feat(web): add durable Tasks workspace

[seonghobae]

Advances #209 as a dependency-ordered child of #231. This slice adds the first-party /tasks workspace on top of the existing Goal → Project → Task BFF chain without moving workspace authority into the browser.

Initial RED starts at 1c4f154f432afcea4fbc12a9edaed3b2d04044dc: the reducer contract requires explicit durable Goal and Project selection, clears descendant evidence when either parent scope changes, rejects unknown parent identities, refuses submission before Project selection, rejects late cross-Project collections/creation evidence, rejects duplicate Task identities, and preserves accepted evidence across validation/offline/auth/dependency failures. adcb68b9e3c9131f3fcdf6fc154dfbde4fd83b43 is the initial causal state implementation. The first material workspace implementation is 3b22564a2bbd43da392044be748dfcb52557453f.

Fresh review of that implementation found a durable-acceptance gap: the reducer accepted a matching submit-succeeded Task even when no explicit submission was active. RED f393f1b7551fdc645594de003c5dd5497b19eadb adds the focused regression and wires it into the web test suite; the pre-fix reducer reproduces the failure. GREEN 94bacf82fe0dee1e8d3d1188148cdb87ba2ac8ce adds the minimal state.submitting acceptance guard. Exact current head 05692a786ff51796adc210c28574dc0488ddbc9a aligns the existing cross-scope test with the tightened contract. A strict TypeScript compile of the exact current reducer plus a bounded Node harness covering the original ten reducer invariants and the new unsolicited-acceptance regression is GREEN 11/11. This is bounded state-module evidence only, not repository-wide hosted evidence.

The /tasks workspace validates Goal/Project/Task BFF payloads before accepting them, fetches Tasks only after explicit Project selection, ignores late child responses using separate Goal/Project/Task generations, creates Tasks only after explicit form submit and returned UUIDv4/project-scope/title/todo/canonical-UTC evidence, and never accepts optimistic browser-generated Task identity. The UI includes loading/empty/auth/dependency/offline behavior, keyboard focus, 44px controls, a 390px responsive contract, Unicode code-point title limits, and Playwright coverage for scope ordering, stale responses, durable creation, auth failure, and mobile overflow.

This is intentionally Draft. The repository's PR workflows do not issue hosted exact-head evidence for this feature-branch base, and the current head has zero check runs, so this PR does not claim repository-wide CI/security/coverage GREEN. The Playwright spec is committed but has not been executed in this connector runtime. It must reacquire current-head hosted gates after its prerequisite stack integrates/restacks. This slice also does not claim Figma/Storybook completion, KO/EN/JA/ZH/VI/ES/DE/FR translation-ledger parity, Task completion mutation, full Goal → Project → Task → Habit → Review closure, release readiness, or #209 closure.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}