DevOS v1 + Phase 2: unified resource model, infra ops, website deployment, AI chat ops

- Monorepo: NestJS API (Fastify) + React web (antd/ProComponents) + shared packages
- PostgreSQL/Prisma (unified resources, relations graph, audit, events, jobs)
- Auth/RBAC/workspace isolation, credential vault (AES-256-GCM)
- Servers/SSH, Docker discovery & lifecycle, Job Center
- Websites & deployments (git provider credential clone, env, health verification)
- Domains/DNS (Cloudflare adapter), certificates (TLS probe), monitoring
- Automation (cron/event/webhook HMAC + notifications), AI Gateway, MCP (29 tools)
- AI chat window (LLM function-calling + rules fallback, SSE streaming, approvals)
- Notes: Vditor WYSIWYG markdown editor, non-blocking autosave
- Tests: 35 unit/security tests; UI audit clean (desktop+mobile, deep links)

Docs/devos-v1/04-DATABASE-SCHEMA.md

@@ -0,0 +1,119 @@
+# DevOS v1 Database Schema
+
+## 1. Persistence Strategy
+PostgreSQL is the system of record. Prisma is the initial ORM.
+
+## 2. Core Tables
+
+Recommended initial tables:
+- users
+- workspaces
+- workspace_members
+- resources
+- resource_relations
+- projects
+- project_resources
+- credentials
+- audit_logs
+- events
+- jobs
+- deployments
+- servers
+- websites
+- domains
+- containers
+- monitors
+
+## 3. Resource Table
+
+Conceptual schema:
+
+```text
+resources
+- id
+- workspace_id
+- type
+- name
+- provider
+- status
+- metadata_json
+- created_at
+- updated_at
+```
+
+Use a typed domain table when the resource has substantial operational state; use `resources` for identity, discovery and graph-level common fields.
+
+## 4. Resource Relations
+
+```text
+resource_relations
+- id
+- workspace_id
+- source_resource_id
+- target_resource_id
+- relation_type
+- metadata_json
+- created_at
+```
+
+This allows the resource graph to evolve without embedding every relationship into one giant table.
+
+## 5. Credential Storage
+Store encrypted credential payloads separately from general resource metadata.
+
+```text
+credentials
+- id
+- workspace_id
+- type
+- provider
+- encrypted_data
+- metadata_json
+- created_at
+- updated_at
+```
+
+The application must never log decrypted credential material.
+
+## 6. Audit Log
+
+```text
+audit_logs
+- id
+- workspace_id
+- actor_type
+- actor_id
+- action
+- resource_type
+- resource_id
+- risk_level
+- status
+- request_id
+- metadata_json
+- created_at
+```
+
+## 7. Event
+
+```text
+events
+- id
+- workspace_id
+- event_type
+- resource_id
+- payload_json
+- correlation_id
+- created_at
+```
+
+## 8. Indexing
+At minimum index:
+- workspace_id
+- resource type/status
+- resource relation endpoints
+- event type + created_at
+- audit workspace + created_at
+- deployment website/project + created_at
+- jobs status + scheduled_at
+
+Exact migrations should be generated from the implementation model and reviewed before production.