2 files changed, 20 insertions(+), 1 deletions(-)

M docs/TODO.md
M docs/tasks/lethe-web-ui-aggregates.md

@@ 10,11 10,12 @@ Index of task specs and their state. Each row points at a `docs/tasks/<slug>.md`
 | 2 | [`lethe-collector-claude-code`](tasks/lethe-collector-claude-code.md) | Designed (deferred) | Per-host systemd-user collector that tails `~/.claude/projects/*.jsonl` and POSTs normalized turns to ingest. Blocks #8 and #9. |
 | 3 | [`lethe-search-and-opencode`](tasks/lethe-search-and-opencode.md) | Designed (deferred) | Adds `GET /api/v1/search` (FTS5) and an `opencode` collector. Blocks #7. |
 | 4 | [`lethe-web-ui-foundation`](tasks/lethe-web-ui-foundation.md) | **Reviewed** | Vite/React/TS SPA, embed pipeline, shell + Home + Session views, palette skeleton, 5 stub routes. Plus `/sessions` aggregate fields. |
-| 5 | [`lethe-web-ui-aggregates`](tasks/lethe-web-ui-aggregates.md) | **In progress** | Backend `/projects` + `/stats` endpoints, Projects index + Project detail + Stats screen. Replaces 3 of #4's stubs. |
+| 5 | [`lethe-web-ui-aggregates`](tasks/lethe-web-ui-aggregates.md) | **Reviewed** | Backend `/projects` + `/stats` endpoints, Projects index + Project detail + Stats screen. Replaces 3 of #4's stubs. |
 | 6 | `lethe-web-ui-palette-savedsearch` | Not started | Full ⌘K palette (PROJECT/SESSION items), saved-searches table + UI, palette pulls from it. Small backend (1 table) + Settings → Saved searches. |
 | 7 | `lethe-web-ui-search` | Blocked on #3 | Search route: turn-level results, FTS `<mark>` highlighting, save-search action. |
 | 8 | `lethe-web-ui-settings-display` | Not started | Settings → Display: theme toggle (light/dark/system), density toggle, "show tool calls" toggle, persisted to localStorage. |
 | 9 | `lethe-web-ui-health-sources` | Blocked on #2 (and ideally #3) | Settings → Sources (per-host-per-tool config table) + `/health` route (collector ingestion table, status pills, footer strip with backfill progress and last-error). |
+| 10 | `lethe-oidc-stub` | Not started | Promote the in-test `oidcTestServer` (`internal/server/auth/oidctestserver_test.go`) to an exported `internal/testutil/oidcstub/` package, optionally wrap as `cmd/oidc-stub`. Unblocks real-browser smoke for #5 (the deferred verify item) and any future SPA route work without standing up Authelia locally. JWT-based by design — see `~/data/home/second-brain/wiki/jwt-for-sessions.md`: lethe is the OIDC verifier, JWT is the only legal wire format here. |
 
 ## Carry-overs from `lethe-web-ui-foundation`
 


@@ 26,6 27,23 @@ These were captured in `lethe-web-ui-foundation.md` Conclusion → Future work /
 - **`go test ./...` walks `web/node_modules/flatted/golang/pkg/flatted`**: stray Go package shipped inside an npm dep. Switch CI to `go test ./internal/...` or gitignore the path.
 - **CI configuration**: neither `.github/workflows/` nor `.sourcecraft/ci.yml` exists. Pick one (sourcecraft.dev native preferred for personal repos) and wire `npm ci && npm run lint && npm run typecheck && npm test && npm run build` plus the existing Go job.
 
+## Repo hygiene / Tooling DX
+
+Cross-cutting tooling polish that doesn't warrant a full task file each. Track here so they don't get lost.
+
+- [ ] **`just air` → `just dev`** — match the gabin convention; rename the recipe in `Justfile` and update the README quickstart line.
+- [ ] **`air` → `go tool air`** — add `tool github.com/air-verse/air` to `go.mod` (Go 1.24+); the `dev:` recipe runs `go tool air` so contributors don't need a separate `go install`. `.air.toml` is unchanged.
+- [ ] **Add `go fix ./...` to `just fmt`** — runs after `goimports`; mostly a no-op today but standardizes future API-rewrite migrations into the existing `just fmt` flow.
+- [ ] **`migrate` → `go tool migrate`** — `go get -tool github.com/golang-migrate/migrate/v4/cmd/migrate@latest`; rewrite the three `migrate-*` recipes; drop the now-stale `brew install golang-migrate` comment block.
+- [ ] **OIDC stub** — see task #10 (separate task file).
+
+## Deferred operational follow-ups
+
+Tracked outside the task workflow because they're user-driven, not engineering work.
+
+- **Sourcecraft.dev push** — `~/data/home/lethe` has no remote configured; per global preference all `~/data/home/*` projects mirror to sourcecraft.dev. `sc init / sc push` when you want it visible / backed up.
+- **Browser smoke for task #5** — `/projects`, `/project/<encoded cwd>`, `/stats?range=…` were verified by tsc + vitest + Go handler tests, but never walked in a real browser. Blocked on having an OIDC bearer + populated DB locally; task #10 (OIDC stub) closes both halves of that.
+
 ## Notes
 
 - Task numbering is arbitrary order-of-appearance, not priority.

@@ 283,6 283,7 @@ Invariants:
 - **Drop the synthesized sparkline column from `ProjectsTable`, or extend `/api/v1/projects` with a real `daily_sparkline`**. Justification: the no-silent-fallbacks invariant prefers no column over a fake one. New backend field is the bigger fix and warrants its own task. Cross-references the Phase 3 deviation above.
 - **Tighten the chart-primitive invariant or convert `HorizontalBars` to inline `<svg>`**. Justification: the literal-vs-spirit ambiguity in the current invariant text invites future drift. The decision belongs to a design revision, not an in-task fix.
 - **Extract `web/src/lib/toolColors.ts`** if a third call site for tool colors appears. Today `ToolDot` and `routes/stats.tsx` are the only two; one duplication is below the rule-of-three threshold.
+- **Browser smoke (deferred verify item)** — see `docs/TODO.md` *Deferred operational follow-ups*. Unblocks once task #10 (`lethe-oidc-stub`) ships a `cmd/oidc-stub` binary; until then the deferred-by-user gap stands as recorded in *Verify → Deferred* below.
 
 ## Verify