What's coming

Welcome — what should we ship next?

Search misses results with apostrophes

Full analytics charts + printable analytics PDF

Google Drive OAuth — push every report to a folder

Richer archive filters (profile, date range, delivery status)

Advanced scheduling (weekly cadence, timezone override)

Access-control enforcement hooks (capability checks on every action)

OneDrive integration

Outbound signed webhooks for generated reports

Accounting API connectors (sandbox-tested)

Agency / white-label mode

Make / Zapier native integrations

Slack notification when a scheduled report fails to send

Report template presets (bookkeeping, marketing, wholesale)

REST API read endpoints for report archive

Domain search + Cloudflare Registrar integration (register & point to products)

App hosting wizard: VPS providers and preinstalled apps

Agent runtime: LLM provider abstraction and metering proxy

Production backbone: Supabase auth, RLS and billing foundation

AI Agents: crew, skills, tools, files and apps

P6: Rollback plan

P6: Parallel-run plan + cutover checklist

P6: Validation / reconciliation reports

P6: Importer - tickets & messages

P6: Importer - invoices & transactions

P6: Importer - services & domains

P6: Importer - products & pricing

P6: Importer - clients to orgs/users

P6: Map WHMCS schema to OMA schema (analysis)

P5: WhatsApp channel integration

P5: Admin agent mode (elevated, audited)

P5: In-panel chat UI

P5: Confirmation flow for destructive/billable actions

P5: agent_sessions + agent_actions tables

P5: Per-user entitlement scoping on every tool call

P5: Action tools (create ticket, manage DNS, restart, request upgrade)

P5: Read-only tools (services, invoices, domains, tickets)

P5: MCP server skeleton wrapping core-api

P4: Idempotency + audit for all adapter calls

P4: Reseller / third-party provider adapter(s)

P4: Payment gateway adapter

P4: Email provider adapter

P4: Registrar / domain adapter

P4: Owned-infra adapter (VPS/server) - pending creds

P4: Stub/dev adapter

P4: Adapter registry + product mapping resolution

P4: Define ProvisioningAdapter contract + capability model

P3: Job run logs + retry policy + admin visibility

P3: External provider sync jobs

P3: Termination queue with safety delays

P3: Unsuspension workflow

P3: Suspension workflow

P3: Renewal reminders (hosting/domains/email)

P3: Payment retry / dunning flow

P3: Recurring invoice generation

P3: Scheduler (cron) infrastructure

P3: Worker service + job queue + jobs table

P2: Admin audit log viewer

P2: Reporting - revenue & service reports

P2: Support admin - queues, assignment, internal notes, SLA

P2: Billing admin - invoices, payments, refunds/adjustments

P2: Services admin - status, metadata, suspend/unsuspend/terminate

P2: Orders - retry provisioning

P2: Orders - list, create, approve, cancel

P2: Product-to-adapter mapping configuration

P2: Product catalog - options, addons, pricing, billing cycles

P2: Product catalog - products CRUD

P2: Client management - detail, roles, impersonation (audited)

P2: Client management - list & search

P2: Admin dashboard (revenue, active services, tickets, health)

P1: Notifications & preferences

P1: Account settings - security (password, sessions, 2FA placeholder)

P1: Account settings - profile

P1: Support - ticket detail, replies, attachments

P1: Support - ticket list

P1: Billing - credits / account balance

P1: Billing - payment methods management

P1: Billing - transactions & payment history

P1: Billing - invoices list + invoice detail

P1: Email / mailbox management views

P1: DNS records view

P1: Domains list + renewal status

P1: Service detail page

P1: Services list page

P1: Client dashboard (summary, to-dos, notices, AI entry point)

P0: Vertical slice (login -> dummy service -> dummy invoice -> audit)

P0: Secrets/env management (.env.example, no client secrets)

P0: Audit log writer (from day one)

P0: Trusted server layer (core-api) + entitlement guard

P0: Role-gated routing ((client) and (admin) groups + middleware)

P0: Supabase Auth integration + session handling

P0: Row-Level Security policies for tenant isolation

P0: Core domain schema (catalog, services, billing, support, audit)

P0: Identity schema (users, organizations, memberships, roles)

P0: Supabase project + local dev + migration workflow

P0: CI pipeline (GitHub Actions: typecheck/lint/build)

P0: Lint/format/typecheck + git hooks

P0: Add Tailwind + shadcn/ui design system in packages/ui

P0: Scaffold Next.js (App Router) + TypeScript in apps/web

P0: Initialize monorepo (pnpm workspaces + Turborepo)

CRITICAL: cpanel_credentials RLS policy is non-functional (using(true))

Missing FK indexes on cpanel_provisioned_service and enhance_db_access_rules

cpanel_provisioned_service.status missing CHECK constraint; local set_updated_at() redefinition is fragile

Inconsistent credential status enums across 5 credential tables

hetzner_provisioned_server breaks the *_provisioned_service naming convention

Migration filename collisions (0013, 0017, 0020 each used twice)

No shared IntegrationAdapter interface — every provider reinvents credentials/provisioning/management

manage-actions.ts is hardcoded to Enhance — cPanel/Hetzner/Proxmox have no service-management surface

Extract useManageAction hook — ~1750 duplicated lines across 22 panel components

failManageAction error helper not adopted outside manage-actions.ts

No shared CredentialForm component — every admin integration page reimplements the same form

No rollback path — all images tagged :latest with zero retention

No staging environment — every change is tested directly against production

No pre-commit hooks — lint/typecheck/test are advisory only until CI

Low test coverage on security/business-critical modules (roles.ts, provisioning.ts, team/store.ts)

feat(admin): resurface setup wizard when a release adds setup

Fix critical and high security audit findings