Web-first resurrection: UI builds and runs on the WASM Rust core, real CI, docs truth reset

[hyperpolymath]

What this is

The repo had three disconnected layers (a working Rust core, a ReScript UI that didn't compile and reimplemented all logic client-side, and a desktop shell blocked on the external gossamer sibling), no working build pipeline, and no CI that touched the product. This PR makes the web app the primary, fully self-contained target: the ReScript UI now runs the real Rust core compiled to WebAssembly, in the browser, with working persistence — and every piece of it is built and tested by CI from this repo alone.

Architecture decision recorded in docs/adr/0001-wasm-core-web-first.md; the Deno-only package-management interpretation in docs/adr/0002-deno-only-interpretation.md.

Highlights, by commit

• build: Deno 2 toolchain with pinned npm: specifiers and a real deno.lock (was 0 bytes); esbuild bundle/dev-server scripts; root cargo workspace that excludes desktop/ so the missing gossamer sibling can never break builds; the npm install task that violated the repo's own Deno-only MUST is gone.
• core: new wasm.rs bindings (granular mutations, camelCase views for the UI, snake_case disk format unchanged); rebuild_backlinks() on every load; fixes a real index-corruption bug — link_notes(a, a) recorded a backlink for a link that was never created (found by the new property test on its first run); golden-fixture contract tests + proptest invariants.
• ui: all notebook logic now delegates to the core through a store seam (WasmStore.res) whose operations mirror the desktop shell's commands, so a future GossamerStore swaps in with zero UI changes; IDs/timestamps come from the core (the UI previously fabricated Math.random() IDs); debounced IndexedDB autosave + file Save/Load replace the former no-ops; fixes for rec update, the undeclared Webapi dependency, and a stale-closure delete guard; TEA update tests + contract tests under deno test.
• ci: rust-ci.yml (fmt, clippy -D warnings incl. the wasm feature, all tests, wasm32 build) and ui-ci.yml (ReScript compile, wasm build, deno tests, bundle, lint) — the first workflows in the repo that build or test the product. SHA-pinned, no new third-party actions.
• docs: truth reset — TOPOLOGY claimed ~70% done with petgraph/tantivy/Nickel at 100% (none exist); now every document describes what the code actually does, placeholders are filled, and dead references (flake.nix, .scm state files, nonexistent just recipes) are fixed.

Verified

• cargo test: 14 unit + 2 golden + 2 property tests green
• deno task test:ui: TEA update suite + both contract tests green against the real wasm binary
• cargo fmt --check, cargo clippy --all-targets --features wasm -- -D warnings, deno lint: clean
• Browser E2E (headless Chromium): create two notes → titles/content via the core → search returns the right note → reload → both notes restored from IndexedDB autosave, stored in the same snake_case format the desktop shell reads

Not in this PR (next phases per ROADMAP)

Canvas drag-and-drop, WCAG keyboard canvas, PWA service worker, wiki-links, graph view, agents, import/export — see the revised ROADMAP.adoc sequencing.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PAEqVP7Y3bZDhtAaPUTbps

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🔍 Hypatia Security Scan

Findings: 62 issues detected

Severity	Count
🔴 Critical	1
🟠 High	23
🟡 Medium	38

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in hypatia-scan.yml",
    "type": "missing_timeout_minutes",
    "file": "hypatia-scan.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence