## 1. API and Safety Inventory

- [x] 1.1 Inventory current platform APIs for users, server instances, server administrators, plugin marketplace, AI providers, config, logs, run endpoints, and audit events.
- [x] 1.2 Decide and document resource-specific removal semantics for users, server instances, and AI providers: delete, disable, archive, or retire.
- [x] 1.3 Identify missing backend DTOs, validators, repository methods, service methods, and HTTP routes required by the frontend completion workflows.
- [x] 1.4 Confirm no planned request or response shape includes raw AI keys, raw host paths, run credentials, direct socket details, or unrestricted plugin execution fields.

## 2. Platform API Support

- [x] 2.1 Add or extend user management APIs for editing identity/contact fields, roles, status, and delete/deactivate behavior.
- [x] 2.2 Add or extend server instance APIs for metadata edits and safe archive/delete behavior while preserving lifecycle validation.
- [x] 2.3 Add or extend AI provider APIs for empty list correctness and delete/retire behavior with secret-reference-only validation.
- [x] 2.4 Add backend tests for accepted and rejected edit/delete/archive/retire workflows and stable JSON errors.
- [x] 2.5 Update platform route/API documentation for newly added management actions.

## 3. Frontend Contracts and Schemas

- [x] 3.1 Add frontend API DTO types and client methods for all new user, server, plugin, and AI provider management actions.
- [x] 3.2 Add shared frontend contracts for edit forms, removal confirmations, operation result state, and development-fixture state outside page components.
- [x] 3.3 Add or update frontend schemas for user edit, server metadata edit, server removal, AI provider save, and AI provider retirement requests.
- [x] 3.4 Remove unused static shell demo constants or isolate them as explicit test/development fixtures.

## 4. User Management Completion

- [x] 4.1 Replace silent `fallbackUsers` display with API-backed loading, empty, error, and explicitly labeled local-development states.
- [x] 4.2 Add existing-user edit controls for profile/contact fields, roles, and status using typed API requests.
- [x] 4.3 Add user delete/deactivate confirmation flow with persisted result feedback and rejection diagnostics.
- [x] 4.4 Add tests for user empty state, edit success, edit failure, status update, and delete/deactivate behavior.

## 5. Server Management Completion

- [x] 5.1 Add server list or detail controls for editable server metadata such as display name and allowed ownership-visible fields.
- [x] 5.2 Add safe server archive/delete flow with state-aware confirmation and platform rejection feedback.
- [x] 5.3 Ensure server administrator add/remove flows refresh assigned administrators and candidates after each operation.
- [x] 5.4 Replace server config fallback behavior with explicit API unavailable state or clearly labeled local-development fixture state.
- [x] 5.5 Add tests for server metadata edit, archive/delete rejection, administrator refresh, and config unavailable state.

## 6. Plugin Marketplace Completion

- [x] 6.1 Remove production reliance on `pluginCatalog` fallback data from marketplace list and detail rendering.
- [x] 6.2 Render marketplace API empty and error states with retry and diagnostic context.
- [x] 6.3 Ensure install, enable, and disable actions update list and detail state only from persisted platform responses.
- [x] 6.4 Add tests for marketplace API failure, empty list, detail refresh, disabled fixture actions, and state action feedback.

## 7. AI Provider Completion

- [x] 7.1 Fix zero-provider API responses so seed providers are not kept visible after a successful empty list.
- [x] 7.2 Remove optimistic local success for failed save, status, test, model refresh, and delete/retire actions.
- [x] 7.3 Add delete or retire action UI with confirmation, persisted response handling, and reference-safety rejection feedback.
- [x] 7.4 Add tests for empty provider list, create/update failure, status failure, model refresh failure, and delete/retire behavior.

## 8. Verification

- [x] 8.1 Run relevant backend tests from `platform/` and record evidence.
- [x] 8.2 Run `cd platform_web && npm run typecheck && npm run test && npm run build` and record evidence.
- [x] 8.3 Run a browser walkthrough covering users, servers, plugin marketplace, AI providers, and empty/error states at desktop and narrow widths.
- [x] 8.4 Run forbidden-fragment checks for raw AI keys, raw host paths, run credentials, and direct socket details in rendered management pages.
- [x] 8.5 Run `scripts/check-structure.sh` and record evidence.
- [x] 8.6 Run `openspec validate complete-platform-web-management-workflows --strict` and record evidence.

## 9. Management Layout Corrections

- [x] 9.1 Replace permanent inline create/edit/detail panes on AI provider, user, and plugin marketplace list pages with modal workflows while preserving full-width list surfaces.
- [x] 9.2 Document the ban on permanent right-side or inline split management panes in platform_web Markdown guidance.
- [x] 9.3 Verify AI provider create/edit, user create/edit, and plugin detail workflows in a browser after the modal conversion.