# Implementation Roadmap

Each row becomes complete only when the module-level Definition of Done passes.

| Stage | Modules | Exit evidence |
|---|---|---|
| 0 | Discovery and architecture | accepted maps, ADRs, risks, environment baseline |
| 1 | Foundation | config contracts, request IDs, security headers, health, CI gates |
| 2 | Identity | login/logout, verify, reset, active checks, 2FA, auth audit, tests |
| 3 | RBAC and users | dynamic permissions, policies, protected CEO invariant, tests |
| 4 | Admin shell | accessible Blade layout, responsive theme tokens, persisted mode |
| 5 | Audit/notifications | append-only audit, queued templates/delivery, redaction |
| 6 | Analytics/dashboard | event ingestion, metric definitions, executive read models |
| 7 | Company/content/settings | company and home CMS, typed settings, publication controls |
| 8 | Catalog/media | services/categories/industries/templates/features/technologies/media |
| 9 | Pricing | currencies, effective prices, packages/rules, deterministic engine |
| 10 | Portfolio/publishing/recruitment | clients/projects/blog/jobs/applications |
| 11 | Scheduling | availability, human/AI booking, locks, workflows, dashboard, notifications |
| 12 | CRM/quotations | contacts/leads, immutable pricing snapshots, proposal workflow |
| 13 | AI/integrations/SEO | grounded provider adapters, consent-safe providers, sitemap/meta |
| 14 | Production readiness | load/security audits, recovery drills, observability, deployment runbook |

## Per-module gate

- Business rules and state transitions documented.
- Schema constraints, indexes, delete behavior, and rollback reviewed.
- Form Requests/input DTOs and server-side policies cover every entry point.
- Transactions, idempotency, race conditions, and external failures handled.
- Blade UI is accessible and contains no business logic.
- Unit, feature, policy, integration, regression, and security tests pass as relevant.
- MySQL-specific behavior passes on MySQL 8.
- `composer validate --strict`, PHPUnit, Larastan, Pint, and dependency audit pass.
- Query counts/plans and caching/queue behavior are reviewed.
- Audit/notification/analytics effects are redacted and tested.
- Operational/configuration decisions are documented.