# Implementation Backlog

Priority reflects dependency and safety, not marketing order.

## P0 — Phase 1 foundation

- Workspace, user, membership, role, permission, device/session, login-event migrations.
- Owner bootstrap, password hashing, reset, optional TOTP/WebAuthn architecture, session revocation.
- Central RBAC authorization and cross-workspace negative tests.
- Append-only audit event and canonical action payload hashing.
- Approval requests bound to actor, action hash, expiry, risk, and one-time decision.
- Transactional outbox and idempotency records.
- Dependency readiness, structured logging, CI, backup/restore scripts.
- Authenticated dashboard and onboarding state.

## P0 — Dedicated AI computers

- Deploy a restricted KVM/libvirt or Proxmox compute-provider gateway; Core must remain the only
  application service authorized to request VM mutations.
- Build, patch, sign, and verify Ubuntu Desktop, Ubuntu Server + Desktop, Debian Desktop, Windows 11,
  and Windows Server 2025 golden images. Windows templates require operator-confirmed licensing.
- Install an authenticated in-guest control daemon and boot service for terminal, application,
  file, screenshot, browser, health, and graceful-shutdown operations without exposing the
  hypervisor, host filesystem, Docker socket, database, Redis, or platform secrets to a guest.
- Prove one-to-one agent/VM ownership, encrypted persistent disk/profile storage, deny-host network
  policy, per-workspace quotas, idempotent lifecycle, snapshots, restore, resize, crash recovery,
  backup/deletion, and host/guest plus guest/guest isolation in a production-like environment.
- Add streamed display and atomic human takeover for the full desktop. The existing Chromium
  runtime remains an in-VM browser tool; it is not accepted as the dedicated computer itself.

## P1 — AI and runtime agents

- Provider-neutral model settings and encrypted provider credentials.
- Supervisor state machine, typed tool registry, policy boundary, execution checkpoints.
- Independent agent identity, instructions, model, tools, permission/memory scopes, queues, cost, and status.
- Agent builder, hierarchy, delegation, templates, and audit trail.

## P1 — Computer and communication

- Run isolated persistent Chromium profiles inside each assigned VM with fencing locks, recovery,
  and download quarantine.
- Authenticated live view, atomic human takeover, pause/resume, emergency stop.
- WhatsApp Web connector after owner QR authorization; send idempotency and verification.
- Google/Microsoft OAuth email/calendar connectors and unified inbox.

## P2 — Product modules

- Contacts, CRM, tasks, reminders, conditional follow-ups, schedules, automations.
- Memory with pgvector, retention, deletion/export, and retrieval authorization.
- Voice calling with consent/recording controls.
- Global search, analytics, cost controls, saved commands, and PWA preparation.

## Production gate

- Security hardening, adversarial tests, E2E scenarios, load tests, observability, alerts.
- VPS deployment, HTTPS/firewall, encrypted backups, tested restore, reboot recovery.