devos/Docs/devos-v1-phase2/12-CODEX-EXECUTION.md

12 — Codex Execution Plan

Rules

• Continue from /home/dev/bun/devos.
• Do NOT recreate the project.
• Before changes, inspect current source and Prisma schema.
• Preserve working functionality.
• Make incremental migrations only.
• Do not reset/drop production-like databases.
• Do not expose secrets.

Phase A — Audit and hardening

1. Inspect auth, workspace guard, credential vault, mask utilities.
2. Remove/disable default admin credential exposure.
3. Add production secret validation.
4. Disable public registration by default in production.
5. Remove test credential.
6. Upgrade webhook authentication to HMAC + timestamp.
7. Add security regression tests.

Phase B — Resource graph

1. Extend ResourceRelation.
2. Build relation service.
3. Add resource relation endpoints.
4. Add relation UI.
5. Add project-centric overview.

Phase C — Infrastructure

1. Complete server lifecycle.
2. Complete Docker operations.
3. Standardize Job Center.
4. Add monitoring/incident model.

Phase D — Website/deployment

1. Git provider connection model.
2. Repository model.
3. Credential-based private repo access.
4. Deployment adapters.
5. Environment management.
6. Health verification.
7. Deployment timeline/logs.

Phase E — Code/domain/productivity

1. GitHub/GitLab/Gitea adapters.
2. Domain/DNS provider abstraction.
3. Certificate model.
4. Project/Task completion.
5. Note/Document completion.
6. Email account/send/search foundation.

Phase F — Automation

1. Event catalog.
2. Trigger/action schemas.
3. Sequential workflow executor.
4. HMAC webhook.
5. Job Center integration.
6. Automation UI.

Phase G — AI

1. Tool registry.
2. Tool permission resolver.
3. Risk engine.
4. Approval model/UI.
5. Planner.
6. Executor.
7. Verification.
8. Execution report.

Phase H — MCP

Expose selected stable tools through MCP, reusing the exact application services and authorization pipeline.

Phase I — Unified UX

1. Global search.
2. Command palette.
3. Activity feed.
4. Job center.
5. AI command entry.
6. Project dashboard.
7. Resource relation navigation.

Execution protocol

For each phase:

1. inspect current implementation
2. write/update design notes
3. implement backend
4. migrate DB safely
5. implement frontend
6. add tests
7. run typecheck
8. run unit/integration/E2E
9. update docs
10. report files changed and verification

Important

Do not mark a feature complete merely because its endpoint returns 200. Acceptance requires a complete user-facing workflow and tests.