Nexus-Guard-Suite/.sisyphus/plans/archive/firewall-and-legacy-cleanup.md

# Firewall System Fix + Legacy Styling Cleanup

## TL;DR

> **Quick Summary**: Fix broken nftables firewall rule system (rules from UI never actually filter traffic), remove dead LinkedDevices component, and modernize ALL remaining legacy-styled views/components to use the Ng* design system with proper @theme tokens.
> 
> **Deliverables**:
> - Working nftables firewall rules (UI rules actually filter kernel traffic)
> - fwd_estab duplicate bug fixed
> - RemoveForwardRule multi-CIDR fix
> - @theme design tokens defined in main.css
> - 11 files restyled with Ng* components + design tokens
> - All 19 alert() → useToast(), all 6 confirm() → useConfirm()
> - LinkedDevices.vue deleted
> - Backend go tests for firewall rule CRUD
> 
> **Estimated Effort**: Large
> **Parallel Execution**: YES - 3 waves
> **Critical Path**: Task 1 (@theme) → Wave 2 frontend tasks → Final verification

---

## Context

### Original Request
User identified LinkedDevices.vue ("Perangkat Tertaut") as broken/redundant and asked:
1. What is it for? → Answered: legacy component showing device's own data, not actual linked devices
2. Firewall needs fixing — conflicts with AllowedIPs and nftables → Investigated: found critical backend bugs
3. Fix with recommendations + check all legacy styling across all menus

### Interview Summary
**Key Discussions**:
- LinkedDevices.vue: DELETE — broken, redundant, uses emoji/alert/confirm
- FirewallEditor.vue: Redesign with Ng* design system
- Backend bugs: fwd_estab 3x duplicate, syncRuleToFirewall completely broken (rules never actually filter), RemoveForwardRule single-handle bug
- AllowedIPs vs nftables: Separate concerns (routing vs filtering) — UI already separates them correctly
- Styling: ALL 7 views + 4 components need cleanup (19 alert, 6 confirm, hardcoded colors, emoji)

**Research Findings**:
- Ng* components use @theme tokens (`bg-bg-surface`, `text-text-primary`, etc.) but main.css has NO @theme block — tokens undefined
- `syncRuleToFirewall()` calls `AddRangeRule()` which creates orphaned nftables SETs with no chain RULE referencing them — UI firewall rules are 100% non-functional
- `AddRangeRule` interface inadequate: no protocol, no action, CIDR parsing wrong
- 3 callers of AddRangeRule: rules.go:133, devices.go:144, peers.go:128
- useToast() and useConfirm() composables already exist and ready to use
- All 16 Ng* components created during redesign, ready to use

### Metis Review
**Identified Gaps** (addressed):
- @theme tokens missing — added as Wave 0 prerequisite task
- NetManager interface needs new method for proper firewall rules — planned
- devices.go:144 and peers.go:128 SSH auto-provisioning also use broken AddRangeRule — included in scope
- RemoveForwardRule multi-CIDR awk bug — included in scope
- Existing orphaned nftables sets in production — noted, InitNetwork will clean
- alert/confirm count correction: 21/7 raw → 19/6 after LinkedDevices deletion — confirmed

---

## Work Objectives

### Core Objective
Fix the completely non-functional firewall rule system so UI-created rules actually filter traffic in the Linux kernel, and modernize all remaining legacy UI to the Ng* design system.

### Concrete Deliverables
- `apps/server-core/internal/firewall/manager.go` — new `AddFirewallRule`/`RemoveFirewallRule` methods
- `apps/server-core/internal/firewall/nftables_linux.go` — fwd_estab fix, new methods, RemoveForwardRule fix
- `apps/server-core/internal/firewall/nftables_stub.go` — matching stub methods
- `apps/server-core/api/rules.go` — rewritten `syncRuleToFirewall` + delete cleanup
- `apps/server-core/api/devices.go` + `peers.go` — updated SSH auto-provisioning callers
- `apps/dashboard-ui/src/assets/main.css` — @theme design tokens
- `apps/dashboard-ui/src/components/LinkedDevices.vue` — DELETED
- `apps/dashboard-ui/src/components/FirewallEditor.vue` — redesigned with Ng*
- 9 more .vue files restyled (see TODOs)

### Definition of Done
- [x] `cd apps/server-core && go build ./...` passes
- [x] `cd apps/server-core && go test ./... -tags dev -count=1` all pass
- [x] `cd apps/dashboard-ui && npm run build` passes with 0 errors
- [x] `grep -r "alert(" --include="*.vue" src/` returns 0 matches
- [x] `grep -r "LinkedDevices" --include="*.vue" --include="*.ts" src/` returns 0 matches
- [x] `grep -r "confirm(" --include="*.vue" src/ | grep -v useConfirm | grep -v handleConfirm | grep -v ConfirmModal | grep -v "\/\/"` returns 0 matches

### Must Have
- Firewall rules created via UI must produce actual nft rules in FORWARD chain
- All alert()/confirm() replaced with useToast()/useConfirm()
- LinkedDevices.vue deleted with all references
- @theme tokens defined so Ng* components render correctly
- Port range support (e.g., 80-443)
- Protocol selection (tcp/udp/both) honored in nft rules
- Action (accept/drop) honored in nft rules

### Must NOT Have (Guardrails)
- NEVER use `nft flush table` — destroys all peer isolation
- NEVER touch `AddForwardRule`, `AddInputRule`, `RemoveInputRule`, `AddUserIsolation` — they work correctly
- NEVER introduce new Ng* components — use existing 16 only
- NEVER touch Login.vue — already redesigned
- NEVER touch style.css — dead scaffold code
- NEVER add logging/audit trails to firewall backend
- NEVER refactor admin-only checks (known debt, out of scope)
- NEVER add sorting/filtering/pagination to FirewallEditor rule table
- Port format: single port or dash-range ONLY (e.g., `80` or `8000-9000`). No comma-separated.

---

## Verification Strategy

> **ZERO HUMAN INTERVENTION** - ALL verification is agent-executed. No exceptions.

### Test Decision
- **Infrastructure exists**: YES (Go: `go test`, Frontend: `npm run build` / vue-tsc)
- **Automated tests**: YES (backend tests after implementation)
- **Framework**: Go `testing` package for backend; no frontend unit tests
- **Test approach**: Tests-after for backend; agent QA for frontend

### QA Policy
Every task MUST include agent-executed QA scenarios.
Evidence saved to `.sisyphus/evidence/task-{N}-{scenario-slug}.{ext}`.

- **Backend**: Use Bash (`go test`, `go build`) — compile, run tests, verify output
- **Frontend/UI**: Use Bash (`npm run build`, `grep`) — type-check, verify no legacy patterns remain

---

## Execution Strategy

### Parallel Execution Waves

```
Wave 0 (Prerequisite — must complete first):
└── Task 1: Define @theme design tokens in main.css [quick]

Wave 1 (Backend firewall — all parallel):
├── Task 2: Fix InitNetwork fwd_estab duplicates [quick]
├── Task 3: Add AddFirewallRule/RemoveFirewallRule to NetManager interface [quick]
├── Task 4: Rewrite syncRuleToFirewall + fix rule delete cleanup [quick]
├── Task 5: Fix RemoveForwardRule multi-CIDR handling [quick]
├── Task 6: Update SSH auto-provisioning callers [quick]
└── Task 7: Add backend tests for firewall rule CRUD [quick]

Wave 2 (Frontend — all parallel, depends on Task 1):
├── Task 8: Delete LinkedDevices.vue + clean references [quick]
├── Task 9: Redesign FirewallEditor.vue with Ng* design system [quick]
├── Task 10: Restyle DeviceDetail.vue [quick]
├── Task 11: Restyle Devices.vue [quick]
├── Task 12: Restyle Dashboard.vue [quick]
├── Task 13: Restyle Servers.vue modals/forms [quick]
├── Task 14: Restyle Users.vue [quick]
├── Task 15: Restyle AddPeerModal.vue + PeerConfigModal.vue [quick]
├── Task 16: Restyle ShareConfig.vue [quick]
└── Task 17: Restyle TrafficChart.vue SVG colors [quick]

Wave FINAL (After ALL tasks — 4 parallel reviews):
├── Task F1: Plan compliance audit (oracle)
├── Task F2: Code quality review (unspecified-high)
├── Task F3: Real manual QA (unspecified-high)
└── Task F4: Scope fidelity check (deep)
-> Present results -> Get explicit user okay
```

### Dependency Matrix

| Task | Depends On | Blocks | Wave |
|------|-----------|--------|------|
| 1 | - | 8-17 | 0 |
| 2 | - | 7 | 1 |
| 3 | - | 4, 5, 6, 7 | 1 |
| 4 | 3 | 7 | 1 |
| 5 | - | 7 | 1 |
| 6 | 3 | 7 | 1 |
| 7 | 2, 3, 4, 5, 6 | FINAL | 1 |
| 8 | 1 | FINAL | 2 |
| 9 | 1 | FINAL | 2 |
| 10 | 1, 8 | FINAL | 2 |
| 11-17 | 1 | FINAL | 2 |
| F1-F4 | ALL | - | FINAL |

### Agent Dispatch Summary

- **Wave 0**: **1** — T1 → `quick`
- **Wave 1**: **6** — T2-T6 → `quick`, T7 → `quick`
- **Wave 2**: **10** — T8-T17 → `quick`
- **FINAL**: **4** — F1 → `oracle`, F2 → `unspecified-high`, F3 → `unspecified-high`, F4 → `deep`

---

## TODOs

- [x] 1. Define @theme design tokens in main.css

  **What to do**:
  - Add `@theme` block to `apps/dashboard-ui/src/assets/main.css` after `@import "tailwindcss";`
  - Define ALL color tokens used by existing Ng* components (found by grepping `src/components/ui/*.vue`):
    - Background: `--color-bg-base`, `--color-bg-surface`, `--color-bg-elevated`, `--color-bg-overlay`
    - Text: `--color-text-primary`, `--color-text-secondary`, `--color-text-muted`
    - Border: `--color-border-subtle`, `--color-border-default`, `--color-border-strong`
    - Accent: `--color-accent`, `--color-accent-hover`
    - Semantic: `--color-danger`, `--color-success`, `--color-warning`
    - Shadow: `--shadow-glow`
  - Color palette: dark glassmorphism theme — `bg-base` ~`#0a0a14`, `bg-surface` ~`#12121e`, `bg-elevated` ~`#1a1a2e`, accent = cyan (#06b6d4), danger = red (#ef4444)
  - Verify existing Ng* components render correctly after tokens are defined

  **Must NOT do**:
  - Do NOT modify any Ng* component files
  - Do NOT touch `style.css` (dead code)
  - Do NOT add custom utility classes beyond what @theme provides

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: NO (prerequisite for all frontend tasks)
  - **Parallel Group**: Wave 0
  - **Blocks**: Tasks 8-17
  - **Blocked By**: None

  **References**:
  - `apps/dashboard-ui/src/assets/main.css` — Current file (17 lines: @import + fadeInUp animation only)
  - `apps/dashboard-ui/src/components/ui/NgCard.vue:14-17` — Uses `bg-bg-surface`, `bg-bg-elevated`, `border-border-subtle`, `border-border-default`, `shadow-glow`
  - `apps/dashboard-ui/src/components/ui/NgButton.vue:18-22` — Uses `bg-accent`, `bg-accent-hover`, `bg-bg-elevated`, `bg-bg-surface`, `text-text-primary`, `text-text-secondary`, `bg-danger`, `ring-accent`, `ring-offset-bg-base`
  - `apps/dashboard-ui/src/components/ui/NgInput.vue:49-51` — Uses `bg-bg-base`, `text-text-primary`, `placeholder-text-muted`, `border-border-default`, `border-border-strong`, `ring-accent`, `border-danger`, `ring-danger`
  - `apps/dashboard-ui/src/components/ui/NgModal.vue:46,63,70,77` — Uses `bg-bg-overlay`, `from-bg-surface`, `to-bg-elevated`, `border-border-subtle`, `text-text-primary`, `text-text-muted`, `text-text-secondary`
  - `apps/dashboard-ui/vite.config.ts` — Vite 8 + `@tailwindcss/vite` plugin (TailwindCSS v4 syntax, `@theme` directive)
  - TailwindCSS v4 docs: `@theme` defines custom design tokens as CSS custom properties that generate utility classes

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: @theme tokens compile and generate utilities
    Tool: Bash
    Preconditions: apps/dashboard-ui has node_modules installed
    Steps:
      1. Run: cd apps/dashboard-ui && npm run build
      2. Check exit code is 0
      3. Run: grep -c "@theme" src/assets/main.css
    Expected Result: Build succeeds. grep returns 1 (one @theme block exists)
    Evidence: .sisyphus/evidence/task-1-theme-build.txt

  Scenario: All required token names defined
    Tool: Bash
    Steps:
      1. Run: grep -E "bg-base|bg-surface|bg-elevated|bg-overlay|text-primary|text-secondary|text-muted|border-subtle|border-default|border-strong|accent|accent-hover|danger|success|warning|shadow-glow" apps/dashboard-ui/src/assets/main.css | wc -l
    Expected Result: At least 15 matches (all tokens present)
    Evidence: .sisyphus/evidence/task-1-token-audit.txt
  ```

  **Commit**: YES (Commit A)
  - Message: `feat(dashboard): add @theme design tokens to main.css`
  - Files: `src/assets/main.css`
  - Pre-commit: `npm run build`

- [x] 2. Fix InitNetwork fwd_estab duplicates in nftables_linux.go

  **What to do**:
  - DELETE lines 67, 75, 83 in `nftables_linux.go` — these are copy-paste duplicates that insert `fwd_estab` into FORWARD chain from inside the INPUT chain section
  - Keep ONLY line 43 (the correct one inside the FORWARD `wg_isolation` guard)
  - Verify the idempotency guard: line 43 is inside `if exec.Command("sh", "-c", checkWgDrop).Run() != nil` — this means `fwd_estab` is only added when `wg_isolation` doesn't exist yet. This is correct behavior.

  **Must NOT do**:
  - Do NOT touch the INPUT chain rules (lines 48-84 excluding the fwd_estab duplicates)
  - Do NOT change `wg_isolation` rule
  - Do NOT use `nft flush table`
  - Do NOT modify `AddForwardRule`, `AddInputRule`, or any method outside `InitNetwork`

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: YES
  - **Parallel Group**: Wave 1 (with Tasks 3, 4, 5, 6)
  - **Blocks**: Task 7
  - **Blocked By**: None

  **References**:
  - `apps/server-core/internal/firewall/nftables_linux.go:25-87` — Full `InitNetwork()` function
  - Line 43: Correct `fwd_estab` insert (inside FORWARD wg_isolation guard)
  - Line 67: DUPLICATE — inside INPUT section, inserts into FORWARD
  - Line 75: DUPLICATE — inside INPUT section, inserts into FORWARD
  - Line 83: DUPLICATE — inside INPUT section, inserts into FORWARD
  - All 3 duplicates lack idempotency guards (no grep check), so every `InitNetwork()` call creates new handles

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: fwd_estab appears exactly once in InitNetwork
    Tool: Bash
    Steps:
      1. Run: grep -c "fwd_estab" apps/server-core/internal/firewall/nftables_linux.go
    Expected Result: Exactly 1 match (line 43 area only)
    Evidence: .sisyphus/evidence/task-2-fwd-estab-count.txt

  Scenario: Build compiles successfully
    Tool: Bash
    Steps:
      1. Run: cd apps/server-core && go build ./...
    Expected Result: Exit code 0, no errors
    Evidence: .sisyphus/evidence/task-2-go-build.txt
  ```

  **Commit**: NO (groups with Commit B)

- [x] 3. Add AddFirewallRule/RemoveFirewallRule to NetManager interface

  **What to do**:
  - Add new method to `manager.go` interface:
    ```go
    AddFirewallRule(ruleName string, sourceIP net.IP, destCIDR string, portRange string, protocol string, action string) error
    RemoveFirewallRule(ruleName string) error
    ```
  - Implement in `nftables_linux.go`:
    - `AddFirewallRule`: Generate proper `nft insert rule ip nexusguard forward ip saddr {sourceIP} ip daddr {destCIDR} {protocol} dport {portRange} {action} comment "fwrule_{ruleName}"`
    - Handle protocol: `tcp`, `udp`, or omit for `both`
    - Handle portRange: empty = all ports (no dport match), single port `80`, range `80-443`
    - Handle action: `accept` or `drop`
    - Handle destCIDR: single IP auto-appended `/32`, CIDR passed as-is
    - `RemoveFirewallRule`: Find and delete ALL handles matching `comment "fwrule_{ruleName}"` (loop over awk output)
  - Implement stubs in `nftables_stub.go` (return nil)
  - Do NOT remove old `AddRangeRule`/`RemoveRangeRule` yet — keep for backward compatibility until callers are updated

  **Must NOT do**:
  - Do NOT remove `AddRangeRule`/`RemoveRangeRule` from interface (callers still reference them until Task 4/6)
  - Do NOT touch `AddForwardRule`, `AddInputRule`, or any other existing methods
  - Do NOT use `nft flush table`

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: YES
  - **Parallel Group**: Wave 1 (with Tasks 2, 5)
  - **Blocks**: Tasks 4, 6, 7
  - **Blocked By**: None

  **References**:
  - `apps/server-core/internal/firewall/manager.go` — Full interface (17 lines). New methods follow existing pattern.
  - `apps/server-core/internal/firewall/nftables_linux.go:181-200` — `AddForwardRule` as PATTERN to follow: uses `nft insert rule`, handles comma-separated CIDRs, uses comment for identification, uses `exec.Command`
  - `apps/server-core/internal/firewall/nftables_linux.go:202-211` — `RemoveForwardRule` as PATTERN but with KNOWN BUG (single handle). New `RemoveFirewallRule` must loop ALL handles.
  - `apps/server-core/internal/firewall/nftables_stub.go` — All methods return nil, one-liner pattern

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: Interface compiles with new methods
    Tool: Bash
    Steps:
      1. Run: cd apps/server-core && go build ./...
    Expected Result: Exit code 0
    Evidence: .sisyphus/evidence/task-3-go-build.txt

  Scenario: New methods exist in all 3 files
    Tool: Bash
    Steps:
      1. Run: grep -c "AddFirewallRule" apps/server-core/internal/firewall/manager.go apps/server-core/internal/firewall/nftables_linux.go apps/server-core/internal/firewall/nftables_stub.go
    Expected Result: 1 match per file (3 total)
    Evidence: .sisyphus/evidence/task-3-method-check.txt
  ```

  **Commit**: NO (groups with Commit B)

- [x] 4. Rewrite syncRuleToFirewall + fix rule delete in rules.go

  **What to do**:
  - Rewrite `syncRuleToFirewall()` in `rules.go` to use new `AddFirewallRule()`:
    ```go
    func (h *RulesHandler) syncRuleToFirewall(rule models.FirewallRule, deviceName string) {
        // Get device's internal IP for source matching
        var device models.Device
        if err := h.db.Where("id = ?", rule.DeviceID).First(&device).Error; err != nil {
            return
        }
        sourceIP := net.ParseIP(device.InternalIP)
        if sourceIP == nil {
            return
        }
        
        destCIDR := rule.DestIPRange
        // Single IP → append /32
        if !strings.Contains(destCIDR, "/") {
            destCIDR += "/32"
        }
        
        h.fw.AddFirewallRule(
            rule.ID.String(),
            sourceIP,
            destCIDR,
            rule.DestPortRange,  // "" = all ports, "80" = single, "80-443" = range
            rule.Protocol,       // "tcp", "udp", "both"
            rule.Action,         // "accept", "drop"
        )
    }
    ```
  - Update `Delete()` handler to use `RemoveFirewallRule()` instead of `RemoveRangeRule()`:
    ```go
    h.fw.RemoveFirewallRule(rule.ID.String())
    ```
  - Add input validation in `Create()`: validate `DestPortRange` format (empty, single number, or `N-N` range)
  - Add input validation: validate `Action` is `accept` or `drop` only
  - Add input validation: validate `Protocol` is `tcp`, `udp`, or `both` only

  **Must NOT do**:
  - Do NOT change the API request/response shape (keep `CreateRuleRequest` struct)
  - Do NOT add new fields to the model
  - Do NOT add logging or audit trails

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: YES (after Task 3)
  - **Parallel Group**: Wave 1
  - **Blocks**: Task 7
  - **Blocked By**: Task 3

  **References**:
  - `apps/server-core/api/rules.go` — Full file (135 lines). `syncRuleToFirewall` at line 114-135, `Delete` at line 83-112, `Create` at line 49-81
  - `apps/server-core/api/helpers.go` — Has `validateAllowedIPs()` pattern to follow for validation
  - `apps/server-core/internal/models/models.go:95-112` — `FirewallRule` model: ID, DeviceID, DestIPRange, DestPortRange, Protocol, Action
  - `apps/server-core/api/rules.go:109` — Current delete uses `RemoveRangeRule("rule_" + rule.ID.String())` → change to `RemoveFirewallRule(rule.ID.String())`

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: syncRuleToFirewall uses new AddFirewallRule
    Tool: Bash
    Steps:
      1. Run: grep "AddFirewallRule" apps/server-core/api/rules.go
      2. Run: grep "AddRangeRule" apps/server-core/api/rules.go
    Expected Result: AddFirewallRule found, AddRangeRule NOT found
    Evidence: .sisyphus/evidence/task-4-sync-rewrite.txt

  Scenario: Delete uses RemoveFirewallRule
    Tool: Bash
    Steps:
      1. Run: grep "RemoveFirewallRule" apps/server-core/api/rules.go
      2. Run: grep "RemoveRangeRule" apps/server-core/api/rules.go
    Expected Result: RemoveFirewallRule found, RemoveRangeRule NOT found
    Evidence: .sisyphus/evidence/task-4-delete-fix.txt

  Scenario: Build succeeds
    Tool: Bash
    Steps:
      1. Run: cd apps/server-core && go build ./...
    Expected Result: Exit code 0
    Evidence: .sisyphus/evidence/task-4-build.txt
  ```

  **Commit**: NO (groups with Commit B)

- [x] 5. Fix RemoveForwardRule multi-CIDR handling

  **What to do**:
  - Fix `RemoveForwardRule()` in `nftables_linux.go` to handle multiple handles (multi-CIDR peers)
  - Current bug: `awk '/comment \\"peer_xxx\\"/ {print $NF}'` returns only the LAST match when piped to a single string. Only one handle is deleted.
  - Fix: Loop over ALL matching handles. Use approach:
    ```go
    func (m *LinuxManager) RemoveForwardRule(peerName string) error {
        // Match both exact "peer_xxx" and suffixed "peer_xxx_0", "peer_xxx_1" patterns
        cmdStr := fmt.Sprintf(`nft -a list chain ip nexusguard forward | grep -E 'comment "peer_%s(_[0-9]+)?"' | awk '{print $NF}'`, peerName)
        out, err := exec.Command("sh", "-c", cmdStr).Output()
        if err != nil || len(out) == 0 {
            return nil
        }
        for _, handle := range strings.Split(strings.TrimSpace(string(out)), "\n") {
            handle = strings.TrimSpace(handle)
            if handle == "" {
                continue
            }
            exec.Command("sh", "-c", fmt.Sprintf("nft delete rule ip nexusguard forward handle %s", handle)).Run()
        }
        return nil
    }
    ```
  - Note: `AddForwardRule` creates rules with comments `peer_xxx` (single CIDR) or `peer_xxx_0`, `peer_xxx_1` (multi-CIDR). The grep pattern must match all variants.

  **Must NOT do**:
  - Do NOT modify `AddForwardRule` — it works correctly
  - Do NOT use `nft flush table`

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: YES
  - **Parallel Group**: Wave 1 (with Tasks 2, 3)
  - **Blocks**: Task 7
  - **Blocked By**: None

  **References**:
  - `apps/server-core/internal/firewall/nftables_linux.go:202-211` — Current buggy `RemoveForwardRule` (single handle)
  - `apps/server-core/internal/firewall/nftables_linux.go:181-200` — `AddForwardRule` creates comments `peer_{name}` and `peer_{name}_{i}` for multi-CIDR
  - Line 190-192: Suffix logic — `suffix = fmt.Sprintf("_%d", i)` for multi-CIDR, empty string for single CIDR

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: RemoveForwardRule loops over all handles
    Tool: Bash
    Steps:
      1. Run: grep -A 15 "func.*RemoveForwardRule" apps/server-core/internal/firewall/nftables_linux.go
      2. Verify the output contains a loop (for/range or while) over handles
      3. Verify grep pattern matches both "peer_xxx" and "peer_xxx_N" suffixes
    Expected Result: Function contains loop + regex pattern for suffixed comments
    Evidence: .sisyphus/evidence/task-5-remove-forward.txt

  Scenario: Build succeeds
    Tool: Bash
    Steps:
      1. Run: cd apps/server-core && go build ./...
    Expected Result: Exit code 0
    Evidence: .sisyphus/evidence/task-5-build.txt
  ```

  **Commit**: NO (groups with Commit B)

- [x] 6. Update SSH auto-provisioning callers (devices.go + peers.go)

  **What to do**:
  - Update `apps/server-core/api/devices.go:144` — replace `AddRangeRule` call with `AddFirewallRule`:
    ```go
    // Before: _ = h.fw.AddRangeRule("rule_"+rule.ID.String(), ip, ip, 22, 22)
    // After:
    _ = h.fw.AddFirewallRule(rule.ID.String(), sourceIP, rule.DestIPRange, "22", "tcp", "accept")
    ```
    Where `sourceIP` is the device's InternalIP (already available in the handler context)
  - Update `apps/server-core/api/peers.go:128` — same pattern as devices.go
  - Read surrounding code context to get the correct `sourceIP` variable name (the device's internal IP is available in the handler)
  - After updating both callers, `AddRangeRule` and `RemoveRangeRule` can be removed from the interface + all implementations (cleanup)

  **Must NOT do**:
  - Do NOT change the SSH auto-provisioning logic (still creates port 22 TCP accept rule)
  - Do NOT change the FirewallRule model or DB operations
  - Do NOT remove `AddRangeRule`/`RemoveRangeRule` until AFTER both callers are updated

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: YES (after Task 3)
  - **Parallel Group**: Wave 1
  - **Blocks**: Task 7
  - **Blocked By**: Task 3

  **References**:
  - `apps/server-core/api/devices.go:144` — Current: `_ = h.fw.AddRangeRule("rule_"+rule.ID.String(), ip, ip, 22, 22)`. Read lines 130-150 for full context to find the sourceIP variable.
  - `apps/server-core/api/peers.go:128` — Current: `_ = h.fw.AddRangeRule("rule_"+rule.ID.String(), ip, ip, 22, 22)`. Read lines 115-135 for full context.
  - `apps/server-core/internal/firewall/manager.go` — After cleanup, remove `AddRangeRule`/`RemoveRangeRule` from interface
  - `apps/server-core/internal/firewall/nftables_linux.go:154-177` — Remove `AddRangeRule`/`RemoveRangeRule` implementations
  - `apps/server-core/internal/firewall/nftables_stub.go:22-23` — Remove stub methods
  - `apps/server-core/internal/firewall/nftables_test.go:40-52` — Remove or update `TestRangeRule`

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: No more AddRangeRule callers in API
    Tool: Bash
    Steps:
      1. Run: grep -r "AddRangeRule" apps/server-core/
    Expected Result: 0 matches (removed from interface, impls, callers, and tests)
    Evidence: .sisyphus/evidence/task-6-no-rangerule.txt

  Scenario: AddFirewallRule used in devices.go and peers.go
    Tool: Bash
    Steps:
      1. Run: grep "AddFirewallRule" apps/server-core/api/devices.go apps/server-core/api/peers.go
    Expected Result: 1 match per file (2 total)
    Evidence: .sisyphus/evidence/task-6-new-callers.txt

  Scenario: Build succeeds after cleanup
    Tool: Bash
    Steps:
      1. Run: cd apps/server-core && go build ./...
    Expected Result: Exit code 0
    Evidence: .sisyphus/evidence/task-6-build.txt
  ```

  **Commit**: NO (groups with Commit B)

- [x] 7. Add backend tests for firewall rule CRUD

  **What to do**:
  - Add/update tests in `apps/server-core/api/rules_test.go` (if exists) or create it:
    - Test `Create` handler: valid rule with IP/CIDR, port range, protocol, action → 201 Created
    - Test `Create` handler: invalid port format → 400
    - Test `Create` handler: invalid action → 400
    - Test `Create` handler: invalid protocol → 400
    - Test `Delete` handler: existing rule → 200, verify rule removed from DB
    - Test `List` handler: returns rules for a device
  - Update `apps/server-core/internal/firewall/nftables_test.go`:
    - Replace `TestRangeRule` with `TestFirewallRule` testing new `AddFirewallRule`/`RemoveFirewallRule` via stub
  - Run all tests: `go test ./... -tags dev -count=1`

  **Must NOT do**:
  - Do NOT write tests that require a running Linux nftables kernel — use stub manager
  - Do NOT mock the database — use GORM in-memory SQLite (pattern from existing tests)

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: NO (depends on all Wave 1 tasks)
  - **Parallel Group**: Wave 1 (sequential after Tasks 2-6)
  - **Blocks**: Final verification
  - **Blocked By**: Tasks 2, 3, 4, 5, 6

  **References**:
  - `apps/server-core/internal/firewall/nftables_test.go` — Existing test file (52 lines), has `TestRangeRule` to replace
  - `apps/server-core/internal/models/models_test.go` — Pattern for GORM in-memory SQLite test setup (lines 1-30)
  - `apps/server-core/api/rules.go` — Handler code to test
  - Check if `apps/server-core/api/rules_test.go` exists — if so, read it for existing patterns

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: All tests pass
    Tool: Bash
    Steps:
      1. Run: cd apps/server-core && go test ./... -tags dev -count=1 -v 2>&1 | tail -30
    Expected Result: All tests PASS, exit code 0
    Evidence: .sisyphus/evidence/task-7-test-results.txt

  Scenario: New firewall tests exist
    Tool: Bash
    Steps:
      1. Run: grep -c "TestFirewallRule\|TestCreate.*Rule\|TestDelete.*Rule\|TestList.*Rule" apps/server-core/internal/firewall/nftables_test.go apps/server-core/api/rules_test.go 2>/dev/null || echo "no test files"
    Expected Result: At least 3 test functions found
    Evidence: .sisyphus/evidence/task-7-test-count.txt
  ```

  **Commit**: YES (Commit B)
  - Message: `fix(firewall): rewrite nftables rule system + fix fwd_estab duplicates`
  - Files: `internal/firewall/manager.go`, `internal/firewall/nftables_linux.go`, `internal/firewall/nftables_stub.go`, `internal/firewall/nftables_test.go`, `api/rules.go`, `api/rules_test.go`, `api/devices.go`, `api/peers.go`
  - Pre-commit: `go test ./... -tags dev -count=1`

- [x] 8. Delete LinkedDevices.vue + clean all references

  **What to do**:
  - Delete `apps/dashboard-ui/src/components/LinkedDevices.vue`
  - Remove import and template usage from `DeviceDetail.vue`:
    - Line 175: `<LinkedDevices v-if="device.InternalIP" :device-id="device.ID" />` → DELETE
    - Line 220: `import LinkedDevices from '../components/LinkedDevices.vue'` → DELETE
  - Remove `src/components/LinkedDevices.vue` from any tsconfig references if applicable
  - Verify no other files reference LinkedDevices

  **Must NOT do**:
  - Do NOT modify any other component files
  - Do NOT remove the FirewallEditor section from DeviceDetail.vue (it stays)

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: YES
  - **Parallel Group**: Wave 2 (with Tasks 9-17)
  - **Blocks**: Final verification
  - **Blocked By**: Task 1

  **References**:
  - `apps/dashboard-ui/src/components/LinkedDevices.vue` — 84 lines, DELETE entirely
  - `apps/dashboard-ui/src/views/DeviceDetail.vue:175` — Template reference: `<LinkedDevices v-if="device.InternalIP" :device-id="device.ID" />`
  - `apps/dashboard-ui/src/views/DeviceDetail.vue:220` — Import: `import LinkedDevices from '../components/LinkedDevices.vue'`

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: LinkedDevices.vue deleted
    Tool: Bash
    Steps:
      1. Run: test -f apps/dashboard-ui/src/components/LinkedDevices.vue && echo "EXISTS" || echo "DELETED"
    Expected Result: DELETED
    Evidence: .sisyphus/evidence/task-8-deleted.txt

  Scenario: No references to LinkedDevices remain
    Tool: Bash
    Steps:
      1. Run: grep -r "LinkedDevices" --include="*.vue" --include="*.ts" apps/dashboard-ui/src/
    Expected Result: 0 matches
    Evidence: .sisyphus/evidence/task-8-no-refs.txt

  Scenario: Build succeeds
    Tool: Bash
    Steps:
      1. Run: cd apps/dashboard-ui && npm run build
    Expected Result: Exit code 0
    Evidence: .sisyphus/evidence/task-8-build.txt
  ```

  **Commit**: YES (Commit C — group with Task 9)
  - Message: `refactor(dashboard): delete LinkedDevices + redesign FirewallEditor`
  - Files: `src/components/LinkedDevices.vue` (delete), `src/views/DeviceDetail.vue`

- [x] 9. Redesign FirewallEditor.vue with Ng* design system

  **What to do**:
  - Complete rewrite of `apps/dashboard-ui/src/components/FirewallEditor.vue`:
    - Replace raw `<table>` with NgTable or keep structured table but use NgCard wrapper
    - Replace all hardcoded `text-cyan-400`, `bg-gray-900/50`, `border-white/10` etc. with design tokens
    - Replace `alert()` (if any) with `useToast()`
    - Use NgButton for Add Rule button
    - Use NgInput for form fields
    - Add NgBadge for Action (accept=success, drop=danger)
    - Keep the component functional — same CRUD operations, same API calls
    - Add success toast after rule creation/deletion
    - Add proper error display (NgBadge or inline error, not `alert()`)
    - Validate port format: empty, single number, or `N-N` range

  **Must NOT do**:
  - Do NOT change the API contract (same fetchRules/createRule/deleteRule calls)
  - Do NOT add sorting/filtering/pagination to the rule table
  - Do NOT introduce new Ng* components beyond what already exists

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: YES
  - **Parallel Group**: Wave 2 (with Tasks 8, 10-17)
  - **Blocks**: Final verification
  - **Blocked By**: Task 1

  **References**:
  - `apps/dashboard-ui/src/components/FirewallEditor.vue` — Current file (127 lines). Has raw table, hardcoded colors, no error toasts.
  - `apps/dashboard-ui/src/components/ui/NgCard.vue` — Use as wrapper
  - `apps/dashboard-ui/src/components/ui/NgInput.vue` — Use for IP, port inputs
  - `apps/dashboard-ui/src/components/ui/NgSelect.vue` — Use for protocol, action dropdowns
  - `apps/dashboard-ui/src/components/ui/NgButton.vue` — Use for Add Rule button
  - `apps/dashboard-ui/src/components/ui/NgBadge.vue` — Use for Action badges (accept/drop)
  - `apps/dashboard-ui/src/components/ui/NgEmptyState.vue` — Use for empty rule list
  - `apps/dashboard-ui/src/composables/useToast.ts` — For success/error toasts
  - `apps/dashboard-ui/src/api/rules.ts` — API contract (unchanged): fetchRules, createRule, deleteRule

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: FirewallEditor uses Ng* components
    Tool: Bash
    Steps:
      1. Run: grep -c "NgCard\|NgInput\|NgSelect\|NgButton\|NgBadge\|NgEmptyState\|useToast" apps/dashboard-ui/src/components/FirewallEditor.vue
    Expected Result: At least 3 matches (NgCard + useToast + at least one other)
    Evidence: .sisyphus/evidence/task-9-ng-components.txt

  Scenario: No hardcoded colors remain in FirewallEditor
    Tool: Bash
    Steps:
      1. Run: grep -E "text-cyan-|text-green-|text-red-|bg-gray-|bg-black/|border-white/" apps/dashboard-ui/src/components/FirewallEditor.vue
    Expected Result: 0 matches
    Evidence: .sisyphus/evidence/task-9-no-hardcoded.txt

  Scenario: No alert() in FirewallEditor
    Tool: Bash
    Steps:
      1. Run: grep "alert(" apps/dashboard-ui/src/components/FirewallEditor.vue
    Expected Result: 0 matches
    Evidence: .sisyphus/evidence/task-9-no-alert.txt

  Scenario: Build succeeds
    Tool: Bash
    Steps:
      1. Run: cd apps/dashboard-ui && npm run build
    Expected Result: Exit code 0
    Evidence: .sisyphus/evidence/task-9-build.txt
  ```

  **Commit**: YES (Commit C — group with Task 8)
  - Message: `refactor(dashboard): delete LinkedDevices + redesign FirewallEditor`
  - Files: `src/components/FirewallEditor.vue`
  - Pre-commit: `npm run build`

- [x] 10. Restyle DeviceDetail.vue

  **What to do**:
  - Replace ALL `alert()` calls with `useToast()`:
    - `alert('Failed to regenerate token')` → `toast.error('Failed to regenerate token')`
    - `alert('Failed to save advanced settings')` → `toast.error('Failed to save advanced settings')`
    - `alert('Failed to regenerate keys')` → `toast.error('Failed to regenerate keys')`
    - `alert('Failed to delete device')` → `toast.error('Failed to delete device')`
    - `alert('Failed to toggle suspension')` → `toast.error('Failed to toggle suspension')`
    - `alert('Token copied to clipboard!')` → `toast.success('Token copied to clipboard!')`
  - Replace ALL `confirm()` with `useConfirm()`:
    - `confirm('This will invalidate...')` → `await confirm('This will invalidate...')`
    - `confirm('Are you absolutely sure...')` → `await confirm('Are you absolutely sure...')`
    - `confirm('This will regenerate...')` → `await confirm('This will regenerate...')`
  - Replace emoji `⚙️` (line 66) with `@iconify/vue` icon (e.g., `heroicons:cog-6-tooth`)
  - Replace all hardcoded Tailwind colors with design tokens (`text-cyan-400` → `text-accent`, `bg-gray-900/90` → `bg-surface`, etc.)
  - Use NgCard for sections (keys display, advanced settings, connection status)
  - Use NgInput for advanced settings form fields
  - Use NgToggle for Allow Internet, Suspend, Disable PSK toggles (if NgToggle exists, else keep custom toggle with token colors)

  **Must NOT do**:
  - Do NOT change the API calls or data flow
  - Do NOT change the component's functionality
  - Do NOT remove the FirewallEditor or PeerConfigModal sections

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: YES
  - **Parallel Group**: Wave 2 (with Tasks 8, 9, 11-17)
  - **Blocks**: Final verification
  - **Blocked By**: Task 1, Task 8 (must delete LinkedDevices first since it was in DeviceDetail)

  **References**:
  - `apps/dashboard-ui/src/views/DeviceDetail.vue` — Full file (392 lines). 6 alert(), 3 confirm(), emoji ⚙️, extensive hardcoded colors.
  - `apps/dashboard-ui/src/composables/useToast.ts` — `toast.success(msg)`, `toast.error(msg)`
  - `apps/dashboard-ui/src/composables/useConfirm.ts` — `const confirmed = await confirm('message')` returns boolean
  - `apps/dashboard-ui/src/components/ui/NgCard.vue` — Use for sections
  - `apps/dashboard-ui/src/components/ui/NgInput.vue` — Use for form fields
  - `apps/dashboard-ui/src/components/ui/NgToggle.vue` — Use for toggle switches
  - `@iconify/vue` — Use `<Icon icon="heroicons:cog-6-tooth" />` instead of ⚙️ emoji

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: No alert() in DeviceDetail
    Tool: Bash
    Steps:
      1. Run: grep "alert(" apps/dashboard-ui/src/views/DeviceDetail.vue
    Expected Result: 0 matches
    Evidence: .sisyphus/evidence/task-10-no-alert.txt

  Scenario: No confirm() in DeviceDetail
    Tool: Bash
    Steps:
      1. Run: grep "confirm(" apps/dashboard-ui/src/views/DeviceDetail.vue
    Expected Result: 0 matches (excluding useConfirm import)
    Evidence: .sisyphus/evidence/task-10-no-confirm.txt

  Scenario: No emoji in DeviceDetail
    Tool: Bash
    Steps:
      1. Run: grep -P "[\x{1F300}-\x{1F9FF}]|⚙️" apps/dashboard-ui/src/views/DeviceDetail.vue
    Expected Result: 0 matches
    Evidence: .sisyphus/evidence/task-10-no-emoji.txt

  Scenario: No hardcoded colors
    Tool: Bash
    Steps:
      1. Run: grep -cE "text-cyan-|text-green-|text-red-|bg-gray-|bg-black/|border-white/|text-amber-" apps/dashboard-ui/src/views/DeviceDetail.vue
    Expected Result: 0 or minimal (allow some if unavoidable)
    Evidence: .sisyphus/evidence/task-10-hardcoded-count.txt

  Scenario: Build succeeds
    Tool: Bash
    Steps:
      1. Run: cd apps/dashboard-ui && npm run build
    Expected Result: Exit code 0
    Evidence: .sisyphus/evidence/task-10-build.txt
  ```

  **Commit**: YES (Commit D — batch with Tasks 11-17)
  - Message: `refactor(dashboard): replace alert/confirm + restyle all views`
  - Files: `src/views/DeviceDetail.vue`

- [x] 11. Restyle Devices.vue

  **What to do**:
  - Replace `confirm()` (line 111) with `useConfirm()`:
    ```ts
    const confirmed = await confirm(`Delete device "${name}"? This will destroy its tunnel and all firewall rules.`)
    if (!confirmed) return
    ```
  - Replace `alert()` (line 116) with `toast.error(err.response?.data?.error || 'Failed to delete device')`
  - Replace hardcoded colors in table rows with design tokens
  - Replace raw firewall modal with NgModal:
    - Current: manual `<div class="fixed inset-0 bg-black/70 backdrop-blur-sm flex items-center...">`
    - Replace with: `<NgModal :open="showFirewallModal" @close="showFirewallModal = false" title="Firewall Rules" size="lg">`
  - Use NgButton for "+ Add Peer" button
  - Use NgBadge for Online/Offline status

  **Must NOT do**:
  - Do NOT change the API calls or data flow
  - Do NOT add sorting/filtering to the device table

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: YES
  - **Parallel Group**: Wave 2 (with Tasks 8-10, 12-17)
  - **Blocks**: Final verification
  - **Blocked By**: Task 1

  **References**:
  - `apps/dashboard-ui/src/views/Devices.vue` — Full file (138 lines). 1 confirm, 1 alert, raw table, raw modal.
  - `apps/dashboard-ui/src/components/ui/NgModal.vue` — Use for firewall modal wrapper
  - `apps/dashboard-ui/src/components/ui/NgButton.vue` — Use for action buttons
  - `apps/dashboard-ui/src/components/ui/NgBadge.vue` — Use for status badges
  - `apps/dashboard-ui/src/composables/useToast.ts` — For error toasts
  - `apps/dashboard-ui/src/composables/useConfirm.ts` — For delete confirmation

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: No alert()/confirm() in Devices
    Tool: Bash
    Steps:
      1. Run: grep -E "alert\(|confirm\(" apps/dashboard-ui/src/views/Devices.vue
    Expected Result: 0 matches (excluding useConfirm import)
    Evidence: .sisyphus/evidence/task-11-no-dialogs.txt

  Scenario: Firewall modal uses NgModal
    Tool: Bash
    Steps:
      1. Run: grep "NgModal" apps/dashboard-ui/src/views/Devices.vue
    Expected Result: 1+ match
    Evidence: .sisyphus/evidence/task-11-ngmodal.txt

  Scenario: Build succeeds
    Tool: Bash
    Steps:
      1. Run: cd apps/dashboard-ui && npm run build
    Expected Result: Exit code 0
    Evidence: .sisyphus/evidence/task-11-build.txt
  ```

  **Commit**: YES (Commit D)
  - Files: `src/views/Devices.vue`

- [x] 12. Restyle Dashboard.vue

  **What to do**:
  - Replace stat cards with NgCard (variant="stat"):
    ```vue
    <NgCard variant="stat">
      <p class="text-text-muted text-sm font-semibold uppercase tracking-wider mb-2">Total Devices</p>
      <p class="text-4xl font-bold">{{ store.devices.length }}</p>
    </NgCard>
    ```
  - Replace hardcoded `text-green-400`/`text-red-400` with `text-success`/`text-danger`
  - Replace hardcoded `bg-gray-900/50` with `bg-surface` or use NgCard
  - Replace hardcoded `text-cyan-400` with `text-accent`
  - Replace hardcoded `border-white/10` with `border-border-subtle`
  - Keep the device grid but use design tokens for card backgrounds

  **Must NOT do**:
  - Do NOT change the API calls or polling logic
  - Do NOT add new dashboard features

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: YES
  - **Parallel Group**: Wave 2 (with Tasks 8-11, 13-17)
  - **Blocks**: Final verification
  - **Blocked By**: Task 1

  **References**:
  - `apps/dashboard-ui/src/views/Dashboard.vue` — Full file (99 lines). Hardcoded stat cards, no NgCard usage.
  - `apps/dashboard-ui/src/components/ui/NgCard.vue` — Use variant="stat" for stat cards
  - `apps/dashboard-ui/src/assets/main.css` — @theme tokens (from Task 1)

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: Dashboard uses NgCard
    Tool: Bash
    Steps:
      1. Run: grep "NgCard" apps/dashboard-ui/src/views/Dashboard.vue
    Expected Result: 1+ match (stat cards)
    Evidence: .sisyphus/evidence/task-12-ngcard.txt

  Scenario: No hardcoded stat card colors
    Tool: Bash
    Steps:
      1. Run: grep -c "bg-gradient-to-br from-gray-900" apps/dashboard-ui/src/views/Dashboard.vue
    Expected Result: 0 matches (all replaced with NgCard)
    Evidence: .sisyphus/evidence/task-12-no-hardcoded.txt

  Scenario: Build succeeds
    Tool: Bash
    Steps:
      1. Run: cd apps/dashboard-ui && npm run build
    Expected Result: Exit code 0
    Evidence: .sisyphus/evidence/task-12-build.txt
  ```

  **Commit**: YES (Commit D)
  - Files: `src/views/Dashboard.vue`

- [x] 13. Restyle Servers.vue modals/forms

  **What to do**:
  - Replace `confirm()` (line 576) with `useConfirm()`
  - Replace `alert('Delete failed')` (line 582) with `toast.error('Delete failed')`
  - Replace hardcoded colors in add/edit modals with design tokens
  - Use NgInput for form fields in Register Node and Edit Node modals
  - Use NgButton for Register/Save/Cancel buttons
  - Use NgSelect for Table dropdown (auto/off)
  - Replace hardcoded `text-cyan-400` with `text-accent`, `bg-gray-900/90` with `bg-surface`
  - Servers list already uses NgCard — no change needed there

  **Must NOT do**:
  - Do NOT change the IP parsing logic or form data structure
  - Do NOT change the API calls

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: YES
  - **Parallel Group**: Wave 2 (with Tasks 8-12, 14-17)
  - **Blocks**: Final verification
  - **Blocked By**: Task 1

  **References**:
  - `apps/dashboard-ui/src/views/Servers.vue` — Full file (599 lines). 1 confirm, 1 alert, modals with hardcoded colors.
  - `apps/dashboard-ui/src/components/ui/NgInput.vue` — Use for form fields
  - `apps/dashboard-ui/src/components/ui/NgSelect.vue` — Use for dropdowns
  - `apps/dashboard-ui/src/components/ui/NgButton.vue` — Use for action buttons
  - `apps/dashboard-ui/src/composables/useConfirm.ts` — For delete confirmation
  - `apps/dashboard-ui/src/composables/useToast.ts` — For error toasts

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: No alert()/confirm() in Servers
    Tool: Bash
    Steps:
      1. Run: grep -E "alert\(|confirm\(" apps/dashboard-ui/src/views/Servers.vue
    Expected Result: 0 matches (excluding useConfirm import)
    Evidence: .sisyphus/evidence/task-13-no-dialogs.txt

  Scenario: Modals use NgInput/NgButton
    Tool: Bash
    Steps:
      1. Run: grep -c "NgInput\|NgButton\|NgSelect" apps/dashboard-ui/src/views/Servers.vue
    Expected Result: 3+ matches
    Evidence: .sisyphus/evidence/task-13-ng-components.txt

  Scenario: Build succeeds
    Tool: Bash
    Steps:
      1. Run: cd apps/dashboard-ui && npm run build
    Expected Result: Exit code 0
    Evidence: .sisyphus/evidence/task-13-build.txt
  ```

  **Commit**: YES (Commit D)
  - Files: `src/views/Servers.vue`

- [x] 14. Restyle Users.vue

  **What to do**:
  - Replace `confirm()` (line 110) with `useConfirm()`
  - Replace `alert('Delete failed')` (line 117) with `toast.error('Delete failed')`
  - Replace hardcoded colors with design tokens
  - Use NgInput for username/password fields
  - Use NgButton for Add User button
  - Use NgBadge for username display
  - Keep raw table but use design tokens for styling

  **Must NOT do**:
  - Do NOT change the API calls or user management logic

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: YES
  - **Parallel Group**: Wave 2 (with Tasks 8-13, 15-17)
  - **Blocks**: Final verification
  - **Blocked By**: Task 1

  **References**:
  - `apps/dashboard-ui/src/views/Users.vue` — Full file (124 lines). 1 confirm, 1 alert, hardcoded colors.
  - `apps/dashboard-ui/src/components/ui/NgInput.vue` — Use for form fields
  - `apps/dashboard-ui/src/components/ui/NgButton.vue` — Use for action buttons
  - `apps/dashboard-ui/src/composables/useConfirm.ts` — For delete confirmation
  - `apps/dashboard-ui/src/composables/useToast.ts` — For error toasts

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: No alert()/confirm() in Users
    Tool: Bash
    Steps:
      1. Run: grep -E "alert\(|confirm\(" apps/dashboard-ui/src/views/Users.vue
    Expected Result: 0 matches
    Evidence: .sisyphus/evidence/task-14-no-dialogs.txt

  Scenario: Build succeeds
    Tool: Bash
    Steps:
      1. Run: cd apps/dashboard-ui && npm run build
    Expected Result: Exit code 0
    Evidence: .sisyphus/evidence/task-14-build.txt
  ```

  **Commit**: YES (Commit D)
  - Files: `src/views/Users.vue`

- [x] 15. Restyle AddPeerModal.vue + PeerConfigModal.vue

  **What to do**:
  - **AddPeerModal.vue**:
    - Replace 3x `alert()` with `toast.success()`/`toast.error()`
    - Replace hardcoded colors with design tokens
    - Use NgModal for the modal wrapper (currently manual `<div class="fixed inset-0...">`)
    - Use NgInput for peer name field
    - Use NgSelect for target node dropdown
    - Use NgToggle for "Allow Internet" and "Disable PSK" toggles
    - Use NgButton for Create/Download/Copy/Cancel buttons
  - **PeerConfigModal.vue**:
    - Replace 5x `alert()` with `toast.success()`/`toast.error()`
    - Replace hardcoded colors with design tokens
    - Use NgModal for the modal wrapper
    - Use NgButton for Save/Cancel/Copy/Download buttons
    - Keep QR code and config textarea (textarea is specific, no Ng equivalent)

  **Must NOT do**:
  - Do NOT change the API calls or provisioning logic
  - Do NOT change the QR code generation

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: YES
  - **Parallel Group**: Wave 2 (with Tasks 8-14, 16-17)
  - **Blocks**: Final verification
  - **Blocked By**: Task 1

  **References**:
  - `apps/dashboard-ui/src/components/AddPeerModal.vue` — Full file (171 lines). 3 alert(), hardcoded colors, manual modal.
  - `apps/dashboard-ui/src/components/PeerConfigModal.vue` — Full file (186 lines). 5 alert(), hardcoded colors, manual modal.
  - `apps/dashboard-ui/src/components/ui/NgModal.vue` — Use for modal wrapper
  - `apps/dashboard-ui/src/components/ui/NgInput.vue` — Use for form fields
  - `apps/dashboard-ui/src/components/ui/NgSelect.vue` — Use for dropdowns
  - `apps/dashboard-ui/src/components/ui/NgToggle.vue` — Use for toggles
  - `apps/dashboard-ui/src/components/ui/NgButton.vue` — Use for action buttons
  - `apps/dashboard-ui/src/composables/useToast.ts` — For success/error toasts

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: No alert() in AddPeerModal
    Tool: Bash
    Steps:
      1. Run: grep "alert(" apps/dashboard-ui/src/components/AddPeerModal.vue
    Expected Result: 0 matches
    Evidence: .sisyphus/evidence/task-15-addpeer-no-alert.txt

  Scenario: No alert() in PeerConfigModal
    Tool: Bash
    Steps:
      1. Run: grep "alert(" apps/dashboard-ui/src/components/PeerConfigModal.vue
    Expected Result: 0 matches
    Evidence: .sisyphus/evidence/task-15-peerconfig-no-alert.txt

  Scenario: Both use NgModal
    Tool: Bash
    Steps:
      1. Run: grep -c "NgModal" apps/dashboard-ui/src/components/AddPeerModal.vue apps/dashboard-ui/src/components/PeerConfigModal.vue
    Expected Result: 1 match per file
    Evidence: .sisyphus/evidence/task-15-ngmodal.txt

  Scenario: Build succeeds
    Tool: Bash
    Steps:
      1. Run: cd apps/dashboard-ui && npm run build
    Expected Result: Exit code 0
    Evidence: .sisyphus/evidence/task-15-build.txt
  ```

  **Commit**: YES (Commit D)
  - Files: `src/components/AddPeerModal.vue`, `src/components/PeerConfigModal.vue`

- [x] 16. Restyle ShareConfig.vue

  **What to do**:
  - Replace 2x `alert()` with `toast.success()`/`toast.error()`
  - Replace hardcoded colors with design tokens (`text-cyan-400` → `text-accent`, `bg-gradient-to-br from-gray-900 to-gray-800` → `bg-gradient-to-br from-bg-surface to-bg-elevated`)
  - Use NgButton for Download/Copy buttons
  - Use NgCard for the config container

  **Must NOT do**:
  - Do NOT change the fetch logic or config display
  - Do NOT add new features

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: YES
  - **Parallel Group**: Wave 2 (with Tasks 8-15, 17)
  - **Blocks**: Final verification
  - **Blocked By**: Task 1

  **References**:
  - `apps/dashboard-ui/src/views/ShareConfig.vue` — Full file (80 lines). 2 alert(), hardcoded colors.
  - `apps/dashboard-ui/src/components/ui/NgButton.vue` — Use for action buttons
  - `apps/dashboard-ui/src/components/ui/NgCard.vue` — Use for config container
  - `apps/dashboard-ui/src/composables/useToast.ts` — For success/error toasts

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: No alert() in ShareConfig
    Tool: Bash
    Steps:
      1. Run: grep "alert(" apps/dashboard-ui/src/views/ShareConfig.vue
    Expected Result: 0 matches
    Evidence: .sisyphus/evidence/task-16-no-alert.txt

  Scenario: Build succeeds
    Tool: Bash
    Steps:
      1. Run: cd apps/dashboard-ui && npm run build
    Expected Result: Exit code 0
    Evidence: .sisyphus/evidence/task-16-build.txt
  ```

  **Commit**: YES (Commit D)
  - Files: `src/views/ShareConfig.vue`

- [x] 17. Restyle TrafficChart.vue SVG colors

  **What to do**:
  - Replace hardcoded SVG hex colors with CSS custom properties:
    - `stroke="#00ffff"` → `stroke="var(--color-accent)"` or use `currentColor` where appropriate
    - `fill="#00ffff"` → `fill="var(--color-accent)"`
    - `fill="#3b82f6"` → `fill="var(--color-info)"` (define --color-info in @theme if needed, or use existing blue token)
  - Replace hardcoded gradient stop colors with CSS variables
  - Replace inline SVG spinner with NgSkeleton or keep as-is (spinner is functional)
  - Replace hardcoded `text-gray-400`, `text-gray-500` with `text-text-secondary`, `text-text-muted`

  **Must NOT do**:
  - Do NOT change the chart rendering logic
  - Do NOT change the data transformation or formatting functions

  **Recommended Agent Profile**:
  - **Category**: `quick`
  - **Skills**: []

  **Parallelization**:
  - **Can Run In Parallel**: YES
  - **Parallel Group**: Wave 2 (with Tasks 8-16)
  - **Blocks**: Final verification
  - **Blocked By**: Task 1

  **References**:
  - `apps/dashboard-ui/src/components/TrafficChart.vue` — Full file (299 lines). Hardcoded SVG colors (#00ffff, #3b82f6), inline spinner.
  - `apps/dashboard-ui/src/assets/main.css` — @theme tokens (from Task 1)

  **Acceptance Criteria**:

  **QA Scenarios (MANDATORY):**

  ```
  Scenario: No hardcoded hex colors in TrafficChart
    Tool: Bash
    Steps:
      1. Run: grep -E "#[0-9a-fA-F]{3,8}" apps/dashboard-ui/src/components/TrafficChart.vue
    Expected Result: 0 matches
    Evidence: .sisyphus/evidence/task-17-no-hex.txt

  Scenario: Build succeeds
    Tool: Bash
    Steps:
      1. Run: cd apps/dashboard-ui && npm run build
    Expected Result: Exit code 0
    Evidence: .sisyphus/evidence/task-17-build.txt
  ```

  **Commit**: YES (Commit D)
  - Files: `src/components/TrafficChart.vue`
  - Pre-commit: `npm run build`

---

## Final Verification Wave

- [x] F1. **Plan Compliance Audit** — `oracle`
- [x] F2. **Code Quality Review** — `unspecified-high`
- [x] F3. **Real Manual QA** — `unspecified-high`
- [x] F4. **Scope Fidelity Check** — `deep`
  For each task: read "What to do", read actual diff. Verify 1:1 — everything in spec was built, nothing beyond spec was built. Check "Must NOT do" compliance. Detect cross-task contamination. Flag unaccounted changes. Specifically verify: Login.vue untouched, style.css untouched, AddForwardRule untouched, no nft flush table.
  Output: `Tasks [N/N compliant] | Contamination [CLEAN/N issues] | VERDICT`

---

## Commit Strategy

- **Commit A** (Wave 0): `feat(dashboard): add @theme design tokens to main.css` — main.css
- **Commit B** (Wave 1): `fix(firewall): rewrite nftables rule system + fix fwd_estab duplicates` — all backend firewall files
- **Commit C** (Wave 2 batch 1): `refactor(dashboard): delete LinkedDevices + redesign FirewallEditor` — LinkedDevices.vue (delete), FirewallEditor.vue, DeviceDetail.vue
- **Commit D** (Wave 2 batch 2): `refactor(dashboard): replace alert/confirm + restyle all views` — remaining 8 .vue files

---

## Success Criteria

### Verification Commands
```bash
# Backend
cd apps/server-core && go build ./...          # Expected: no errors
cd apps/server-core && go test ./... -tags dev  # Expected: all PASS

# Frontend
cd apps/dashboard-ui && npm run build           # Expected: no errors

# Legacy pattern audit
grep -r "alert(" --include="*.vue" apps/dashboard-ui/src/     # Expected: 0 matches
grep -r "LinkedDevices" --include="*.vue" --include="*.ts" apps/dashboard-ui/src/  # Expected: 0 matches
```

### Final Checklist
- [x] All "Must Have" present
- [x] All "Must NOT Have" absent
- [x] All go tests pass
- [x] Frontend builds without errors
- [x] Zero alert()/confirm() in .vue files
- [x] Zero LinkedDevices references