Redis
← Dashboard View All Docs →

Approve Gate

3f2a1b4c-8e91-4c2d-b7f1-9a0e5d2c3b1a

85
CC Ready Score
GREEN
Claude Code execution ready
4
review issues

Top Risky Assumptions

RISK JWT secret rotation will not invalidate active user sessions unexpectedly
RISK Refresh token storage in httpOnly cookies is sufficient for OWASP compliance
RISK PostgreSQL row-level security adequately scopes multi-tenant token data

Out-of-Scope (Do Not Implement)

  • OAuth 2.0 / SSO integration
  • Admin user management portal
  • Multi-region failover

Confirm Before Approving