Twelve tasks from model through middleware, scope enforcement, endpoints, web UI, generated OpenAPI and documentation. Verification is build plus curl and UI checks rather than test cycles, matching a repository with no Go test harness beyond shared/mail.