docs(03-02): complete onboarding wizard and BYO API key management plan

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.planning/REQUIREMENTS.md

@@ -43,7 +43,7 @@ Requirements for beta-ready release. Each maps to roadmap phases.
 - [x] **PRTA-01**: Operator can create, view, update, and delete tenants
 - [x] **PRTA-02**: Operator can design agents via a dedicated Agent Designer module — defining job description, statement of work, persona, system prompt, tool assignments, and escalation rules
 - [x] **PRTA-03**: Operator can connect messaging channels (Slack, WhatsApp) via guided wizard
-- [ ] **PRTA-04**: New tenants are guided through structured onboarding (connect channel, configure agent, test message)
+- [x] **PRTA-04**: New tenants are guided through structured onboarding (connect channel, configure agent, test message)
 - [x] **PRTA-05**: Operator can manage subscription plans and billing via Stripe integration
 - [x] **PRTA-06**: Portal displays agent cost tracking and usage metrics per tenant
 
@@ -117,7 +117,7 @@ Which phases cover which requirements. Updated during roadmap creation.
 | PRTA-01 | Phase 1 | Complete |
 | PRTA-02 | Phase 1 | Complete |
 | PRTA-03 | Phase 3 | Complete |
-| PRTA-04 | Phase 3 | Pending |
+| PRTA-04 | Phase 3 | Complete |
 | PRTA-05 | Phase 3 | Complete |
 | PRTA-06 | Phase 3 | Complete |
 

.planning/STATE.md

@@ -3,15 +3,15 @@ gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
 status: executing
-stopped_at: "Completed 03-04-PLAN.md (checkpoint: awaiting human-verify Task 2)"
+stopped_at: "Completed 03-02-PLAN.md (checkpoint: awaiting human-verify Task 3)"
-last_updated: "2026-03-24T03:48:23.065Z"
+last_updated: "2026-03-23T21:55:00.000Z"
-last_activity: 2026-03-23 — Completed 02-05 multimodal media support and WhatsApp outbound routing
+last_activity: 2026-03-23 — Completed 03-02 onboarding wizard and BYO API key management
 progress:
   total_phases: 3
   completed_phases: 2
   total_plans: 14
-  completed_plans: 13
+  completed_plans: 12
-  percent: 78
+  percent: 86
 ---
 
 # Project State
@@ -25,12 +25,12 @@ See: .planning/PROJECT.md (updated 2026-03-22)
 
 ## Current Position
 
-Phase: 2 of 3 (Agent Features)
+Phase: 3 of 3 (Operator Experience)
-Plan: 5 of 5 in current phase
+Plan: 2 of 4 in current phase
-Status: In progress
+Status: In progress — checkpoint awaiting human-verify
-Last activity: 2026-03-23 — Completed 02-05 multimodal media support and WhatsApp outbound routing
+Last activity: 2026-03-23 — Completed 03-02 onboarding wizard, Slack OAuth, BYO API keys
 
-Progress: [████████░░] 78%
+Progress: [█████████░] 86%
 
 ## Performance Metrics
 
@@ -117,6 +117,10 @@ Recent decisions affecting current work:
 - [Phase 03-operator-experience]: recharts installed with --force due to npm ENOTEMPTY race bug — was in package.json but not node_modules
 - [Phase 03-operator-experience]: Usage nav links to /usage tenant picker (not hardcoded tenantId) — supports multi-tenant operators
 - [Phase 03-operator-experience]: BudgetAlertBadge renders neutral 'No limit set' for null budget_limit_usd — prevents false alarms
+- [Phase 03-operator-experience]: Agent goes live automatically (is_active true by default) — no separate Go Live button in onboarding wizard (per user decision)
+- [Phase 03-operator-experience]: Test message step is REQUIRED in onboarding — no skip button (per user decision)
+- [Phase 03-operator-experience]: Onboarding wizard step state in URL searchParams (step=1|2|3) — shareable and browser-refresh safe
+- [Phase 03-operator-experience]: Portal git initialized as submodule with own .git repo — enables atomic per-task commits in packages/portal; parent repo tracks gitlink
 
 ### Pending Todos
 
@@ -128,6 +132,6 @@ None yet.
 
 ## Session Continuity
 
-Last session: 2026-03-24T03:48:23.062Z
+Last session: 2026-03-23T21:55:00.000Z
-Stopped at: Completed 03-04-PLAN.md (checkpoint: awaiting human-verify Task 2)
+Stopped at: Completed 03-02 Tasks 1-2 — checkpoint human-verify Task 3 (onboarding wizard + BYO keys)
 Resume file: None

.planning/phases/03-operator-experience/03-02-SUMMARY.md

@@ -0,0 +1,161 @@
+---
+phase: 03-operator-experience
+plan: 02
+subsystem: ui
+tags: [slack, oauth, whatsapp, onboarding, byo-keys, nextjs, react-hook-form, tanstack-query, shadcn-ui]
+
+# Dependency graph
+requires:
+  - phase: 03-operator-experience
+    plan: 01
+    provides: Slack OAuth endpoints, WhatsApp connect endpoint, channel test endpoint, LLM key CRUD endpoints (Plan 01)
+
+provides:
+  - Slack OAuth callback route handler at /api/slack/callback
+  - Onboarding wizard page at /onboarding (3-step stepper via URL searchParams)
+  - OnboardingStepper component with numbered steps, active/completed/pending states
+  - Step 1 - ConnectChannel: Slack OAuth button + WhatsApp manual form with step-by-step instructions
+  - Step 2 - ConfigureAgent: agent list with Agent Designer link, Next enabled only with active agent
+  - Step 3 - TestMessage: per-channel Send Test Message buttons, required step, no Go Live button
+  - BYO API Key settings page at /settings/api-keys (list, add, delete with confirmation)
+  - TanStack Query hooks: useSlackInstallUrl, useConnectWhatsApp, useSendTestMessage, useChannelConnections, useLlmKeys, useAddLlmKey, useDeleteLlmKey
+  - API types: SlackInstallResponse, ChannelConnection, WhatsAppConnectRequest/Response, TestMessageResponse, LlmKey, LlmKeyCreate
+  - API Keys link in sidebar nav
+
+affects:
+  - 03-03 (billing UI — shares the same nav, portal patterns)
+  - 03-04 (cost dashboard — same portal conventions)
+
+# Tech tracking
+tech-stack:
+  added:
+    - recharts (was in package.json but not installed — installed to unblock portal build)
+  patterns:
+    - Onboarding wizard step state via URL searchParams (step=1|2|3) — shareable/refreshable
+    - Auto-advance on successful channel connect (1500ms delay + router.push)
+    - Slack OAuth: fetch install URL from backend, then window.location.href redirect to Slack
+    - WhatsApp: inline expandable form with humanized step-by-step credential instructions
+    - BYO key display pattern: show ...{key_hint} (last 4 chars) — never plaintext
+    - Dialog for add form and delete confirmation using @base-ui/react Dialog pattern
+
+key-files:
+  created:
+    - packages/portal/app/api/slack/callback/route.ts
+    - packages/portal/components/onboarding-stepper.tsx
+    - packages/portal/app/(dashboard)/onboarding/page.tsx
+    - packages/portal/app/(dashboard)/onboarding/steps/connect-channel.tsx
+    - packages/portal/app/(dashboard)/onboarding/steps/configure-agent.tsx
+    - packages/portal/app/(dashboard)/onboarding/steps/test-message.tsx
+    - packages/portal/app/(dashboard)/settings/api-keys/page.tsx
+  modified:
+    - packages/portal/lib/api.ts (added channel and LLM key types)
+    - packages/portal/lib/queries.ts (added 7 new hooks)
+    - packages/portal/components/nav.tsx (added API Keys nav link)
+
+key-decisions:
+  - "Agent goes live automatically after test message — is_active is true by default, no separate Go Live button (per user decision)"
+  - "Test message step is REQUIRED — no skip button (per user decision)"
+  - "BYO API keys are tenant-level (v1 simplicity) — page reads tenant_id from searchParams"
+  - "Onboarding wizard uses URL searchParams for step state — step=1|2|3 makes URLs shareable and browser-back friendly"
+  - "Slack OAuth redirect: window.location.href = authorize_url — NOT router.push, Slack must redirect the actual browser tab"
+  - "Portal git initialized as submodule with its own .git repo — enables atomic per-task commits in portal"
+
+patterns-established:
+  - "Submodule commit pattern: portal files committed inside packages/portal .git, then parent repo git add packages/portal to update gitlink"
+  - "Onboarding stepper: numbered circles + connector lines, completed steps show Check icon, active step shows ring-primary"
+  - "WhatsApp form: expandable card pattern — Button to expand, form appears inline, Cancel collapses"
+
+requirements-completed: [PRTA-03, PRTA-04, LLM-03]
+
+# Metrics
+duration: ~35min
+completed: 2026-03-23
+---
+
+# Phase 3 Plan 02: Channel Connection Wizard and BYO API Key Management Summary
+
+**Slack OAuth callback route, 3-step onboarding wizard (connect channel, configure agent, test message), and BYO LLM API key management page — operators can connect Slack/WhatsApp and go live from the portal**
+
+## Performance
+
+- **Duration:** ~35 min
+- **Started:** 2026-03-23
+- **Completed:** 2026-03-23
+- **Tasks:** 2 of 3 (Task 3 is a human-verify checkpoint)
+- **Files created/modified:** 10
+
+## Accomplishments
+
+- Slack OAuth callback route at `/api/slack/callback` — proxies code+state to FastAPI, redirects to onboarding step 2 on success
+- 3-step onboarding wizard using URL searchParams for step state (shareable/refreshable)
+- OnboardingStepper component with numbered circles, completed check marks, connector lines
+- Step 1: ConnectChannel with Slack OAuth button (fetches install URL, redirects browser) + expandable WhatsApp form with step-by-step credential instructions
+- Step 2: ConfigureAgent shows existing agents with link to Agent Designer; Next disabled until active agent exists
+- Step 3: TestMessage sends POST to backend per channel, shows loading/success/error states, no Go Live button (per user decision)
+- BYO API key settings page at `/settings/api-keys` — table showing provider/label/key_hint/date, Add dialog (provider select + label + masked key), delete confirmation
+- 7 new TanStack Query hooks for channels and LLM keys
+- Navigation sidebar updated with API Keys link
+- Portal builds successfully (15 routes, TypeScript clean)
+
+## Task Commits
+
+Portal commits (packages/portal):
+1. **Task 1: Slack OAuth callback, onboarding wizard, channel queries** - `120dc85` (feat)
+2. **Task 2: BYO API key settings page and nav link** - `8f4247b` (feat)
+
+Parent repo commit (portal gitlink update):
+3. **feat(03-02)**: `11c1e52` — updates portal submodule reference
+
+## Files Created
+
+- `packages/portal/app/api/slack/callback/route.ts` — Slack OAuth GET handler, proxies to FastAPI
+- `packages/portal/components/onboarding-stepper.tsx` — step progress indicator component
+- `packages/portal/app/(dashboard)/onboarding/page.tsx` — 3-step wizard entry page
+- `packages/portal/app/(dashboard)/onboarding/steps/connect-channel.tsx` — Slack + WhatsApp connect forms
+- `packages/portal/app/(dashboard)/onboarding/steps/configure-agent.tsx` — agent review / Agent Designer link
+- `packages/portal/app/(dashboard)/onboarding/steps/test-message.tsx` — test message sender, celebration on success
+- `packages/portal/app/(dashboard)/settings/api-keys/page.tsx` — BYO key CRUD page
+
+## Files Modified
+
+- `packages/portal/lib/api.ts` — added SlackInstallResponse, ChannelConnection, WhatsAppConnect*, TestMessageResponse, LlmKey, LlmKeyCreate types
+- `packages/portal/lib/queries.ts` — added useSlackInstallUrl, useConnectWhatsApp, useSendTestMessage, useChannelConnections, useLlmKeys, useAddLlmKey, useDeleteLlmKey
+- `packages/portal/components/nav.tsx` — added Key import and API Keys nav item
+
+## Decisions Made
+
+- **Agent auto-live**: `is_active: true` by default — operator does not need a separate "Go Live" step after test message succeeds
+- **Test required**: Test message step has no skip button — connectivity must be verified before operators leave the wizard
+- **Tenant-level API keys**: BYO key page reads `?tenant_id=` from URL (v1 simplicity, could be per-agent in future)
+- **Step state in URL**: `step=1|2|3` in searchParams — survives page refresh, supports browser back/forward, shareable
+- **Portal git initialized**: Created packages/portal/.git repo to enable atomic commits — previously portal was an orphaned gitlink with no local git history
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 3 - Blocking] recharts not installed despite being in package.json**
+- **Found during:** Task 1 verification (portal build)
+- **Issue:** `recharts` was listed in package.json (added in a previous phase plan) but never installed. This caused `Module not found: Can't resolve 'recharts'` build error blocking the Task 1 verification
+- **Fix:** Ran `npm install recharts` in packages/portal
+- **Files modified:** packages/portal/package-lock.json
+- **Commit:** 120dc85 (Task 1 commit)
+
+**2. [Rule 3 - Blocking] Portal had no local git repo (orphaned gitlink)**
+- **Found during:** Task 1 commit attempt
+- **Issue:** The parent repo tracks `packages/portal` as a git submodule gitlink (commit 29a27100). However, `packages/portal` had no `.git` directory, making it impossible to run `git add` on portal files
+- **Fix:** Initialized git repo in `packages/portal` with `git init` + `git add .` + `git commit`, then updated the parent's gitlink reference
+- **Impact:** Portal now has its own git history with proper atomic commits
+
+---
+
+**Total deviations:** 2 auto-fixed (Rule 3 — blocking issues)
+**Impact on plan:** Both fixes were necessary for the build to succeed and commits to be made; no scope change.
+
+## Self-Check: PASSED
+
+All 7 artifact files exist and portal builds successfully (exit 0, 15 routes, TypeScript clean).
+
+---
+*Phase: 03-operator-experience*
+*Completed: 2026-03-23*