DevOS v1 + Phase 2: unified resource model, infra ops, website deployment, AI chat ops

- Monorepo: NestJS API (Fastify) + React web (antd/ProComponents) + shared packages
- PostgreSQL/Prisma (unified resources, relations graph, audit, events, jobs)
- Auth/RBAC/workspace isolation, credential vault (AES-256-GCM)
- Servers/SSH, Docker discovery & lifecycle, Job Center
- Websites & deployments (git provider credential clone, env, health verification)
- Domains/DNS (Cloudflare adapter), certificates (TLS probe), monitoring
- Automation (cron/event/webhook HMAC + notifications), AI Gateway, MCP (29 tools)
- AI chat window (LLM function-calling + rules fallback, SSE streaming, approvals)
- Notes: Vditor WYSIWYG markdown editor, non-blocking autosave
- Tests: 35 unit/security tests; UI audit clean (desktop+mobile, deep links)

Docs/devos-v1/03-DOMAIN-MODEL.md

@@ -0,0 +1,105 @@
+# DevOS v1 Domain Model
+
+## 1. Resource
+
+```typescript
+interface Resource {
+  id: string
+  type: ResourceType
+  name: string
+  workspaceId: string
+  provider?: string
+  status: ResourceStatus
+  metadata: Record<string, unknown>
+  createdAt: Date
+  updatedAt: Date
+}
+```
+
+## 2. Resource Types
+Initial model:
+- Server
+- Domain
+- Website
+- Repository
+- Database
+- Container
+- EmailAccount
+- Project
+- Task
+- Note
+- Document
+- Backup
+- Deployment
+- Monitor
+- Credential
+
+## 3. Core Entities
+
+### Workspace
+Tenant/security boundary for users and resources.
+
+### Project
+Business/work boundary connecting repositories, websites, servers, databases, deployments, domains, email and monitoring.
+
+### Server
+Managed compute target. Supports SSH connection and infrastructure discovery.
+
+### Website
+Deployable application resource associated with domain, repository, deployment, server/container, database, SSL, environment, logs, monitoring and backup.
+
+### Deployment
+A concrete execution of deploying a repository/version to a target.
+
+### Credential
+Encrypted provider or infrastructure secret reference. Secret material is never exposed as ordinary resource metadata.
+
+### Task
+Work item associated with a project and optionally related to resources and automations.
+
+## 4. Relationships
+
+```text
+Workspace
+ ├── Projects
+ ├── Resources
+ ├── Users
+ ├── Credentials
+ └── Automations
+
+Project
+ ├── Repository*
+ ├── Website*
+ ├── Server*
+ ├── Database*
+ ├── Deployment*
+ ├── Domain*
+ ├── Task*
+ └── Monitoring*
+```
+
+## 5. Actions
+Every mutable operation should be modeled as an auditable action:
+- server.exec
+- server.restart
+- server.installPackage
+- website.deploy
+- website.logs
+- domain.updateRecords
+- deployment.create
+- container.restart
+
+## 6. Events
+Canonical event names should use `<resource>.<verb>` or `<domain>.<verb>`:
+- deployment.created
+- deployment.started
+- deployment.success
+- deployment.failed
+- server.online
+- server.offline
+- website.down
+- website.recovered
+- email.received
+- github.push
+- task.created
+- task.completed