# Tasks — MS21 Multi-Tenant RBAC Data Migration

> Single-writer: orchestrator (Jarvis/OpenClaw) only. Workers read but never modify.

| id | status | milestone | description | pr | agent | notes |
|----|--------|-----------|-------------|----|-------|-------|
| MS21-PLAN-001 | done | phase-1 | Write PRD, init mission, populate TASKS.md | #552 | orchestrator | CI: #552 green |
| MS21-DB-001 | done | phase-1 | Prisma migration: add user fields | #553 | claude-worker-1 | CI: #684 green |
| MS21-API-001 | done | phase-1 | AdminModule with user/workspace admin endpoints | #555 | claude-worker-2 | CI: #689 green |
| MS21-API-002 | done | phase-1 | Admin user endpoints (list, invite, update, deactivate) | #555 | claude-worker-2 | Combined with API-001 |
| MS21-API-003 | done | phase-1 | Workspace member management endpoints | #556 | codex-worker-1 | CI: #700 green |
| MS21-API-004 | done | phase-1 | Team management module | #564 | codex-worker-2 | CI: #707 green |
| MS21-API-005 | done | phase-1 | Admin workspace endpoints | #555 | claude-worker-2 | Combined with API-001 |
| MS21-TEST-001 | done | phase-1 | Unit tests for AdminService and AdminController | #555 | claude-worker-2 | 26 tests included |
| MS21-AUTH-001 | done | phase-2 | LocalAuthModule: break-glass auth | #559 | claude-worker-3 | CI: #691 green |
| MS21-AUTH-002 | done | phase-2 | Break-glass setup endpoint | #559 | claude-worker-3 | Combined with AUTH-001 |
| MS21-AUTH-003 | done | phase-2 | Break-glass login endpoint | #559 | claude-worker-3 | Combined with AUTH-001 |
| MS21-AUTH-004 | not-started | phase-2 | Deactivation session invalidation | — | — | Deferred |
| MS21-TEST-002 | done | phase-2 | Unit tests for LocalAuth | #559 | claude-worker-3 | 27 tests included |
| MS21-MIG-001 | done | phase-3 | Migration script: scripts/migrate-brain.ts | #554 | codex-worker-1 | CI: #688 (test flaky, code clean) |
| MS21-MIG-002 | done | phase-3 | Migration mapping: status/priority/domain mapping | #554 | codex-worker-1 | Included in MIG-001 |
| MS21-MIG-003 | not-started | phase-3 | Migration execution: run on production database | — | — | Needs deploy |
| MS21-MIG-004 | not-started | phase-3 | Import API endpoints | — | — | |
| MS21-TEST-003 | not-started | phase-3 | Migration script tests | — | — | |
| MS21-UI-001 | not-started | phase-4 | Settings/users page | — | — | |
| MS21-UI-002 | not-started | phase-4 | User detail/edit and invite dialogs | — | — | |
| MS21-UI-003 | not-started | phase-4 | Settings/workspaces page (wire to real API) | — | — | Mock data exists |
| MS21-UI-004 | not-started | phase-4 | Workspace member management UI | — | — | Components exist |
| MS21-UI-005 | not-started | phase-4 | Settings/teams page | — | — | |
| MS21-TEST-004 | not-started | phase-4 | Frontend component tests | — | — | |
| MS21-RBAC-001 | not-started | phase-5 | Sidebar navigation role gating | — | — | |
| MS21-RBAC-002 | not-started | phase-5 | Settings page access restriction | — | — | |
| MS21-RBAC-003 | not-started | phase-5 | Action button permission gating | — | — | |
| MS21-RBAC-004 | not-started | phase-5 | User profile role display | — | — | |
| MS21-VER-001 | not-started | phase-6 | Full quality gate pass | — | — | |
| MS21-VER-002 | not-started | phase-6 | Deploy and smoke test | — | — | |
| MS21-VER-003 | not-started | phase-6 | Tag v0.0.21 | — | — | |
| MS21-FIX-001 | done | phase-1 | Fix flaky CI tests (rate limit timeout + log sanitizer) | #562 | codex-worker-3 | CI: #705 green |
