| C-001 | A1 | Root auth redirect | Redirects authenticated to /admin, unauthenticated to /login | apps/platform/src/app/page.tsx | Supabase auth helper -> router replace | user-facing | active |
| C-002 | A1 | Login/password auth | Email/password sign-in, post-login destination resolve | apps/platform/src/app/login/page.tsx, apps/platform/src/app/api/auth/post-login-destination/route.js | Supabase auth -> user role lookup -> destination route | user-facing | active |
| C-003 | A1 | Google OAuth login | Optional Google sign-in flow | apps/platform/src/app/login/page.tsx, apps/platform/src/app/auth/callback/route.js | Supabase OAuth provider | user-facing | active |
| C-004 | A1 | White-label login variant | Alternate secure login page path | apps/platform/src/app/secure-login/page.tsx | Branding/theming + auth | user-facing | active |
| C-005 | A1 | Account setup flow | Invitation/setup password entry flow | apps/platform/src/app/setup-account/page.tsx, apps/platform/src/app/api/agencies/[agencyId]/resend-welcome/route.js | User management + email delivery | user-facing | active |
| C-006 | A2 | Admin shell role context | Wraps /admin/* with auth, user, nav, and settings load | apps/platform/src/app/admin/layout.tsx | Supabase auth + /api/settings + impersonation context | operator-facing | active |
| C-007 | A2 | Effective tenant context resolver | Builds effective role, agency/business scope, impersonation normalization | apps/platform/src/lib/tenant-context.js | users/businesses lookups + role group logic | internal | active |
| C-008 | A2 | Impersonation persistence + lifecycle | Start/stop agency/business impersonation with cookie/local storage | apps/platform/src/context/ImpersonationContext.tsx | tenant-context + /api/agencies/* /api/businesses/* validation | operator-facing | active |
| C-009 | A2 | Authorized business scope helper | Restricts business-target API actions by role and tenant | apps/platform/src/lib/business-scope.js | tenant-context derived roles + businesses query | internal | active |
| C-010 | A2 | Settings inheritance resolution | Merges platform/agency/business settings with impersonation-awareness | apps/platform/src/app/api/settings/route.js | tenant-context + dashboard settings merge + db integration helpers | internal/operator-facing | active |
| C-011 | A3 | Agencies CRUD + onboarding | Create/list/update/delete agencies, user setup hooks | apps/platform/src/app/api/agencies/route.js, apps/platform/src/app/admin/agencies/page.tsx | auth + tenant checks + app offering defaults | operator-facing | active |
| C-012 | A3 | Agency detail ops | Agency profile, credentials, users, app offering bindings | apps/platform/src/app/api/agencies/[agencyId]/*, apps/platform/src/app/admin/agencies/[agencyId]/page.tsx | users/agencies/businesses tables + app catalog tables | operator-facing | active |
| C-013 | A3 | Businesses CRUD | Create/list/update businesses with tenant checks | apps/platform/src/app/api/businesses/route.js, apps/platform/src/app/api/businesses/[businessId]/route.js, apps/platform/src/app/admin/sub-accounts/page.jsx | tenant context + agencies/businesses tables | operator-facing | active |
| C-014 | A3 | Users CRUD and profile management | User creation/update/list with scoped role logic | apps/platform/src/app/api/users/route.js, apps/platform/src/app/admin/users/page.jsx, apps/platform/src/app/admin/account/* | auth + tenant rules + users table | operator-facing | active |
| C-015 | A4 | Agency branding management | Get/save agency branding and dashboard settings | apps/platform/src/app/api/agencies/[agencyId]/branding/route.js, apps/platform/src/app/admin/agencies/[agencyId]/branding/page.tsx | settings defaults + agency record + merge utilities | operator-facing | active |
| C-016 | A4 | Business branding management | Get/save business branding, chat settings, advanced theme | apps/platform/src/app/api/businesses/[businessId]/branding/route.js, apps/platform/src/app/admin/branding/page.jsx | business + agency + platform branding fallback | operator-facing | active |
| C-017 | A4 | Platform branding controls | Global branding/dash theme controls | apps/platform/src/app/admin/platform/branding/page.jsx, apps/platform/src/app/api/settings/route.js | settings table + admin theme helpers | operator-facing | active |
| C-018 | A4 | Dashboard theme editor | Dashboard colors/fonts/spacing controls | apps/platform/src/app/admin/dashboard-settings/page.tsx | settings API + theme token mapping | operator-facing | active |
| C-019 | A4 | Custom domain management | Configure/verify business custom domains | apps/platform/src/app/api/businesses/[businessId]/domains/route.js, apps/platform/src/app/api/verify-domain/route.js, apps/platform/src/app/admin/settings/domains/page.jsx | businesses table (custom_domain, domain_verified) | operator-facing | active |
| C-020 | A4 | Domain-based chat routing | Hostname -> business account resolution for chat runtime | apps/chat/src/app/page.jsx | Supabase business lookup by custom_domain | user-facing | active |
| C-021 | A5 | Platform app catalog browsing | Lists managed/imported apps and connection metadata | apps/platform/src/features/app-catalog/PlatformAppCatalogScreen.jsx, apps/platform/src/app/admin/platform/apps/page.jsx | @sec-admn/app-sdk + /api/platform/apps | operator-facing | active |
| C-022 | A5 | Module import pipeline | Upload zip, normalize imports/colors, assess manifest, persist report | apps/platform/src/app/api/platform/apps/import/route.js, packages/app-sdk/src/imports.js, sdk/packages/schemas/src/index.ts, sdk/packages/ui/src/components/NormalizationReport.tsx | app-sdk normalization -> db report storage | operator-facing/infrastructure | active |
| C-023 | A5 | Manifest validation and compatibility assessment | Validates module manifest contract and connection requirements | packages/app-sdk/src/manifests.js, packages/app-sdk/src/imports.js, apps/platform/src/app/(dashboard)/modules/upload/assessment/page.tsx | manifest parser/validator + assessment report | internal/operator-facing | active |
| C-024 | A5 | App availability resolution by tenant | Returns installable apps for tenant scope | apps/platform/src/app/api/apps/available/route.js | app catalog tables + tenant context | operator-facing | active |
| C-025 | A6 | Capabilities registry APIs | CRUD/list categories/requirements for capabilities | apps/platform/src/app/api/capabilities/* | capabilities tables + requirement resolver | operator-facing | active |
| C-026 | A6 | Capability install flow | Installs capabilities for business context | apps/platform/src/app/api/capabilities/[id]/install/route.js, apps/platform/src/app/admin/capabilities/[slug]/requirements/page.tsx | capability tables + business bindings | operator-facing | active |
| C-027 | A6 | n8n template intake lane | Imports/reads n8n template-backed capabilities | apps/platform/src/app/api/capabilities/n8n-templates/route.js, apps/platform/src/app/admin/platform/capabilities/page.jsx | template parsing + capabilities import route | operator-facing | active |
| C-028 | A6 | Capabilities compiler workflow | Converts workflow payload into capability records | apps/platform/src/lib/compiler/*, apps/platform/src/app/api/capabilities/import/route.js | parser -> compiler -> db write | internal/operator-facing | active |
| C-029 | A7 | Integration settings management | AI provider/webhook/http request integration settings by scope | apps/platform/src/app/admin/integrations/page.tsx, apps/platform/src/app/api/agencies/[agencyId]/integrations/route.js, apps/platform/src/app/api/businesses/[businessId]/connectors/* | tenant context + integration sharing merge + encryption helpers | operator-facing | active |
| C-030 | A7 | Composio connection flow | Connect/disconnect/callback for external toolkits | apps/platform/src/app/api/connections/*, apps/platform/src/app/api/integrations/composio/callback/route.js, apps/platform/src/lib/composio/* | composio libs + business connector state | operator-facing | active |
| C-031 | A7 | Business connector state APIs | Read/update connector settings per business | apps/platform/src/app/api/businesses/[businessId]/connectors/* | connector settings schema + db helper | operator-facing | active |
| C-032 | A8 | Public business chat runtime UI | Main chat UI, messages, guided flow, lead form rendering | apps/chat/src/app/[accountId]/page.jsx | /api/business-settings + /api/chat + /api/conversations + /api/leads | user-facing | active |
| C-033 | A8 | Chat response generation API | Runs AI provider, tool usage, structured response parse | apps/chat/src/app/api/chat/route.js, packages/chat-core/src/* | runtime-config + ai-config + structured-response + db integration sharing | infrastructure/user-facing | active |
| C-034 | A8 | Conversation persistence API | Create/update/read conversations by session/business | apps/chat/src/app/api/conversations/route.js, apps/platform/src/app/api/conversations/route.js | conversations table + tenant scoping | infrastructure | active |
| C-035 | A8 | Platform chat API variant | Overlapping chat API in platform app with capability tool loading | apps/platform/src/app/api/chat/route.js | chat-core + platform capability tool-loader | internal | duplicate |
| C-036 | A8 | Embed widget deployment docs | Embed script examples and runtime guidance | apps/chat/src/app/embed/page.jsx, apps/chat/public/widget.js | chat runtime URL/account id | operator-facing | active |
| C-037 | A9 | Lead capture ingestion | Validates form data, writes lead record, routes delivery | apps/chat/src/app/api/leads/route.js, packages/chat-core/src/lead-capture.js, packages/chat-core/src/lead-delivery.js | lead forms + delivery routing + decrypt/encryption | infrastructure | active |
| C-038 | A9 | Lead routing admin surface | Configure forms, fields, delivery routes in platform admin | apps/platform/src/app/admin/services/chat/lead-capture/page.jsx, apps/platform/src/app/api/businesses/[businessId]/lead-capture/route.js | lead forms/routing tables + business scope | operator-facing | active |
| C-039 | A9 | Webhook delivery pipeline | Outbound webhook calls for lead/chat events | apps/chat/src/app/api/webhook/route.js, apps/platform/src/app/api/webhook/route.js | settings/integration state + retries/logging | infrastructure | active |
| C-040 | A9 | Email delivery pipeline | SMTP/config-based lead/email dispatch | apps/chat/src/app/api/email/route.js, apps/platform/src/app/api/email/route.js | settings decrypt + nodemailer | infrastructure | active |
| C-041 | A10 | KB onboarding wizard UI | Multi-step onboarding for business setup and KB bootstrapping | apps/platform/src/components/onboarding/OnboardingWizard.tsx, apps/platform/src/app/onboarding/page.tsx | onboarding context API + upload docs + kb jobs | operator-facing | active |
| C-042 | A10 | Onboarding context/complete APIs | Read and persist onboarding progress/config | apps/platform/src/app/api/onboarding/context/route.js, apps/platform/src/app/api/onboarding/complete/route.js | businesses/users/kb jobs tables + integration sharing | infrastructure | active |
| C-043 | A10 | KB jobs API | Queue/list/get/restore/process knowledge base jobs | apps/platform/src/app/api/kb-jobs/*, apps/platform/src/app/api/agency/kb-jobs/[businessId]/route.js | kb_generation_jobs + knowledge-base store + worker launcher | infrastructure | active |
| C-044 | A10 | KB generation worker | Claims/requeues/processes KB jobs | services/worker/src/index.js, services/worker/src/run-job.js | kb-engine + db integration sharing + encryption | infrastructure | active |
| C-045 | A10 | KB engine pipeline package | Scrape/extract/research/compile/system-prompt/quiz/starters | packages/kb-engine/src/* | AI providers + compiler + runtime helpers | internal | active |
| C-046 | A10 | KB Studio app scaffold | Projects/review/publish shell pages | apps/kb-studio/src/app/* | next/react + planned @sec-admn/kb-engine dependency | operator-facing | partial |
| C-047 | A11 | Billing dashboard | Billing overview and configuration UIs | apps/platform/src/app/admin/billing/page.tsx, apps/platform/src/app/admin/billing/configuration/page.tsx, apps/platform/src/app/api/billing/configuration/route.js | stripe config tables + settings + tenant scope | operator-facing | partial |
| C-048 | A11 | Billing invoices/payments/subscriptions pages | Invoice/payment/subscription management views | apps/platform/src/app/admin/billing/invoices/page.tsx, .../payments/page.tsx, .../subscriptions/page.tsx | billing APIs + TODO markers | operator-facing | partial |
| C-049 | A11 | Reporting dashboard | Activity/metrics reporting surfaces | apps/platform/src/app/admin/reporting/page.jsx, apps/platform/src/app/api/dashboard/stats/route.js, apps/platform/src/app/api/dashboard/overview/route.js | sessions/leads/business stats + window selectors | operator-facing | partial |
| C-050 | A11 | Session/live session pages | Lists and filters conversations/sessions | apps/platform/src/app/admin/live-sessions/page.jsx, apps/platform/src/app/admin/services/chat/sessions/page.jsx, apps/platform/src/app/api/sessions/route.js | chat_sessions + tenant scope | operator-facing | active |
| C-051 | A11 | Leads admin view | Lead listing and operations UI | apps/platform/src/app/admin/leads/page.jsx, apps/platform/src/app/api/leads/route.js | new_leads table + tenant scope | operator-facing | active |
| C-052 | A11 | Business info and email settings pages | Tenant profile data and email config controls | apps/platform/src/app/admin/business-info/page.tsx, apps/platform/src/app/admin/email-settings/page.tsx | /api/settings + /api/test-connection | operator-facing | active |
| C-053 | A11 | Account profile/password/notifications pages | User self-management and account preferences | apps/platform/src/app/admin/account/* | users API + profile/password forms | operator-facing | partial |
| C-054 | A11 | Platform changelog/admin pages | Platform-level admin surfaces | apps/platform/src/app/admin/platform/changelog/page.jsx, apps/platform/src/app/admin/platform/branding/page.jsx | settings APIs + UI components | operator-facing | active |
| C-055 | A11 | Plasmic host + render/studio-link APIs | CMS-like hosted visual content integration | apps/platform/src/app/plasmic-host/page.tsx, apps/platform/src/app/api/plasmic/* | plasmic loader + auth helpers | operator-facing/internal | active |
| C-056 | A12 | app-sdk package | Manifest normalization, UI import/color normalization, assessment helpers | packages/app-sdk/src/* | parser/validator + normalization report schema | internal | active |
| C-057 | A12 | chat-core package | AI config, runtime config, lead capture/delivery, composio hooks, rate-limit | packages/chat-core/src/* | db/runtime config + provider adapters | internal | active |
| C-058 | A12 | db package | Browser/server supabase clients and integration sharing logic | packages/db/src/* | supabase client wrappers + integration merge logic | internal | active |
| C-059 | A12 | permissions package | Role constants and auth checks | packages/permissions/src/* | consumed by apps/platform/src/lib/auth.js | internal | active |
| C-060 | A12 | branding package | Theme defaults and merge helper | packages/branding/src/index.js | declared dependency, low direct usage evidence | internal | uncertain |
| C-061 | A12 | auth package | Login route constants helper | packages/auth/src/index.js | dependency declared, low direct runtime use | internal | uncertain |
| C-062 | A12 | contracts package | Shared contracts placeholder package | packages/contracts/src/index.js | widely declared dependency, sparse runtime imports | internal | uncertain |
| C-063 | A12 | config package | Workspace config helper | packages/config/src/index.js | no clear app-level consumer | internal | legacy |
| C-064 | A12 | sdk schemas package | Typed core data/normalization contracts | sdk/packages/schemas/src/index.ts | consumed by sdk/ui and platform import assessment | internal | active |
| C-065 | A12 | sdk ui package | Shared UI primitives and normalization report component | sdk/packages/ui/src/* | used in assessment/editor contexts | internal | active |
| C-066 | A12 | sdk client package | platform client (emit/call/usage) for module interactions | sdk/packages/client/src/index.ts | module-runtime integration contract | internal | active |
| C-067 | A12 | sdk manifest package | Manifest schema/validator package | sdk/packages/manifest/src/index.ts | module manifest contract layer | internal | active |
| C-068 | A12 | sdk cli scaffolder | create-aiconnected-module module generator | sdk/packages/cli/src/index.ts | scaffolding for module dev flow | operator-facing/internal | active |
| C-069 | A13 | Supabase schema baseline | Core multi-tenant tables and constraints | supabase/migrations/001_multi_tenant_schema.sql | agencies/businesses/users + related domain tables | infrastructure | active |
| C-070 | A13 | RLS policy baseline | Role-scoped row-level access policies across core tables | supabase/migrations/002_rls_policies.sql | auth.uid + users role mapping | infrastructure | active |
| C-071 | A13 | Extended migration lane | Adds onboarding, dashboard settings, capabilities, connectors, billing, imports, normalization reports | supabase/migrations/003_*.sql through 20260315180025_*.sql | iterative schema evolution | infrastructure | active |
| C-072 | A13 | Full deploy migration aggregate | One-shot deploy migration script | supabase/migrations/999_full_deploy.sql | aggregate schema deployment lane | infrastructure | uncertain |
| C-073 | A13 | Dokploy monorepo deployment model | App-specific build args/watch paths and shared Docker strategy | docs/dokploy-monorepo.md, Dockerfile | workspace-targeted build/deploy | infrastructure | active |
| C-074 | A14 | Duplicate route implementations | Same route in .jsx and .tsx for many admin pages/layouts | e.g. apps/platform/src/app/admin/dashboard/page.jsx + .../page.tsx | duplicate UI logic paths | internal | duplicate |
| C-075 | A14 | Legacy .old route files | Stale preserved route variants in active tree | e.g. apps/platform/src/app/admin/page.jsx.old, apps/platform/src/app/admin/settings/domains/page.jsx.old | historical carry-over | internal | legacy |
| C-076 | A14 | Mock/TODO billing/reporting paths | Mock data and TODO comments in billing/reporting flows | apps/platform/src/app/admin/billing/page.tsx, .../billing/invoices/page.tsx, .../billing/subscriptions/page.tsx, apps/platform/src/app/admin/reporting/page.jsx | missing production wiring in parts | operator-facing | partial |
| C-077 | A14 | KB Studio scaffold-only implementation | Pages exist but no substantive feature wiring/fetch/API | apps/kb-studio/src/app/*, apps/kb-studio/src/features/*/.gitkeep | placeholder application shell | operator-facing | partial |
| C-078 | A14 | Deep-import internal package coupling | Imports package internals via @sec-admn/*/src/* paths | apps/chat/src/app/api/leads/route.js, apps/chat/src/app/[accountId]/page.jsx, services/worker/src/run-job.js, apps/platform/src/lib/supabase-server.js | boundary bypass increases fragility | internal | legacy |