DevOS v1 + Phase 2: unified resource model, infra ops, website deployment, AI chat ops

- Monorepo: NestJS API (Fastify) + React web (antd/ProComponents) + shared packages
- PostgreSQL/Prisma (unified resources, relations graph, audit, events, jobs)
- Auth/RBAC/workspace isolation, credential vault (AES-256-GCM)
- Servers/SSH, Docker discovery & lifecycle, Job Center
- Websites & deployments (git provider credential clone, env, health verification)
- Domains/DNS (Cloudflare adapter), certificates (TLS probe), monitoring
- Automation (cron/event/webhook HMAC + notifications), AI Gateway, MCP (29 tools)
- AI chat window (LLM function-calling + rules fallback, SSE streaming, approvals)
- Notes: Vditor WYSIWYG markdown editor, non-blocking autosave
- Tests: 35 unit/security tests; UI audit clean (desktop+mobile, deep links)

Docs/devos-v1-phase2/12-CODEX-EXECUTION.md

@@ -0,0 +1,95 @@
+# 12 — Codex Execution Plan
+
+## Rules
+- Continue from `/home/dev/bun/devos`.
+- Do NOT recreate the project.
+- Before changes, inspect current source and Prisma schema.
+- Preserve working functionality.
+- Make incremental migrations only.
+- Do not reset/drop production-like databases.
+- Do not expose secrets.
+
+## Phase A — Audit and hardening
+1. Inspect auth, workspace guard, credential vault, mask utilities.
+2. Remove/disable default admin credential exposure.
+3. Add production secret validation.
+4. Disable public registration by default in production.
+5. Remove test credential.
+6. Upgrade webhook authentication to HMAC + timestamp.
+7. Add security regression tests.
+
+## Phase B — Resource graph
+1. Extend ResourceRelation.
+2. Build relation service.
+3. Add resource relation endpoints.
+4. Add relation UI.
+5. Add project-centric overview.
+
+## Phase C — Infrastructure
+1. Complete server lifecycle.
+2. Complete Docker operations.
+3. Standardize Job Center.
+4. Add monitoring/incident model.
+
+## Phase D — Website/deployment
+1. Git provider connection model.
+2. Repository model.
+3. Credential-based private repo access.
+4. Deployment adapters.
+5. Environment management.
+6. Health verification.
+7. Deployment timeline/logs.
+
+## Phase E — Code/domain/productivity
+1. GitHub/GitLab/Gitea adapters.
+2. Domain/DNS provider abstraction.
+3. Certificate model.
+4. Project/Task completion.
+5. Note/Document completion.
+6. Email account/send/search foundation.
+
+## Phase F — Automation
+1. Event catalog.
+2. Trigger/action schemas.
+3. Sequential workflow executor.
+4. HMAC webhook.
+5. Job Center integration.
+6. Automation UI.
+
+## Phase G — AI
+1. Tool registry.
+2. Tool permission resolver.
+3. Risk engine.
+4. Approval model/UI.
+5. Planner.
+6. Executor.
+7. Verification.
+8. Execution report.
+
+## Phase H — MCP
+Expose selected stable tools through MCP, reusing the exact application services and authorization pipeline.
+
+## Phase I — Unified UX
+1. Global search.
+2. Command palette.
+3. Activity feed.
+4. Job center.
+5. AI command entry.
+6. Project dashboard.
+7. Resource relation navigation.
+
+## Execution protocol
+For each phase:
+1. inspect current implementation
+2. write/update design notes
+3. implement backend
+4. migrate DB safely
+5. implement frontend
+6. add tests
+7. run typecheck
+8. run unit/integration/E2E
+9. update docs
+10. report files changed and verification
+
+## Important
+Do not mark a feature complete merely because its endpoint returns 200. Acceptance requires a complete user-facing workflow and tests.