hephaestus/docs/changelog.d/v1-prototype.feature.md

Begin the v1 prototype (Phase 1, tech-spec §11.1), built in TDD slices:

• Cargo workspace + heph-core crate; migration-run SQLite schema (§4.5); clock-injected Store trait + LocalStore node create/get; single local-user bootstrap.
• Markdown extraction (§5): [[wiki-links]] and GFM - [ ] checkbox context-items derived purely and idempotently from a body, skipping code blocks.
• Committed tasks (§4.3, §6): task.create auto-creates the canonical context doc + canonical-context link; attention/do-date/late-on/state/recurrence columns; set-state/set-attention. Links CRUD (outgoing/backlinks). A body update reconciles wiki links (diff-based, resolved by alias/title, idempotent).
• "What is next?" ranking (§7): pure, clock-injected, two-stage engine — candidacy filter (do-date as a boolean gate only) then a reorderable list of named dimensions (past-late-on → overdue-amount → attention band → FIFO). late_on is the sole urgency signal; blue hidden; red always shown. Proptest-checked total order. Store::next surfaces it over SQLite.
• Recurrence — roll-forward in place (§4.4): completing a recurring task resets its checklist to all-unchecked, logs the occurrence, and advances the do-date to the next RRULE instance after now (skipping misses) — completion never carries forward (proptest-checked). Per-task append-only logs (log-of) with log.append/log.tail; skip advances without logging.
• hephd daemon, local mode (§3, §6): exclusive file lock (handoff-ready), line-delimited JSON-RPC over a unix socket exposing the node/task/next/links/log methods, with DB work on tokio's blocking pool. Synchronous client for surfaces/CLI. Model types are serde-serializable.
• heph CLI (§1) — a thin client of the daemon: next, task, doc, get, export. Export materializes the store to a <kind>/<id>.md tree with YAML frontmatter + body (§5), one-way, tombstones excluded.
• Sync engine, local-only (§12): real hybrid logical clock + persistent device origin; an append-only op-log per mutation; an idempotent, order-independent merge/apply engine — last-writer-wins task scalars (discards surfaced in a conflicts queue), OR-set links, monotonic tombstones. Two-replica convergence proven.
• Body text CRDT (§5, §12, slice 8d): node bodies now merge through the yrs text CRDT (body_crdt) instead of last-writer-wins — whole-buffer writes are diffed into the doc and the yrs delta rides the op, so concurrent edits to different regions both survive and never enqueue a conflict.
• Network sync over HTTP (§6.1, §12, slice 9a): hephd --mode server exposes a sync hub (POST /sync/push, GET /sync/pull?after=<hlc>, axum) over the same store; hephd --mode local --hub-url <url> becomes a spoke that background-syncs its op-log with that hub (and on demand via the sync.now/sync.status RPC). Exchange is incremental by HLC cursor (sync_state) and idempotent. The merge engine is heph-core's, unchanged. Unauthenticated/single-owner for now (auth lands with OIDC). conflicts.list/conflicts.resolve are now reachable over the daemon socket.
• Client mode (§3.1, slice 9b): hephd --mode client --server-url <url> runs with no local replica, proxying every store call to a server's POST /rpc endpoint (the full daemon API over HTTP). The daemon is now backend-agnostic (local/server front a LocalStore, client a RemoteStore), so surfaces see the same unix-socket API in every mode.
• Hub authentication (§13, slice 10a): the sync hub now verifies an OIDC bearer token on /sync/* and /rpc — RS256-pinned JWT validation with exact issuer/audience, expiry, and a required subject; JWKS discovered and cached, refetched on key rotation (jsonwebtoken). Enabled with hephd --mode server --oidc-issuer <url> --oidc-audience <client-id> (open when unset, for local dev). A single-tenant owner gate binds the hub to the first authenticated identity and rejects any other. Verification sits behind a TokenVerifier trait, so it's tested entirely offline (stub middleware + an adversarial battery against an in-process mock IdP).
• Client authentication (§13, slice 10b): heph auth login --hub-url <url> --issuer <url> --client-id <id> runs the OAuth 2.0 device-code flow and caches the token in the OS keyring; spokes and client mode attach it to hub requests, refreshing on expiry (--oidc-issuer/--oidc-client-id). Offline-tested against a mock OAuth server and a full spoke-to-authenticated-hub loop. (Auth/proxy HTTP uses the runtime-free ureq, since reqwest::blocking is unsafe inside the async daemon.)
• CI runs the Rust suite (fmt/clippy/test) via the project build hook.
• heph.nvim slice 11a (§8) — the primary surface begins: a Neovim plugin that is a thin client of the local hephd over its unix socket. A vim.uv JSON-RPC client (blocking call via vim.wait, id-demuxed, partial-line buffered, JSON null→Lua nil); buffer-backed nodes (heph://node/<id> with BufReadCmd→node.get / BufWriteCmd→node.update, whole-buffer body round-tripping exactly through the CRDT); [[wiki-link]] follow on <CR> via a new exact node.resolve {title} RPC (alias-then-title, the same mapping that materializes wiki links — unresolved links allowed); the daily journal (:Heph today); and the :Heph command surface. Headless e2e (§9) drives the plugin against a real daemon over a temp socket with a self-contained busted-style runner (no external plugins, no network): journal round-trip, follow-link, and link-two-docs/backlink.