# Tasks — MS21 Multi-Tenant RBAC Data Migration

> Single-writer: orchestrator (Jarvis/OpenClaw) only. Workers read but never modify.
> Schema: id | status | milestone | description | issue | repo | branch | depends_on | blocks | agent | started_at | completed_at | estimate | used | notes

| id             | status      | milestone | description                                                                       | issue    | repo  | branch                         | depends_on                                                  | blocks                     | agent           | started_at | completed_at | estimate | used | notes                                                                                                                 |
| -------------- | ----------- | --------- | --------------------------------------------------------------------------------- | -------- | ----- | ------------------------------ | ----------------------------------------------------------- | -------------------------- | --------------- | ---------- | ------------ | -------- | ---- | --------------------------------------------------------------------------------------------------------------------- |
| MS21-PLAN-001  | done        | phase-1   | Write PRD, init mission, populate TASKS.md                                        | TASKS:P1 | stack | chore/ms21-init                | —                                                           | MS21-DB-001                | orchestrator    | 2026-02-28 | 2026-02-28   | 10K      | 12K  | PR #552, CI green                                                                                                     |
| MS21-DB-001    | done        | phase-1   | Prisma migration: add user fields                                                 | TASKS:P1 | api   | feat/ms21-schema               | MS21-PLAN-001                                               | MS21-API-001               | claude-worker-1 | 2026-02-28 | 2026-02-28   | 10K      | 9K   | PR #553, CI green                                                                                                     |
| MS21-API-001   | done        | phase-1   | AdminModule with user/workspace admin endpoints                                   | TASKS:P1 | api   | feat/ms21-admin-api            | MS21-DB-001                                                 | MS21-TEST-001              | claude-worker-2 | 2026-02-28 | 2026-02-28   | 20K      | 18K  | PR #555, CI green                                                                                                     |
| MS21-API-002   | done        | phase-1   | Admin user endpoints (list, invite, update, deactivate)                           | TASKS:P1 | api   | feat/ms21-admin-api            | MS21-DB-001                                                 | MS21-TEST-001              | claude-worker-2 | 2026-02-28 | 2026-02-28   | —        | —    | Combined with API-001                                                                                                 |
| MS21-API-003   | done        | phase-1   | Workspace member management endpoints                                             | TASKS:P1 | api   | feat/ms21-workspace-members    | MS21-DB-001                                                 | —                          | codex-worker-1  | 2026-02-28 | 2026-02-28   | 15K      | 14K  | PR #556, CI green                                                                                                     |
| MS21-API-004   | done        | phase-1   | Team management module                                                            | TASKS:P1 | api   | feat/ms21-teams                | MS21-DB-001                                                 | —                          | codex-worker-2  | 2026-02-28 | 2026-02-28   | 15K      | 13K  | PR #564, CI green                                                                                                     |
| MS21-API-005   | done        | phase-1   | Admin workspace endpoints                                                         | TASKS:P1 | api   | feat/ms21-admin-api            | MS21-DB-001                                                 | —                          | claude-worker-2 | 2026-02-28 | 2026-02-28   | —        | —    | Combined with API-001                                                                                                 |
| MS21-TEST-001  | done        | phase-1   | Unit tests for AdminService and AdminController                                   | TASKS:P1 | api   | feat/ms21-admin-api            | MS21-API-001                                                | —                          | claude-worker-2 | 2026-02-28 | 2026-02-28   | 15K      | —    | PR #555, 26 tests                                                                                                     |
| MS21-FIX-001   | done        | phase-1   | Fix flaky CI tests (rate limit timeout + log sanitizer)                           | TASKS:P1 | api   | fix/ms21-flaky-ci              | MS21-API-001                                                | —                          | codex-worker-3  | 2026-02-28 | 2026-02-28   | 8K       | 7K   | PR #562, CI green                                                                                                     |
| MS21-AUTH-001  | done        | phase-2   | LocalAuthModule: break-glass auth                                                 | TASKS:P2 | api   | feat/ms21-local-auth           | MS21-DB-001                                                 | MS21-TEST-002              | claude-worker-3 | 2026-02-28 | 2026-02-28   | 20K      | 19K  | PR #559, CI green                                                                                                     |
| MS21-AUTH-002  | done        | phase-2   | Break-glass setup endpoint                                                        | TASKS:P2 | api   | feat/ms21-local-auth           | MS21-AUTH-001                                               | —                          | claude-worker-3 | 2026-02-28 | 2026-02-28   | —        | —    | Combined with AUTH-001                                                                                                |
| MS21-AUTH-003  | done        | phase-2   | Break-glass login endpoint                                                        | TASKS:P2 | api   | feat/ms21-local-auth           | MS21-AUTH-001                                               | —                          | claude-worker-3 | 2026-02-28 | 2026-02-28   | —        | —    | Combined with AUTH-001                                                                                                |
| MS21-AUTH-004  | not-started | phase-2   | Deactivation session invalidation                                                 | TASKS:P2 | api   | feat/ms21-session-invalidation | MS21-AUTH-001                                               | —                          | —               | —          | —            | 10K      | —    | Deferred; do after Phase 4                                                                                            |
| MS21-TEST-002  | done        | phase-2   | Unit tests for LocalAuth                                                          | TASKS:P2 | api   | feat/ms21-local-auth           | MS21-AUTH-001                                               | —                          | claude-worker-3 | 2026-02-28 | 2026-02-28   | 15K      | —    | PR #559, 27 tests                                                                                                     |
| MS21-MIG-001   | done        | phase-3   | Migration script: scripts/migrate-brain.ts                                        | #568     | api   | feat/ms21-migration            | MS21-DB-001                                                 | MS21-MIG-002,MS21-TEST-003 | codex-worker-1  | 2026-02-28 | 2026-02-28   | 25K      | 22K  | PR #554                                                                                                               |
| MS21-MIG-002   | done        | phase-3   | Migration mapping: status/priority/domain                                         | #568     | api   | feat/ms21-migration            | MS21-MIG-001                                                | —                          | codex-worker-1  | 2026-02-28 | 2026-02-28   | —        | —    | Included in MIG-001                                                                                                   |
| MS21-TEST-003  | done        | phase-3   | Migration script unit tests (9/9 passing)                                         | #568     | api   | test/ms21-migration-tests      | MS21-MIG-001                                                | —                          | codex           | 2026-02-28 | 2026-02-28   | 20K      | 17K  | PR #566 merged, CI green. Review: 0 blockers, 2 should-fix (brittle harness), 0 sec issues.                           |
| MS21-MIG-003   | not-started | phase-3   | Run migration on production database                                              | #568     | api   | —                              | MS21-MIG-001,MS21-TEST-003                                  | MS21-VER-001               | —               | —          | —            | 5K       | —    | Needs deploy coordination; not automatable                                                                            |
| MS21-MIG-004   | done        | phase-3   | Import API endpoints (6/6 tests)                                                  | #568     | api   | feat/ms21-import-api           | MS21-DB-001                                                 | —                          | codex           | 2026-02-28 | 2026-02-28   | 20K      | 24K  | PR #567 merged, CI green. Review: 0 blockers, 4 should-fix, 1 medium sec (no audit log).                              |
| MS21-UI-001    | done        | phase-4   | Settings/users page                                                               | #569     | web   | feat/ms21-ui-users             | MS21-API-001,MS21-API-002                                   | —                          | codex           | 2026-02-28 | 2026-02-28   | 20K      | ~30K | PR #573 merged. Review: 0 blockers, 4 should-fix → MS21-UI-001-QA                                                     |
| MS21-UI-001-QA | not-started | phase-4   | QA: fix 4 review findings (pagination, error state, self-deactivate guard, tests) | #569     | web   | fix/ms21-ui-001-qa             | MS21-UI-001                                                 | —                          | —               | —          | —            | 15K      | —    | 0 blockers; merged per framework. Should-fix: pagination cap, error/empty collision, self-deactivate guard, no tests. |
| MS21-UI-002    | not-started | phase-4   | User detail/edit and invite dialogs                                               | #569     | web   | feat/ms21-ui-users             | MS21-UI-001                                                 | —                          | —               | —          | —            | 15K      | —    |                                                                                                                       |
| MS21-UI-003    | done        | phase-4   | Settings/workspaces page (wire to real API)                                       | #569     | web   | feat/ms21-ui-workspaces        | MS21-API-003                                                | —                          | codex           | 2026-02-28 | 2026-02-28   | 15K      | ~25K | PR #574 merged. Review: 0 critical, 1 low (raw errors in UI)                                                          |
| MS21-UI-004    | not-started | phase-4   | Workspace member management UI                                                    | #569     | web   | feat/ms21-ui-workspaces        | MS21-UI-003,MS21-API-003                                    | —                          | —               | —          | —            | 15K      | —    | Components exist                                                                                                      |
| MS21-UI-005    | not-started | phase-4   | Settings/teams page                                                               | #569     | web   | feat/ms21-ui-teams             | MS21-API-004                                                | —                          | —               | —          | —            | 15K      | —    |                                                                                                                       |
| MS21-TEST-004  | not-started | phase-4   | Frontend component tests                                                          | #569     | web   | test/ms21-ui                   | MS21-UI-001,MS21-UI-002,MS21-UI-003,MS21-UI-004,MS21-UI-005 | —                          | —               | —          | —            | 20K      | —    |                                                                                                                       |
| MS21-RBAC-001  | not-started | phase-5   | Sidebar navigation role gating                                                    | #570     | web   | feat/ms21-rbac                 | MS21-UI-001                                                 | —                          | —               | —          | —            | 10K      | —    |                                                                                                                       |
| MS21-RBAC-002  | not-started | phase-5   | Settings page access restriction                                                  | #570     | web   | feat/ms21-rbac                 | MS21-RBAC-001                                               | —                          | —               | —          | —            | 8K       | —    |                                                                                                                       |
| MS21-RBAC-003  | done        | phase-5   | Action button permission gating                                                   | #570     | web   | feat/ms21-rbac                 | MS21-RBAC-001                                               | —                          | —               | —          | —            | 8K       | —    |                                                                                                                       |
| MS21-RBAC-004  | done        | phase-5   | User profile role display                                                         | #570     | web   | feat/ms21-rbac                 | MS21-RBAC-001                                               | —                          | —               | —          | —            | 5K       | —    |                                                                                                                       |
| MS21-VER-001   | done        | phase-6   | Full quality gate pass                                                            | #571     | stack | —                              | MS21-TEST-004,MS21-RBAC-004,MS21-MIG-003                    | MS21-VER-002               | —               | —          | —            | 5K       | —    |                                                                                                                       |
| MS21-VER-002   | done        | phase-6   | Deploy and smoke test                                                             | #571     | stack | —                              | MS21-VER-001                                                | MS21-VER-003               | —               | —          | —            | 5K       | —    |                                                                                                                       |
| MS21-VER-003   | done        | phase-6   | Tag v0.0.21                                                                       | #571     | stack | —                              | MS21-VER-002                                                | —                          | —               | —          | —            | 2K       | —    |                                                                                                                       |

## Budget Summary

| Phase                  | Tasks  | Done   | Estimate  | Used      |
| ---------------------- | ------ | ------ | --------- | --------- |
| Phase 1 (Schema + API) | 9      | 9      | ~113K     | ~93K      |
| Phase 2 (Auth)         | 4      | 3      | ~45K      | ~19K      |
| Phase 3 (Migration)    | 5      | 3      | ~70K      | ~63K      |
| Phase 4 (UI)           | 6      | 0      | ~100K     | —         |
| Phase 5 (RBAC)         | 4      | 0      | ~31K      | —         |
| Phase 6 (Verification) | 3      | 0      | ~12K      | —         |
| **Total**              | **31** | **15** | **~371K** | **~175K** |

Remaining estimate: ~143K tokens (Codex budget).
