feat(POS-004): completed feature

work/artifacts/POS-004/architect.md

@@ -0,0 +1,9 @@
+# POS-004 — Architect
+
+## Feature
+POS API Phase 1: config, stores, terminals, sessions routes.
+
+## Design
+Routes: GET/POST /pos/admin/stores, GET/POST /pos/admin/terminals, GET/pos/terminals/me, POST /pos/terminals/bind, GET /pos/config, GET /pos/sessions/me, POST /pos/sessions, POST /pos/sessions/:id/close.
+Auth: requireRole('admin') for admin routes; requireAnyRole(['admin','pos_manager','pos_cashier']) for terminal routes.
+Rate limits applied via existing framework.

work/artifacts/POS-004/documenter.md

@@ -0,0 +1,4 @@
+# POS-004 — Documenter evidence
+
+## Scope of documentation change
+POS-004 adds backend API routes. Swagger summaries are defined inline in each route schema. No external documentation changes needed.

work/artifacts/POS-004/implementer.md

@@ -0,0 +1,30 @@
+# POS-004 — Implementer evidence
+
+## What
+POS API Phase 1 routes registered in build-app.ts. tsc 0, tests 8/8, verify.sh verde.
+
+## Files
+- `src/modules/pos/api/pos.routes.ts` — all POS endpoints (admin stores, terminals; terminal me/config/sessions; Zod schemas)
+- `src/app/build-app.ts` — registered POS routes with pool + authenticate
+
+## Verification
+- `npm run build` → 0 TypeScript errors.
+- `npm test -- --run src/modules/pos/tests/` → 8 passed.
+- `check-module-boundaries.mjs src` → 0 NEW violations.
+- `./scripts/verify.sh` → green.
+
+## Endpoints
+| Route | Method | Auth |
+|-------|--------|------|
+| /pos/admin/stores | GET | admin |
+| /pos/admin/stores | POST | admin |
+| /pos/admin/terminals | GET | admin |
+| /pos/admin/terminals | POST | admin |
+| /pos/admin/terminals/:id | GET | admin |
+| /pos/admin/terminals/:id | DELETE | admin |
+| /pos/terminals/me | GET | admin/pos_manager/pos_cashier |
+| /pos/terminals/bind | POST | admin/pos_manager/pos_cashier |
+| /pos/config | GET | admin/pos_manager/pos_cashier |
+| /pos/sessions/me | GET | admin/pos_manager/pos_cashier |
+| /pos/sessions | POST | admin/pos_manager/pos_cashier |
+| /pos/sessions/:id/close | POST | admin/pos_manager/pos_cashier |

work/artifacts/POS-004/leader-close.json

@@ -0,0 +1,12 @@
+{
+  "feature_id": "POS-004",
+  "agent": "leader",
+  "stage": "close",
+  "verdict": "APPROVED",
+  "summary": "POS-004 closed: 12 POS API routes registered (admin stores/terminals + terminal me/bind/config/sessions). tsc 0, tests 8/8, verify.sh green.",
+  "checks": [
+    {"item": "Gates approved", "ok": true, "evidence": "reviewer.json, security.json, qa.json -> APPROVED"},
+    {"item": "verify.sh", "ok": true, "evidence": "exit 0"}
+  ],
+  "issues": []
+}

work/artifacts/POS-004/qa.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "POS-004",
+  "agent": "qa",
+  "stage": "qa_gate",
+  "verdict": "APPROVED",
+  "summary": "tsc 0, 8 unit tests green, verify.sh green.",
+  "checks": [
+    {"item": "tsc 0", "ok": true, "evidence": "npm run build 0 errors"},
+    {"item": "tests 8/8", "ok": true, "evidence": "vitest run pos/tests 8 passed"},
+    {"item": "verify.sh", "ok": true, "evidence": "exit 0"}
+  ],
+  "issues": []
+}

work/artifacts/POS-004/reviewer.json

@@ -0,0 +1,15 @@
+{
+  "feature_id": "POS-004",
+  "agent": "reviewer",
+  "stage": "review_gate",
+  "verdict": "APPROVED",
+  "summary": "12 POS endpoints registered: admin stores/terminals CRUD, terminal me/bind/config, session open/close. Auth enforced via requireRole/admin + requireAnyRole. tsc 0, tests 8/8.",
+  "checks": [
+    {"item": "Admin routes", "ok": true, "evidence": "GET/POST /pos/admin/stores, GET/POST /pos/admin/terminals, GET/DELETE /pos/admin/terminals/:id"},
+    {"item": "Terminal routes", "ok": true, "evidence": "GET /pos/terminals/me, POST /pos/terminals/bind, GET /pos/config"},
+    {"item": "Session routes", "ok": true, "evidence": "GET /pos/sessions/me, POST /pos/sessions, POST /pos/sessions/:id/close"},
+    {"item": "Auth enforcement", "ok": true, "evidence": "requireRole('admin') for admin; requireAnyRole for terminal"},
+    {"item": "tsc/tests/verify", "ok": true, "evidence": "npm run build 0, tests 8/8, verify.sh green"}
+  ],
+  "issues": []
+}

work/artifacts/POS-004/security.json

@@ -0,0 +1,13 @@
+{
+  "feature_id": "POS-004",
+  "agent": "security",
+  "stage": "security_gate",
+  "verdict": "APPROVED",
+  "summary": "Admin routes require 'admin' role. Terminal routes require 'admin'/'pos_manager'/'pos_cashier'. All DB queries parameterized. x-terminal-id header used but validated as UUID.",
+  "checks": [
+    {"item": "Authentication", "ok": true, "evidence": "requireRole/admin for admin; requireAnyRole for terminal"},
+    {"item": "Parameterized queries", "ok": true, "evidence": "All pool.query uses $1, $2 placeholders"},
+    {"item": "No new secrets", "ok": true, "evidence": "No env vars added"}
+  ],
+  "issues": []
+}