Use /project requirements.md as the single source of truth for this project.

Do NOT implement the application yet.

First, plan the project and organize the Windsurf context model for long-term development.

## Project context

This is a:
- web-first application
- future mobile-ready architecture
- multi-tenant platform
- Next.js + Supabase + Vercel + Claude stack
- white-label / branded per tenant
- tenant resolved by subdomain or custom domain
- strict tenant isolation with server-side enforcement and Supabase RLS

Assume this target repository structure:

apps/web
packages/types
packages/lib
supabase
tests
.windsurf/skills
.windsurf/rules
.windsurf/workflows

## Your tasks

1. Read and analyze requirements.md completely.
2. Extract the main project modules, technical constraints, risks, dependencies, and sequencing.
3. Create a realistic project plan broken into phases and subphases.
4. Create and maintain a Todo list for the project.
5. Propose how to split the project into a small set of high-value Windsurf Skills.
6. Propose the AGENTS.md hierarchy needed for this repository.
7. Propose the Rules needed for cross-cutting constraints.
8. Propose the Workflows needed for repetitive delivery tasks.
9. Keep everything modular, scoped, and minimal.
10. Do not write implementation code unless explicitly asked.

## Planning goals

Optimize for:
- low context overhead
- minimal duplication
- progressive disclosure
- folder-scoped instructions
- safe backend evolution
- multi-tenant correctness
- long-term maintainability
- Claude-friendly development

## Non-negotiable architectural constraints

- Web-first only for now
- No mobile implementation yet
- Single Next.js app
- Multi-tenant by brand / tenant
- Tenant resolved from hostname
- Custom domains and subdomains supported
- No per-tenant deployments
- Supabase as main backend
- All tenant data scoped by brand_id / tenant_id
- RLS required on tenant tables
- Business logic must not live in UI
- packages/types = schemas, DTOs, types
- packages/lib = domain logic, auth helpers, tenant helpers, data access, AI logic
- supabase = migrations, RLS policies, edge functions, seed
- tests = unit, integration, tenant isolation, RBAC, state transitions

## Cross-cutting concerns that must be reflected in planning

- multitenancy
- branding / theming consistency
- design tokens and component system
- auth and tenant membership
- RLS and backend authorization
- evidence upload and validation states
- chain progression rules
- AI integration boundaries
- audit logging
- deployment environments
- testing strategy
- MCP usage boundaries
- secrets handling
- CI / PR checks
- release safety

## Output format

Produce the output in this exact order:

1. Executive summary
2. Project phases
3. Todo list
4. Proposed Windsurf Skills
5. Proposed AGENTS.md structure
6. Proposed Rules
7. Proposed Workflows
8. Key architectural decisions that should be locked early
9. Recommended first implementation step

## Important behavior rules

- Base everything on requirements.md
- Do not invent features not grounded in the document
- Do not generate giant global instructions if folder-specific instructions are better
- Prefer a small number of strong Skills over many weak ones
- Prefer explicit boundaries over vague guidance
- Flag ambiguities and assumptions clearly
- If something should be deferred to a later phase, say so explicitly