# Completed Plans

Archive of implementation plans that have been executed and shipped.

## Content Addressing — COMPLETED ✓

**Completed:** March 2026 (Phase 3)

Hash-based fetch, in-memory index, mirror foundation. All five implementation steps completed:

1. `content-hash` added to FETCH responses — SHA-256 of stripped body in metadata
2. Hash index in Store — `BuildHashIndex()`, `LookupHash()`, `UpdateHashIndex()`, `RemoveHashEntry()`
3. Index updates on writes — `Write()`, `SetArchived()` keep index synchronized
4. Hash-based FETCH — `isHashPath()` validates `/sha256-<64hex>`, `handleFetchByHash()` retrieves by hash
5. Startup initialization — `BuildHashIndex()` called on server startup

**Key details:** Content-hash is separate from etag (stripped body vs full doc). Current versions only indexed. Read auth checked after hash resolves to real path. In-memory index rebuilt on startup.

**Foundation for:** Federation, content-addressed mirroring, distributed caching

---

## Federation — COMPLETED ✓

**Completed:** March 2026 (Phase 3)

Agent-driven hash discovery via MCP tools. Zero server changes, zero new verbs.

**Shipped:**
- `mark_index` MCP tool — crawls source server, collects hashes, publishes index to hub
- `mark_resolve` MCP tool — resolves content by hash using hub index
- `client/internal/index` package — Parse, Build, Merge for markdown hash index documents
- Manifest check enforced by tool, `force` override, `dry_run` mode, 1000 doc cap

---

## Persistent Graph — COMPLETED ✓

**Completed:** March 2026 (Phase 4)

Disk-backed graph store, incremental crawl, backlinks.

**Shipped:**
- `client/internal/graphstore` package — nodes, edges, etags, timestamps, atomic writes, schema versioning
- `CrawlAndPersist` — unified crawl + merge + save, nil-safe, shared across CLI/TUI/MCP
- `mark_backlinks` MCP tool — reverse link lookup
- Graph export — `Store.Export()` renders as publishable markdown, `ParseExport()` parses back
- TUI graph view — Links (BFS), Backlinks, Topology sub-views
- Graph seeding — TUI loads instantly from stored graph while crawl runs in background

---

## Read Auth (Server-Side) — COMPLETED ✓

**Completed:** 2026-03-14 (Phase 5)

Per-path read token enforcement on the server. Fully backwards compatible — no read tokens = everything public.

**Shipped:**
- `RequiresReadAuth(path)` on `TokenStore` — pre-computed `readPaths` at load time
- `authorizeRead` handler helper — checks token store, exempts `/.well-known/agent-manifest.md`
- Integrated into FETCH, LIST, VERSIONS handlers
- Content-addressed fetch respects read auth (hash resolves to path first, then checks auth)
- Versioned path auth — `/doc.md/v2` checks auth on base path `/doc.md`
- Directory path normalization — `/private` and `/private/` both match `/private/**` patterns

**Remaining (Phase 5):** Client-side read auth — `fetch.Client` read methods (`Fetch`, `List`, `Versions`) need a token parameter, then CLI, TUI, and MCP need to pass it through. The server enforces correctly; the clients just can't send a token on reads yet.