# 12 — Codex Execution Plan

## Rules
- Continue from `/home/dev/bun/devos`.
- Do NOT recreate the project.
- Before changes, inspect current source and Prisma schema.
- Preserve working functionality.
- Make incremental migrations only.
- Do not reset/drop production-like databases.
- Do not expose secrets.

## Phase A — Audit and hardening
1. Inspect auth, workspace guard, credential vault, mask utilities.
2. Remove/disable default admin credential exposure.
3. Add production secret validation.
4. Disable public registration by default in production.
5. Remove test credential.
6. Upgrade webhook authentication to HMAC + timestamp.
7. Add security regression tests.

## Phase B — Resource graph
1. Extend ResourceRelation.
2. Build relation service.
3. Add resource relation endpoints.
4. Add relation UI.
5. Add project-centric overview.

## Phase C — Infrastructure
1. Complete server lifecycle.
2. Complete Docker operations.
3. Standardize Job Center.
4. Add monitoring/incident model.

## Phase D — Website/deployment
1. Git provider connection model.
2. Repository model.
3. Credential-based private repo access.
4. Deployment adapters.
5. Environment management.
6. Health verification.
7. Deployment timeline/logs.

## Phase E — Code/domain/productivity
1. GitHub/GitLab/Gitea adapters.
2. Domain/DNS provider abstraction.
3. Certificate model.
4. Project/Task completion.
5. Note/Document completion.
6. Email account/send/search foundation.

## Phase F — Automation
1. Event catalog.
2. Trigger/action schemas.
3. Sequential workflow executor.
4. HMAC webhook.
5. Job Center integration.
6. Automation UI.

## Phase G — AI
1. Tool registry.
2. Tool permission resolver.
3. Risk engine.
4. Approval model/UI.
5. Planner.
6. Executor.
7. Verification.
8. Execution report.

## Phase H — MCP
Expose selected stable tools through MCP, reusing the exact application services and authorization pipeline.

## Phase I — Unified UX
1. Global search.
2. Command palette.
3. Activity feed.
4. Job center.
5. AI command entry.
6. Project dashboard.
7. Resource relation navigation.

## Execution protocol
For each phase:
1. inspect current implementation
2. write/update design notes
3. implement backend
4. migrate DB safely
5. implement frontend
6. add tests
7. run typecheck
8. run unit/integration/E2E
9. update docs
10. report files changed and verification

## Important
Do not mark a feature complete merely because its endpoint returns 200. Acceptance requires a complete user-facing workflow and tests.