browser/openspec/changes/complete-platform-web-management-workflows/tasks.md

1. API and Safety Inventory

• 1.1 Inventory current platform APIs for users, server instances, server administrators, plugin marketplace, AI providers, config, logs, run endpoints, and audit events.
• 1.2 Decide and document resource-specific removal semantics for users, server instances, and AI providers: delete, disable, archive, or retire.
• 1.3 Identify missing backend DTOs, validators, repository methods, service methods, and HTTP routes required by the frontend completion workflows.
• 1.4 Confirm no planned request or response shape includes raw AI keys, raw host paths, run credentials, direct socket details, or unrestricted plugin execution fields.

2. Platform API Support

• 2.1 Add or extend user management APIs for editing identity/contact fields, roles, status, and delete/deactivate behavior.
• 2.2 Add or extend server instance APIs for metadata edits and safe archive/delete behavior while preserving lifecycle validation.
• 2.3 Add or extend AI provider APIs for empty list correctness and delete/retire behavior with secret-reference-only validation.
• 2.4 Add backend tests for accepted and rejected edit/delete/archive/retire workflows and stable JSON errors.
• 2.5 Update platform route/API documentation for newly added management actions.

3. Frontend Contracts and Schemas

• 3.1 Add frontend API DTO types and client methods for all new user, server, plugin, and AI provider management actions.
• 3.2 Add shared frontend contracts for edit forms, removal confirmations, operation result state, and development-fixture state outside page components.
• 3.3 Add or update frontend schemas for user edit, server metadata edit, server removal, AI provider save, and AI provider retirement requests.
• 3.4 Remove unused static shell demo constants or isolate them as explicit test/development fixtures.

4. User Management Completion

• 4.1 Replace silent fallbackUsers display with API-backed loading, empty, error, and explicitly labeled local-development states.
• 4.2 Add existing-user edit controls for profile/contact fields, roles, and status using typed API requests.
• 4.3 Add user delete/deactivate confirmation flow with persisted result feedback and rejection diagnostics.
• 4.4 Add tests for user empty state, edit success, edit failure, status update, and delete/deactivate behavior.

5. Server Management Completion

• 5.1 Add server list or detail controls for editable server metadata such as display name and allowed ownership-visible fields.
• 5.2 Add safe server archive/delete flow with state-aware confirmation and platform rejection feedback.
• 5.3 Ensure server administrator add/remove flows refresh assigned administrators and candidates after each operation.
• 5.4 Replace server config fallback behavior with explicit API unavailable state or clearly labeled local-development fixture state.
• 5.5 Add tests for server metadata edit, archive/delete rejection, administrator refresh, and config unavailable state.

6. Plugin Marketplace Completion

• 6.1 Remove production reliance on pluginCatalog fallback data from marketplace list and detail rendering.
• 6.2 Render marketplace API empty and error states with retry and diagnostic context.
• 6.3 Ensure install, enable, and disable actions update list and detail state only from persisted platform responses.
• 6.4 Add tests for marketplace API failure, empty list, detail refresh, disabled fixture actions, and state action feedback.

7. AI Provider Completion

• 7.1 Fix zero-provider API responses so seed providers are not kept visible after a successful empty list.
• 7.2 Remove optimistic local success for failed save, status, test, model refresh, and delete/retire actions.
• 7.3 Add delete or retire action UI with confirmation, persisted response handling, and reference-safety rejection feedback.
• 7.4 Add tests for empty provider list, create/update failure, status failure, model refresh failure, and delete/retire behavior.

8. Verification

• 8.1 Run relevant backend tests from platform/ and record evidence.
• 8.2 Run cd platform_web && npm run typecheck && npm run test && npm run build and record evidence.
• 8.3 Run a browser walkthrough covering users, servers, plugin marketplace, AI providers, and empty/error states at desktop and narrow widths.
• 8.4 Run forbidden-fragment checks for raw AI keys, raw host paths, run credentials, and direct socket details in rendered management pages.
• 8.5 Run scripts/check-structure.sh and record evidence.
• 8.6 Run openspec validate complete-platform-web-management-workflows --strict and record evidence.

9. Management Layout Corrections

• 9.1 Replace permanent inline create/edit/detail panes on AI provider, user, and plugin marketplace list pages with modal workflows while preserving full-width list surfaces.
• 9.2 Document the ban on permanent right-side or inline split management panes in platform_web Markdown guidance.
• 9.3 Verify AI provider create/edit, user create/edit, and plugin detail workflows in a browser after the modal conversion.