feat: Phase 3 — stories data model, ValidStoryTransition, storage CRUD, API endpoints

- internal/task/story.go: Story struct, StoryState constants, ValidStoryTransition
- internal/task/task.go: add StoryID field
- internal/storage/db.go: stories table + story_id on tasks migrations; CreateStory,
  GetStory, ListStories, UpdateStoryStatus, ListTasksByStory; update all task
  SELECT/INSERT to include story_id; scanTask extended with sql.NullString for story_id;
  added modernc timestamp format to GetMaxUpdatedAt
- internal/storage/sqlite_cgo.go + sqlite_nocgo.go: build-tag based driver selection
  (mattn/go-sqlite3 with CGO, modernc.org/sqlite pure-Go fallback) so tests run
  without a C compiler
- internal/api/stories.go: GET/POST /api/stories, GET /api/stories/{id},
  GET/POST /api/stories/{id}/tasks (auto-wires depends_on chain),
  PUT /api/stories/{id}/status (validates transition)
- internal/api/server.go: register all story routes
- go.mod/go.sum: add modernc.org/sqlite pure-Go dependency

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

10 files changed, 630 insertions, 9 deletions

diff --git a/internal/api/server.go b/internal/api/server.go
index ff6fdb6..092ae3a 100644
--- a/internal/api/server.go
+++ b/internal/api/server.go
@@ -138,6 +138,12 @@ func (s *Server) routes() {
 	s.mux.HandleFunc("POST /api/projects", s.handleCreateProject)
 	s.mux.HandleFunc("GET /api/projects/{id}", s.handleGetProject)
 	s.mux.HandleFunc("PUT /api/projects/{id}", s.handleUpdateProject)
+	s.mux.HandleFunc("GET /api/stories", s.handleListStories)
+	s.mux.HandleFunc("POST /api/stories", s.handleCreateStory)
+	s.mux.HandleFunc("GET /api/stories/{id}", s.handleGetStory)
+	s.mux.HandleFunc("GET /api/stories/{id}/tasks", s.handleListStoryTasks)
+	s.mux.HandleFunc("POST /api/stories/{id}/tasks", s.handleAddTaskToStory)
+	s.mux.HandleFunc("PUT /api/stories/{id}/status", s.handleUpdateStoryStatus)
 	s.mux.HandleFunc("GET /api/health", s.handleHealth)
 	s.mux.HandleFunc("POST /api/webhooks/github", s.handleGitHubWebhook)
 	s.mux.HandleFunc("GET /api/push/vapid-key", s.handleGetVAPIDKey)
diff --git a/internal/api/stories.go b/internal/api/stories.go
new file mode 100644
index 0000000..4b91653
--- /dev/null
+++ b/internal/api/stories.go
@@ -0,0 +1,185 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/thepeterstone/claudomator/internal/task"
+)
+
+func (s *Server) handleListStories(w http.ResponseWriter, r *http.Request) {
+	stories, err := s.store.ListStories()
+	if err != nil {
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
+		return
+	}
+	if stories == nil {
+		stories = []*task.Story{}
+	}
+	writeJSON(w, http.StatusOK, stories)
+}
+
+func (s *Server) handleCreateStory(w http.ResponseWriter, r *http.Request) {
+	var st task.Story
+	if err := json.NewDecoder(r.Body).Decode(&st); err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON: " + err.Error()})
+		return
+	}
+	if st.Name == "" {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "name is required"})
+		return
+	}
+	if st.ID == "" {
+		st.ID = uuid.New().String()
+	}
+	if st.Status == "" {
+		st.Status = task.StoryPending
+	}
+	if err := s.store.CreateStory(&st); err != nil {
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
+		return
+	}
+	writeJSON(w, http.StatusCreated, st)
+}
+
+func (s *Server) handleGetStory(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	st, err := s.store.GetStory(id)
+	if err != nil {
+		writeJSON(w, http.StatusNotFound, map[string]string{"error": "story not found"})
+		return
+	}
+	writeJSON(w, http.StatusOK, st)
+}
+
+func (s *Server) handleListStoryTasks(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	if _, err := s.store.GetStory(id); err != nil {
+		writeJSON(w, http.StatusNotFound, map[string]string{"error": "story not found"})
+		return
+	}
+	tasks, err := s.store.ListTasksByStory(id)
+	if err != nil {
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
+		return
+	}
+	if tasks == nil {
+		tasks = []*task.Task{}
+	}
+	writeJSON(w, http.StatusOK, tasks)
+}
+
+func (s *Server) handleAddTaskToStory(w http.ResponseWriter, r *http.Request) {
+	storyID := r.PathValue("id")
+	st, err := s.store.GetStory(storyID)
+	if err != nil {
+		writeJSON(w, http.StatusNotFound, map[string]string{"error": "story not found"})
+		return
+	}
+	_ = st
+
+	var input struct {
+		Name          string           `json:"name"`
+		Description   string           `json:"description"`
+		Project       string           `json:"project"`
+		RepositoryURL string           `json:"repository_url"`
+		Agent         task.AgentConfig `json:"agent"`
+		Claude        task.AgentConfig `json:"claude"`
+		Timeout       string           `json:"timeout"`
+		Priority      string           `json:"priority"`
+		Tags          []string         `json:"tags"`
+		ParentTaskID  string           `json:"parent_task_id"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON: " + err.Error()})
+		return
+	}
+	if input.Agent.Instructions == "" && input.Claude.Instructions != "" {
+		input.Agent = input.Claude
+	}
+
+	existing, err := s.store.ListTasksByStory(storyID)
+	if err != nil {
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
+		return
+	}
+
+	now := time.Now().UTC()
+	t := &task.Task{
+		ID:            uuid.New().String(),
+		Name:          input.Name,
+		Description:   input.Description,
+		Project:       input.Project,
+		RepositoryURL: input.RepositoryURL,
+		Agent:         input.Agent,
+		Priority:      task.Priority(input.Priority),
+		Tags:          input.Tags,
+		DependsOn:     []string{},
+		Retry:         task.RetryConfig{MaxAttempts: 1, Backoff: "exponential"},
+		State:         task.StatePending,
+		StoryID:       storyID,
+		ParentTaskID:  input.ParentTaskID,
+		CreatedAt:     now,
+		UpdatedAt:     now,
+	}
+
+	if t.Agent.Type == "" {
+		t.Agent.Type = "claude"
+	}
+	if t.Priority == "" {
+		t.Priority = task.PriorityNormal
+	}
+	if t.Tags == nil {
+		t.Tags = []string{}
+	}
+	if input.Timeout != "" {
+		dur, err := time.ParseDuration(input.Timeout)
+		if err != nil {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid timeout: " + err.Error()})
+			return
+		}
+		t.Timeout.Duration = dur
+	}
+
+	// Auto-wire depends_on: new task depends on the last existing task (sorted ASC by created_at).
+	if len(existing) > 0 {
+		lastTask := existing[len(existing)-1]
+		t.DependsOn = []string{lastTask.ID}
+	}
+
+	if err := s.store.CreateTask(t); err != nil {
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
+		return
+	}
+	writeJSON(w, http.StatusCreated, t)
+}
+
+func (s *Server) handleUpdateStoryStatus(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	st, err := s.store.GetStory(id)
+	if err != nil {
+		writeJSON(w, http.StatusNotFound, map[string]string{"error": "story not found"})
+		return
+	}
+
+	var input struct {
+		Status task.StoryState `json:"status"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON: " + err.Error()})
+		return
+	}
+	if !task.ValidStoryTransition(st.Status, input.Status) {
+		writeJSON(w, http.StatusConflict, map[string]string{
+			"error": "invalid story status transition from " + string(st.Status) + " to " + string(input.Status),
+		})
+		return
+	}
+	if err := s.store.UpdateStoryStatus(id, input.Status); err != nil {
+		writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]string{"message": "story status updated", "story_id": id, "status": string(input.Status)})
+}
diff --git a/internal/api/stories_test.go b/internal/api/stories_test.go
new file mode 100644
index 0000000..8516ade
--- /dev/null
+++ b/internal/api/stories_test.go
@@ -0,0 +1,120 @@
+package api
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/thepeterstone/claudomator/internal/task"
+)
+
+func TestCreateStory_API(t *testing.T) {
+	srv, _ := testServer(t)
+
+	body := `{"name":"My Story","project_id":"proj-1"}`
+	req := httptest.NewRequest("POST", "/api/stories", bytes.NewBufferString(body))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	srv.mux.ServeHTTP(w, req)
+
+	if w.Code != http.StatusCreated {
+		t.Fatalf("expected 201, got %d: %s", w.Code, w.Body.String())
+	}
+	var st task.Story
+	if err := json.NewDecoder(w.Body).Decode(&st); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if st.Name != "My Story" {
+		t.Errorf("Name: want 'My Story', got %q", st.Name)
+	}
+	if st.ID == "" {
+		t.Error("ID should be auto-generated")
+	}
+	if st.Status != task.StoryPending {
+		t.Errorf("Status: want PENDING, got %q", st.Status)
+	}
+}
+
+func TestGetStory_API(t *testing.T) {
+	srv, _ := testServer(t)
+
+	// Create a story first.
+	body := `{"name":"Get Me"}`
+	req := httptest.NewRequest("POST", "/api/stories", bytes.NewBufferString(body))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	srv.mux.ServeHTTP(w, req)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("create story: expected 201, got %d", w.Code)
+	}
+	var created task.Story
+	json.NewDecoder(w.Body).Decode(&created)
+
+	// Fetch it.
+	req2 := httptest.NewRequest("GET", "/api/stories/"+created.ID, nil)
+	w2 := httptest.NewRecorder()
+	srv.mux.ServeHTTP(w2, req2)
+
+	if w2.Code != http.StatusOK {
+		t.Fatalf("get story: expected 200, got %d: %s", w2.Code, w2.Body.String())
+	}
+	var got task.Story
+	if err := json.NewDecoder(w2.Body).Decode(&got); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if got.ID != created.ID {
+		t.Errorf("ID: want %q, got %q", created.ID, got.ID)
+	}
+	if got.Name != "Get Me" {
+		t.Errorf("Name: want 'Get Me', got %q", got.Name)
+	}
+}
+
+func TestAddTaskToStory_AutoWiresDependsOn(t *testing.T) {
+	srv, _ := testServer(t)
+
+	// Create a story.
+	storyBody := `{"name":"Story For Tasks"}`
+	req := httptest.NewRequest("POST", "/api/stories", bytes.NewBufferString(storyBody))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	srv.mux.ServeHTTP(w, req)
+	if w.Code != http.StatusCreated {
+		t.Fatalf("create story: %d %s", w.Code, w.Body.String())
+	}
+	var story task.Story
+	json.NewDecoder(w.Body).Decode(&story)
+
+	addTask := func(name string) *task.Task {
+		body := `{"name":"` + name + `","agent":{"type":"claude","instructions":"do it"}}`
+		r := httptest.NewRequest("POST", "/api/stories/"+story.ID+"/tasks", bytes.NewBufferString(body))
+		r.Header.Set("Content-Type", "application/json")
+		wr := httptest.NewRecorder()
+		srv.mux.ServeHTTP(wr, r)
+		if wr.Code != http.StatusCreated {
+			t.Fatalf("add task %s: expected 201, got %d: %s", name, wr.Code, wr.Body.String())
+		}
+		var tk task.Task
+		json.NewDecoder(wr.Body).Decode(&tk)
+		return &tk
+	}
+
+	task1 := addTask("Task 1")
+	task2 := addTask("Task 2")
+	task3 := addTask("Task 3")
+
+	// task1 has no dependencies.
+	if len(task1.DependsOn) != 0 {
+		t.Errorf("task1.DependsOn: want [], got %v", task1.DependsOn)
+	}
+	// task2 depends on task1.
+	if len(task2.DependsOn) != 1 || task2.DependsOn[0] != task1.ID {
+		t.Errorf("task2.DependsOn: want [%s], got %v", task1.ID, task2.DependsOn)
+	}
+	// task3 depends on task2.
+	if len(task3.DependsOn) != 1 || task3.DependsOn[0] != task2.ID {
+		t.Errorf("task3.DependsOn: want [%s], got %v", task2.ID, task3.DependsOn)
+	}
+}
diff --git a/internal/storage/db.go b/internal/storage/db.go
index 8f834b2..24a6cd3 100644
--- a/internal/storage/db.go
+++ b/internal/storage/db.go
@@ -8,7 +8,6 @@ import (
 	"time"
 
 	"github.com/thepeterstone/claudomator/internal/task"
-	_ "github.com/mattn/go-sqlite3"
 )
 
 type DB struct {
@@ -119,6 +118,18 @@ func (s *DB) migrate() error {
 			created_at DATETIME NOT NULL,
 			updated_at DATETIME NOT NULL
 		)`,
+		`CREATE TABLE IF NOT EXISTS stories (
+			id TEXT PRIMARY KEY,
+			name TEXT NOT NULL,
+			project_id TEXT NOT NULL DEFAULT '',
+			branch_name TEXT NOT NULL DEFAULT '',
+			deploy_config TEXT NOT NULL DEFAULT '',
+			validation_json TEXT NOT NULL DEFAULT '',
+			status TEXT NOT NULL DEFAULT 'PENDING',
+			created_at DATETIME NOT NULL,
+			updated_at DATETIME NOT NULL
+		)`,
+		`ALTER TABLE tasks ADD COLUMN story_id TEXT`,
 	}
 	for _, m := range migrations {
 		if _, err := s.db.Exec(m); err != nil {
@@ -156,24 +167,24 @@ func (s *DB) CreateTask(t *task.Task) error {
 	}
 
 	_, err = s.db.Exec(`
-		INSERT INTO tasks (id, name, description, elaboration_input, project, repository_url, config_json, priority, timeout_ns, retry_json, tags_json, depends_on_json, parent_task_id, state, created_at, updated_at)
-		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		INSERT INTO tasks (id, name, description, elaboration_input, project, repository_url, config_json, priority, timeout_ns, retry_json, tags_json, depends_on_json, parent_task_id, state, created_at, updated_at, story_id)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 		t.ID, t.Name, t.Description, t.ElaborationInput, t.Project, t.RepositoryURL, string(configJSON), string(t.Priority),
 		t.Timeout.Duration.Nanoseconds(), string(retryJSON), string(tagsJSON), string(depsJSON),
-		t.ParentTaskID, string(t.State), t.CreatedAt.UTC(), t.UpdatedAt.UTC(),
+		t.ParentTaskID, string(t.State), t.CreatedAt.UTC(), t.UpdatedAt.UTC(), t.StoryID,
 	)
 	return err
 }
 
 // GetTask retrieves a task by ID.
 func (s *DB) GetTask(id string) (*task.Task, error) {
-	row := s.db.QueryRow(`SELECT id, name, description, elaboration_input, project, repository_url, config_json, priority, timeout_ns, retry_json, tags_json, depends_on_json, parent_task_id, state, created_at, updated_at, rejection_comment, question_json, summary, interactions_json FROM tasks WHERE id = ?`, id)
+	row := s.db.QueryRow(`SELECT id, name, description, elaboration_input, project, repository_url, config_json, priority, timeout_ns, retry_json, tags_json, depends_on_json, parent_task_id, state, created_at, updated_at, rejection_comment, question_json, summary, interactions_json, story_id FROM tasks WHERE id = ?`, id)
 	return scanTask(row)
 }
 
 // ListTasks returns tasks matching the given filter.
 func (s *DB) ListTasks(filter TaskFilter) ([]*task.Task, error) {
-	query := `SELECT id, name, description, elaboration_input, project, repository_url, config_json, priority, timeout_ns, retry_json, tags_json, depends_on_json, parent_task_id, state, created_at, updated_at, rejection_comment, question_json, summary, interactions_json FROM tasks WHERE 1=1`
+	query := `SELECT id, name, description, elaboration_input, project, repository_url, config_json, priority, timeout_ns, retry_json, tags_json, depends_on_json, parent_task_id, state, created_at, updated_at, rejection_comment, question_json, summary, interactions_json, story_id FROM tasks WHERE 1=1`
 	var args []interface{}
 
 	if filter.State != "" {
@@ -209,7 +220,7 @@ func (s *DB) ListTasks(filter TaskFilter) ([]*task.Task, error) {
 
 // ListSubtasks returns all tasks whose parent_task_id matches the given ID.
 func (s *DB) ListSubtasks(parentID string) ([]*task.Task, error) {
-	rows, err := s.db.Query(`SELECT id, name, description, elaboration_input, project, repository_url, config_json, priority, timeout_ns, retry_json, tags_json, depends_on_json, parent_task_id, state, created_at, updated_at, rejection_comment, question_json, summary, interactions_json FROM tasks WHERE parent_task_id = ? ORDER BY created_at ASC`, parentID)
+	rows, err := s.db.Query(`SELECT id, name, description, elaboration_input, project, repository_url, config_json, priority, timeout_ns, retry_json, tags_json, depends_on_json, parent_task_id, state, created_at, updated_at, rejection_comment, question_json, summary, interactions_json, story_id FROM tasks WHERE parent_task_id = ? ORDER BY created_at ASC`, parentID)
 	if err != nil {
 		return nil, err
 	}
@@ -262,7 +273,7 @@ func (s *DB) ResetTaskForRetry(id string) (*task.Task, error) {
 	}
 	defer tx.Rollback() //nolint:errcheck
 
-	t, err := scanTask(tx.QueryRow(`SELECT id, name, description, elaboration_input, project, repository_url, config_json, priority, timeout_ns, retry_json, tags_json, depends_on_json, parent_task_id, state, created_at, updated_at, rejection_comment, question_json, summary, interactions_json FROM tasks WHERE id = ?`, id))
+	t, err := scanTask(tx.QueryRow(`SELECT id, name, description, elaboration_input, project, repository_url, config_json, priority, timeout_ns, retry_json, tags_json, depends_on_json, parent_task_id, state, created_at, updated_at, rejection_comment, question_json, summary, interactions_json, story_id FROM tasks WHERE id = ?`, id))
 	if err != nil {
 		if err == sql.ErrNoRows {
 			return nil, fmt.Errorf("task %q not found", id)
@@ -407,6 +418,8 @@ func (s *DB) GetMaxUpdatedAt() (time.Time, error) {
 		"2006-01-02T15:04:05Z07:00",
 		time.RFC3339,
 		"2006-01-02 15:04:05",
+		"2006-01-02 15:04:05 +0000 UTC",
+		"2006-01-02 15:04:05.999999999 +0000 UTC",
 	}
 	for _, f := range formats {
 		parsed, err := time.Parse(f, t.String)
@@ -849,8 +862,9 @@ func scanTask(row scanner) (*task.Task, error) {
 		questionJSON       sql.NullString
 		summary            sql.NullString
 		interactionsJSON   sql.NullString
+		storyID            sql.NullString
 	)
-	err := row.Scan(&t.ID, &t.Name, &t.Description, &elaborationInput, &project, &repositoryURL, &configJSON, &priority, &timeoutNS, &retryJSON, &tagsJSON, &depsJSON, &parentTaskID, &state, &t.CreatedAt, &t.UpdatedAt, &rejectionComment, &questionJSON, &summary, &interactionsJSON)
+	err := row.Scan(&t.ID, &t.Name, &t.Description, &elaborationInput, &project, &repositoryURL, &configJSON, &priority, &timeoutNS, &retryJSON, &tagsJSON, &depsJSON, &parentTaskID, &state, &t.CreatedAt, &t.UpdatedAt, &rejectionComment, &questionJSON, &summary, &interactionsJSON, &storyID)
 	t.ParentTaskID = parentTaskID.String
 	t.ElaborationInput = elaborationInput.String
 	t.Project = project.String
@@ -858,6 +872,7 @@ func scanTask(row scanner) (*task.Task, error) {
 	t.RejectionComment = rejectionComment.String
 	t.QuestionJSON = questionJSON.String
 	t.Summary = summary.String
+	t.StoryID = storyID.String
 	if err != nil {
 		return nil, err
 	}
@@ -1127,3 +1142,74 @@ func (s *DB) UpsertProject(p *task.Project) error {
 	)
 	return err
 }
+
+// CreateStory inserts a new story.
+func (s *DB) CreateStory(st *task.Story) error {
+	now := time.Now().UTC()
+	_, err := s.db.Exec(
+		`INSERT INTO stories (id, name, project_id, branch_name, deploy_config, validation_json, status, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		st.ID, st.Name, st.ProjectID, st.BranchName, st.DeployConfig, st.ValidationJSON, string(st.Status), now, now,
+	)
+	return err
+}
+
+// GetStory retrieves a story by ID.
+func (s *DB) GetStory(id string) (*task.Story, error) {
+	row := s.db.QueryRow(`SELECT id, name, project_id, branch_name, deploy_config, validation_json, status, created_at, updated_at FROM stories WHERE id = ?`, id)
+	st := &task.Story{}
+	var status string
+	if err := row.Scan(&st.ID, &st.Name, &st.ProjectID, &st.BranchName, &st.DeployConfig, &st.ValidationJSON, &status, &st.CreatedAt, &st.UpdatedAt); err != nil {
+		return nil, err
+	}
+	st.Status = task.StoryState(status)
+	return st, nil
+}
+
+// ListStories returns all stories ordered by creation time descending.
+func (s *DB) ListStories() ([]*task.Story, error) {
+	rows, err := s.db.Query(`SELECT id, name, project_id, branch_name, deploy_config, validation_json, status, created_at, updated_at FROM stories ORDER BY created_at DESC`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var stories []*task.Story
+	for rows.Next() {
+		st := &task.Story{}
+		var status string
+		if err := rows.Scan(&st.ID, &st.Name, &st.ProjectID, &st.BranchName, &st.DeployConfig, &st.ValidationJSON, &status, &st.CreatedAt, &st.UpdatedAt); err != nil {
+			return nil, err
+		}
+		st.Status = task.StoryState(status)
+		stories = append(stories, st)
+	}
+	return stories, rows.Err()
+}
+
+// UpdateStoryStatus updates the status of a story.
+func (s *DB) UpdateStoryStatus(id string, status task.StoryState) error {
+	now := time.Now().UTC()
+	_, err := s.db.Exec(`UPDATE stories SET status = ?, updated_at = ? WHERE id = ?`, string(status), now, id)
+	return err
+}
+
+// ListTasksByStory returns all tasks associated with a story, ordered by creation time ascending.
+func (s *DB) ListTasksByStory(storyID string) ([]*task.Task, error) {
+	rows, err := s.db.Query(
+		`SELECT id, name, description, elaboration_input, project, repository_url, config_json, priority, timeout_ns, retry_json, tags_json, depends_on_json, parent_task_id, state, created_at, updated_at, rejection_comment, question_json, summary, interactions_json, story_id FROM tasks WHERE story_id = ? ORDER BY created_at ASC`,
+		storyID,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var tasks []*task.Task
+	for rows.Next() {
+		t, err := scanTaskRows(rows)
+		if err != nil {
+			return nil, err
+		}
+		tasks = append(tasks, t)
+	}
+	return tasks, rows.Err()
+}
diff --git a/internal/storage/db_test.go b/internal/storage/db_test.go
index 82c8262..0426bd0 100644
--- a/internal/storage/db_test.go
+++ b/internal/storage/db_test.go
@@ -1218,3 +1218,117 @@ func TestUpdateProject(t *testing.T) {
 	}
 }
 
+func TestCreateStory(t *testing.T) {
+	db := testDB(t)
+	st := &task.Story{
+		ID:     "story-1",
+		Name:   "My Story",
+		Status: task.StoryPending,
+	}
+	if err := db.CreateStory(st); err != nil {
+		t.Fatalf("CreateStory: %v", err)
+	}
+}
+
+func TestGetStory(t *testing.T) {
+	db := testDB(t)
+	st := &task.Story{
+		ID:        "story-2",
+		Name:      "Get Story",
+		ProjectID: "proj-1",
+		Status:    task.StoryPending,
+	}
+	if err := db.CreateStory(st); err != nil {
+		t.Fatalf("CreateStory: %v", err)
+	}
+	got, err := db.GetStory("story-2")
+	if err != nil {
+		t.Fatalf("GetStory: %v", err)
+	}
+	if got.Name != "Get Story" {
+		t.Errorf("Name: want 'Get Story', got %q", got.Name)
+	}
+	if got.ProjectID != "proj-1" {
+		t.Errorf("ProjectID: want 'proj-1', got %q", got.ProjectID)
+	}
+	if got.Status != task.StoryPending {
+		t.Errorf("Status: want PENDING, got %q", got.Status)
+	}
+}
+
+func TestListStories(t *testing.T) {
+	db := testDB(t)
+	for _, name := range []string{"A", "B", "C"} {
+		if err := db.CreateStory(&task.Story{ID: name, Name: name, Status: task.StoryPending}); err != nil {
+			t.Fatalf("CreateStory %s: %v", name, err)
+		}
+	}
+	stories, err := db.ListStories()
+	if err != nil {
+		t.Fatalf("ListStories: %v", err)
+	}
+	if len(stories) != 3 {
+		t.Errorf("want 3 stories, got %d", len(stories))
+	}
+}
+
+func TestUpdateStoryStatus(t *testing.T) {
+	db := testDB(t)
+	st := &task.Story{ID: "story-upd", Name: "Upd", Status: task.StoryPending}
+	if err := db.CreateStory(st); err != nil {
+		t.Fatalf("CreateStory: %v", err)
+	}
+	if err := db.UpdateStoryStatus("story-upd", task.StoryInProgress); err != nil {
+		t.Fatalf("UpdateStoryStatus: %v", err)
+	}
+	got, _ := db.GetStory("story-upd")
+	if got.Status != task.StoryInProgress {
+		t.Errorf("Status: want IN_PROGRESS, got %q", got.Status)
+	}
+}
+
+func TestListTasksByStory(t *testing.T) {
+	db := testDB(t)
+	now := time.Now().UTC()
+
+	if err := db.CreateStory(&task.Story{ID: "story-tasks", Name: "S", Status: task.StoryPending}); err != nil {
+		t.Fatalf("CreateStory: %v", err)
+	}
+
+	makeTask := func(id string) *task.Task {
+		return &task.Task{
+			ID:        id,
+			Name:      id,
+			StoryID:   "story-tasks",
+			Agent:     task.AgentConfig{Type: "claude"},
+			Priority:  task.PriorityNormal,
+			Tags:      []string{},
+			DependsOn: []string{},
+			Retry:     task.RetryConfig{MaxAttempts: 1},
+			State:     task.StatePending,
+			CreatedAt: now,
+			UpdatedAt: now,
+		}
+	}
+
+	if err := db.CreateTask(makeTask("t1")); err != nil {
+		t.Fatal(err)
+	}
+	if err := db.CreateTask(makeTask("t2")); err != nil {
+		t.Fatal(err)
+	}
+
+	tasks, err := db.ListTasksByStory("story-tasks")
+	if err != nil {
+		t.Fatalf("ListTasksByStory: %v", err)
+	}
+	if len(tasks) != 2 {
+		t.Errorf("want 2 tasks, got %d", len(tasks))
+	}
+	for _, tk := range tasks {
+		if tk.StoryID != "story-tasks" {
+			t.Errorf("task %s: StoryID want 'story-tasks', got %q", tk.ID, tk.StoryID)
+		}
+	}
+}
+
diff --git a/internal/storage/sqlite_cgo.go b/internal/storage/sqlite_cgo.go
new file mode 100644
index 0000000..0956852
--- /dev/null
+++ b/internal/storage/sqlite_cgo.go
@@ -0,0 +1,5 @@
+//go:build cgo
+
+package storage
+
+import _ "github.com/mattn/go-sqlite3"
diff --git a/internal/storage/sqlite_nocgo.go b/internal/storage/sqlite_nocgo.go
new file mode 100644
index 0000000..9862440
--- /dev/null
+++ b/internal/storage/sqlite_nocgo.go
@@ -0,0 +1,21 @@
+//go:build !cgo
+
+package storage
+
+import (
+	"database/sql"
+	"database/sql/driver"
+
+	modernc "modernc.org/sqlite"
+)
+
+// Register the modernc pure-Go SQLite driver under the "sqlite3" name so that
+// the rest of the codebase can use sql.Open("sqlite3", ...) regardless of
+// whether CGO is enabled.
+func init() {
+	sql.Register("sqlite3", &modernc.Driver{})
+}
+
+// modernc.Driver satisfies driver.Driver; this blank-import ensures the
+// compiler sees the interface is satisfied.
+var _ driver.Driver = (*modernc.Driver)(nil)
diff --git a/internal/task/story.go b/internal/task/story.go
new file mode 100644
index 0000000..536bda1
--- /dev/null
+++ b/internal/task/story.go
@@ -0,0 +1,41 @@
+package task
+
+import "time"
+
+type StoryState string
+
+const (
+	StoryPending     StoryState = "PENDING"
+	StoryInProgress  StoryState = "IN_PROGRESS"
+	StoryShippable   StoryState = "SHIPPABLE"
+	StoryDeployed    StoryState = "DEPLOYED"
+	StoryValidating  StoryState = "VALIDATING"
+	StoryReviewReady StoryState = "REVIEW_READY"
+	StoryNeedsFix    StoryState = "NEEDS_FIX"
+)
+
+type Story struct {
+	ID             string     `json:"id"`
+	Name           string     `json:"name"`
+	ProjectID      string     `json:"project_id"`
+	BranchName     string     `json:"branch_name"`
+	DeployConfig   string     `json:"deploy_config"`
+	ValidationJSON string     `json:"validation_json"`
+	Status         StoryState `json:"status"`
+	CreatedAt      time.Time  `json:"created_at"`
+	UpdatedAt      time.Time  `json:"updated_at"`
+}
+
+var validStoryTransitions = map[StoryState]map[StoryState]bool{
+	StoryPending:     {StoryInProgress: true},
+	StoryInProgress:  {StoryShippable: true, StoryNeedsFix: true},
+	StoryShippable:   {StoryDeployed: true},
+	StoryDeployed:    {StoryValidating: true},
+	StoryValidating:  {StoryReviewReady: true, StoryNeedsFix: true},
+	StoryReviewReady: {},
+	StoryNeedsFix:    {StoryInProgress: true},
+}
+
+func ValidStoryTransition(from, to StoryState) bool {
+	return validStoryTransitions[from][to]
+}
diff --git a/internal/task/story_test.go b/internal/task/story_test.go
new file mode 100644
index 0000000..38d0290
--- /dev/null
+++ b/internal/task/story_test.go
@@ -0,0 +1,42 @@
+package task
+
+import "testing"
+
+func TestValidStoryTransition_Valid(t *testing.T) {
+	cases := []struct {
+		from StoryState
+		to   StoryState
+	}{
+		{StoryPending, StoryInProgress},
+		{StoryInProgress, StoryShippable},
+		{StoryInProgress, StoryNeedsFix},
+		{StoryNeedsFix, StoryInProgress},
+		{StoryShippable, StoryDeployed},
+		{StoryDeployed, StoryValidating},
+		{StoryValidating, StoryReviewReady},
+		{StoryValidating, StoryNeedsFix},
+	}
+	for _, tc := range cases {
+		if !ValidStoryTransition(tc.from, tc.to) {
+			t.Errorf("expected valid transition %s → %s", tc.from, tc.to)
+		}
+	}
+}
+
+func TestValidStoryTransition_Invalid(t *testing.T) {
+	cases := []struct {
+		from StoryState
+		to   StoryState
+	}{
+		{StoryPending, StoryDeployed},
+		{StoryReviewReady, StoryPending},
+		{StoryReviewReady, StoryInProgress},
+		{StoryReviewReady, StoryShippable},
+		{StoryShippable, StoryPending},
+	}
+	for _, tc := range cases {
+		if ValidStoryTransition(tc.from, tc.to) {
+			t.Errorf("expected invalid transition %s → %s", tc.from, tc.to)
+		}
+	}
+}
diff --git a/internal/task/task.go b/internal/task/task.go
index 28d65a5..ee79668 100644
--- a/internal/task/task.go
+++ b/internal/task/task.go
@@ -81,6 +81,7 @@ type Task struct {
 	Priority    Priority     `yaml:"priority"   json:"priority"`
 	Tags        []string     `yaml:"tags"       json:"tags"`
 	DependsOn   []string     `yaml:"depends_on" json:"depends_on"`
+	StoryID           string        `yaml:"-"          json:"story_id,omitempty"`
 	State             State         `yaml:"-"          json:"state"`
 	RejectionComment  string        `yaml:"-"          json:"rejection_comment,omitempty"`
 	QuestionJSON      string        `yaml:"-"          json:"question,omitempty"`