MVP Implementation: M1-M6 milestones

[OpenCodeEngineer]

Current State

Architecture simplified:

• Widget connects to OpenClaw gateway via native WebSocket protocol
• Backend (CF Workers) handles auth + config only
• Dead proxy code removed, 18 backend tests passing, 6 plugin tests passing

Remaining Work

Phase 1: Working Demo

• Rewire widget to OpenClaw WebSocket protocol
• Run OpenClaw gateway on dev VM
• Write minimal product agent AGENTS.md for JSONPlaceholder demo
• Seed product/widget in local D1
• End-to-end smoke test

Phase 2: Setup Agent

• Setup Agent AGENTS.md with admin tools
• Product creation flow via chat
• Skill generation from API inspection

Phase 3: Auth & Isolation

• Widget authenticated mode
• Plugin copy-on-bootstrap on real gateway
• Per-user heartbeat cron
• Cross-user isolation verification

Phase 4: Production Deploy

• CF Workers deployment with secrets
• Hetzner gateway deployment via CF Tunnel
• E2E Playwright tests

[OpenCodeEngineer]

Endpoint alignment audit (MVP):\n\nAligned and needed:\n- /auth/signup, /auth/login, /auth/google, /auth/google/callback, /auth/me, /auth/logout\n- POST /v1/bootstrap\n- POST /v1/chat\n- POST /api/setup/chat\n- GET /api/setup/products\n- GET /api/setup/products/:id\n- GET /api/widget-config/:embedToken\n\nMismatches found:\n1) /v1/chat does not forward OpenClaw agent id in upstream payload (it resolves openclawAgentId but does not send agentId).\n2) /v1/bootstrap returns session.expires_at as ISO string; spec expects unix timestamp number.\n3) /v1/bootstrap greeting source uses agents.system_prompt; spec expects widget welcome message.\n4) docs mention /auth/google/start alias; route not implemented.\n\nLikely legacy (not required for MVP path, can be deprecated):\n- /api/fetch, /api/email, /api/escalate, /api/kb, /api/admin, /api/widgets, /dashboard, routes/chat.ts (unmounted legacy provider proxy).\n\nNext proposed work:\n- Fix the 3 functional mismatches in bootstrap/chat proxy.\n- Add /auth/google/start alias or remove from docs.\n- De-scope or deprecate legacy endpoints from MVP runtime path.