COMMAND CENTER ROADMAP

Hostinger VPS provisioned with enterprise-grade default-deny firewall (Layer 1)

Ubuntu OS hardened with dedicated restricted jarvis user account (Layers 2 & 3)

Docker container isolation — sandboxed AI engine with zero filesystem access (Layer 4)

Cryptographic 48-character gateway token — unauthorized connections severed instantly (Layer 5)

Tailscale Zero-Trust VPN — server invisible to the public internet (Layer 6 / Outer Perimeter)

ElevenLabs native voice integration with OpenClaw — zero dropped packets pipeline

"Jarvis" bespoke voice clone synthesized via ElevenLabs

Jarvis AI deployed on VPS — primary conversational intelligence layer

All static credentials stripped from OpenClaw instances

1Password Service Accounts configured — "Blind Injection" via op run, keys never written to disk

Client kill switch provisioned — revoke all AI credentials instantly from 1Password dashboard

Read-only /var/workspace mounts with hourly SHA256 integrity audits

NOC Auditor — rebranded from Sentinel; hourly system health checks with readable reports

Cipher Node — secure computation sandbox (Python3, GCC, Git) with custom Express.js RPC server

Pulse — 24/7 async research agent with Tavily web scraping, delivers daily intelligence briefs

Next.js dashboard with real-time Docker socket telemetry — start/stop every agent from the UI

Live OpenClaw Workspace Editor — modify agent behaviors and tools without touching the terminal

Granular token cost accounting — parses raw .jsonl session files per agent fleet

Security & Research tabs rendering Markdown output from NOC and Pulse directly in the dashboard

Full lift-and-shift from shared Hostinger VPS to dedicated OVH bare-metal (878GB disk, dedicated CPU)

OVH server account, billing, and management panel transferred to Brander Group

Tailscale VPN, 1Password Service Accounts, and all API keys transferred — full client sovereignty

SSH hardened — root login disabled, password auth disabled, key-only access via Tailscale VPN

UFW firewall active — every port restricted to Tailscale private network, zero public exposure

Fail2ban configured — auto-bans any IP after 5 failed SSH attempts

Daily NOC automated audit — 10-point security scan every morning at 6 AM PT with 5th-grade readable reports

Synapse deployed — AI content drafter; Jake receives draft and approves or rejects with notes

Vesper deployed — on approval, generates video, blog image, and thumbnail then publishes blog post

Full workflow: Pulse researches → Synapse drafts → Jake approves → Vesper publishes

NOC Watchdog — auto-restarts any crashed container and logs the incident

API Key Management — live spend tab in Mission Control separating Claude Max from API costs

Jarvis YouTube Skill — fetches transcripts, metadata, and channel data on demand

Security Report Overhaul — replaces raw markdown with a visual color-coded dashboard

Morning Brief & Smart Alerts — AI-curated daily brief replacing Google Alerts, plus OpenClaw digest

Deployment Vault — prototype staging before promoting changes to production

Talk to Jarvis Tab Fix — restores the broken voice interface in Mission Control

Mission Control Simplification — consolidated tabs and removed redundant views

Improve automation

Redo blog automation

Fix blog pipeline

Fix custom draft feature

Add rewrite in progress indicator

Consolidate review pipeline tabs

Fix video and image generation

Fix prompt inside article

Workflow identified and scoped alongside Automation #2

Plan out QC agent

Plan out builder agent

Stage new system

Test run automation

Implement in MC

Run smoke test

Persistent memory schema designed and integrated

Mission Control memory viewer panel built

Improve security architexture

Create roadmap

Review agent configuration changes

Add file system viewer

Restore Mission Control — fix the blog engine and restore the prior Mission Control changes lost during the framework move

Clean agent configuration files, hardcode settings correctly, and harden security across all configs

Restrict Jarvis access so the agent can no longer access the root directory

Revamp the Draft UI — replace separate description and topic fields in custom drafts with one large prompt field

Support multiple reference URLs in blog drafting with a + button for adding and comparing sources

Add a Redo Video action in the blog editor so bad videos can be regenerated without restarting the full pipeline

Add a video generation selector so Jake can choose Sora or SeedDance 2.0 per blog run

Default WordPress posting to the Block Editor instead of the Classic Editor

Provide the blog agent a definitive Brander Group main-menu link list so internal linking stops guessing wrong URLs

Remove the automatic Talk to Brander Group pitch from every generated blog post

Fix 1Password service account token — currently linked to a deleted account, blocking vault access and ElevenLabs API key

Correct Jarvis secrets folder access — currently referencing old inactive ENV file, point to new secrets structure

Restore ElevenLabs voice feature once 1Password token is fixed — verify end-to-end TTS pipeline

Create dedicated system email address for agent sign-up processes and backend research

Fix unmounted database for Intel Database tab

Add priority list for projects

Fix Matrix Layout — default Skills Matrix to a key category (e.g. building or blocker escalation) on open, fixing broken header display and eliminating wide blank spaces

Remove Mission Statement — delete the mission statement from the interface to reclaim real estate

Update Default AI Workflow — hardcode new Jarvis/Hermes default: research best practices first, present three options with pros/cons, then offer a final recommendation for approval before executing

Create UI Design Skill — build a dedicated UI design skill/agent instructed to research top-tier companies and generate high-quality design mockups

Implement style learning so the AI adapts to Jake's custom drafts and manual edits over time

Build Agent Skills Matrix — single-page grid with operatives (y-axis) and skills/tools (x-axis), checkbox assignment

Add skill-type filter dropdown to Skills Matrix (e.g., research, builder, security)

Implement Agent Log View — dedicated log area under Operatives tab with per-agent pop-up on click

Secret Configuration Visibility — secure read-only tab for authorized users to confirm ENV files and secrets within MC

Cross-tab sync — ensure data updates propagate across all MC tabs simultaneously on change

Implement interface breadcrumbs showing the current hierarchy path

Make global Agent Operating Rules manually editable inside the dashboard

Move Agent Rules visibility and access to the left side of the interface

Local LLM setup — install LLaMA for internal server tasks via SSH to prevent public data exposure

Video testing toggle — 5-second max duration option to reduce OpenAI costs during testing

Review agent config UI and files

Add OVH Security Layers

Refine keyword selection logic to choose only one item per keyword

Increase blog idea generation to 10 article ideas per run

Adjust video word limit so speech pacing is slower and content does not get cut off

Create research context tab

Add video context toggle/modal

Rebuild broken blog pipeline

Set an H2 header with a slightly different message, but same keywords right below the top header

Add 2 interlinks per post and make them shorter

FInal stress test for blog generator

Consolidate agent rules and configuration into a single tab with nested subtabs

Restore security audit ui

Investigate why /opt/jarvis and /home/jarvis are both in use and resolve redundant folder structures

Create a detailed filesystem refactor plan and store it as a project directive

Build a permissions UI to view and manage read/write access for agent memories and folders

Implement document/file viewer in the filing system UI so users can read contained files

Mirgate Jarvis to Hermes

Complete file structure refactor

Consultation meetings

Revert and simplify filesystem structure into a clean visual hierarchy

Remove redundant Mission Control tabs

Align Mission Control tabs with backend folder structures exactly

Auto-update breadcrumbs and the filesystem map when folders or global rules change

Merge Ops Log and Change Log into a single linked audit surface

Replace oversized rulesets with a centralized protocol file

Restore clean agents.md files and point them to the central operating rules

Fix Jarvis identity mismatches across soul, identity, and orchestrator files

Integrate Rules of Engagement and explicit agent hierarchy into shared rules

Switch Hermes to the OpenAI OAuth framework with hot-swappable models

Create a Framework tab with the Hermes OAuth and SSH setup guide

Evaluate WordPress Administrator automation access for Vesper

Diagnose why the prison builder task stalled from the session logs

Show the original prompt/directions used to generate each blog post so Jake can reference them during rewrites

Fix featured media placement so images/videos render in the intended body position instead of jumping to the very top of the article

Add a Rewrite Article button directly inside the WordPress draft section so Jake can trigger rewrites without leaving the draft view

Build a queue view for pending rewrite requests so Jake can see which content tasks are actively processing

Re-implement SEO/interlinking guardrails strictly from the Google developer best-practices doc

Fix SEO anchor selection so it stops grouping words incorrectly (for example 'Aaron Q' instead of 'Aaron')

Fix SEO routing so interlinks resolve to the correct destination pages

Reduce interlink density so posts do not stack clusters of links right next to each other

Save Jake's approved custom drafts and manual edits so the system can learn his voice over time

Update blog formatting rules so generated posts always use '%' instead of spelling out 'percent'

Enforce anti-duplication rules so the AI does not repeat the same statistic or fact twice in one post

Generate and present 5 title options for each blog post before final publishing choice

Fix generation and placement of both the meta description and excerpt for every blog post

Add an Approved/Published tab or category so published posts are clearly separated from drafts

Automate WordPress status checks multiple times per day to verify whether posts are live

When WordPress confirms a post is published, automatically flip the pipeline status green and move the item into the Published stage

Finish local Knowledge Hub work, deploy it, and expose the visible Mission Control UI tab so Jake can start dropping in PDFs and reference materials

Extend Knowledge Hub ingestion so Jake can forward emails into Jarvis for voice/style learning and future retrieval

Restore the broken prototypes feature from the recent migration and get the coding loop fully operational again

Build a visual workflow/roadmap system that tracks project steps, progress, and completion state, potentially with Nexus operating the checklist/note-taking layer

Harden agent operating rules so agents stop drifting and reliably follow the currently defined procedures

Review the competitor Fathom video Jake shared and capture actionable UI/product ideas worth borrowing

Hardcode pipeline support for the 3 required image types in the monthly trends report flow

Update the monthly trends report prompt so it automatically calculates the 5-year average and the percentage difference

Publish the Stage 6 Autonomous Build Lab architecture and $950 flat-price proposal to the Brander Group portal

Log the clean Jarvis reinstall/rebuild as Stage 6 infrastructure stabilization so the roadmap reflects the fresh foundation

Replace the buggy Prototypes tab with a clean Innovation Lab dashboard showing active research, active builds, blocked items, and review-ready demos

Build the Research Radar so agents continuously collect business ideas, competitor notes, customer pain points, and useful automation opportunities

Add idea scoring so every opportunity is ranked by expected value, effort, risk, and best next action before a builder touches it

Build the sandboxed prototype pipeline so agents can create apps and dashboards without risking Mission Control or production systems

Add QA gates, screenshots, test results, changelogs, and rollback notes to every prototype card

Add owner controls for Approve, Improve, Pause, Deploy, and Archive with full audit history

Build a Cron Jobs tab modeled on the Projects tab with proper interlinking and cross-referencing to existing tabs

Harden Cipher agents.md to mandate a Version Control subtab on every new tab and require check marks instead of strikethroughs for documenting steps

Find the finished Transfer Trends widget and send it to Jake

Build secure RAG library with wrapped ingestion, chunking, and retrieval

Add QA scrubbing to external reference data before indexing

Expose RAG controls inside the Mission Control Intel Database tab

Shift to a global skills assignment model with dropdown-based agent assignment

Add a central research bot that feeds the RAG system

Build the Knowledge Hub RAG data system and viewing tab as the next major priority after Mission Control cleanup

Create an email-management skill for the Knowledge Hub that processes the new Proton Mail inbox to learn Jake's voice and style

Build Skills Agent — automates research, drafting, and QA of new skills from GitHub, Skills.sh, and best-practice sources

Revert back to OpenClaw framework

Keep the dashboard on the approved custom executive UI while preserving the normal Mission Control shell for every other tab.

Replace hardcoded dashboard buttons with a full grouped searchable Applications launcher overlay that opens above the dashboard, supports search, closes cleanly, and routes into the exact app target.

Group Applications by Core Mission Control, IPv4 Tools, Sales & Outreach, Market Intelligence, Content/SEO, and Ops/Admin.

Clicking an Application item switches into the normal Mission Control shell and opens the exact tab/app target.

Remove the standalone Mission Control Applications tab/page from the normal navigation.

Add a compact Usage & Spend rail showing last-30-days API costs, Codex plan usage percentage, total tokens, most active agent, and plain data status language.

Remove the Recent Agent Actions panel from the dashboard and replace that space with simpler high-value dashboard readouts.

Replace fake/system pulse cards with Lead Intake, IPv4 Transfer Market, Dormant IPv4 Opportunity, Deal/Pricing Desk, Outreach/Replies, and Routing/IRR/RPKI Risk.

Add BEAD/Broadband Leads and Forum/Market Presence as secondary Business Pulse cards.

Every Business Pulse card shows hero number, interpretation, source app, freshness, click target, and stale/static warning.

Read real sources first: WHOIS transfer JSON, WHOIS/Close imports, trade-show reports, email marketing JSON, BEAD summary, forum JSON, pricing snapshots, and static app snapshots where needed.

Label Dormant IPv4, Hilco/pricing, and other HTML-only values as captured/static snapshots when no structured feed exists.

Add a saved IRR/BGP/RPKI risk-check JSON or API output so the Routing/IRR/RPKI Risk card can show actual risk counts instead of a data-gap warning.

Add structured dormant IPv4 opportunity JSON/API output so the dashboard no longer depends on static HTML extraction.

Add or refresh shared pricing/deal-desk snapshots for richer Deal/Pricing Desk metrics.

Add richer drill-down views for each Business Pulse metric beyond the current click-through target.

Keep Business Pulse customization working so the user can choose visible readouts and restore/reset the dashboard readout set.

Add a standout Business Pulse Report play button in the top dashboard bar with loading, playing, paused, and not-ready states.

Generate and cache a daily AI-written Jarvis voice Business Pulse report from current Business Pulse data, with JSON metadata and MP3 audio storage.

Run the Business Pulse voice report generation daily at 6:15 AM Pacific and expose clear ready, stale, and failed states in the dashboard.

Ensure Jarvis addresses the client as Mr. Brander in Business Pulse voice reports and never calls him Jake.

Show the active dashboard agents Jarvis, Cipher, Delta, Recon, Forge, Helix, Sigma, Pulse, Synapse, and Vesper; keep NOC and Quantum out of the main network while preserving NOC in Operatives and Quantum in QA Review.

Restrict dashboard status labels to Working, Available, Stalled, and Offline.

Fix agent card spacing so status/current assignment text does not overflow.

Clicking any visible agent opens the shared agent console with sessions, chat, editable files, editable skills, editable memory, shared rules, and task context.

Keep chats single-agent only; no multi-agent chat sessions.

Support rename, pin, archive, reopen, newest-first sorting, and app/tab/task/project context on chat sessions.

Persist agent chat sessions under /opt/mission-control/agent-chats/ with JSON backups before overwrites.

Add GET/POST/PATCH/message APIs for agent chat sessions and update /api/agent-message to create or append the correct session.

Run final visual QA on the agent console for overflow, chat-bubble spacing, and right-pane readability.

Hide cron/runtime diagnostic sessions and raw dispatch/code output from normal agent chat lists so end users see clean client-created sessions.

Route every console chat to the selected agent with no Jarvis fallback, including Pulse, Synapse, Vesper, Forge, Helix, Sigma, Cipher, Delta, and Recon.

Make chat behave like a normal chat app: Enter sends, Shift+Enter adds a newline, messages appear immediately, composer text wraps, and only the chat thread scrolls.

Show a clear “agent is responding” typing indicator with animated dots while a selected agent reply is pending.

Allow end users to edit and save agent files, skills, memory, and shared rules from the console, plus create new skills from the Skills tab.

Move the per-tab ask-agent control into the app breadcrumb/header bar so apps have one compact command header instead of stacked bars.

Route per-tab requests to the right default agent by app family, with Blog defaulting to Pulse and no hidden Jarvis fallback when another agent is selected.

Persist tab-to-chat request context so returning to a tab can append to the same linked session.

Remove the visible Recent Agent Actions dashboard panel after client feedback that it was not useful and took up too much space.

Keep activity/context metadata available behind the scenes where needed, but do not surface raw cron, JSON, terminal, or diagnostic messages as dashboard chat/activity content.

Browser-test request creation/appending from representative IPv4, outreach, content, ops, and QA tabs.

Send per-tab agent requests through the live agent chat turn system so they create normal chat sessions and selected-agent replies.

Make per-tab sends feel immediate by opening the linked agent console/session and showing the pending message plus typing state while the agent responds.

Fold the separate app context strip into the same app command header so linked session/context information takes less vertical space.

Add an Open Console path from app tabs into the exact linked agent session created by the header command.

Repair Prototypes V2 Research Ideas, Add Idea, Build Queue, preview, QA, client-ready, fix notes, and automation controls without creating a parallel system.

Diagnose stalled Pulse/blog projects and restore production status visibility plus retry behavior.

Update image prompts toward topic-specific visuals, logos/brand-style marks, states, network artifacts, AI/governance/RPKI imagery, and away from repeated generic defaults.

Tighten generated title behavior so titles are clearer and less overcreative.

Keep cron/background checks quiet unless failure, stall, or action is needed, then route to Ops Log/NOC.

Keep IRR/BGP/RPKI responsive table fixes in scope: one-line labels, resizable columns, compact readable cells.

Regression-test Prototypes V2 workflows in-browser after the dashboard correction changes.

Verify live Pulse/blog queued-post recovery and production-state behavior against real current data.

Browser-test IRR/BGP/RPKI/IPv4 tables at desktop and laptop widths for wrapping, resize behavior, and compact readability.

Create the Stage 7 client portal page with dashboard/workflow reliability as the headline package.

Update portal index, roadmap page, and Mission Control roadmap to Stage 1-7 with Stage 7 Active.

Use the shared estimate on both roadmap surfaces: 10 billable package hours x $50/hr = $500 flat.

Keep portal copy clear that Stage 7 is active and still has testing, feature additions, and polish remaining.

Verify static portal files locally, then run a Netlify preview deploy and production deploy only after the corrected dashboard QA pass is complete.

Run final Mission Control roadmap and Brander portal sync checks after remaining QA.

Run npm run test, npm run test:v2, npm run lint, and npm run build; document any legacy lint debt separately from Stage 7 regressions.

Browser-test desktop and laptop dashboard widths for nonblank panels, no overflow, and live data refresh.

Verify Business Pulse cards use Jake business/app facts, click through correctly, and no fake metrics remain.

Verify chat sessions create, rename, pin, archive, reopen, persist, sort by recent activity, and link to app/tab/task/project context.

Verify normal Mission Control remains stable after leaving the dashboard and the standalone Applications page is gone.

After final deploy/sync, verify Mission Control container health passes and no unrelated dirty files were reverted.

Run end-user UI QA across dashboard loading, Applications launcher, Business Pulse customization, agent consoles, session management, editor tabs, and desktop/mobile layouts.

Stress-test chat/session behavior across visible agents, including create, rename, pin, archive, reopen, switch sessions, async replies, and no Jarvis fallback.

Verify the Business Pulse Report button, cached report API, audio route, player states, transcript, desktop/mobile layout, and Ops Log entries.

Audit the current dashboard navigation, top-bar items, merged-tabs registry, and application launcher to identify which surfaces are native Mission Control tools and which should operate as linked business apps.

Lock the native Mission Control set as Dashboard, Roadmap, Projects, Blog, Prototypes, Operatives, File System, Logs, and Intel Database.

Define a registry metadata contract for linked business apps: display name, category, owner, live URL, status, data freshness, source system, and internal notes.

Clean launcher grouping and descriptions so external apps open from the dashboard/app launcher without duplicating normal Mission Control navigation.

Create a maintenance checklist for future apps so new tools are either registered as launched business apps or explicitly added to the native Mission Control set.

Add a release-readiness panel for core Mission Control areas and linked business apps showing current live version, pending work, review requirement, blocked status, and rollback reference.

Map branch, preview, commit, deploy, and rollback details into operator-facing release information while keeping exact technical evidence available in an expandable detail view.

Define pre-release evidence requirements: build or test result, browser verification for UI changes, API/data verification where applicable, and rollback note before release readiness is confirmed.

Record post-release verification with deploy URL, timestamp, app area, checks performed, and any residual risk or follow-up.

Route failed, stale, blocked, or review-ready release items into Projects, Operatives, NOC, and Ops Log instead of leaving them as silent technical state.

Add change summary cards for each core area and registered app showing last meaningful change, pending change count, release target, and current review status.

Connect change cards to related project events, Ops Log entries, Change Log records, verification notes, and affected file paths when technical detail is expanded.

Show a clear clean/pending/review/blocked distinction without requiring users to interpret raw Git or worktree state.

Link release history, rollback notes, and verification evidence from the app or Mission Control area where the work is managed.

Rework Operatives into a clearer structure: Team Overview, Agent Profiles, Skills & Tools, Rules & Memory, and Health & QA.

Create one official roster model for active, retired, and experimental agents so names and availability are consistent across the dashboard, agent console, skills, and health views.

Group agents by operational responsibility: orchestration, operations management, build, research, content, QA, security, and monitoring.

Build per-agent profile summaries covering purpose, responsibilities, current assignment, default app families, model/framework, container, memory files, config files, and escalation path.

Add professional request guidance for each agent so the interface communicates which class of work belongs to each operative.

Add search, filters, and return paths so users can move between overview, profile, skills/tools, rules, and health views without losing context.

Consolidate the current Skills, Skill Matrix, and overview skill-tag concepts into one Skills & Tools hub inside Operatives.

Show assigned skills by agent, available skills by category, skill counts, and role coverage in one scannable interface.

Add recommended and missing-skill indicators based on each agent role, current responsibilities, and expected workflow coverage.

Preserve assignment controls for adding/removing skills while adding confirmation feedback, failure handling, and no-data-loss safeguards.

Keep the live SKILL.md editor available as an advanced view with version history, reload, save, and file-path evidence.

Normalize skill categories, labels, and filters so the matrix, agent profiles, and skills editor use the same terminology.

Add a per-agent workload table showing assignment, project or app, queue position, last heartbeat, next action, blocker, and current owner.

Make Nexus the operations-management lane for queue pressure, idle capacity, stale jobs, blocked work, and reassignment recommendations.

Integrate NOC and Quantum indicators for security status, QA status, offline agents, failed jobs, stale work, and required checks.

Add workload filters for blocked, ready for review, awaiting approval, release queued, active, idle, and stale work.

Limit alerts to action-needed cases and route each alert to the relevant project, agent, NOC/Quantum check, and Ops Log entry.

Publish the Stage 8 portal page with detailed workstreams, deliverables, scope assumptions, and a bottom-of-page commercial summary.

Sync the Stage 8 package across Mission Control roadmap, Projects, and the Brander portal roadmap.

Define acceptance checks for core app boundaries, release controls, version visibility, Operatives structure, skills/tools, workload visibility, and portal consistency.

Keep the final estimate and pricing summary grouped at the bottom of the Stage 8 roadmap section.

Workstream estimates: Core Boundary 3 hrs; Release Controls 3 hrs; Version Ledger 3 hrs; Operatives Information Architecture 5 hrs; Skills & Tooling 3 hrs; Workload & Health 3 hrs; Portal, Roadmap & QA 1 hr.

Total: 21 billable hours. Standard rate $50/hr = $1,050. Discounted project rate $30/hr = $630. Discount savings $420.