# Progress

Last updated: 2026-08-26

## Completed

- Audited the repository: it was an unborn Git repository with no reusable code.
- Defined persistent engineering rules in `AGENTS.md`.
- Added a minimal FastAPI liveness endpoint with request IDs and standard application errors.
- Added a deterministic, deny-by-default action policy with autonomy and risk controls.
- Added initial policy unit tests.
- Added production-shaped Nginx, PostgreSQL/pgvector, Redis, and core API Compose configuration. PostgreSQL and Redis are not host-published.
- Added a safe environment template; no provider integration is represented as connected.
- Added workspace-scoped SQLAlchemy models and an initial Alembic migration for identity, RBAC,
  approvals, idempotency, append-only audit events, and the transactional outbox.
- Added Argon2 password hashing and canonical payload hashes used to bind approvals.
- Added approval lifecycle checks for exact payload, expiry, permission, workspace, and one-time use.
- Added Python CI for lint and tests.
- Implemented atomic one-time owner setup with the default role/permission catalogue.
- Implemented password login, hashed device sessions, secure cookie attributes, generic failures,
  login history, CSRF-protected logout, and chained authentication audit events.
- Replaced the dynamic initial migration with explicit immutable Alembic operations.
- Added server-side role/permission resolution scoped through active workspace membership.
- Added current-user, device-session history, and logout-all endpoints without exposing token hashes.
- Added database/Redis readiness plus honest AI/browser `unconfigured` health states.
- Pinned current container versions and added a one-shot migration service, read-only API filesystem,
  no-new-privileges, private data services, and Docker-context secret exclusions.
- Added an out-of-band bootstrap capability, request-ID bounds, active-user/membership checks,
  explicit multi-workspace login selection, and Redis login throttling.
- Added composite workspace foreign keys and database status/decision/counter constraints.
- Serialized audit appends through a locked workspace head, added chain verification, audited session
  revocation, and made the audit table append-only with database triggers.
- Split app/data networks, limited migration secrets to the database URL, bound Nginx to localhost,
  blocked detailed edge health, and routed only when aggregate readiness passes.
- Added automated Alembic upgrade/check/downgrade/re-upgrade tests and a PostgreSQL migration CI job.
- Persisted and locked a seeded installation-state row so owner bootstrap is atomic and permanently
  one-time even if the bootstrap file is mistakenly left mounted.
- Split login throttling into source limits and invalid-account counters so attacker failures cannot
  deny a correct password; successful authentication clears the account failure state.
- Made login evidence append-only with database triggers, protected Redis with a mounted ACL file,
  and stopped trusting client-supplied forwarded IP chains at Nginx.
- Added a PostgreSQL CI probe for the installation seed and audit/login append-only behavior.
- Added a responsive React/TypeScript dashboard shell with first-run owner setup, login,
  authenticated workspace state, server-resolved permission summary, CSRF logout, and explicit
  `unconfigured`/`planned` states instead of simulated product data.
- Added a locked frontend dependency graph, type checks, component/API tests, production asset
  build, non-root read-only web container, and gateway routing between the web and versioned API.
- Browser-smoke-tested desktop setup/login/dashboard rendering and the mobile navigation breakpoint;
  fixed the mobile sign-out control found during visual verification.
- Added an isolated, service-authenticated AI planning service with a typed tool registry and
  OpenAI Responses structured-output adapter. Missing provider credentials remain explicitly
  `unconfigured` and provider response storage is disabled.
- Added workspace-scoped durable executions and execution steps, Core-owned reauthorization of
  every proposed tool, token-usage persistence, audit events, and CSRF-protected cancellation.
- Added only two low-risk read tools (`system.status.read` and `workspace.profile.read`) to the
  initial allowlist, plus an original-actor runtime with repeated authorization/schema checks,
  dependency ordering, timeouts, verified checkpoints, cancellation fencing, audit, and safe replay.
- Added explicit Phase 2 migrations plus cross-workspace, service-authentication,
  plan-validation, provider-privacy, durable-blocked-state, and cancellation tests.
- Added a data migration that grants runtime permissions to existing default roles while fresh owner
  setup reuses the migration-seeded global permission catalogue.
- Isolated the AI service from the data network while allowing provider egress, and mounted the
  Core-to-AI token and OpenAI credential as files rather than process arguments.
- Added workspace-scoped runtime agents with configuration versions, explicit permission/tool
  grants, schedules, budgets and limits, six autonomy levels, manager/escalation hierarchy with
  cycle rejection, lifecycle actions, duplication, deletion safeguards, and auditable delegation.
- Owner setup and the upgrade migration create/backfill a Personal Executive Assistant with read
  grants and approval-required autonomy; no provider model is hard-coded or implied connected.
- Bound new executions to an active agent and intersect actor permissions, agent permissions, and
  agent tools both during planning and immediately before each runtime step.
- Replaced dashboard placeholder agent/execution counts with authenticated persisted state and kept
  provider-dependent commands visibly disabled until the provider is configured.
- Added workspace-owned model profiles with honest provider health, permission/CSRF enforcement,
  reference validation, auditing, migrations, and per-agent planning model resolution without
  storing credentials.
- Added a responsive premium Agent Studio for model-profile setup, least-privilege agent creation,
  lifecycle versioning, and duplication, plus a safe command surface wired to durable executions.
- Browser-tested setup, dashboard, model routing, agent creation/activation/duplication, and the
  390px Agent Studio breakpoint; fixed an asynchronous setup form-event lifecycle defect found in
  the real browser and added regression coverage.
- Added `docs/APPLICATION_SUMMARY.md` as the consolidated product, architecture, security, API,
  deployment, verification, roadmap, and limitation handoff for the current repository state.
- Added workspace-owned persistent computer profiles, sessions, exclusive control leases, browser
  actions, verified screenshot artifacts, ordered checkpoints, and durable workspace emergency-stop
  state with a reversible migration and upgrade backfill.
- Added a service-authenticated isolated Computer Agent using pinned Playwright/Chromium persistent
  contexts, runtime manifests, fencing tokens, request deduplication, DOM-first browser tools, human
  input, JPEG frames, artifact path containment, and public-destination URL checks.
- Added Core-owned browser tool contracts, actor/agent permission intersection, autonomy/risk policy,
  exact approval-payload binding, required idempotency keys, redacted persistence, post-action
  verification, takeover/return, pause/resume/stop, explicit recovery, and global emergency stop.
- Added the premium responsive Computer control room with session history, live view, browser
  navigation/observation, action and checkpoint timeline, approval cards, artifact links, human
  takeover/return, lifecycle controls, recovery, and emergency controls.
- Hardened the Computer Agent Compose service with no host port/data network, separate browser
  egress, non-root execution, read-only root, dedicated volumes, dropped capabilities,
  `no-new-privileges`, resource limits, and the upstream Playwright seccomp profile.
- Exercised the Computer control room against real local Core/worker/Vite services and Chromium at
  desktop and 390px widths. The pass found and fixed conflicting worker request IDs during
  return-to-AI and a mismatched action-timeline field.
- Added encrypted RFC 6238 TOTP MFA, replay-resistant verification, one-use recovery codes,
  operator-assisted password reset, password change, idle/absolute session expiry, token rotation,
  per-device revocation, and global session invalidation with audit evidence.
- Added the responsive `/security` product route plus MFA-aware login, MFA enrollment/disable/
  recovery, password change, session rotation, and device-revocation UI.
- Replaced fence-only Core-to-Computer trust with Ed25519-signed, audience/scope/request/workspace/
  session/fence-bound capabilities lasting at most 45 seconds.
- Added safe interrupted-write handling and human reconciliation: uncertain actions remain `unknown`,
  the lease is released, and the computer pauses instead of retrying or claiming success.
- Added the production maintenance loop for expired leases/approvals, stale idempotency state, and
  retention-based physical artifact deletion with worker retry.
- Added standard validation/unhandled API errors and production response security headers.
- Split migration/runtime PostgreSQL identities in Compose and added post-migration grants that
  revoke runtime DDL and audit/login evidence mutation.
- Added a TLS production overlay, CSP/HSTS/origin signal/rate-limit gateway controls, bounded
  container logs/resources, security scanning/CodeQL/SBOM CI, and static infrastructure tests.
- Added Age-encrypted database/profile/artifact backups and an isolated networkless PostgreSQL
  restore-drill script. The Docker-dependent procedure remains unexecuted on this host.
- Replaced the browser-profile-as-computer assumption with a first-class dedicated VM control plane:
  every activatable runtime agent owns exactly one computer record plus its private browser profile.
- Added workspace-scoped Linux/Windows OS templates, CPU/RAM/disk and guest-privilege configuration,
  persistent-disk/start policy, deny-host network policies, workspace resource quotas, VM snapshots,
  lifecycle operations, metrics, and a reversible upgrade/backfill migration.
- Added `ComputeProvider` and `ComputerProvisioningService`. Core alone can call a restricted
  libvirt/Proxmox/cloud gateway; operations are persisted first, idempotent, audited, followed by a
  provider status verification, and remain `blocked`/`unknown` when configuration/evidence is absent.
- Changed initial owner/agent behavior so no agent is active while its real computer is
  `unconfigured`; browser sessions also reject profile/agent/computer mismatches and non-running VMs.
- Expanded Agent Studio with OS template, resources, browser, start policy, privilege, computer
  autonomy, persistent disk, and network selection. The Computers control room now shows the VM fleet
  and honest hypervisor state above the existing live browser/takeover surface.
- Added dedicated-computer API coverage for honest unconfigured state, activation gating, exact
  one-agent/one-computer assignment, Linux/Windows provisioning, Windows license confirmation,
  provider verification, lifecycle/snapshot idempotency, and host-network-policy rejection.
- Added fail-closed production startup validation across Core, AI Agent, and Computer Agent for
  mounted secrets, authenticated data services, the external HTTPS origin, real compute gateway,
  owner-selected model, safe storage roots, and headless browser operation.
- Made aggregate readiness require authenticated health from both internal workers in production
  and reject unexpected public Host headers while retaining loopback-only container health probes.
- Added a secret-safe production preflight that verifies protected files, independent PostgreSQL
  roles, Redis ACL alignment, TLS expiry, clean/remote-bound Git revision, Docker/Compose, and can
  emit exclusive JSON evidence only after every check passes.
- Added exact reviewed Python runtime constraints to all service images, upgraded cryptography to
  50.0.0 after a local advisory finding, and obtained clean Python and web dependency audits.
- Added provider-outage coverage proving ambiguous VM lifecycle writes stay `unknown`/`recovering`
  and are not dispatched twice on an idempotent replay.

## Current work

- Dedicated AI computer: the VM control plane and provider contract are implemented, but no real
  hypervisor is configured on this workstation. Production work remains for a deployed KVM/libvirt
  or Proxmox gateway, patched golden images, the in-guest daemon/boot service, encrypted VM/profile
  disks, enforced guest egress, secure live desktop/terminal transport, and isolation/recovery drills.
- Phase 3 Agent Builder: execution budgets, queued delegation, specialist templates, and
  version-history UI remain.
- Project intelligence and specialist development-agent records.
- Phase 1 production-environment evidence and remaining RBAC administration controls.

## Test status

- Local Ruff check: passed on 2026-08-26.
- Local pytest: 88 passed on 2026-08-26, including real Chromium runtime coverage and dedicated-VM
  migration/API tests.
- Frontend TypeScript build check: passed on 2026-08-26.
- Frontend Vitest: 8 passed on 2026-08-26.
- Frontend production bundle: passed on 2026-08-26.
- Python dependency integrity (`pip check`): passed on 2026-08-25.
- Python runtime dependency audit (`pip-audit`): no known vulnerabilities on 2026-08-26.
- Web locked dependency audit (`pnpm audit --audit-level high`): no known vulnerabilities on
  2026-08-26.
- OpenAI planning tests use an injected provider-compatible fake; no live provider request was made.
- CI workflow is present but has not run because the repository has no configured remote/push.
- Migration upgrade, drift check, downgrade, and re-upgrade pass automatically against SQLite.
- PostgreSQL migration and constraint CI is configured but has not run because the repository has
  no remote.
- PostgreSQL migration and trigger behavior have not been executed against a live local database.
- Docker/Compose cannot be verified because Docker is not installed in the current workstation shell.
- Real-browser Computer control-room QA passed locally against live Core, Computer Agent, Vite, and
  Chromium at desktop and 390px widths; this is not a substitute for automated container E2E.
- Production gate: **not passed**.

## Blocked items

- Clean container build and PostgreSQL/Redis integration verification require a Docker-capable host.
- External integrations require provider credentials and owner authorization; all remain `unconfigured`.
- WhatsApp Web requires owner QR authentication.
- Deployment URL, DNS, TLS, firewall, backups, and restore testing require the target VPS.

## Known issues

- The authentication lifecycle and Security Center exist, but a production-like abuse/recovery
  campaign and full product-wide RBAC administration remain incomplete.
- Separate migration/runtime PostgreSQL identities and audit restrictions are defined and statically
  tested, but remain a production blocker until verified on live PostgreSQL.
- Compose includes the initial AI planner and Computer Agent, but not voice, queue, or domain
  workers. The Computer service has only static Compose verification on this workstation.
- The dashboard and Agent Studio are functional for implemented features; provider-dependent
  commands and later module navigation remain visibly disabled until their backing services exist.
- Execution instructions and plans are currently stored as plaintext; retention controls and
  encrypted sensitive-payload storage remain production blockers.
- Agent/delegation instructions are also plaintext. Model identifiers are now backed by an
  owner-managed routing catalogue, but profile-level capability/fallback policy remains incomplete.

## Next tasks

1. Execute the initial migration and PostgreSQL-only invariant probe on a Docker-capable host.
2. Deploy the restricted KVM/libvirt or Proxmox provider gateway, configure verified Ubuntu and
   licensed Windows templates, and pass real VM provisioning/persistence/host-isolation tests.
3. Install and authenticate the in-guest computer daemon, then add secure desktop, terminal,
   filesystem, process, application, clipboard, upload/download, and package-management tools through
   Core policy—not direct LLM-to-hypervisor access.
4. Verify Computer Agent isolation, persistence, emergency stop, and recovery with encrypted VM and
   profile storage plus controlled guest/browser egress.
5. Add a durable browser execution queue and automatic worker crash detection; exercise the current
   unknown-outcome reconciliation and signed capability paths under injected failures.
6. Verify the separate PostgreSQL migration/runtime identities and audit privileges.
7. Run production authentication abuse/recovery tests and review login limiting policy.