#Missing backend dependencies
Phase 9 (2026-10-17): Pair 2 started the server panel — Step 0 groundwork (Ready-only, permission per screen incl. Docker / panel update / service monitoring, OSS data passed through, oss_message errors). Screens come step by step.
Phase 8 status (2026-10-16 10:59, Pair 2): 8.1 (all 5 cloud providers), 8.3, 8.4, 8.5, 8.7, 8.9–8.12 built & pushed. 8.8 checks built except plan active / server limit (wait for Phase 7) and provider enabled by admin (waits for the admin panel). Pending: 8.2 managed (waits for Billing — no user screen anyway, D-36) and 8.6 Lite (waits for Phase 10 + Phase 12 Control Panel). Still needs the OSS installer update before install-based ways go live.
Phase 8 Step 4 (2026-10-16): 8.1 cloud server — all five providers built (DigitalOcean, Vultr, Hetzner, Linode, Lightsail) (Pair 2, API71–75): account → region → size + Ubuntu + stack + optional SSH key → Creating → install progress; Retry on the same droplet; Delete can also delete the droplet. Other providers one by one. Cloud server.
Phase 8 Step 3 (2026-10-16): 8.3 root password built (Pair 2, API69–70): name + stack + public IPv4 + SSH port + root password → Central checks Ubuntu/CPU over SSH, starts the installer → same progress as the install command; Retry asks for the password again. Install APIs renumbered: 66 retry, 67 delete (one delete for all servers). Root password.
Phase 8 Step 2 (2026-10-15): 8.4 install command built locally (Pair 2 33bd7c0, API65–68, not pushed): name + stack, official OSS command, live progress, Ready → create admin in the panel, Retry/Delete on failure. Needs the OSS installer update before release. Force cleanup dropped. Install command.
Phase 8 latest (2026-10-14): Step 0 pushed (2899bd1); 8.5 Connect an existing OSS panel + server list/view built and pushed (Pair 2 API62–64, up to 5be6dec; response field system_info (was facts); tested live on an OSS test server; API address (https://api.…) + token only — panel web address refused with oss_not_a_panel). Next: 8.4 → 8.1 → 8.3. Connect a panel.
Phase 8 build plan (Pair 2, 2026-10-12): Pair 2 builds Servers in steps — Step 0 foundation → 8.5 connect OSS panel → 8.4 install command → 8.1 own cloud account → 8.3 root password; 8.2 managed + 8.6 Lite later. 8.8 plan-active/server-limit checks skipped until Phase 7 is built. Step 0 foundation built locally 2026-10-13 (4a375e9, not pushed) — no server endpoints yet, so no server screen can be wired. Account and organization delete are now refused while servers exist. Add a server.
Billing readiness (2026-10-10): B6.1 gateway configuration foundation and enabled-metadata API built on Pair2, pushed. No real credentials configured, all gateways initially disabled. B6.2 own-account billing details GET/PUT also built and pushed; B6.3 own-account USD balance API also built and pushed; B6.4 Add credits built locally/not activated; B6.5–B6.13 remain unbuilt here; checkout/payment capture/webhook verification/admin gateway screens not implied. Metadata screen states.
Foundation, Authentication, Account (except channels/server alerts), and most of Organization & Members are built. Pair 1 explicitly confirms B4.1–B4.5 and B4.8–B4.11 on 2026-10-09. Other modules below still need their APIs; this page records remaining gaps rather than treating all endpoints as missing. This page lists each capability, why it's needed, and what's known. The frontend won't fake any of them.
Priority: P0 blocks the first usable release · P1 needed for launch · P2 later.
| Feature | Required API (capability) | Why | Current status | Suggested backend work | Frontend impact | Priority |
|---|---|---|---|---|---|---|
| Foundation | MySQL, Redis, Horizon, Sanctum, CORS | Everything | ✅ BUILT 2026-10-08 V8 requirement — the first V8 code to exist. Pair 2 built it and pushed it to GitHub main; MySQL sv_central_2, Redis, Horizon, Sanctum, Telescope, CORS, logs, translations, Pint + PHPStan + Pest. The API lives at /api/v1. Two stack changes landed the same day: auth Passport → Sanctum, database MariaDB → MySQL 8.4 LTS | Nothing — done. Next blocker is Phase 2 (login, refresh token) | Frontend Phase 0 can now be built against a real server; no session flow until Phase 2 | |
| Session contract | Login/refresh/logout responses + the cookie/BFF decision | Frontend auth | "Next.js login flow: decided later" | Decide D-1, document token responses | Phase 1 blocked | P0 |
| Authentication | Register, verify, login, 2FA, OAuth, reset, invitation password, IP approval, refresh, logout, current user | Entry | ✅ BUILT 2026-10-09 (Pair 1, main) V8 requirement — endpoints under /api/v1/auth/*, login returns tokens in the body, stable error codes published. One gap left: the permission middleware is built with Phase 4 roles; and no current-user / me endpoint is named in the built list — though login and the profile both return the user with their organizations, so there may be nothing to wait for. ✅ Invitation password (2.6) is built (2026-10-09, with 4.3) | Publish me, or confirm login's user + organizations is the only source. Permission middleware is now built (B4.5/B4.9–B4.11) | Phase 1 ✅ | P2 — entry, invitations and organization permission checks are built |
| Account | Profile/security/history/channels | Account pages | ✅ B3.1–B3.16 built Pair2; SectionC pushed2026-10-10 | B3.17 alerts wait for Servers; channel attachments/groups wait Phase11. Account-security IP-added channel routing conflicts with Bhavik | Built channels | core done / routing conflict |
| Organizations | CRUD/list/default/delete | Tenant context | ✅ B4.1/B4.2 built, Pair 1 | Server-deletion guard waits for Phase 8 | Organizations screens buildable; default never deletable | done / guard pending |
| Permission catalog + my permissions | Catalog, role grants, visible menu | Menus, guards | ✅ B4.9–B4.11 built; /organizations/{organization}/permissions and /menu published | A separate role/plan/expiry deny-reason map is not promised | Render catalog and menu from API data; handle 403 | catalog done / deny-reasons open |
| Roles | CRUD | Access | ✅ B4.5 built, Pair 1 | Nothing for basic roles | Role editor buildable | done |
| Members + invitations | List/search/invite/resend/cancel/accept/update/remove/leave | Teams | ✅ B4.3/B4.4 built, Pair 1 | Invite-linked auto-join still conflicts with Bhavik's explicit Accept requirement; do not treat approval as inferred | Members screens buildable with conflict retained | basic API done / Accept decision open |
| Audit log | Organization list + type/action filters | Attribution | ✅ B4.8 built, Pair 1; shared B3.12 table | Transfer start/accept/cancel recorded; share events later with B4.6 | Audit log buildable with activity-view | done / later events pending |
| Server link + create | Six ways in (own cloud account, managed, root-password install, install command, connect a panel, ServerAvatar Lite), stack choice, pre-create checks, live install progress, token handling, the stored link record | Core product | Requirements complete — backend Phase 8 (2026-10-06, Pair 1) V8 requirement. Q1 and Q2 are answered (8.11 stored fields incl. a one-time copy from OSS; 8.10 the installer saves the token in both places). No endpoints. Still undecided: refreshing server data / offline status / "needs new token" (Q3), the unclaimed server, and which Ubuntu versions are offered | Publish the endpoints; decide the refresh story (Q3) before the server list is built | Phase 5 | P0 |
| Plans + subscription | Requirements complete — backend Phase 7 (2026-10-03, extended 2026-10-05 to 7.25) V8 requirement: admin-managed plans with a per-plan feature list and renameable names, one plan per owner across all their organizations, paid from credit (tax added, saved as a charge), trial that ends in a must-buy gate, change with unused days returned as credit, downgrade checks, cancel / resume, auto-renew, reminders, the V7 expiry flow (warning day: managed servers powered off at the provider · lock day: managed servers deleted at the provider, self-managed only removed from Central, account + members locked), automatic unlock on payment, coupons, price / feature / limit changes applying at the next renewal, archive, per-user custom plans, free forever, all plans common to all users (a per-plan user list only for migrating V7 "restructured" accounts, 7.14), enterprise form, activity log | FE: Plans & subscription | Rules written, no endpoints: no plan catalog, no admin plan management, no feature-list API. How credit is bought is now defined by Phase 6 (2026-10-05). 7.17 added 2026-10-05: a price change warns existing users by email and applies at their next renewal | Publish the catalog + admin endpoints and the feature list; settle tax and currency (D-22) | Phase 6 | P0 |
| Cloud providers | ✅ B5.1 list built Pair 1, 2026-10-10: name search, provider/status filters, translated labels, 10/page max 50 | FE: Integrations | Connect/Edit/Check B5.2–B5.4 built on Pair1; B5.5 endpoint partial; usage guard/warning and Git/storage activity pending; usage count not returned | Build list+Connect+Edit+Check on Pair1; no invented usage data/blocker. D-27 organization placement resolved | list done / mutations pending | P1 |
| Create server at a provider | Draft only — moved to the Servers phase on 2026-10-03 V8 requirement: start-up script installs OSS, statuses Creating / Installing OSS / Ready / Failed, Retry or delete at the provider | FE: Integrations §B | Parked draft, no endpoints | Write it in the Servers phase; answer Q13 (OSS registration is open after an automatic install) before the first automatic install | Phase 5 | P0 security (Q13) |
| Git & backup storage accounts | Specified by backend Phase 5 (2026-10-03) V8 requirement: Central holds the form and a note only; secrets are pushed to each server's OSS, with per-server results, update-everywhere and remove-from-one-or-all | FE: Integrations | Rules written, no endpoints published. Q9–Q12 open | Publish endpoints; decide tokens vs one-click login and what happens to V7 connections | Phase 8 | P1 |
| Organizations, members, roles, share, transfer | Backend Phase 4 | FE: Organization & Members | ✅ B4.1–B4.5, B4.7–B4.11 built (Pair 1, 2026-10-09) | B4.7 built including deletion safety; preview email delivery unverified; unpaid-charge/recipient-plan guards not enforced until Phases 6–7; B4.6 share + server-deletion guard wait for Phase 8; D-28 migration choice remains | Core Phase 3 buildable; do not expose unbuilt flows | core done / remaining flows pending |
| OSS client + proxy | Per-server client (in the V8 plan) + a proxy/feature endpoints with permission + audit | Server Details | Client designed (§2.2), built with the Servers phase, not the Foundation phase (2026-10-03). Proxy not designed | Decide D-10, build | Phase 5 | P0 |
| Plan catalog | Plans with cycles, prices, currency, limits, features, eligibility, archived state, and the pending change (new price / lower limit) with its date | Plans screen without hard-coding; the current plan may be archived or user-specific and absent from the catalogue | Doesn't exist even in V7 (constants) | Model + admin management. Return the current plan's own data separately from the catalogue, plus any pending change | Phase 6 | P1 |
| Admin: per-user plan + extra servers | Set one user's custom price / limits / cycle / expiry days (7.20); grant a user extra servers (7.21 — replaced "free forever" on 2026-10-08; server limit = plan + extras, kept across plan changes) | V7 features the backend kept | Rules written 2026-10-05 V8 requirement, no endpoints. Admin screens generally are still "admin panel phase" | Publish them with the admin plan endpoints | Phase 6 | P2 |
| Subscription | Current + usage, create, change, preview (credit back, amount, new end date), renew, cancel, resume, expiry date + status active / expired / locked | Commercial | Specified — Phase 7 (7.7, 7.25, 2026-10-05) V8 requirement. Ownership answered (D-3: the owner). The old "V8 should expose an explicit status" gap is closed. No endpoints | Publish the endpoints; return the expiry date and status, never a day counter | Phase 6 | P1 |
| Billing | Wallet (paid/free/promo), top-up with min + $4,000 max + promo + tax, gateway execute/verify, receipts, payments-and-charges history, Stripe cards, auto-recharge, low-credit reminder, account billing details | Payment | Requirements complete — backend Phase 6 (2026-10-05, Pair 1) V8 requirement: Stripe / PayPal / Instamojo with per-gateway on/off + test/live (D-5 answered), credit added only after the gateway confirms and credited once, server credits dropped (V7's "+3 per payment" is off the plan's server limit; it survives as a separate managed-server limit, which both docs confirmed on 2026-10-06 — D-32, invisible to users). B6.1 metadata and B6.2 own-account GET/PUT built locally, not pushed; wallet balance B6.3 built locally; payments/history/receipts unbuilt | Publish remaining billing/payment endpoints; answer tax/currency (D-22) | Phase 6 | P0 |
| Managed servers (hourly) | Admin price list per provider / region / size, create with a credit check, hourly charge job, usage per server | A second kind of server, billed by the hour | Requirements complete — backend Phase 6 (2026-10-05) V8 requirement: DigitalOcean, Vultr, Linode, Hetzner; one month's price in credit to create; rate = monthly ÷ (days × 24), full hours, paid credits only; usage per server. No endpoints. Admin price-list screens are explicitly not in this phase | Publish the price-list + usage endpoints; confirm "popular plans" means provider sizes; say whether Lightsail is ever managed | Phase 5 / 6 | P1 |
| Negative balance (managed servers) | The saved due / expire / deletion dates per account, each managed server's state and whether it has apps or databases, and a "back to positive" reset | Banners, server states, deletion warnings | Requirements complete — backend Phase 6 (6.12–6.13) V8 requirement. Narrowed 2026-10-05: the wallet track for plan-billed servers was removed, so this is managed servers only; plan expiry is Phase 7's. On the expire date servers with content are powered off and empty ones deleted, decided by asking each server's OSS panel — so this depends on the OSS client being ready | Return the saved dates (never a day count), the per-server outcome, and what happens when a panel is unreachable (D-35). Admin control of the timing days is parked for its own phase | Phase 6 | P0 |
| Plan expiry timing settings | Admin-set reminder start, warning day, lock day and reminder weekdays (7.10–7.12) | Every expiry banner must use a date, not a fixed day count | Rules written 2026-10-05 V8 requirement, no endpoints. Defaults are V7's (7 / −7 / −15, Mon + Thu) | Publish them with the plan endpoints, and return the computed dates on the subscription | Phase 6 | P1 |
| Usage counts | Servers + applications per organization | Limits, dashboard | Apps live on OSS | Cached counts via the status job | Phase 6–7 | P1 |
| Dashboard aggregates | One endpoint: KPIs + per-server status/metrics summary + spend + activity | Dashboard | None | Parallel OSS calls with timeouts + cache | Phase 7 | P1 |
| Providers | List + connect/edit/disconnect | Create VPS | B5.1 list built; integration-view, organization-scoped | B5.2–B5.4 Connect/Edit/on-demand Check built on Pair1; B5.5 endpoint partial; usage guard/warning pending Phase8; regions/sizes belong to Servers | FE: Integrations | list done / mutations pending |
| Provisioning | Create VPS + run installer with --stack + CENTRAL_TOKEN, progress, link | Create server | Not specified | Decide D-12, build jobs | Phase 8 | P2 |
| Server panel screens | Server list + search / filter / sort, shared-with-me, deleted servers + restore, power / resize / delete / disconnect, and every menu screen (dashboard, databases, users, firewall, Fail2ban, cron, services, PHP, Node, Docker, logs, disk cleaner, backups, settings, sync, panel update, service monitoring, alerts, change IP, PHP-FPM, activity log) | Core product | Requirements complete — backend Phase 9 (2026-10-06, Pair 1) V8 requirement. Central asks OSS to revoke its own token on disconnect (9.8) — the gap this page had flagged. five screens still need OSS API support Missing — 9.11 root SSH per user, 9.26 default web page, 9.27 DB root password, 9.28 server alerts and 9.30 PHP-FPM config | Place Docker / Panel update / Service monitoring in the menu (D-45); answer Q3 (refresh + offline) | Phase 9 | P0 |
| Blueprints | CRUD, uploads (signed URLs), WP.org search, run + track | Blueprints | Not specified. OSS run exists | Build. Decide D-14 | Phase 9 | P2 |
| WP Toolkit install + licence | Install the add-on on a server, licence it | Blueprint runs | Not specified anywhere in Central | Decide D-15 | Phase 9 | P2 |
| Global search | One query endpoint over permitted Central resources | ⌘K | None | Decide D-16 | Phase 10 | P2 |
| Notifications + mail | Event catalogue (key, group, default channels, required), channels attached per server with six event-group ticks (all on by default) plus the four account groups chosen once, in-app list/unread/mark read, channels + test, failing-channel state, per-server alert limits, admin SMTP + test email, sent log, alert limits, announcements | Bell, the two settings screens, alerts, admin mail screens | Requirements complete — backend Phase 11 (2026-10-05) V8 requirement. No endpoints. The groups are fixed, but the events inside them come from the event catalogue, so that endpoint is still needed — exactly as the plan screens depend on the feature list | Publish the event catalogue + the per-event/per-channel/per-server settings endpoints, and the admin mail endpoints | Phase 2/10 | P1 |
| Server alerts source | Central reports its own actions (11.11) and polls existing OSS APIs on a schedule — backups, SSL, auto-deploys, live metrics, services, health (11.12); alerts compare metrics with per-server limits the user sets (11.13) and include top processes | 3.17, 11.11–11.14 | Answered — Phase 11 (2026-10-05, reworked 10:19) V8 requirement: OSS does not push and no OSS change is needed; there is no activity-log reading, and work done directly in the OSS panel is deliberately not notified. D-17 closed. Needs the OSS client + server list from Phase 8 | Publish the live-metrics read, the per-server alert-limit endpoints, and the admin check-frequency setting; keep the "sent once / back to normal" state visible to the frontend | Phase 10 | P2 |
| Key self-revoke on OSS | OSS endpoint for the Central key to revoke itself | Clean disconnect | Not in OSS (admin session only) | OSS team | Disconnect copy | P2 |
| Locale in API | Accept-Language support + error codes | Translated errors | Specified 2026-10-08 — Phase 1 step 1.10 V8 requirement: a middleware reads Accept-Language and every user-facing text comes from lang/ keys, falling back to English. Error codes are still not promised, and the language list is "decided later" | Publish the language list; keep stable error codes so the frontend can map the common ones itself | All forms | P2 — the mechanism exists; what is left is the list |
| V7 migration | Account/billing import, permission mapping, server onboarding | Existing users | "Decided at the end" | Design after D-3/D-4/D-7/D-19 | Launch | P1 |
Provider code availability (2026-10-10): Pair2 reports B5.1–B5.5 pulled through cf36220;1211 tests/7473 assertions, Pint/PHPStan and optimization passed after pull (not rerun by this sync). List/Connect/Edit/Check and partial Disconnect are present in its copy. No genuine provider success is established. Disconnect server-usage blocker/server-name warning remain unbuilt until Phase8; Git/storage still wait Servers.
Latest B6.4 (Pair2): Add credits quotes/checkout/status/confirm/free-code APIs43–47 built locally, not pushed or live activated. All gateways need keys/webhooks/return integration; Instamojo additionally needs verified merchant/API proof. No real payment/cards/auto-recharge/history/receipts/imports.1605 tests9194 assertions backend-reported; no frontend/provider-sandbox proof, host scheduling unverified. Exact screen states and blockers. Unresolved real payments now block account deletion409.
Admin readiness update (2026-10-12, Pair1 B17.1): normal-login administrator discovery and guarded own admin identity built (GET /account/admin-access, GET /admin/me). B17.2 permissions/roles, B17.3 sidebar/seeder and all business screens remain unbuilt; no real account promoted. Pair2 presence unconfirmed;1501 tests/9118 assertions and36 live checks backend-reported. Entry states.
2026-10-12 latest readiness: Pair1 B17.2/17.2a adminroles/catalog/assignment APIs51–58 BUILT, menu/sidebar17.3 not built. Pair2 B6.5 savedcards/default/remove,autorecharge/consent/same-payment recovery APIs49–62 IN PROGRESS—notcomplete/committed/pushed/activated; safety fixes and final verification ongoing. Admin contracts/screens; Billing drafts/states. Do not confuse Pair1API49–58(admin) with Pair2API49–62(cards).
Latest B6.5 status (2026-10-12 10:35): 6.4 + 6.5 pushed to GitHub; later local follow-ups: card APIs answer directly (0ff3da9) and auto-recharge is not available for India (billing country or India-issued card, as V7) — the India mandate API (old 62) was removed (e65e8c3). Real payments still not activated; no real keys/charges or host scheduler change. Frontend/consent/provider proof still required.
Removed 2026-10-16 (Pair 1): GET /account/admin-access and GET /admin/me no longer exist. Admin entry = role / is_administrator from the login/profile response + the filtered sidebar GET /admin/menu (API59). The admin's role and permissions now come with /admin/menu (admin_role, permissions — added 2026-10-16 05:22).
B17.11 revised (2026-10-16, Pair1): no separate admin Organizations screen — admins open a user's organization under Users → user → Organizations (API69), which gets tabs members, servers, charges, deleted servers (with restore), subscription, backups (users.organizations.*, view/manage; only members can be built now, the rest wait for Phases 7–8). Catalog back to 59 permissions, 33 sidebar screens. ⚠ Deleted servers + restore conflicts with Bhavik's 'not in V8' rule (D-63).
Latest B17.3 (Pair1): GET /api/v1/admin/menu built, active verified administrator; role-filtered translated group/title/Lucide/localURL/order/parent, no role→empty. 59 permissions, 34 sidebar screens at that time — now 53 permissions / 33 sidebar screens after B17.11 (2026-10-16); tabs/actions no URLs. Queue-size page/permission removed, Horizon instead. B17.4+ business/viewer unbuilt; menu≠working destination, Pair2 availability unconfirmed. Menu states.
B17.4 latest: Pair1 admin Activity log API60 GET /api/v1/admin/activity BUILT; active verified administrator+admin-activity view, private/no-store. Table/filters/pagination/snapshot targets read-only, separate admin feed; account/org feed unaffected. B17.5+ still unbuilt,Pair2unconfirmed. Activity screen.
B17.6 latest (2026-10-12): Pair1 admin Users API61–68 BUILT — list/counts/view/create/ban/unban/verify/delete, deleted users, referred users; statuses active/pending/banned (no locked); admins can't ban/delete themselves or other administrators. Users are now soft deleted (also self-delete B3.7) — the email can still sign up again, nothing changes on screen. B17.5 and B17.7+ still unbuilt, Pair2 unconfirmed. Users screens.
B17.7 latest (2026-10-12): Pair1 admin User details API69–76 BUILT — organizations, login history, account activity, 2FA status/turn off (backup codes counted only), IP whitelist view/turn off/remove IP; new users.activity view permission (60 admin permissions); servers tab waits for Phase 8. Admin changes show in the user's activity as by a ServerAvatar admin. B17.5 and B17.8+ still unbuilt. User details.
B17.10 latest (2026-10-14): Pair1 Login as user API77 BUILT — users.login-as manage only; normal user login without password/2FA/IP whitelist; refused for own account/administrators/banned users; recorded only in admin activity. Login as user.
B17.15 latest (2026-10-14): Pair1 admin Promo codes API78–81 BUILT — list/create/on-off/delete (soft, name stays taken, history kept); no edit after creation; cohort renamed customer_type (all/new/existing). Promo codes.
B17.17 latest (2026-10-16): Pair1 admin Site settings API93–97 BUILT — basic details (branding, uploads, custom header/footer, links) + company billing details (tax % = checkout tax); public GET /site-settings before login. D-64 open (custom code). Site settings.
B17.12 Part 1 (2026-10-17): Pair1 admin Servers API114–119 BUILT — list/view/edit (name, hostname, IP) + user/organization Servers and Deleted servers tabs; live parts later. Servers are now soft deleted (hidden from users). Deleted list = D-63 conflict. Admin servers.
B17.19 (2026-10-17): Pair1 admin General settings API103–113 BUILT — display message (banner for every user via API97 display_message), trial mode on/off (not used — V8 has no trial, D-56), referral program settings, Slack webhook for admin alerts. User settings / temporary domain / support email removed (57 permissions, 31 screens). General settings.
B17.23 (2026-10-16): Pair1 admin Error monitor API99–101 BUILT — list/view/resolve unhandled request/job/command errors (secrets removed, kept 2 days, reopen on repeat). Error monitor.
B17.6 edit (2026-10-16): Pair1 admin Edit a user API98 BUILT — profile, email (no confirmation), password, role, admin role, status for any account incl. administrators; lockout guard. Edit a user.
B17.20 Part 1 latest (2026-10-14): Pair1 admin Integration keys API82–88 BUILT — social login (GitHub/Google), Turnstile, payment gateways (Stripe/PayPal/Instamojo, test/live keys, webhook URLs); secrets write-only. SMTP + test mail (Part 2) next. Integration keys.
B17.20 Part 2 (2026-10-15): Pair1 admin SMTP + test email API89–92 BUILT (saved vs server-default settings, write-only password, test email with short failure reason, reset to defaults). Integration keys complete except cloud platforms (to confirm). SMTP.