conductor/TASKS.md

# Conductor MVP Tasks

This document summarizes the current implementation and the remaining work required to complete the initial Conductor MVP. Completed items are based on the current workspace source code; the complete application has not yet been revalidated through a fresh full-stack test run.

## Completed

### Application foundation

- [x] Create the React and TypeScript frontend application.
- [x] Create the Node.js, Express, and TypeScript backend service.
- [x] Add SQLite project persistence.
- [x] Add Dockerfiles and Docker Compose configuration.
- [x] Add application navigation and a shared project context.
- [x] Add the backend health endpoint.
- [x] Add project create, list, read, update, and delete endpoints.
- [x] Add frontend project creation, save, update, and load controls.

### Canonical project model

- [x] Define the canonical JSON project document.
- [x] Add the versioned `0.1.0` JSON schema.
- [x] Add shared frontend TypeScript project types.
- [x] Add backend schema validation.
- [x] Add valid and intentionally invalid example project definitions.
- [x] Add a JSON editor that validates and applies changes to shared project state.
- [x] Keep the Visual Editor and JSON Editor synchronized through the canonical document.

### Visual Editor

- [x] Add the component palette and canvas.
- [x] Support component selection, movement, resizing, and deletion.
- [x] Add common property editing for component name, label, placeholder, default value, visibility, disabled state, required state, position, and size where applicable.
- [x] Detect duplicate component names in the editor.
- [x] Implement the Label component.
- [x] Implement the Button component.
- [x] Implement the Text Input component.
- [x] Implement the Dropdown component, including static option editing.
- [x] Implement the Table component, including column and row editing.
- [x] Implement the JSON Viewer component.

### REST actions and Preview runtime

- [x] Define REST actions in the project schema and TypeScript model.
- [x] Support GET, POST, PUT, PATCH, and DELETE action definitions.
- [x] Add the server-side REST proxy.
- [x] Add URL, path, query, header, and body template handling.
- [x] Add normalized proxy response envelopes and basic error handling.
- [x] Add Preview mode.
- [x] Execute button-bound REST actions in Preview mode.
- [x] Resolve component and variable values in request templates.
- [x] Store action, component, and variable runtime state separately from canonical project JSON.
- [x] Implement response bindings to Label and JSON Viewer values.
- [x] Implement response bindings to Dropdown options.
- [x] Implement response bindings to Table rows.
- [x] Implement response bindings to project variables.
- [x] Support Table row selection at runtime.
- [x] Add binding and action diagnostics in the Inspector.
- [x] Add frontend unit tests for request templates, bindings, variables, dropdowns, and tables.

## Remaining MVP Tasks

### Missing MVP GUI components

- [x] Implement the Text Area component in the palette, canvas, property editor, Preview runtime, and tests.
- [x] Implement the Checkbox component in the palette, canvas, property editor, Preview runtime, and tests.
- [x] Implement the Radio Group component in the palette, canvas, property editor, Preview runtime, and tests.
- [x] Implement the Status/Message Panel component in the palette, canvas, property editor, Preview runtime, response bindings, and tests.
- [x] Implement the Container/Card component in the palette, canvas, property editor, Preview runtime, and tests.
- [x] Remove the schema/runtime component-type mismatch; all eleven schema-supported types now render in the editor and Preview.

### Visual configuration workflows

- [ ] Implement a visual REST Action editor for creating, editing, and deleting actions without hand-editing JSON.
- [ ] Implement visual component-event configuration, including binding a button to an action.
- [ ] Implement a visual project-binding editor for request inputs and response targets.
- [ ] Implement page-load action configuration for automatically populated components.
- [ ] Complete component-specific property controls and basic styling controls required by the MVP specification.

### Authentication and secrets

- [ ] Implement Basic authentication during proxy execution.
- [ ] Implement Bearer token authentication during proxy execution.
- [ ] Implement API-key header authentication during proxy execution.
- [ ] Implement API-key query-parameter authentication during proxy execution.
- [ ] Add secure server-side credential storage and secret references.
- [ ] Ensure exported project JSON excludes secret values.
- [ ] Mask credentials and sensitive values in logs and error messages.

### Proxy security and observability

- [ ] Add permitted-origin or endpoint allowlisting for proxied requests.
- [ ] Add SSRF protections and stricter URL validation.
- [ ] Validate and sanitize forwarded request headers.
- [ ] Persist sanitized API execution history, including timestamp, method, endpoint, status, duration, and error details.
- [ ] Add a way to inspect basic execution history for troubleshooting.

### Validation and error handling

- [ ] Validate the canonical project document on every save operation.
- [ ] Prevent invalid project documents from being persisted.
- [ ] Add user-facing Preview error states for all supported component targets.
- [ ] Reconcile schema descriptions and examples with the canonical `project.bindings` response-mapping model.
- [ ] Remove new uses of the deprecated `action.responseMapping` field.

### Testing and release validation

- [ ] Add backend tests for health, project CRUD, schema validation, and proxy input validation.
- [ ] Add proxy integration tests for successful responses, upstream errors, malformed responses, and timeouts.
- [ ] Add persistence round-trip tests for complete canonical project documents.
- [ ] Add editor tests for every MVP component and its property controls.
- [ ] Add end-to-end tests covering project creation, visual editing, action execution, response mapping, saving, and loading.
- [ ] Run frontend and backend TypeScript checks successfully.
- [ ] Run all frontend and backend automated tests successfully.
- [ ] Run schema validation against every valid and invalid example successfully.
- [ ] Produce successful frontend and backend production builds.
- [ ] Run the full application through Docker Compose and complete the documented integration checklist.

### MVP scope decision

- [x] Decide that IBM Bob/watsonx and other AI integrations are not part of the initial MVP.
- [x] Confirm that all five modeled authentication modes are required for MVP.
- [x] Define the six end-to-end MVP acceptance workflows in `MVP_SCOPE.md`.

### Documentation

- [ ] Designate the `docs/` copies of project documentation as authoritative and remove or redirect duplicate root-level copies.
- [ ] Update the README documentation index to include the schema and response-mapping documents.
- [ ] Update the build plan with the current implementation status and remaining milestone order.
- [ ] Remove resolved questions from the requirements document or record their architectural decisions.
- [ ] Publish a final MVP acceptance checklist tied to tested user workflows.

## Post-MVP Ideas

- [ ] Add multi-page application support.
- [ ] Add OAuth 2.0 and IBM Cloud IAM authentication.
- [ ] Add OpenAPI import and generated forms/actions.
- [ ] Add reusable templates, themes, and component libraries.
- [ ] Add version history, Git integration, and team collaboration.
- [ ] Add role-based access control and enterprise audit retention.
- [ ] Add tabs, modal dialogs, date pickers, file uploads, charts, and progress indicators.