# Zyquo Cloud Web — Build Plan & Phase Log Strict phase order 0 → 8. Each phase gets a checklist here, checked off as work lands, plus a 3–5 line summary at its checkpoint. --- ## Phase 0 — Research + Zyquo Cloud study - [x] Locate native Zyquo Cloud repo (`~/Desktop/zyquo-cloud`) - [x] Study provider layer (ProviderID, ProviderRegistry, OpenAICompatibleClient, AnthropicClient, StreamingService/SSEParser, ProviderProtocol) - [x] Study AIModel / capabilities / pricing / ParameterSupport model - [x] Study ZyquoTheme design tokens - [x] Extract complete model catalog (170 models, 12 providers — port from ModelCatalogData.swift, NOT the drifted catalog-summary.md) - [x] Study native UX (views, model picker, personas, prompt library, brand glyph) → `docs/NATIVE-UX.md` - [x] Empirical CORS probes, all 12 providers (preflight + real POST with Origin) - [x] Anthropic browser header confirmed (`anthropic-dangerous-direct-browser-access: true`) - [x] Web research: documented CORS stance per provider (cited in CORS-MATRIX) - [x] Write `docs/CORS-MATRIX.md` - [x] Write `docs/PROVIDER-REUSE.md` **Phase 0 summary.** Native repo studied end-to-end: only two wire formats (OpenAI chat/completions ×11 incl. Gemini-compat; Anthropic Messages ×1), one SSE parser, 170-model catalog, ZyquoTheme tokens extracted. Empirical CORS probes with real keys: **all 12 providers callable directly from the browser** (Anthropic needs `anthropic-dangerous-direct-browser-access: true`); documented stances researched and cited. Proxy/Zyquo Router override still ships since only Anthropic documents CORS officially. Gate satisfied: PROVIDER-REUSE.md + CORS-MATRIX.md complete. --- ## Phase 1 — Project setup (React + TS + Vite) - [x] Vite + React 19 + TypeScript strict (project references, `noUncheckedIndexedAccess`) - [x] Styling: CSS variables implementing ZyquoTheme (`src/design/tokens.css` + `global.css`) — no Tailwind (dependency minimalism = smaller XSS surface) - [x] State: Zustand installed - [x] ESLint (flat config) + Prettier; scripts `dev/build/preview/lint/typecheck/check` - [x] PWA scaffold (vite-plugin-pwa): app-shell precache only, NO API/key caching, manifest (light theme-color) - [x] Strict CSP meta in `index.html`: `connect-src` = exact 12 provider origins + localhost (Zyquo Router); no inline/third-party scripts - [x] Phase checkpoint: `npm run check` green (typecheck, lint, build) **Phase 1 summary.** Hand-scaffolded Vite/React/TS-strict app with mandatory headers everywhere, ZyquoTheme tokens as CSS variables (light default + dark + 5 accents), a locked-down CSP whose connect-src is exactly the 12 provider origins plus localhost for Zyquo Router, and an app-shell-only PWA. Build, lint, and typecheck all green on first checkpoint. ## Phase 2 — Architecture + browser provider layer — pending ## Phase 3 — Local persistence — pending ## Phase 4 — Design system & UI — pending ## Phase 5 — Brand assets — pending ## Phase 6 — Features — pending ## Phase 7 — Verification — pending ## Phase 8 — Build & deployment — pending