# Nexus Platform Foundation — Evidence Summary

> Build **86** · Version `0.1.0-identity2` · 2026-06-05  
> Scope: **Platform only** — no new user apps (Notes/Mail/Chat)

## Executive summary

Nexus Platform Foundation extends **NexusIdentity.Api** with persistent registries (organizations, users, devices, trust, enrollment, policies), remote enrollment MVP, Control Center dashboard API, and shell integration for optional remote sync. Deployment and policy architecture documents were added.

## What was built

### Backend (`NexusIdentity.Api`)

| Area | Deliverable |
|------|-------------|
| EF entities | `OrganizationEntity`, `DeviceEntity`, `DeviceTrustEntity`, `EnrollmentRequestEntity`, `PolicyEntity` |
| User extension | `UserEntity.OrganizationId` FK to organizations |
| Migration | `20260605120000_PlatformFoundation` |
| Seed | 3 orgs from shell catalog, 3 platform policies, POC users linked to orgs |
| Device registry | `DevicesController` persisted to DB (replaces in-memory) |
| Organization registry | CRUD `/api/organizations` |
| User registry | `/api/registry/users` list/get/create linked to org |
| Remote enrollment | `POST /api/enrollment/register`, `GET /api/enrollment/status/{deviceId}`, `POST /api/enrollment/approve` |
| Policy foundation | `PolicyService` — read + basic trust evaluation |
| Control Center API | `GET /api/control-center/dashboard`, `GET /api/control-center/policies` |

### Shell (`NexusShell`)

| Area | Deliverable |
|------|-------------|
| Config | `ControlCenter:BaseUrl` in `appsettings.json` |
| Remote enrollment | `NexusRemoteEnrollmentClient` — POST after local enroll |
| Control Center service | `NexusControlCenterApiClient` + extended `NexusControlCenterService` |
| Settings UI | **Control Center** section — read-only remote dashboard summary |
| Version | `version.poc.json` build **86** |

### Documentation

| Document | Path |
|----------|------|
| Deployment architecture | `docs/architecture/NEXUS_DEPLOYMENT_ARCHITECTURE.md` |
| Policy architecture | `docs/architecture/NEXUS_POLICY_ARCHITECTURE.md` |

## API list

| Method | Route | Auth | Description |
|--------|-------|------|-------------|
| GET | `/api/organizations` | Open (POC) | List organizations |
| GET | `/api/organizations/{id}` | Open | Get organization |
| POST | `/api/organizations` | Open | Create organization |
| PUT | `/api/organizations/{id}` | Open | Update organization |
| DELETE | `/api/organizations/{id}` | Open | Delete organization |
| GET | `/api/registry/users` | Open | List users (optional `?organizationId=`) |
| GET | `/api/registry/users/{id}` | Open | Get registry user |
| POST | `/api/registry/users` | Open | Create registry user |
| POST | `/api/devices/register` | Open | Agent device registration |
| POST | `/api/devices/heartbeat` | Open | Agent heartbeat |
| GET | `/api/devices` | Open | List devices |
| GET | `/api/devices/{deviceId}` | Open | Get device |
| POST | `/api/enrollment/register` | Open | Remote enrollment request |
| GET | `/api/enrollment/status/{deviceId}` | Open | Enrollment + policy status |
| POST | `/api/enrollment/approve` | Open | Admin approve/reject (POC) |
| GET | `/api/control-center/dashboard` | Open | Platform dashboard aggregate |
| GET | `/api/control-center/policies` | Open | List policies |

Existing auth endpoints unchanged: `/connect/token`, `/api/users/me`, `/health`, `/api/downloads/*`.

## Configuration

**Shell** (`appsettings.json`):

```json
"ControlCenter": {
  "BaseUrl": "http://localhost:5050"
}
```

Set to Identity API URL when testing remote enrollment + dashboard. Leave empty for local-only.

## Test plan (manual POC)

1. Start Identity API: `dotnet run --project source/nexus-identity/NexusIdentity.Api`
2. Set shell `ControlCenter:BaseUrl` to API URL.
3. Run enrollment in shell → verify `POST /api/enrollment/register` creates pending request.
4. `POST /api/enrollment/approve` with `{ "deviceId": "...", "approve": true }`.
5. `GET /api/control-center/dashboard` shows orgs, devices, pending count, trust summary.
6. Open Settings → Control Center — remote summary visible.

## Gaps (still POC)

| Gap | Notes |
|-----|-------|
| No dedicated Control Center WPF/web app | Shell Settings section only |
| Enrollment approve unauthenticated | Production needs admin JWT |
| Local vs remote trust not synced back to shell JSON | Post-approval poll not wired to local trust file |
| PostgreSQL on Coolify unhealthy | API falls back to SQLite |
| Domain proxy `/health` 404 | Coolify routing incomplete |
| No CI/CD | Manual build/deploy |
| GPO / advanced policy enforcement | Schema + evaluation foundation only |
| `nexus-control-center/` project | Still stub README — API lives in Identity.Api |

## Changed files (summary)

**Identity API:** entities, DbContext, SeedData, migration, PolicyService, Devices/Organizations/Enrollment/ControlCenter/RegistryUsers controllers, Program.cs

**Shell:** enrollment + control center clients/services, settings VM/view, models, appsettings, version.poc.json, App.xaml.cs

**Docs:** deployment + policy architecture, this SUMMARY

## Build status

| Project | Result |
|---------|--------|
| `NexusIdentity.Api` | **PASS** (Release) |
| `NexusShell` | **PASS** (Release) |
| `NexusInstaller` | **PASS** (Release) |
| `NexusShell.Tests` | **PASS** — 9/9 tests |

Verified: `GET /api/control-center/dashboard` returns 3 seeded orgs + policies on fresh SQLite DB.

**Note:** EF migration files exist for PostgreSQL upgrades; POC SQLite uses `DatabaseInitializer` with `EnsureCreated` fallback when migration assembly metadata is unavailable. Delete `nexus-identity.db` if upgrading from pre-build-86 EnsureCreated schema.
