@startuml
!theme plain
top to bottom direction

title CASAN Plan 13 - Baseline Complete and Remaining Follow-ups

skinparam backgroundColor #FAFAFA
skinparam componentStyle rectangle
skinparam shadowing false
skinparam ArrowColor #333333
skinparam componentBorderColor #555555
skinparam packageBorderColor #999999
skinparam packageBackgroundColor #FFFFFF

actor "Ops / Admin" as ops
actor "Platform Lead" as lead

package "DONE - Plan 13 Control Panel" #E8F5E9 {
  component "React Ops Console\nmonitoring + Settings + Approvals\nIncidents + FinOps/SLO" as ui_done #A9DFBF
  component "NestJS Control API\nread telemetry + governed writes" as api_done #A9DFBF
  component "Harness governance core\nsettings + RBAC + approvals\nkill-switch + H5 audit" as gov_core #A9DFBF
  component "Local-prod deploy smoke\nTLS + oauth2-proxy + mock OIDC\nnginx auth_request" as local_prod #D5F5E3
  component "Command Center baseline\n8 evidence-backed widgets\nbriefing + ticker + evidence drawer" as command_done #D5F5E3
}

package "NEXT - offline platform follow-ups" #FFF8E1 {
  component "RAI / Data Gov view\nretention + model-card + PII report" as rai #F9E79F
  component "Ask CASAN MVP-0\nread-only prompt router\nsource-cited answers + H4/H5/H6" as chat_ro #F9E79F
  component "Loop/Chat widgets\nbudget + replay drawer + chat ticker\nextends Command Center contract" as loop_widgets #FAD7A0
}

package "EXTERNAL / MANAGED PROD" #FDEDEC {
  component "Enterprise IdP + real cert + host\npromote local-prod OIDC flow" as managed_oidc #F1948A
  component "Managed alerts + on-call\nSlack/PagerDuty webhook" as alerts #F1948A
  component "Billing usage API live\nprovider cost ground truth" as billing #F1948A
}

ops --> ui_done : operate
ui_done --> api_done : API calls
api_done --> gov_core : wraps harness CLIs
api_done --> local_prod : verified behind auth proxy
api_done --> command_done : GET /api/v1/command
command_done --> gov_core : provenance + audit state

lead --> rai : next if staying offline
rai --> gov_core : read RAI + policy artifacts
chat_ro --> gov_core : read-only, audited, guarded
loop_widgets --> command_done : add specialized widgets

managed_oidc ..> local_prod : replace mock IdP/cert
alerts ..> gov_core : route real incidents
billing ..> command_done : ground-truth FinOps

note right of rai
Recommended next:
1. If no external infra: build RAI view or Ask CASAN MVP-0.
2. If infra is available: promote local-prod OIDC to managed prod.
3. Loop/Chat widgets should extend the existing Command envelope.
4. Keep every metric evidence-backed with provenance.
end note

@enduml