Story 26: Establish TDD workflow and quality gates

Add workflow engine with acceptance gates, test recording, and review
queue. Frontend displays gate status (blocked/ready), test summaries,
failing badges, and warnings. Proceed action is disabled when gates
are not met. Includes 13 unit tests (Vitest) and 9 E2E tests
(Playwright) covering all five acceptance criteria.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/io/fs.rs

@@ -1,3 +1,4 @@
+use crate::io::story_metadata::{TestPlanStatus, parse_front_matter};
 use crate::state::SessionState;
 use crate::store::StoreOps;
 use serde::Serialize;
@@ -276,6 +277,7 @@ This project is a standalone Rust **web server binary** that serves a Vite/React
     *   **Framework:** Poem HTTP server with WebSocket support for streaming; HTTP APIs should use Poem OpenAPI (Swagger) for non-streaming endpoints.
 *   **Frontend:** TypeScript + React
     *   **Build Tool:** Vite
+    *   **Package Manager:** pnpm (required)
     *   **Styling:** CSS Modules or Tailwind (TBD - Defaulting to CSS Modules)
     *   **State Management:** React Context / Hooks
     *   **Chat UI:** Rendered Markdown with syntax highlighting.
@@ -394,6 +396,34 @@ fn resolve_path_impl(root: PathBuf, relative_path: &str) -> Result<PathBuf, Stri
     Ok(root.join(relative_path))
 }
 
+fn is_story_kit_path(path: &str) -> bool {
+    path == ".story_kit" || path.starts_with(".story_kit/")
+}
+
+async fn ensure_test_plan_approved(root: PathBuf) -> Result<(), String> {
+    let approved = tokio::task::spawn_blocking(move || {
+        let story_path = root
+            .join(".story_kit")
+            .join("stories")
+            .join("current")
+            .join("26_establish_tdd_workflow_and_gates.md");
+        let contents = fs::read_to_string(&story_path)
+            .map_err(|e| format!("Failed to read story file for test plan approval: {e}"))?;
+        let metadata = parse_front_matter(&contents)
+            .map_err(|e| format!("Failed to parse story front matter: {e:?}"))?;
+
+        Ok::<bool, String>(matches!(metadata.test_plan, Some(TestPlanStatus::Approved)))
+    })
+    .await
+    .map_err(|e| format!("Task failed: {e}"))??;
+
+    if approved {
+        Ok(())
+    } else {
+        Err("Test plan is not approved for the current story.".to_string())
+    }
+}
+
 /// Resolves a relative path against the active project root.
 /// Returns error if no project is open or if path attempts traversal (..).
 fn resolve_path(state: &SessionState, relative_path: &str) -> Result<PathBuf, String> {
@@ -597,7 +627,11 @@ async fn write_file_impl(full_path: PathBuf, content: String) -> Result<(), Stri
 }
 
 pub async fn write_file(path: String, content: String, state: &SessionState) -> Result<(), String> {
-    let full_path = resolve_path(state, &path)?;
+    let root = state.get_project_root()?;
+    if !is_story_kit_path(&path) {
+        ensure_test_plan_approved(root.clone()).await?;
+    }
+    let full_path = resolve_path_impl(root, &path)?;
     write_file_impl(full_path, content).await
 }
 
@@ -658,3 +692,27 @@ pub async fn create_directory_absolute(path: String) -> Result<bool, String> {
     .await
     .map_err(|e| format!("Task failed: {}", e))?
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[tokio::test]
+    async fn write_file_requires_approved_test_plan() {
+        let dir = tempdir().expect("tempdir");
+        let state = SessionState::default();
+
+        {
+            let mut root = state.project_root.lock().expect("lock project root");
+            *root = Some(dir.path().to_path_buf());
+        }
+
+        let result = write_file("notes.txt".to_string(), "hello".to_string(), &state).await;
+
+        assert!(
+            result.is_err(),
+            "expected write to be blocked when test plan is not approved"
+        );
+    }
+}