# CloudPanel Legacy Restoration Resume Plan

> **For agentic workers:** Do not execute until a future user explicitly resumes and the stopped working tree is checkpointed on `fix/cloudpanel-runtime-health`.

**Goal:** Review, land, deploy, and live-verify the stopped CloudPanel01 legacy backend remediation without altering other environments or the production staff panel.

**Architecture:** Preserve the stopped implementation as a local checkpoint before isolated execution. Run an independent adversarial review, then consume existing clean receipts unless fixes invalidate them. Publication and CloudPanel01 API/worker-only deployment must use the project delivery controller with immediate rollback on failed live verification.

**Tech Stack:** Express, TypeScript, Prisma, PostgreSQL, Redis, Bull, Podman Compose, WordPress REST clients.

---

## Preconditions

- Future user explicitly resumes work.
- The exact stopped task-owned diff is committed locally on `fix/cloudpanel-runtime-health`; unrelated dirty files remain unstaged.
- No secrets are present in the checkpoint.
- Production rollback artifacts listed in the handoff remain available and validated.

## Wave Plan

| Wave | Tasks | Files touched | Safe to parallelize? |
|---|---|---|---|
| 1 | Task 1 | Only files named by verified review findings within the checkpoint diff | single task |
| 2 | Task 2 | No source changes unless a failed gate exposes a defect | single task |

## Task 1: Independent adversarial review and fixes

**Wave:** 1  
**Blocks:** Task 2  
**Blocked by:** —

**Files:**
- Review: checkpoint diff from `origin/master...HEAD`
- Modify: only task-owned paths named by confirmed review findings
- Test: focused tests covering each confirmed finding

**Contract:**
- Dispatch the repository security-guard through `/ask-codex 5.6-sol/low`; never use `cx.sh`.
- Review plugin scope/authentication, money/refund idempotency, PayPal raw-body verification, encrypted settings migration, Prisma migration fail-closed behavior, Bull retries, and durable webhook outbox concurrency.
- Every reported blocker must include a concrete trigger and survive refutation.

**Behavior:**
- Fix every confirmed blocker surgically.
- Preserve unrelated working-tree and production artifacts.
- Do not deploy or touch CloudPanel01 in this task.

**Acceptance (one executable check):**
- Run: `git diff --check origin/master...HEAD`
- Expected: exit 0 after the independent review reports no unresolved ship blocker.

## Task 2: Final clean validation receipt

**Wave:** 2  
**Blocks:** —  
**Blocked by:** Task 1

**Files:**
- Verify: `api/`
- Verify: `api/prisma/`
- Verify: `api/docker-compose.yml`
- Verify: `podman-compose.yml`

**Contract:**
- Reuse valid current-tree receipts when Task 1 did not invalidate them.
- If Task 1 changed behavior, rerun focused checks first, then the final build/test gate.
- Address every warning, migration ambiguity, and Compose configuration failure.

**Behavior:**
- Prisma generation and TypeScript compilation pass.
- Jest passes without warnings.
- Fresh migration succeeds; ambiguous ownership fails closed; remediated ownership succeeds.
- Both Compose files fail when `SETTINGS_ENCRYPTION_KEY` is absent and validate with a 64-hex key.

**Acceptance (one executable check):**
- Run: `cd api && npm run build && npm test -- --runInBand`
- Expected: exit 0 with all suites passing and no warnings.

## Delivery controller contract

After both tasks pass, land and push according to project policy, then operate CloudPanel01 only:

1. Preserve the production `settings.ts` hotfix, `press-zone-backend/api/create-test-api-key.mjs`, `press-zone-backend/_archive/deploy-backups/`, and staff-panel bundle.
2. Generate/store one stable 64-hex `SETTINGS_ENCRYPTION_KEY` shared only by API and worker.
3. Run ownership preflight before Prisma migration.
4. Rebuild/recreate API and worker only.
5. Observe public/origin readiness, licensing, onboarding, authenticated estimate and translation with credit debit, worker heartbeat/logs, outbox drain, and staff admin.
6. Any failed observation triggers immediate rollback to the saved API/worker images and database artifact.