## 1. EventBridge Provider

- [x] 1.1 **P2-01: IEventBus Provider Scaffold and Registration** (1 day, 2/5 pts) -- Create EventBridge provider implementing IEventBus with publish, subscribe, matchRules stubs and start/stop/healthCheck lifecycle. Register in provider registry. Set AWS_ENDPOINT_URL_EVENTBRIDGE. Expose FastAPI router for PutEvents, PutRule, ListRules. Unit tests for lifecycle.
- [x] 1.2 **P2-02: Event Pattern Matching Engine** (2 days, 4/5 pts) -- Implement pattern_matcher.py as pure function match_event(pattern, event) -> bool. Support exact value matching, prefix matching, numeric range, exists/not-exists, anything-but, nested detail patterns. Unit tests cover all pattern types with positive and negative cases.
- [x] 1.3 **P2-03: Event Bus Publish and Rule Routing** (1.5 days, 3/5 pts) -- Implement PutEvents API endpoint. Parse AWS::Events::Rule from cloud assembly for EventPattern and Targets. Route matching events to target Lambda handlers with correct event envelope (source, detail-type, detail, time, id, region, account, resources). Integration test: publish -> match -> invoke.
- [x] 1.4 **P2-04: Scheduled Rules with Croniter** (1.5 days, 3/5 pts) -- Parse ScheduleExpression from rules. Convert AWS cron format to standard for croniter. Support rate expressions. Background asyncio.create_task loop for scheduling. Terminal logging of scheduled invocations. Unit tests for cron parsing and next-fire-time. Integration test for schedule trigger.
- [x] 1.5 **P2-05: Cross-Service Event Routing** (1.5 days, 3/5 pts) -- Internal event publishing function for other providers. Modify S3 provider to emit events when EventBridge notifications configured. Correct AWS source format (aws.s3, aws.dynamodb). Integration test: S3 putObject -> EventBridge rule -> Lambda invoked.
- [x] 1.6 **P2-06: EventBridge Provider Cloud Assembly Parsing** (1 day, 2/5 pts) -- Parse AWS::Events::EventBus, AWS::Events::Rule resources. Extract EventPattern, ScheduleExpression, EventBusName, Targets. Resolve rule targets to Lambda handler entries. Create default event bus. Unit tests with CloudFormation template snippets.

## 2. Step Functions Provider

- [x] 2.1 **P2-07: IStateMachine Provider Scaffold and ASL Parser** (1.5 days, 3/5 pts) -- Create provider implementing IStateMachine with startExecution stub and lifecycle methods. Build ASL parser reading JSON definitions into internal state graph (Task, Choice, Wait, Parallel, Map, Pass, Succeed, Fail dataclasses). Parse StartAt, States, Next, End, Comment. Unit tests for multi-state ASL parsing.
- [x] 2.2 **P2-08: State Machine Execution Engine Core** (2 days, 4/5 pts) -- Implement recursive state walker ExecutionEngine. Start at StartAt, follow Next transitions, terminate at End/Succeed/Fail. Pass state with Result and ResultPath. InputPath, OutputPath, ResultPath processing. Unit tests: Pass -> Pass -> Succeed chain, Fail state, InputPath/OutputPath filtering.
- [x] 2.3 **P2-09: Task State with Lambda Invocation** (1.5 days, 3/5 pts) -- Task state resolves Resource ARN to local Lambda handler. InputPath/Parameters processing with JSONPath. Handler invocation via Lambda runtime. ResultPath/OutputPath on response. Parameters with .$ suffix JSONPath extraction. TimeoutSeconds enforcement. Integration test with actual Lambda handler.
- [x] 2.4 **P2-10: Choice State Branching** (1.5 days, 3/5 pts) -- Implement choice_evaluator.py. Support StringEquals/GreaterThan/LessThan, NumericEquals/GreaterThan/LessThan, BooleanEquals, IsPresent/IsNull/IsString/IsNumeric/IsBoolean, And/Or/Not combinators. Default state fallthrough. Error on missing Default with no match. Unit tests for all operators and combinators.
- [x] 2.5 **P2-11: Wait State Implementation** (0.5 days, 1/5 pts) -- Support Seconds, Timestamp, SecondsPath, TimestampPath. asyncio.sleep for wait. ISO 8601 timestamp parsing. Configurable max_wait_seconds compression for local dev. Unit tests for each wait mode.
- [x] 2.6 **P2-12: Retry and Catch Error Handling** (2 days, 4/5 pts) -- Retry matching error names (States.ALL, States.TaskFailed, States.Timeout, custom). MaxAttempts (default 3), IntervalSeconds (default 1), BackoffRate (default 2.0). Catch matches errors, transitions to fallback with error info at ResultPath. Multiple Retry/Catch evaluated in order. Unit tests: retry succeeds on 2nd attempt, retry exhausted -> Catch, backoff timing.
- [x] 2.7 **P2-13: Parallel State Execution** (1.5 days, 3/5 pts) -- Execute all branches concurrently using asyncio.gather. Each branch is a sub-state-machine via ExecutionEngine reuse. Output is array in definition order. Branch failure cancels remaining branches. Retry/Catch on Parallel states. Integration test: two Task branches -> array of two results.
- [x] 2.8 **P2-14: Map State Execution** (1.5 days, 3/5 pts) -- ItemsPath extraction (default $). Iterator state machine per item. MaxConcurrency via asyncio.Semaphore. Parameters template with $$.Map.Item.Value and $$.Map.Item.Index context. Results in input order. Unit tests: Map over 5 items, MaxConcurrency=2, Parameters with context.
- [x] 2.9 **P2-15: Execution Tracking and Terminal Output** (1 day, 2/5 pts) -- ExecutionHistory dataclass accumulating StateTransition records. Terminal formatted trace: state name, duration, status. In-memory storage by execution ARN. ListExecutions and DescribeExecution API endpoints. Parallel/Map branches indented in trace.
- [x] 2.10 **P2-16: Workflow Type Support** (1 day, 2/5 pts) -- Express workflows: StartSyncExecution blocks and returns result. Standard workflows: StartExecution returns ARN immediately, DescribeExecution for polling. Parse Type from cloud assembly. Default STANDARD. Unit tests for sync vs async behavior.
- [x] 2.11 **P2-17: Step Functions Cloud Assembly Parsing** (1 day, 2/5 pts) -- Parse AWS::StepFunctions::StateMachine. Extract DefinitionString, resolve DefinitionSubstitutions. Extract workflow Type. Resolve Lambda ARNs in Task Resource fields to local handlers. Add state machine nodes to application graph. Unit tests with sample CloudFormation template.

## 3. ECS Service Support

- [x] 3.1 **P2-18: ECS Provider Scaffold and Process Manager** (1.5 days, 3/5 pts) -- Create ECS provider with process manager using asyncio.create_subprocess_exec. Start subprocess per service from container command/entryPoint. Inject environment variables. Stream stdout/stderr with service-name prefix via asyncio.StreamReader. Continuous running until stopped. SIGTERM then SIGKILL on stop. Unit tests for lifecycle.
- [x] 3.2 **P2-19: ECS Cloud Assembly Parsing** (1 day, 2/5 pts) -- Parse AWS::ECS::TaskDefinition with container definitions. Extract image, command, entryPoint, environment, portMappings. Extract health check config. Link AWS::ECS::Service to task definitions. Support ldk.local_command override. Unit tests with sample template.
- [x] 3.3 **P2-20: Health Check Polling** (1 day, 2/5 pts) -- Async polling loop at configured interval (default 30s). HTTP 200 = healthy, non-200/timeout = unhealthy. Terminal output with service name. Respect startPeriod grace and retries threshold. healthCheck lifecycle method returns status. Unit tests with mock HTTP server.
- [x] 3.4 **P2-21: Graceful Restart on Code Changes** (1.5 days, 3/5 pts) -- Integrate with watchdog file watcher. SIGTERM on change, configurable grace period (default 10s), SIGKILL fallback. Start new process after old terminates. Resume health check polling. Terminal restart progress. 500ms debounce for rapid changes. Integration test: file modify -> restart.
- [x] 3.5 **P2-22: Service Discovery** (1 day, 2/5 pts) -- Service registry mapping service name -> localhost:port. Register on start, deregister on stop. Inject endpoints into Lambda handler environment variables. Update on restart. API for querying services. Unit tests for registration and discovery.
- [x] 3.6 **P2-23: ALB Integration and HTTP Routing** (1.5 days, 3/5 pts) -- Parse AWS::ElasticLoadBalancingV2::ListenerRule resources. Path-based routing on local HTTP server. Proxy requests to ECS service local port via httpx.AsyncClient. Health check path routing. Multiple target groups. Transparent header/status passthrough. Integration test: HTTP -> ALB match -> proxy -> response.

## 4. Cognito Provider

- [x] 4.1 **P2-24: Cognito Provider Scaffold and User Store** (1.5 days, 3/5 pts) -- Create provider with aiosqlite user store. SignUp API with username, password hash (bcrypt/argon2), attributes. Password policy enforcement from CDK. Required attribute validation. ConfirmSignUp with auto-confirm default. Duplicate username rejection. Unit tests for sign-up, confirmation, password policy.
- [x] 4.2 **P2-25: Sign-In and JWT Token Generation** (1.5 days, 3/5 pts) -- InitiateAuth with USER_PASSWORD_AUTH flow. ID token claims (sub, email, cognito:username, iss, aud, exp, iat, token_use). Access token claims. Refresh token storage. RS256 signing with ephemeral RSA key pair via PyJWT. JWKS endpoint at /.well-known/jwks.json. NotAuthorizedException and UserNotConfirmedException errors. Unit tests for tokens and JWKS.
- [x] 4.3 **P2-26: API Gateway Authorizer Integration** (1.5 days, 3/5 pts) -- Parse AWS::ApiGateway::Authorizer with COGNITO_USER_POOLS type. Validate Authorization header JWT on protected routes. Verify signature via JWKS, check expiration, verify iss claim. Pass decoded claims to handler in event.requestContext.authorizer.claims. 401 for missing/invalid/expired tokens. Unit and integration tests.
- [x] 4.4 **P2-27: Lambda Triggers (Pre-Auth and Post-Confirmation)** (1.5 days, 3/5 pts) -- Parse LambdaConfig.PreAuthentication and PostConfirmation from user pool. Invoke pre-auth trigger before credential verification; allow or deny based on result. Invoke post-confirmation after confirmation with user attributes. Standard Cognito trigger event payloads. Integration test: sign-in with trigger allow/deny, confirm with post-confirmation trigger.
- [x] 4.5 **P2-28: Cognito Cloud Assembly Parsing** (1 day, 2/5 pts) -- Parse AWS::Cognito::UserPool (PasswordPolicy, Schema, LambdaConfig). Parse AWS::Cognito::UserPoolClient (ClientId, ExplicitAuthFlows, AllowedOAuthFlows). Parse API Gateway Authorizer linked to user pool. Resolve Lambda trigger ARN references. Add nodes to application graph. Unit tests with sample template.

## 5. Validation Engine

- [x] 5.1 **P2-29: Validation Engine Framework and Configurable Strictness** (1.5 days, 3/5 pts) -- Create ValidationEngine with pluggable Validator protocol/ABC. validate(context) -> list[ValidationIssue] method. ValidationIssue dataclass (level, message, resource, operation). Warn mode: log and continue. Strict mode: fail on errors. Configurable via ldk.yaml (validation.strictness). Per-validator overrides. Terminal output formatting. Unit tests for warn/strict modes.
- [x] 5.2 **P2-30: Permission Validation** (2 days, 4/5 pts) -- Implement permission_validator.py checking handler access via application graph permission edges. grantRead allows get/query/scan not put/delete. grantWrite allows put/delete. grantReadWrite allows all. Warn/strict mode behavior. Unit tests: authorized passes, unauthorized detected, strict blocks.
- [x] 5.3 **P2-31: DynamoDB Schema Validation** (1.5 days, 3/5 pts) -- Implement schema_validator.py checking putItem/updateItem/deleteItem against table key schema. Validate partition key and sort key presence and type (S, N, B). Type mismatch and missing key produce issues. GSI/LSI key validation on queries. Unit tests: correct key passes, wrong type, missing key.
- [x] 5.4 **P2-32: Environment Variable Validation** (1 day, 2/5 pts) -- Implement env_var_validator.py running at startup. Check Ref/Fn::GetAtt references in Lambda environment variables against known resources. Issue on unresolvable references. Strict mode prevents handler start. Unit tests: valid reference passes, missing resource detected.
- [x] 5.5 **P2-33: Event Shape Validation** (1.5 days, 3/5 pts) -- Implement event_shape_validator.py. Define event schemas as Pydantic models per trigger type (API Gateway, SQS, S3, SNS, EventBridge, Cognito). Validate constructed events before handler invocation. Report missing required fields. Unit tests: valid events pass, missing fields flagged.
- [x] 5.6 **P2-34: Validation Engine Integration with Providers** (1.5 days, 3/5 pts) -- Wire validators into provider operation paths. DynamoDB: schema + permission. SQS: permission. S3: permission. Lambda: event shape. API Gateway: event shape. EventBridge: permission. Inject validation_engine via DI. validate_operation(handler_id, resource_id, operation, data) method. Pass handler identity through SDK redirection. End-to-end integration test: unauthorized write -> warning/error per strictness.
