php-devops/TODO.md

# TODO - Session Summary 2026-01-31

## ✅ Completed Today

### GitHub Org Setup
- [x] Dev branches as default (all repos)
- [x] Labels taxonomy (agent:*, priority:*, type:*, lang:*)
- [x] Discord webhooks (7 channels × 20 repos)
- [x] Branch protection rules
- [x] Org security defaults enabled

### CodeRabbit
- [x] Central config: host-uk/coderabbit
- [x] Per-repo .coderabbit.yaml (21 repos)
- [x] review_status: false

### CodeQL/Security
- [x] Enabled on all public repos
- [x] Language-appropriate scanning

### GitHub Projects
- [x] Auto-add workflow (label → project)
- [x] PROJECT_TOKEN secret set

### Agent Verification Workflow
- [x] Labels: agent:ready → agent:wip → agent:review → verified
- [x] Self-verification blocked
- [x] core/.github/workflows/agent-verify.yml

### Template Repo (core-devops)
- [x] Bootstrap workflow for new repos
- [x] TEMPLATE_SETUP.md guide

### Free Tier Integration
- [x] Gemini, Groq, Mistral, Cohere, Cloudflare workflows
- [x] Semgrep, Trivy, Gitleaks, OSV, Checkov
- [x] Jules dispatch workflow
- [x] CONTRIBUTING.md + scripts/contribute.sh

### Docs
- [x] VitePress setup
- [x] core docs sync tested
- [x] free-tier-services.md

## 🔲 Pending (Core CLI Issues Created)

- [ ] #46 - docs sync ignores packages_dir
- [ ] #47 - core qa command area
- [ ] #48 - core security command
- [ ] #49 - core monitor (aggregate free tier findings)

## 🔲 Next Steps

- [ ] Merge dev → main on repos to deploy docs
- [ ] Recruit first 10 contributors
- [ ] Rotate PROJECT_TOKEN (was shared in chat)
- [x] Add workflow to remaining PHP repos (8 repos)
- [ ] Set up external OSS project scanning