#Findings summary

Inspection date: 2026-10-03. Read-only, no product code changed.

#What I found

1. The V8 product doesn't exist yet in code. frontend-2 is a Next.js scaffold (shadcn primitives only). sa-central-api-2 (backend-2) is a Laravel skeleton with zero API routes.
2. The V8 requirements cover only the start. Rules R1–R7, Phase 1 Foundation, Phase 2 Authentication & Security, Phase 3 Account. Organizations, plans, subscriptions, billing, roles, members, servers, providers, blueprints and audit are not specified for V8 yet.
3. V7 is a rich functional reference (62 route files): organizations with owner/admin/custom roles, ~92 boolean permissions gated by plan tier, members with email invitations, a per-user subscription, prepaid wallet credits with Stripe/PayPal/Instamojo, invoices, auto-recharge, 7 cloud providers, WordPress blueprints, activity log, notifications.
4. The OSS panel is the real backend for servers. Its Central key (sv_central_…) signs in as a machine administrator, so Central can use almost the whole OSS API (everything in Server Details). The installer accepts CENTRAL_TOKEN. Central-only add-on routes run WordPress blueprints.
5. The demo gives a good navigation and screen concept, but has no backend and some different formats (sm_ keys, level.name.view|manage permissions).

#What already exists

#What can be reused from V7 (as logic, never code — R1)

• Organization rules: first org = main; can't delete main/only/with servers; owner + admin roles on create.
• Invitation flow (existing user vs new email + token), role assignment, owner-only removal.
• Plan tiers/cycles/limits as the shape of a plan catalog; trial logic; expiry behaviour (block server actions except delete; 15-day grace on renew).
• Wallet + transaction + verify-before-credit payment flow; auto-recharge rules; invoice data.
• Provider list + per-provider validation rules; OAuth for DigitalOcean/Linode.
• Blueprint data model (OSS already accepts exactly that shape).
• 2FA / IP whitelist / login history behaviour (already adopted by the V8 doc).

#What backend APIs exist

• Central (sa-central-api-2): none.
• OSS: everything listed in Server details and API architecture.

#What backend APIs are missing

All Central APIs, see Missing backend dependencies. The most important: session contract, auth, organizations, permission map, members, audit writer, server link + OSS proxy, plan catalog (doesn't exist even in V7), subscription, billing, dashboard aggregation. On the OSS side: alerts API (requirement 3.17 has nothing to call) and key self-revoke.

#Conflicts

#Recommended implementation phases

0 Foundation → 1 Auth → 2 Account → 3 Organizations + Roles + Members → 4 Audit → 5 Servers → 6 Plans + Subscription + Billing → 7 Dashboard → 8 Providers → 9 Blueprints → 10 Search + Notifications + polish → 11 Production readiness. Details and blockers: Implementation phases.

#Final document index