Completed Plans

Archive of implementation plans that have been executed and shipped.

Content Addressing — COMPLETED ✓

Completed: March 2026 (Phase 3)

Hash-based fetch, in-memory index, mirror foundation. All five implementation steps completed:

1. content-hash added to FETCH responses — SHA-256 of stripped body in metadata
2. Hash index in Store — BuildHashIndex(), LookupHash(), UpdateHashIndex(), RemoveHashEntry()
3. Index updates on writes — Write(), SetArchived() keep index synchronized
4. Hash-based FETCH — isHashPath() validates /sha256-<64hex>, handleFetchByHash() retrieves by hash
5. Startup initialization — BuildHashIndex() called on server startup

Key details: Content-hash is separate from etag (stripped body vs full doc). Current versions only indexed. Read auth checked after hash resolves to real path. In-memory index rebuilt on startup.

Foundation for: Federation, content-addressed mirroring, distributed caching

Federation — COMPLETED ✓

Completed: March 2026 (Phase 3)

Agent-driven hash discovery via MCP tools. Zero server changes, zero new verbs.

Shipped:

• mark_index MCP tool — crawls source server, collects hashes, publishes index to hub
• mark_resolve MCP tool — resolves content by hash using hub index
• client/internal/index package — Parse, Build, Merge for markdown hash index documents
• Manifest check enforced by tool, force override, dry_run mode, 1000 doc cap

Persistent Graph — COMPLETED ✓

Completed: March 2026 (Phase 4)

Disk-backed graph store, incremental crawl, backlinks.

Shipped:

• client/internal/graphstore package — nodes, edges, etags, timestamps, atomic writes, schema versioning
• CrawlAndPersist — unified crawl + merge + save, nil-safe, shared across CLI/TUI/MCP
• mark_backlinks MCP tool — reverse link lookup
• Graph export — Store.Export() renders as publishable markdown, ParseExport() parses back
• TUI graph view — Links (BFS), Backlinks, Topology sub-views
• Graph seeding — TUI loads instantly from stored graph while crawl runs in background

Read Auth (Server-Side) — COMPLETED ✓

Completed: 2026-03-14 (Phase 5)

Per-path read token enforcement on the server. Fully backwards compatible — no read tokens = everything public.

Shipped:

• RequiresReadAuth(path) on TokenStore — pre-computed readPaths at load time
• authorizeRead handler helper — checks token store, exempts /.well-known/agent-manifest.md
• Integrated into FETCH, LIST, VERSIONS handlers
• Content-addressed fetch respects read auth (hash resolves to path first, then checks auth)
• Versioned path auth — /doc.md/v2 checks auth on base path /doc.md
• Directory path normalization — /private and /private/ both match /private/** patterns

Remaining (Phase 5): Client-side read auth — fetch.Client read methods (Fetch, List, Versions) need a token parameter, then CLI, TUI, and MCP need to pass it through. The server enforces correctly; the clients just can't send a token on reads yet.