# TODO — lethe roadmap

Index of task specs and their state. Each row points at a `docs/tasks/<slug>.md` task file (when one exists) or describes what needs to be created.

## Tasks

| # | Slug | Status | Description |
|---|---|---|---|
| 1 | [`lethe-server`](tasks/lethe-server.md) | **Verified** | Backend skeleton: SQLite ingest, sessions list/detail, forward-auth, RFC 7807, deployable on phoebe behind Authelia. Shipped over 9 phases. |
| 2 | [`lethe-collector-claude-code`](tasks/lethe-collector-claude-code.md) | **Reviewed** | Per-host systemd-user collector that tails `~/.claude/projects/*.jsonl` and POSTs normalized turns to ingest. Blocks #8 and #9. |
| 3 | [`lethe-search-and-opencode`](tasks/lethe-search-and-opencode.md) | Designed (deferred) | Adds `GET /api/v1/search` (FTS5) and an `opencode` collector. Blocks #7. |
| 4 | [`lethe-web-ui-foundation`](tasks/lethe-web-ui-foundation.md) | **Reviewed** | Vite/React/TS SPA, embed pipeline, shell + Home + Session views, palette skeleton, 5 stub routes. Plus `/sessions` aggregate fields. |
| 5 | [`lethe-web-ui-aggregates`](tasks/lethe-web-ui-aggregates.md) | **Reviewed** | Backend `/projects` + `/stats` endpoints, Projects index + Project detail + Stats screen. Replaces 3 of #4's stubs. |
| 6 | [`lethe-web-ui-palette-savedsearch`](tasks/lethe-web-ui-palette-savedsearch.md) | **Reviewed** | Full ⌘K palette (PROJECT/SESSION items), saved-searches table + UI, palette pulls from it. Small backend (1 table) + Settings → Saved searches. |
| 7 | `lethe-web-ui-search` | Blocked on #3 | Search route: turn-level results, FTS `<mark>` highlighting, save-search action. |
| 8 | [`lethe-web-ui-settings-display`](tasks/lethe-web-ui-settings-display.md) | **Reviewed** | Settings → Display: theme toggle (light/dark/system), density toggle, "show tool calls" toggle, persisted to localStorage. |
| 9 | `lethe-web-ui-health-sources` | Blocked on #2 (and ideally #3) | Settings → Sources (per-host-per-tool config table) + `/health` route (collector ingestion table, status pills, footer strip with backfill progress and last-error). |
| 10 | [`lethe-oidc-stub`](tasks/lethe-oidc-stub.md) | **Reviewed** | Promote the in-test `oidcTestServer` (`internal/server/auth/oidctestserver_test.go`) to an exported `internal/testutil/oidcstub/` package, optionally wrap as `cmd/oidc-stub`. Unblocks real-browser smoke for #5 (the deferred verify item) and any future SPA route work without standing up Authelia locally. JWT-based by design — see `~/data/home/second-brain/wiki/jwt-for-sessions.md`: lethe is the OIDC verifier, JWT is the only legal wire format here. |
| 11 | [`lethe-web-ui-login`](tasks/lethe-web-ui-login.md) | **Reviewed** | SPA OIDC auth-code+PKCE flow: `/login` + `/auth/callback`, in-memory token store, `apiFetch` Bearer attachment, shared `AuthGate` replacing the three "not authenticated" placeholder cards. Dev-stub upgraded to a real auth-code OP. Closes the browser-smoke gate for #5 and #6. |

## Carry-overs from `lethe-web-ui-foundation`

These were captured in `lethe-web-ui-foundation.md` Conclusion → Future work / Deferred. Pulled here so they're visible across tasks.

- ~~**Composite-id-in-URL**~~ — closed by #6 PH2 (`Session.sessionId` adapter field + call-site swaps in `routes/index.tsx:48` and `routes/project.$.tsx:33`).
- **Aggregates absent on `GET /sessions/{tool}/{host}/{id}`**: the new `summary`/`turn_count`/`tokens_*_total` fields appear as zero values on the Get path because the Get SQL is unchanged (Plan 1.2 said so). UI doesn't read them, but a future API consumer would. Fix is either extending the Get SQL or adding `,omitempty` to the four numeric tags.
- **Turn meta-line lacks timestamp**: the `Turn` TS interface from foundation Plan 6.1 omitted `timestamp`; meta line shows `# seq · model · tokens-in→tokens-out` only. Add `timestamp` to the interface + render.
- **`go test ./...` walks `web/node_modules/flatted/golang/pkg/flatted`**: stray Go package shipped inside an npm dep. Switch CI to `go test ./internal/...` or gitignore the path.
- **CI configuration**: neither `.github/workflows/` nor `.sourcecraft/ci.yml` exists. Pick one (sourcecraft.dev native preferred for personal repos) and wire `npm ci && npm run lint && npm run typecheck && npm test && npm run build` plus the existing Go job.

## Repo hygiene / Tooling DX

Cross-cutting tooling polish that doesn't warrant a full task file each. Track here so they don't get lost.

- [x] **`just air` → `just dev`** — done; `README.md` quickstart now points at `just dev` and the dev recipe follows that convention.
- [x] **`air` → `go tool air`** — done; `go.mod` carries the `tool github.com/air-verse/air` directive and `dev` / `dev-all` invoke `go tool air`.
- [x] **Add `go fix ./...` to `just fmt`** — done; `fmt` now runs `gofmt`, `goimports`, then `go fix`.
- [x] **`migrate` → `go tool migrate`** — done; all `migrate-*` recipes use `go tool migrate` and the stale install note is gone.
- [x] **OIDC stub** — shipped in task #10 (`lethe-oidc-stub.md`).
- [x] **Full web lint unblock** — fixed the unused catch binding in `web/src/routes/auth.callback.tsx`; `npm run lint` should now pass again.

## Deferred operational follow-ups

Tracked outside the task workflow because they're user-driven, not engineering work.

- **Sourcecraft.dev push** — `~/data/home/lethe` has no remote configured; per global preference all `~/data/home/*` projects mirror to sourcecraft.dev. `sc init / sc push` when you want it visible / backed up.
- **Browser smoke for tasks #5, #6, and #8** — `/projects`, `/project/<encoded cwd>`, `/stats?range=…`, `/settings` saved-search CRUD, `/settings` Display toggles, and the widened ⌘K palette were verified by tsc + vitest + Go handler tests, but never walked in a real browser. Unblocked: #10 (OIDC stub) + #11 (login flow) ship the dev OP and SPA flow needed. Recommended walk per the affected task Verify sections.

## Notes

- Task numbering is arbitrary order-of-appearance, not priority.
- "Not started" means a slot in this index without a `docs/tasks/<slug>.md` yet — invoking `/up:udesign <slug>` creates one.
- All commits across the project are GPG-signed (`commit.gpgsign=true`).
- Sourcecraft.dev is the primary git host; mirror to GitHub is not currently configured.