feat(web): add authenticated task BFF

[seonghobae]

Canonical non-force successor to #224, now stacked on #237. Historical parent #223 exact head c3937124f1f77ce94821ae9d1b5358e1f654a818 advanced to successor parent 724ef1fec75852c1afc2273c9c8f8b2ad0ae9abb by ancestry only; fresh compare reports zero changed files. This successor 2d14b19d349348bc84e12165bdfc079a6848c7cd is a two-parent descendant of predecessor #224 head e3c54b2907e5e98ba78da553162055e17472ae75 and current parent #237, preserving the predecessor tree unchanged. No predecessor check/review evidence transfers.

The bounded Task BFF continues to derive workspace authority from Identity, validate UUIDv4 Project identity before dependency access, sign the exact Planning method/path, forward no browser credential, preserve tenant-indistinguishable missing-parent semantics, and reject workspace/parent/schema/status mismatches plus duplicate or oversized collections. Original test-first lineage beginning af185e9e42c7624418a05999266f63e4ba736b16 remains in ancestry.

Keep Draft until #237 and its prerequisites integrate through normal policy, then retarget/restack non-destructively and acquire fresh exact-head repository/central CI, security, coverage and review evidence.

Refs #209, #224, #237.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}