# WG Paid / VM121 — roadmap and STEP matrix V2

## Phase 0 — Read-only truth

### P0.1 Multi-machine audit

VM121:

- source/Git;
- containers and services;
- Alembic and live DB schema/indexes;
- users/subscriptions/peers/jobs counts;
- safe environment fields;
- listen/firewall;
- backup state.

VM100:

- current Git/runtime;
- WG selector lifecycle;
- AmneziaWG packages, CLI, kernel/proto support;
- existing interface/port/address conflicts;
- candidate AWG pool;
- firewall/PBR/Direct/activity implications.

VM101:

- existing paid WG DNAT;
- available UDP port;
- firewall forwarding;
- public endpoint architecture;
- current source/runtime health.

Result: current-state/gap register. No mutation.

### P0.2 Canonical documentation publication

Publish:

- architecture V2;
- responsibility contract V2;
- multi-protocol quota model;
- current-state/gap register;
- updated global plan;
- updated test matrix.

## Phase 1 — VM100 common multi-protocol lifecycle

- generalize selector membership to include protocol/interface;
- add new peer automatic least-loaded selector assignment;
- disable removes peer/selector;
- common load across protocols;
- topology transition fixtures;
- no VM121 selector logic.

## Phase 2 — AmneziaWG transport foundation

- install/confirm AWG support VM100;
- create `awg_paid`;
- choose separate pool/listen port;
- VM101 DNAT;
- firewall/PBR/Direct/activity;
- one synthetic AWG client;
- persistence/reboot proof only when required.

## Phase 3 — VM121 schema V2

- protocol catalog;
- access grants;
- per-protocol quotas;
- connection profiles;
- encrypted credentials;
- tokens/sessions/audit;
- migration from existing schema.

## Phase 4 — Secure app and email

- production image;
- secrets;
- SMTP/outbox;
- TLS/reverse proxy;
- admin auth;
- magic-link auth.

## Phase 5 — Invite/account/config MVP

- tester invite;
- protocol quotas;
- account dashboard;
- WG and AWG profile creation;
- config and QR;
- re-download/reissue/revoke.

## Phase 6 — Pilot migration

- synthetic user;
- 2–3 home users;
- overlap old/new;
- expand cohort;
- individual old-peer removal.

## Phase 7 — Referrals and payments

- user-issued invites;
- plans;
- YooKassa;
- grant create/extend;
- no alternate provisioning path.