Crucite

v7.0: The Temper Line

v7.0 Highlights

• Completed a multi-version migration from a block-and-properties data model to a unified entity substrate by removing the final BlockService write path and the legacy block mirror, closing out a migration that had spanned four prior release cycles.
• Designed and built a parallel multi-agent build pipeline that resolves a roadmap reference to one proposal, dispatches isolated worktree agents for multi-phase work, and lands through a rebase-linear consolidation branch, including a pre-allocation scheme for database migration numbers that eliminated a recurring collision failure mode across concurrent agents.
• Built a remote CI gate that dispatches the full test and lint suite to GitHub Actions against live account billing data, refusing to dispatch when Actions-minutes usage is outrunning the billing cycle, preventing runaway spend from automated build agents.
• Authored a 19-rule semgrep enforcement layer for UI component standards, mobile guardrails, and copy conventions, replacing weaker ESLint pattern-matching and cutting the both-app test suite runtime from 20 to 30 minutes down to 6 to 8 minutes through parallel pool tuning.

v7.0 Quick Highlights

• Block to entity substrate migration reached terminal cutover: BlockService and the legacy block mirror fully removed, every module on typed _bodies tables
• Parallel worktree multi-agent build pipeline shipped: one roadmap reference resolves to inline or multi-phase execution, dispatches worktree agents, and lands through a rebase-linear consolidation branch
• Remote CI gate dispatches the full test and lint suite to GitHub Actions instead of the developer machine, with budget-aware refusal against the account's Actions minutes allowance
• Nineteen semgrep rules now enforce the UI-library primitive contract, mobile guardrails, and copy standards across the frontend, replacing weaker ESLint pattern bans
• Both-app test suite runtime cut from roughly 20 to 30 minutes down to 6 to 8 minutes through pool tuning and worker-cap resolution
• apps/labs shipped as a new Worker app and the first adopter of @cloudflare/vitest-pool-workers outside the API, with its own CI lane
• Map stack migrated fully off Leaflet onto MapLibre GL with Protomaps vector tiles
• Roadmap governance tooling shipped: five-lane classification, deep multi-agent audit and reshape, and a cross-model build contract for a second AI coding agent building against the same roadmap
• Module surface crossed sixty registered modules, up from the mid-forties at the previous version

v7.0 Overview

v7.0: The Temper Line is the version where shipping itself became an engineered process. Tempering, as a metallurgical step, is not a single reheat but a controlled, repeatable line: hold at a set temperature, quench, hold again, until the internal stress the earlier forging left behind is gone and the grain structure is stable. This cycle applies that idea to delivery. The entity data model migration that ran through v5 and v6 reached its terminal cutover: BlockService and the legacy block mirror are gone, and every module writes through EntityService and typed body tables. With that migration closed, the remaining stress in the system was process, not architecture, and this cycle spent its effort there.

The centerpiece is a parallel-agent build and consolidation pipeline. A single roadmap reference now resolves to one proposal, picks inline or multi-phase execution automatically, and either lands directly or dispatches parallel worktree agents that pre-allocate migration numbers, avoid shared-file collisions through an inventory pass, and land through a rebase-linear consolidation branch instead of a merge commit. A companion remote gate dispatches the full test-and-lint suite to GitHub Actions rather than the developer's own machine, with budget-aware refusal logic so a dispatch cannot silently overrun CI spend. Nineteen semgrep rules now enforce the UI-library contract, mobile guardrails, and copy standards that used to rely on code review catching them. None of this changes what the product does for a user; all of it changes how reliably the product can keep changing.

Elsewhere the surface kept growing in the ordinary way: apps/labs shipped as a new Worker app and the first adopter of @cloudflare/vitest-pool-workers outside the main API, the map stack moved fully off Leaflet onto MapLibre GL and vector tiles, and the module count crossed sixty. None of these are the headline of the cycle, but together they are the difference between a platform that works and one that keeps working while multiple lines of work land on it at once.

v7.0 Role Summary

• Sole developer, architect, and delivery engineer through the terminal entity cutover and the build-system cycle. Designed and built the parallel worktree agent pipeline end to end: the roadmap reference resolver, migration number pre-allocation, the shared-file collision matrix, and the rebase-linear consolidation-to-merge-queue flow. Authored the remote CI gate's budget-aware refusal logic against live Actions billing data. Wrote the semgrep rule set backing the UI-library and copy-standard enforcement gate. Drove the entity model's last migration phase to completion and the map stack's move from Leaflet to MapLibre. Extended the roadmap system with automated classification and a documented contract for a second AI coding agent building against the same backlog.

v7.0 Technical Breakdown

Terminal entity cutover. BlockService.createModuleItem() and the legacy block mirror are fully removed. Every module writes through EntityService against the substrate entities table and typed per-type _bodies tables. Block now refers only to a TipTap and ProseMirror node inside a Document entity's content tree, not a storage primitive.

Parallel agent build pipeline. A single front-door workflow resolves a roadmap reference (an ID fragment, a lane-and-rank pair, or a title fragment) to exactly one proposal through a shared ambiguity-rejecting resolver, then chooses inline execution or multi-phase wave dispatch by shape. Wave dispatch pre-allocates DO SQLite and D1 migration numbers per agent up front, since the DO migration array's import identifier is derived from the migration number itself and a collision there can merge silently while leaving one branch's array entry pointing at another branch's SQL. A shared-file collision matrix runs before sequencing, separating expected mechanical collisions (enrollment files, lockfiles) from genuine architecture conflicts in a source file two branches both rewrite. Landing happens through an ephemeral consolidation branch built by linear rebase and fast-forward merge only, never a merge commit, because the merge queue's method is rebase and a resolved conflict inside a merge commit gets silently discarded when the queue replays commits onto main.

Remote CI gate. scripts/ci-local.sh --remote dispatches the full web and API suite to GitHub Actions against a pushed ref instead of running it on the developer machine, and refuses to dispatch when live org Actions-minutes usage is running ahead of the billing cycle's calendar pace by more than a configurable margin, or when a single dispatch no longer fits the cycle's remaining allowance.

Standards enforcement. Nineteen semgrep rules in a dedicated rule directory are now the sole enforcement of the UI-library primitive contract, mobile guardrails, the em-dash copy rule, and a dangerouslySetInnerHTML ban, replacing the ESLint no-restricted-syntax blocks that previously backed them.

Map stack migration. Leaflet is fully removed from the frontend; MapLibre GL with Protomaps basemaps and PMTiles vector tiles is now the only map rendering path.

v7.0 Systems Used

• Cloudflare platform: unchanged from v6.0 (Workers, Durable Objects, D1, R2, KV, Vectorize, Workers AI, AI Gateway, Queues, Workflows, Cloudflare Access), plus GitHub Actions as the remote CI execution target for the merge-queue-equivalent gate. Frontend: MapLibre GL, Protomaps basemaps, and PMTiles vector tiles replace Leaflet for all map rendering; Konva and React Konva power the floor-plan editor; @react-three/drei extends the React Three Fiber 3D surfaces. Delivery tooling: semgrep for static enforcement of UI-library and copy standards, a GitHub Actions merge queue running on rebase semantics, and a roadmap-reference resolver shared between the Claude-based wave dispatcher and a parallel Codex CLI build lane. Testing: Vitest 4.1 (up from 2.1), with per-worktree worker-cap resolution to avoid CPU contention between concurrent agent sessions.

v7.0 Impact Results

• Closed the entity data model migration: BlockService and the legacy block mirror fully removed, ending a multi-phase migration that spanned four prior versions
• Cut both-app test suite runtime from roughly 20 to 30 minutes down to 6 to 8 minutes, making full-suite validation practical as a routine gate rather than a rare one
• Replaced ad hoc migration numbering with a pre-allocation script after a six-way Durable Object migration collision, eliminating that failure mode for concurrent agent work
• Shipped a remote CI gate with live billing-aware refusal, preventing a runaway dispatch loop from silently overrunning the account's GitHub Actions allowance
• Brought a second AI coding agent (Codex CLI) onto the same roadmap under a documented cross-model contract, without duplicating the roadmap or build tooling
• Grew the registered module count past sixty while keeping per-module addition to a schema declaration plus module-specific logic, no hand-written glue at each layer

---

v6.0: Crucite

v6.0 Highlights

• Rebranded the product from Crucible to Crucite and executed a zero-downtime domain cutover from belmonthomestead.com to crucite.com and mcp.crucite.dev, renaming every user-facing surface, URL, and AI connector endpoint while preserving infra resource names (crucible-prod, crucible-mcp, homebrew-crucible) unchanged; 301 redirects kept legacy hosts live during the transition
• Built a collaboration layer across three dimensions: read-only entity sharing with revocable per-entity access tokens, family tree co-maintain with cross-DO identity resolution so the "You" marker resolves correctly for any team member's tree; and collab finance with household pot accounts, per-member exposure rollup, and family-scoped read-only financial rollups
• Replaced the Dagre-based family tree layout engine with a custom familyTreeLayout.ts cluster engine implementing atomic couple grouping, married-in birth-family bridging, step-family side-clustering, a direct-lineage accent ring, and viewport-pinned toolbar with Jump-to-family surname navigation; backed by 210 layout tests covering multi-partner descent, co-parent pairing, and bridge snap geometry
• Shipped two-way M365 calendar sync (Phases 1 through 5) with an injected-IO engine and loop-breaker preventing echo cycles, unified IntegrationCredentials token path, and live calendar overlay in the Travel module; delivered in the same cycle as the pane workbench (VS Code-style split views) and live budget grid with plan-vs-actual Variance lens
• Completed 8 consolidation waves and 62+ PRs: org catalog (vendor folded into global substrate), Security Advisory Board (D1 0054 schema, board backfill, MCP read surface), travel overhaul (placeholder covers, TabbedModal detail, city/country catalog), 1Password reference primitive (secret_ref entity type), and BlockService drop milestone with 47+ entity types migrated to typed _bodies columns under the schema-first codegen pipeline

v6.0 Quick Highlights

• Crucite rename + domain cutover live: crucite.com production apex, demo.crucite.com public sandbox, mcp.crucite.dev AI connector; 301 redirects from legacy belmonthomestead.com hosts; infra resource names (crucible-prod, crucible-mcp, homebrew-crucible) preserved
• Custom family tree layout engine (familyTreeLayout.ts): atomic couple grouping, married-in birth-family bridging, step-family side-clustering, direct-lineage accent ring, viewport-pinned toolbar, Jump-to-family surname navigation; 210 layout tests; replaced Dagre entirely
• Read-only sharing shipped across 3 waves: per-entity revocable access tokens, family tree co-maintain with cross-DO "You" resolution, viewer-context isolation
• Two-way M365 calendar sync (P1-5): injected-IO engine with loop-breaker, unified IntegrationCredentials token path, event conflict detection, live calendar overlay in Travel
• Pane workbench (P1+P2): VS Code-style tab engine and two-pane split view with per-pane navigation state
• Collab finance: household pot accounts, per-member exposure rollup, family-scoped read-only financial rollup; finance group backed by Team primitive
• Live budget grid: plan-vs-actual lens, Variance column, side-by-side category spending view
• Global org catalog: org as global substrate type, vendor folded in, cross-user catalog enrichment, finance institution pickers wired to catalog
• Entity data model milestone: 47+ entity types under schema-first codegen pipeline, BlockService drop in progress
• Security Advisory Board (W1+W2): D1 0054 schema, full board backfill with body_md seed, MCP read surface
• Travel overhaul (6 phases): placeholder hero covers, TabbedModal detail, grid view, CityPicker, static country library, calendar overlay
• 1Password integration: secret_ref entity type as reference primitive; SDK approach declined (dead on Workers)

v6.0 Overview

Crucite v6.0 is the era where the platform found its name and became collaborative. The product rebranded from Crucible to Crucite with a domain cutover to crucite.com and mcp.crucite.dev, updating every user-facing surface while preserving infra resource names (crucible-prod, crucible-mcp, homebrew-crucible) as stable identifiers. The AI connector re-registered at mcp.crucite.dev and the demo sandbox moved to demo.crucite.com, with 301 redirects keeping the legacy belmonthomestead.com hosts live.

The defining architectural thread is the entity data model reaching practical completion. BlockService is being dropped: new writes go through EntityService and typed _bodies columns, 47+ entity types now live under the schema-first codegen pipeline, and the block mirror is being removed. Three collaboration threads converged in the same cycle: read-only sharing with per-entity revocable access tokens, family tree co-maintain with cross-DO identity resolution, and collab finance with household pot accounts and per-member rollup.

Feature depth shipped across every major module: a custom familyTreeLayout.ts engine replaced Dagre with 210 layout tests; two-way M365 calendar sync (P1 through P5) landed with a loop-breaker engine and live Travel overlay; the pane workbench brought VS Code-style split views; the live budget grid introduced a plan-vs-actual Variance lens; the global org catalog folded vendor into a unified substrate type; the Security Advisory Board shipped D1 schema 0054, full board backfill, and MCP read surface; travel received a full UI overhaul with placeholder covers, TabbedModal detail, and city/country catalog; and the 1Password integration landed as a secret_ref reference primitive.

v6.0 Role Summary

• Sole developer, architect, designer, and DevOps engineer through the Crucite rebranding and the v6.0 feature cycle. Drove the decision to rename the product from Crucible to Crucite and executed the domain cutover across every user-facing surface while preserving infra resource stability. Designed the collaboration architecture spanning read-only sharing with per-entity revocable access tokens, family tree co-maintain with cross-DO identity resolution, and collab finance with household pot accounting and per-member exposure rollup. Authored the custom family tree layout engine replacing Dagre, the two-way M365 calendar sync with its injected-IO loop-breaker engine, the pane workbench split-view architecture, and the live budget grid plan-vs-actual surface. Completed the entity data model migration to 47+ codegen entity types and drove the BlockService drop phase. Managed the full Cloudflare infrastructure stack as a single operator through 62+ PRs and 8 consolidation waves landing org catalog, Security Advisory Board, travel overhaul, 1Password reference primitive, read-only sharing, collab finance, calendar sync, pane workbench, and the Crucite domain cutover in a single release cycle.

v6.0 Technical Breakdown

• Entity data model cutover. The schema-first codegen pipeline extended to 47+ entity types, each with a _bodies table, typed Zod validators, generated dispatcher handlers, and optional MCP tool stubs. BlockService.createModuleItem() is permanently deprecated; EntityService is the canonical write path. The drop progressed across four phases: PropertiesService cutover (12 property-to-bodies migrations), read-side block elimination, block mirror removal, and the terminal BlockService deletion.

• Crucite rebranding + domain cutover. Every user-facing string, URL, and AI connector endpoint renamed from Crucible to Crucite. Production apex moved to crucite.com, public demo to demo.crucite.com, MCP connector to mcp.crucite.dev. Cloudflare infra resource names (crucible-prod, crucible-mcp, homebrew-crucible) preserved. 301 redirects served from the legacy belmonthomestead.com Worker. All 5 prior project entity versions updated to reflect Crucite branding throughout.

• Custom family tree layout engine. familyTreeLayout.ts replaced Dagre with a cluster-based algorithm: atomic couple nodes, married-in birth-family bridge positioning, step-family side-cluster grouping, direct-lineage accent ring derived from the root selection, viewport-pinned toolbar with Jump-to-family surname selector, and animated layout transitions. 210 layout tests cover multi-partner descent, co-parent pairing, bridge snap geometry, and step-sibling clustering.

• Collaboration layer (three threads). Read-only sharing: SharingKernel issues per-entity revocable share_token JWTs backed by D1 schema 0054/0055/0056; viewer-context isolation prevents write escalation. Family tree co-maintain: cross-DO identity resolution using family_identity_link_propose / family_identity_link_accept handshake, so the "You" overlay reads from the requesting user's DO context. Collab finance: finance_pot_* commands with per-pot member list, household exposure rollup, and a family-read-only summary that aggregates across private finance stores without exposing per-member transactions.

• M365 calendar sync + pane workbench + live budget. Two-way M365 sync uses an injected-IO engine separating Graph fetch from local write, a loop-breaker flag preventing echo cycles (Crucite write stamps a pending_graph_ack flag; incoming webhook clears it rather than triggering another write), unified IntegrationCredentials token management, and conflict detection. Pane workbench: PaneManager with TabEngine backing per-pane navigation state, VS Code-style tab strips, two-pane split layout with resizable gutters. Live budget grid: plan-vs-actual Variance column derived from monthly budget targets vs. actual transaction sums, category-level side-by-side view, drill-through to underlying transactions.

v6.0 Systems Used

• Cloudflare platform: Workers (compute), Durable Objects (per-user SQLite, real-time WebSocket invalidation), D1 (cross-user schema: auth, sharing tokens, advisory board, station nodes), R2 (blobs, backups, audit anchors), KV (feature flags, share-token lookups, hot caches), Vectorize (per-user semantic search namespaces), Workers AI (on-platform inference, embeddings), AI Gateway (Anthropic/OpenAI/Gemini routing, caching, fallback), Queues (background job dispatch), Workflows (multi-step async), Cloudflare Access (Entra ID, Google, Passkeys/WebAuthn)
• Frontend: React 19, TypeScript 5.7, Vite 5.4, Tailwind CSS v3.4, TipTap 3.22 (ProseMirror editor), Zustand 5.0 (state management), Framer Motion 11 (animations), React Three Fiber 9.6 + Three.js 0.184 + Drei 10.7 (3D backdrops), D3 7.9 + Recharts 3.8 (data visualization), XYFlow 12.10 (graph/flow diagrams), Leaflet 1.9 (maps), React Konva 19.2 + Konva 10.3 (canvas), Mermaid 11.13 (diagram rendering)
• Backend/API: Hono 4.12 (Worker router), Kysely 0.28 (query builder), MCP SDK 1.29 (Streamable HTTP + SSE transport), Workers OAuth Provider 0.4 (OAuth 2.1 PKCE), drizzle-orm (schema generation)
• External integrations: Microsoft Graph API (M365 calendar two-way sync, Entra user profiles), 1Password (reference-only via secret_ref primitive; SDK declined as incompatible with Workers runtime)
• Infrastructure + tooling: Go 1.23 (Station daemon, apps/station/), Vitest 2.1 (unit + integration tests), Playwright 1.59 (E2E scaffold), Sentry React 8.55 (client error tracking), GitHub Actions (CI: typecheck, eslint, vitest, merge queue gating), Wrangler (D1 migrations, Worker deployment via Versions API)

v6.0 Impact Results

• Product rebranded to Crucite and deployed to production at crucite.com; demo publicly accessible at demo.crucite.com; AI connector registered at mcp.crucite.dev; zero downtime during cutover with 301 redirects from legacy hosts
• 62+ pull requests merged across 8 consolidation waves in a single v6 release cycle, covering 12 major feature areas simultaneously
• Entity data model migration reached 47+ entity types under the schema-first codegen pipeline; BlockService deprecated with no new callers permitted; block mirror removal in final phase
• Custom family tree layout engine passed 210 automated layout tests covering blended families, multi-partner descent, co-parent pairing, and step-sibling geometry; fully replaced the Dagre dependency
• Collaboration shipped across three independent dimensions (read-only sharing, family co-maintain, collab finance) without compromising the per-user isolation model; each surface uses distinct token types with separate revocation paths
• M365 two-way calendar sync live with loop-breaker preventing echo cycles; Travel module gained calendar overlay showing sync'd events inline with trip itinerary; pane workbench enables VS Code-style split-view workflows
• Security Advisory Board live with D1 schema, full backfill of prior advisories with body_md seeds, MCP read surface for AI-assisted triage; findings A+E resolved; CRUC-2026-0007 filed on the live board
• All CI gates passing: scoped Kysely lint (cross-user query leak detection), migration parity check, both vitest suites, eslint, and typecheck; merge-queue protected main with single CI Gate check

v6.0 Deep Dive

Crucite v6.0 opened with a rename. The product had been built under the codename Crucible since its first commit, using belmonthomestead.com as its production domain. In this cycle the decision was made to give the product its own identity: Crucite, with a clean apex domain at crucite.com and a dedicated connector endpoint at mcp.crucite.dev. The rename swept every user-facing surface (the site, the Claude Custom Connector registration, the demo sandbox, all documentation strings) while leaving the Cloudflare infrastructure resource names untouched. Wrangler projects, D1 databases, R2 buckets, and KV namespaces all stay as crucible-* because they live inside the Cloudflare account and carry no user-facing identity. Legacy belmonthomestead.com URLs redirect via 301 to the new apex.

The collaboration architecture was designed in three independent but simultaneously-shipped threads. Read-only sharing uses the SharingKernel: a share_token JWT issued per entity, stored in D1, and validated at the Worker edge before the request reaches the user's DO. Tokens carry an expiry and a revocation flag; revocation is synchronous (D1 write) and immediately effective. The viewer-context isolation means every read through a share token goes through a permission projection layer that strips write capability from the returned envelope, so a shared view cannot escalate by replaying the same invocation payload with a write command. Family tree co-maintain required a cross-DO resolution: two users each have their own DO with separate family tree data; the co-maintain link joins the trees at a known person entity, and the "You" marker resolves from the requesting user's DO context, not the tree owner's. A family_identity_link_propose / family_identity_link_accept handshake creates the cross-tree join without requiring the two users to share a space. Collab finance is the most structurally contained: a household pot is a finance entity owned by a team; team members can write to pots; non-members can read the household rollup but not the individual member breakdowns. The finance group maps to the Team primitive that was already in the substrate from the collaboration model unification work.

The family tree layout engine deserved its own pass. The prior Dagre-based implementation treated the family tree as a DAG and laid it out accordingly, which broke for blended families, step-siblings, and any structure where a person appears in multiple family units. The replacement, familyTreeLayout.ts, models the tree as a set of family clusters. Each cluster is a nuclear unit: couple node, children array, optional step-parent links. The layout algorithm places clusters independently, then bridges married-in members between their birth-family cluster and their partner-family cluster. Step-siblings land in a side-cluster positioned off the canonical sibling row. The direct-lineage accent ring marks the ancestry chain from any selected person up to the root, computed from the traversal rather than stored. The viewport-pinned toolbar includes a Jump-to-family navigator that indexes all surnames in the tree and scrolls the canvas to the matching cluster. 210 layout tests validate geometry at the cluster level: couple node positions, child column spacing, bridge segment coordinates, and step-cluster offsets. The layout is computed in a pure function from the graph data, with no DOM reads, so it can run at build time or server-side.

The M365 calendar integration ran through five phases: OAuth token acquisition via the unified IntegrationCredentials path (also used by Entra graph queries), initial one-way sync from Graph to Crucite, event creation and update from Crucite back to Graph, the loop-breaker to prevent echo cycles (a Crucite write triggers a Graph webhook which would otherwise trigger another Crucite write), and the live Travel overlay that reads the synced calendar and superimposes events on the trip timeline. The injected-IO pattern separates the Graph fetch from the local write so the two can be retried independently and so the sync worker can be unit-tested without hitting the real Graph API. The loop-breaker uses a per-event state flag: when Crucite initiates a write to Graph, it stamps the local event record with a pending_graph_ack flag; when the webhook arrives with that event's Graph ID, the flag is cleared and no local write is triggered. Events arriving from Graph without the flag go through the normal inbound sync path.

The entity data model reached a milestone in this cycle. The schema-first codegen pipeline now covers 47+ entity types. Each type is defined in a TypeScript schema file that emits a _bodies table migration, typed Zod validators for the body shape, a generated CRUD dispatcher, and optional MCP tool stubs. The code generation produces output in apps/web/src/core/api/generated/ and apps/web/src/core/api/localDispatch/modules/generated/. The BlockService drop progressed through four phases: the PropertiesService cutover migrated 12 modules from block properties to typed _bodies columns; the read-side cutover redirected getters to the entity tables; the block mirror removal is the final phase. Once the mirror is removed, the blocks table will contain only document content (TipTap AST) and legacy lookup tokens for modules not yet migrated. New modules may never call BlockService: the schema prohibits new callers via lint rules in place since the deblock wave.

---

v5.0: Tempering

v5.0 Highlights

• Drove Crucible's migration from a local desktop application to a server-authoritative Cloudflare-native architecture, deprecating the desktop surface and executing a single-phase deletion of roughly 30 to 50 thousand lines of Rust, Tauri, SQLCipher, and Python sidecar code, reducing the codebase to one web surface plus a Go station daemon while continuing to ship dozens of new modules and features in the same window
• Designed and shipped a universal Intel Service across six phases covering a facet registry, multiple entity-id-aware providers, citation arrays, pin and hide UI, ProjectBrief surfaces, and MCP tools, all gated by viewer-context permissions and a three-tier sensitivity model, replacing per-module ad hoc permission checks across the platform
• Built a two-tier audit pipeline combining a hash-chained per-user audit_log with periodic R2 anchoring (user-verifiable from the Settings Activity tab) and Cloudflare Logpush plus Analytics Engine for operator-side observability, plus Sentry, DO storage monitor, and GDPR-compliant account deletion with a seven-day grace window
• Launched the Station tier: a Go daemon at apps/station/ with nine packages (capability, cli, client, config, fingerprint, heartbeat, queue, supervisor, version), a D1 0023_station_nodes registration table, seven station_* dispatcher commands, and a Sentinel Stations view, extending Crucible's compute footprint off the Worker for the first time
• Integrated Workers AI and Vectorize behind a four-bucket per-user rate limiter (embedding, cheap, frontier, vectorize) with an embedding queue producer plus consumer pattern, enabling per-user semantic search and on-platform inference while bounding cost and abuse and deleting the dedicated AI provider chain layer that the rate limiter replaced
• Expanded the MCP surface to 57 tool files and 312 tool definitions covering every dispatcher command, with a snapshot-tested capability tier policy that hard-blocks destructive operations and applies per-tier response budgets; registered Crucible as a Claude Custom Connector via Streamable HTTP and SSE at mcp.belmonthomestead.com with OAuth 2.1 PKCE
• Renamed 264 dispatcher commands to the {module}{feature}{action} convention via an alias-then-deprecate path, keeping the old names registered for backwards compatibility while standardizing the tool surface for AI consumers
• Cut the v0.10 line of releases across the Tempering version cycle covering the server-authoritative migration, codegen pipeline, Intel Service, Assessment kernel, Station MVP, Phase 4 observability, Phase 5 AI, Horizon 3D, Family Tree, and the 264-command dispatcher rename

v5.0 Quick Highlights

• Server-authoritative migration executed: roughly 30 to 50 thousand lines of Rust, Tauri, SQLCipher, and Sentinel Python sidecar code deleted in one sustained phase after the architectural cutover from local desktop to Cloudflare-native
• Schema-first codegen pipeline shipped: YAML entity definitions generate TypeScript types, DO migrations, and MCP tool stubs; entity_save conflict-detection protocol live; education_degree pilot ported
• Universal Intel Service shipped across six phases: facet registry, providers, citations, pin/hide UI, ProjectBrief, MCP tools, all gated by viewer-context permissions and three-tier sensitivity
• Assessment kernel Phases 1 and 2 shipped: TIPI, IPIP-50, GAD-7 seeded; drift detection, retest scheduling, intimate-tier MCP hold, demographics in localStorage
• Two-tier audit log live end-to-end: hash-chained per-user audit_log with R2 anchoring, Settings Activity tab, Cloudflare Logpush, Analytics Engine, Sentry, DO storage monitor, GDPR account deletion with 7-day grace
• Station tier shipped: apps/station/ Go daemon with capability, cli, client, config, fingerprint, heartbeat, queue, supervisor, and version packages; D1 0023_station_nodes; 7 station_* dispatcher commands; Stations view in Sentinel
• Workers AI and Vectorize shipped: embedding queue producer plus consumer, entity_semantic_search, 4-bucket per-user AI rate limiter (embedding/cheap/frontier/vectorize)
• MCP surface expanded to 57 tool files and 312 tool definitions covering every dispatcher command; D1-backed audit tools; capability table snapshot test
• Single-Worker deployment: Workers Assets plus Versions API replaced split Pages+Worker setup; PR preview deploys on workers.dev
• 264 dispatcher commands renamed to {module}{feature}{action} convention with alias-then-deprecate path
• Horizon 3D backdrop Phases 0 through 5 shipped: Three.js, React Three Fiber, Drei; Core-tier 3D ambient layer
• Family Tree module shipped: persons, lineage edges, identity links, suggestion engine, household lineage book
• UI compliance drift closed: 149 lint violations to 0 across the web bundle
• Notifications bell and slide-in drawer, per-entity history side drawer with diff view, Playwright E2E scaffold for high-risk post-migration flows

v5.0 Overview

Crucible v6.0: Tempering is the version where the platform's structure refines and the security perimeter tightens. The server-authoritative migration locked the architecture as Cloudflare-native: the Rust core, Tauri desktop shell, SQLCipher vault, and Python Sentinel sidecar were deleted in a single phase, taking roughly thirty to fifty thousand lines of dead code with them and reducing the project to a single web surface plus a Go station daemon. The DO migration runner, schema-first codegen pipeline, and entity_save protocol with conflict detection landed as the substrate for the next data model, with the education_degree type ported as the pilot.

The cybersecurity surface expanded along three axes. A universal Intel Service rolled out across six phases: a facet registry, multiple entity-id-aware providers, citation arrays, pin and hide UI, ProjectBrief surfaces, and MCP-exposed tools, all gated by viewer-context permissions and three-tier sensitivity classification. The Assessment kernel shipped Phases 1 and 2 with tests-as-data architecture seeded with TIPI, IPIP-50, and GAD-7, plus drift detection, retest scheduling, demographics held in localStorage to minimize server-side PII, and an intimate-tier hold that keeps sensitive responses inside the DO and out of MCP. A two-tier audit pipeline shipped end-to-end: hash-chained per-user audit_log inside each DO with R2 anchoring, a Settings Activity tab for user-side verification, Cloudflare Logpush plus Analytics Engine for operator-side observability, Sentry React for client error tracking, a DO storage monitor, and GDPR-compliant account deletion with a seven-day grace window.

Compute extended off the Worker for the first time with the Station tier. apps/station/ shipped as a Go daemon skeleton with capability, cli, client, config, fingerprint, heartbeat, queue, supervisor, and version packages, registering with Crucible over a fingerprint-authenticated /api/station/* surface backed by D1 migration 0023. Seven station_* dispatcher commands and a Stations view inside Sentinel made the new tier visible in the UI. Workers AI, Vectorize, and an embedding queue shipped behind a four-bucket per-user rate limiter (embedding, cheap, frontier, vectorize), enabling on-platform inference and per-user semantic search while bounding cost and abuse. The MCP surface tripled: 312 tool definitions covering every dispatcher command, registered as a Claude Custom Connector at mcp.belmonthomestead.com over Streamable HTTP and SSE with OAuth 2.1 PKCE.

v5.0 Role Summary

• Sole developer, architect, designer, and DevOps engineer through Crucible's server-authoritative migration and the v6.0: Tempering cut. Drove the decision to deprecate desktop entirely and rebuild as Cloudflare-native, then executed the deletion of approximately thirty to fifty thousand lines of Rust, Tauri, and Python code in a single sustained phase. Designed and shipped the schema-first codegen pipeline that backs the new entity data model, the universal Intel Service with viewer-context permissions and three-tier sensitivity gating, the Assessment kernel with its intimate-tier MCP hold, the hash-chained per-user audit log with R2 anchoring, and the Station Go daemon with its fingerprint-authenticated registration surface. Owned the Workers AI plus Vectorize integration including per-user rate limiting, the single-Worker deployment migration via Workers Assets and Versions API, and the dispatcher rename that standardized 264 commands and the 312 MCP tool definitions on top of them. Managed Cloudflare infrastructure across Workers, Durable Objects, D1, R2, KV, Vectorize, Workers AI, Queues, AI Gateway, Access, and Logpush as a single operator.

v5.0 Technical Breakdown

• Server-Authoritative Migration Wave. The Rust core in crates/, the Tauri shell in src-tauri/, the Python Sentinel sidecar, and all SQLCipher and Tantivy bindings were removed in a single deletion pass after the architectural decision to migrate from a local desktop application to a Cloudflare-native server-authoritative surface. The web bundle dropped its Tauri detection branches and DesktopStorageAdapter; StorageAdapter now has a single live implementation, DOStorageAdapter, backed by ctx.storage.sql. The sqlite-wasm path remains for demo mode only.

• Schema-First Codegen Pipeline. generate-from-schema.mjs turns YAML entity definitions into TypeScript types, DO migrations, MCP tool stubs, and dispatcher signatures. entity_save writes substrate-aware entities through a conflict-detection protocol that compares an expected base version against the live row, returning a structured conflict to the client on mismatch. The education_degree type is the pilot port; remaining types migrate incrementally.

• Universal Intel Service. IntelService wraps a facet registry where each facet declares its provider, sensitivity tier, viewer-context evaluator, and cache strategy. Providers return citation arrays with source links. The DO caches per-entity facet results and invalidates on EventBus emissions. MCP tools surface read-only intel facets; destructive operations on facets like pin and hide are blocked at the capability tier.

• Assessment Kernel. AssessmentService stores assessment_test, assessment_question, and assessment_response rows generated from seeded YAML for TIPI, IPIP-50, and GAD-7. AssessmentRunner reads questions sequentially, scoring on submit. Drift detection schedules a retest based on the test's recommended cadence. The intimate-tier hold prevents the corresponding facets from being returned through MCP, isolating sensitive responses to the DO.

• Audit Log Two-Tier. Every DO write appends to audit_log with a hash chain rooted in the user's DO start state. Periodic R2 anchors checkpoint the chain head, letting users verify their own log integrity from the Settings Activity tab. Cloudflare Logpush ships request logs to R2 and Axiom for operator visibility, separated from user-visible content. Sentry captures client errors. The DO storage monitor surfaces per-user storage growth in Settings.

• Station Daemon. apps/station/ is a Go 1.23 daemon with packages for capability (capability tier policy mirroring the Worker), cli (operator commands), client (Crucible API client), config (TOML), fingerprint (TPM-rooted node identity), heartbeat (recurring ping), queue (job pull), supervisor (lifecycle), and version. D1 0023_station_nodes stores registered nodes per user. Seven dispatcher commands in stationNodes.ts wire the UI to station state. SentinelStationsView shows registered nodes, queued jobs, and capability tiers.

• Workers AI and Vectorize. The Worker binds Workers AI and Vectorize. The embedding queue producer enqueues entity changes for embedding generation; handleEmbeddingBatch in the queue consumer writes vectors back. entity_semantic_search queries the per-user Vectorize namespace. Per-user AI rate limits live in four buckets: embedding (cheap, high-volume), cheap (Workers AI inference), frontier (Anthropic via AI Gateway), and vectorize (search queries). FitnessAIService inlines the Anthropic provider after the dedicated provider chain layer was deleted.

• MCP Surface Expansion. apps/api/src/mcp/tools/ grew to fifty-seven tool files covering 312 dispatcher commands. mcpPolicy.ts applies prefix-rule capability classification; the snapshot test in mcpPolicy.test.ts locks the classification table. D1-backed audit tools (mcp_audit_log_list, mcp_audit_summary_get) read the bytes-only audit table. A dispatcher rename pass moved 264 commands to the {module}_{feature}_{action} convention; old aliases stay registered with deprecation flags.

• Single-Worker Deployment. The split Cloudflare Pages plus Worker setup collapsed into one Worker using Workers Assets for the SPA bundle and the Versions API for atomic deploys. The deploy workflow uploads a new version, runs smoke tests against the version URL, and promotes to production in a single transition. PR preview deploys run on workers.dev; the demo stays on CF Pages.

• Notifications, Entity History, and GDPR Deletion. A notifications bell with a slide-in drawer wires to notification_* dispatcher commands. Per-entity version history surfaces in a side drawer with a diff view backed by entity_history. Account deletion runs as a queued workflow: a seven-day grace window after request, then full DO purge plus D1 cross-user cleanup plus R2 asset removal, with a confirmation receipt anchored back to R2.

v5.0 Systems Used

• Cloudflare Workers, Durable Objects with ctx.storage.sql, D1, R2, KV, Vectorize, Workers AI, Queues, Workflows, AI Gateway, Access, Logpush, Analytics Engine, Pages
• Entra ID, Google OAuth, Passkeys via WebAuthn (three SSO providers behind CF Access)
• Anthropic Messages API via AI Gateway for frontier inference; Workers AI for on-platform inference; Vectorize for per-user semantic search
• Sentry React for client error tracking; Cloudflare Logpush plus Axiom for operator-side observability
• Model Context Protocol via @modelcontextprotocol/sdk; registered as a Claude Custom Connector at mcp.belmonthomestead.com
• OAuth 2.1 PKCE via @cloudflare/workers-oauth-provider with CF Access SaaS as the upstream IdP
• Microsoft Graph API for Entra contacts sync; Spotify Web API via OAuth2 PKCE for the Music tab in Signal
• Open-Meteo, NWS, NHC, RainViewer for the Weather module; Leaflet plus OpenStreetMap for the shared map canvas
• Stripe for subscription billing (planned at $10/month, Customer ID in D1 with capability gate in DO)
• Playwright for end-to-end browser tests across high-risk post-migration flows
• Homebrew distribution via NocturnalProgress/homebrew-crucible for the crucible-mcp stdio proxy
• GitHub Actions for CI, multi-arch macOS builds for the MCP proxy, and the single-Worker Versions API deploy pipeline

v5.0 Impact Results

• Reduced the codebase by roughly 30 to 50 thousand lines through the server-authoritative migration's deletion pass while net-adding dozens of new modules and features in the same window, leaving the project smaller and easier to reason about after a sustained scope expansion
• Closed UI compliance drift from 149 lint violations to 0 across the web bundle, locking layout, color, and component conventions in lint rather than reviewer judgment
• Expanded the MCP surface from 21 tool files at v4.0 to 57 tool files and 312 tool definitions covering every dispatcher command, while keeping the capability tier policy snapshot-tested in CI to prevent classification drift
• Established compute beyond the Worker for the first time through the Station tier, opening a path to local AI inference, sustained security scans, and other workloads that cannot fit inside a stateless web request budget
• Made per-user audit verifiable end-to-end through the hash-chained audit log and Settings Activity tab, giving users a way to detect tampering against their own data without trusting the operator
• Shipped 47 modules total live at crucible.belmonthomestead.com behind CF Access plus Entra, Google, or Passkey SSO, with a no-login demo at demo.belmonthomestead.com seeded with realistic data across all modules
• Forge career portfolio pipeline reached production: publish toggle on entity blocks, an export API that ships visible entities to the Forge surface, and digest polling that keeps Forge in sync, allowing Crucible to drive a public-facing portfolio site from inside the same workspace

v5.0 Deep Dive

Server-Authoritative Migration and the Deletion Pass. The May 2026 decision to migrate Crucible from a local desktop application to a server-authoritative Cloudflare-native architecture committed the project to no sync engine, no offline mode, and no desktop client. Real-time multi-device feel comes from Durable Object WebSocket invalidation, not state convergence. The migration executed a single-pass deletion of the Rust core in crates/, the Tauri shell in src-tauri/, the SQLCipher and Tantivy bindings, the Python Sentinel sidecar, and the vault concept from the web entirely. Roughly thirty to fifty thousand lines of code disappeared, and the web bundle's StorageAdapter interface dropped to a single implementation. The sqlite-wasm path remains in the bundle but only as the demo mode adapter, never wired to a live user account.

Entity Data Model and Schema-First Codegen. The block data model that has carried Crucible since v1 is being supplemented (not replaced) by an entity substrate with per-type body tables and shared cross-cut tables for comments, reactions, shares, and notifications. The codegen pipeline at generate-from-schema.mjs reads YAML schema definitions and emits TypeScript types, DO migrations, MCP tool stubs, and dispatcher command signatures, ensuring the runtime shape and the type system agree by construction. The entity_save protocol writes through a conflict-detection check that compares an expected base version against the row at write time, returning a structured conflict to the client when the comparison fails so the UI can offer a merge. The education_degree entity is the first port; remaining types migrate incrementally as their modules need substrate features the block model cannot offer.

Universal Intel Service. The Intel Service replaces ad hoc permission checks scattered across modules with a single primitive: a facet registry. Each facet declares its provider, sensitivity tier, viewer-context evaluator, cache strategy, and MCP exposure. When a client requests an entity's intel, the service resolves which facets the viewer is authorized to see based on the relationship between the viewer and the entity owner, computes the missing facets through their providers (which can be local or remote), caches the results inside the DO with EventBus invalidation, and returns citation arrays alongside the facet values. The result is that the same contact card can show different facets to different viewers without per-screen permission code, and the MCP tool surface gets a uniform sensitivity gate.

Assessment Kernel. The Assessment module models psychological and health tests as data rather than as code. Tests like TIPI, IPIP-50, and GAD-7 ship as seeded YAML defining items, scoring rules, and recommended retest cadences; AssessmentService reads those rows at runtime and AssessmentRunner walks the user through them. Demographics live in browser localStorage, not the DO, to minimize server-side PII for the most identifying fields. Drift detection compares current scores to the user's baseline and surfaces meaningful shifts in the briefing view. The intimate-tier hold blocks the Intel Service from returning intimate-tier facets through MCP, so sensitive assessment responses remain readable inside the app but invisible to AI clients.

Two-Tier Audit Pipeline. Every write inside a DO appends to audit_log with a hash chain rooted in the DO's start state. Periodic R2 anchors checkpoint the chain head, letting users prove their log has not been tampered with after the fact: the Settings Activity tab walks the chain forward from the last anchor and verifies the current head against R2. The user-side audit log is private to each DO. Operator-side observability comes from Cloudflare Logpush shipping request logs to R2 and Axiom, separated from user content. Sentry React captures client-side errors, and a DO storage monitor surfaces per-user storage growth so heavy users can be flagged before they hit the Durable Object size limit. GDPR account deletion runs as a queued workflow with a seven-day grace window between request and full purge.

Station Daemon and the Compute Tier. The Station tier is a Go daemon at apps/station/ that extends Crucible's compute footprint to user-controlled hardware. The daemon's nine packages cover capability tier policy mirroring the Worker, the operator CLI, the API client, TOML configuration, TPM-rooted node fingerprint, periodic heartbeat, job queue pull, lifecycle supervisor, and version reporting. D1 0023_station_nodes stores registered nodes per user, keyed by fingerprint and authenticated against the Worker. Seven station_* dispatcher commands wire the UI to station state: list, register, heartbeat, ack, retract, get_capabilities, set_capability. SentinelStationsView shows registered nodes, queued jobs, and current capability tiers. The reference architecture pairs multiple x86 mini PCs running tiered services with a Mac Mini acting as an AI anchor for frontier inference. The tier opens a path to local AI inference, sustained security scans, and other workloads that cannot fit inside a stateless web request budget.

Workers AI, Vectorize, and the AI Rate Limiter. The Worker binds Workers AI and Vectorize. An embedding queue producer fans entity changes out to a Queue that an embedding consumer drains, generating vectors and writing them back to the per-user Vectorize namespace. entity_semantic_search queries that namespace at read time. AI cost and abuse are bounded by a four-bucket per-user rate limiter: embedding (high-volume, cheap), cheap (Workers AI inference), frontier (Anthropic via AI Gateway), and vectorize (search queries). Each bucket has its own refill rate and ceiling, and the limiter shields the user's quota across modules. The dedicated AI provider chain layer that previously coordinated routing between providers was deleted in favor of inline service-level wiring; FitnessAIService now calls Anthropic directly with the rate limiter as the only gate.

MCP Surface and Dispatcher Rename. Fifty-seven MCP tool files in apps/api/src/mcp/tools/ cover 312 dispatcher commands, registered as a Claude Custom Connector at mcp.belmonthomestead.com over Streamable HTTP and SSE with OAuth 2.1 PKCE. mcpPolicy.ts applies prefix-rule capability tier classification across all commands; mcpPolicy.test.ts snapshot-tests the classification table so any reclassification is visible in the diff. Per-tier response budgets prevent oversized tool outputs from consuming excessive tokens in downstream LLM calls. A rename pass moved 264 dispatcher commands to the {module}_{feature}_{action} convention via an alias-then-deprecate path that keeps the old names registered for backwards compatibility.

Single-Worker Deployment. The split Cloudflare Pages plus Worker setup collapsed into one Worker using Workers Assets for the SPA bundle and the Versions API for atomic deploys. The CI workflow uploads a new version, runs smoke tests against the version URL, and only promotes to production when the smoke checks pass. PR preview deploys run on workers.dev with isolated D1 instances; the demo stays on CF Pages, served from a separate Vite build with the sqlite-wasm adapter. The migration eliminated the dual-deploy race condition that had bitten earlier releases.

---

v4.0: Signal & Synthesis

v4.0 Highlights

• Shipped Education shell module with degree/course/term/slot data model, palette-driven grid card view, and bulk attempt import; wired education_* commands through the TS dispatcher and MCP
• Shipped Signal module with Peer Pulse card grid, Intel Digest, Progression Board, and Music showcase; integrated Spotify OAuth2 PKCE to back the Music section with live playlist data
• Wired Fitness AI panel to Anthropic Messages API via per-user integration key stored in DO, enabling contextual coaching inside active workout sessions
• Added freeform canvas block to the TipTap editor using @xyflow/react, enabling React Flow diagrams (cards, labels, arrows) embeddable in any page
• Expanded Progression system with Smith's Log, shell-level tier-up vignette overlay, and Horizon stellar events that fire on tier crossings; added 32 new achievements across 7 modules with retroactive recheck
• Ported 4 new tool modules (education, learning, travel, vendors) to the HTTP MCP transport; MCP tool surface grew from 21 to 25+ files
• Added Google as an IdP/auth type alongside Entra and passkeys; migrated app versioning to CalVer with auto-generated per-push changelog entries
• Cut v0.9.0 (2026-04-26) covering Signal, Horizon overhaul, Spotify integration, and achievements catalog expansion

v4.0 Quick Highlights

• Live at crucible.belmonthomestead.com with CF Access + Entra SSO; demo at demo.belmonthomestead.com (no login required)
• Two new shell modules: Education (degrees, courses, terms, slots) and Signal (Peer Pulse, Progression Board, Intel Digest, Music/Spotify)
• Fitness AI panel wired to Anthropic Messages API via per-user integration keys stored in DO
• Freeform canvas block in TipTap editor: React Flow cards, labels, and arrows embeddable in any page
• Progression system: Smith's Log inscriptions, shell-level tier-up vignette, Horizon stellar events on tier crossings; 90+ achievements across 7 modules
• 35+ modules, 400+ commands, 100+ MCP tools available on both desktop and web
• Google added as IdP/auth type; CalVer versioning (2026.4.26) with auto-generated per-push changelog
• v0.9.0 released 2026-04-26: Signal, Horizon overhaul, Spotify, achievements catalog expansion

v4.0 Overview

Crucible v4.0 adds a layer of ambient intelligence on top of the dual-platform foundation from v3.0. Two new shell modules shipped: Education, which models degree programs, courses, terms, and slots with palette-driven visual identity, and Signal, a peer-awareness layer showing Progression Board standings, Peer Pulse contact cards, Intel Digest, and a Music showcase backed by Spotify OAuth2 PKCE. The Fitness module gained a live AI panel wired to the Anthropic Messages API via per-user integration keys, enabling workout planning and analysis inside the session tracker.

The block editor gained a freeform canvas block: React Flow cards, labels, and arrows embeddable in any page, turning notes into lightweight diagrams without leaving the workspace. The progression system deepened with a Smith's Log showing nucleosynthesis-themed tier inscriptions, a shell-level tier-up vignette overlay, and Horizon stellar events that fire on tier crossings. The achievements catalog expanded to 90+ entries across 7 modules with retroactive rechecks on login.

The app version migrated to CalVer (2026.4.26), with auto-generated changelog entries on every push. MCP tooling grew from 21 to 25+ tool files, with education, learning, travel, and vendor modules ported to the HTTP transport. Google was added as an auth type alongside Entra and passkeys, and the What-If module was renamed Scenarios throughout the UI.

v4.0 Role Summary

• Sole developer, architect, designer, and DevOps engineer across all layers of a dual-platform production system. Designed and executed the web server-authoritative pivot, including the per-user Durable Object topology, the TypeScript migration runner, and the StorageAdapter abstraction that made the same service code run on both desktop and web. Owned the full MCP surface: designed the capability-tier policy, built and published the crucible-mcp Homebrew formula, implemented the remote Streamable-HTTP transport, and integrated with ChatGPT Connectors via OAuth PKCE. Managed Cloudflare infrastructure across Workers, Durable Objects, D1, Pages, and Access with no ops team. Shipped v0.6.0 covering the UI compliance audit, Weather Carrot-parity rework, Budget Insights, and MCP Phase 3 cleanup across a single release cycle.

v4.0 Technical Breakdown

• Education module: education_* command set, degree/course/term/slot schema in DO SQLite migration, palette-driven DegreeCard grid, CourseDetailModal, and TermView slot scheduler

• Signal module: SignalHubView and SignalSidebar, Peer Pulse card grid backed by galaxy peer snapshots, MusicTab with Spotify OAuth2 PKCE via SpotifyService, Peer View cross-user profile renderer

• Fitness AI: FitnessAiPanel streams Anthropic Messages API responses via per-user anthropic_key stored in DO; WorkoutSessionView activates the panel on session start

• Freeform canvas: CanvasBlock TipTap node extension wraps @xyflow/react ReactFlow component; persists node/edge graph as JSON in block content; supports label editing and connection handles inline

• Horizon v4: contact belt entity layer, capacity-aware moon shells, PlanetArchetype variant system, stellar surface detail, rare phenomena (supernovae, binary encounters), click-to-learn glossary with ObserverAchievement triggers

• MCP expansion: education, learning, travel, and vendor modules ported to HTTP transport; budget tests enforced across 25+ tool files; tool names aligned to TS-dispatcher snake_case convention

v4.0 Systems Used

• Cloudflare Workers + Durable Objects. Per-user UserWorkspaceDO instances as the canonical web store: isolated SQLite, TS migration runner, and full dispatcher execution per user. Worker routing via Hono with per-route middleware for rate limiting, CORS, and CF Access validation.
• MCP Capability-Tier Policy. Prefix-rule classification of all 352 dispatcher commands into seven tiers. Hard block at the Worker for destructive and none tiers. Per-tier response budgets (8K light, 16K heavy, 12K search, 1K writes) with paginate-hint truncation footers. Snapshot-tested capability table in CI via mcpPolicy.test.ts.
• OAuth PKCE + CF Access SaaS Integration. Remote MCP transport uses an OAuth authorization server façade backed by CF Access SaaS app validation. Upstream PKCE flow via CF Access authorize endpoint; code-exchange handled in the Worker; tokens never stored client-side. ChatGPT Connector registration verified against the resulting 62-tool surface.
• Homebrew Binary Distribution. Custom tap at NocturnalProgress/homebrew-crucible with a GitHub Actions pipeline building aarch64 and x86_64 macOS binaries on mcp-v* tags. Formula rewrites via a custom Python step handling the multi-arch on_arm and on_intel formula shape that off-the-shelf bump actions do not support.
• TS Dispatcher + StorageAdapter. 352 commands registered across 33 handler modules. DesktopStorageAdapter (Tauri db_* IPC) and DOStorageAdapter (ctx.storage.sql) share a common interface so service code is platform-agnostic. BlockService.createModuleItem() wraps block creation with property writes, FTS5 indexing, and event emission in a single transaction.
• XYFlow + Dagre. What-If scenario planner uses XYFlow for the interactive graph canvas with dagre-powered auto-layout replacing manual positioning. Node types cover decisions, outcomes, adjustments, and phases; edges carry directional weight labels.
• Recharts + D3-Sankey. Finance Hub data visualization: sparklines in Budget Insights, category flow diagrams in the Sankey view, and trend charts across the 9 Finance sub-views.
• Open-Meteo + NHC + NWS Pipeline. Weather module fetches from Open-Meteo (forecast, air quality, minutely), NWS (alerts), RainViewer (radar), and NHC (hurricanes via a Worker proxy for CORS bypass). Three-layer protection: property-backed DB cache per location, in-memory per-URL throttle, and Cloudflare Worker Cache API on the NHC proxy.

v4.0 Impact Results

• Shipped Crucible to production at crucible.belmonthomestead.com, evolving a local-only Tauri desktop app into a cloud-native platform backed by Cloudflare Workers, per-user Durable Objects, and a TypeScript dispatcher shared with the desktop client
• Ported 12,818 rows from the encrypted local desktop vault into production Durable Objects on the first migration with zero data loss, validating the StorageAdapter abstraction across both local and remote SQLite runtimes
• Wired 352 commands across 33 modules through the TS dispatcher in a single cutover, eliminating the Rust business-logic surface and making the full feature set available on both desktop and web with a shared code path
• Published crucible-mcp via a Homebrew tap with a GitHub Actions multi-arch build pipeline, enabling one-command installation of the MCP stdio proxy on Apple Silicon and Intel Macs
• Registered Crucible as a ChatGPT Connector with 62 tools via remote Streamable-HTTP MCP at mcp.belmonthomestead.com/sse, with full OAuth PKCE and a capability-tier policy blocking all destructive operations from AI clients
• Launched Budget Insights in Finance Hub: analyzes trailing 12-month transaction history, maps free-text categories to an 11-way canonical taxonomy, surfaces monthly and yearly budget recommendations with confidence tiers, and provides an adopt flow that diffs recommendations against existing budgets before writing
• Deployed UI compliance enforcement via lint, replacing reviewer-enforced conventions: every module leaf now mounts in ModuleLayout, core cannot import from modules, and shared UI components are enforced over bespoke reimplementations
• Cut v0.6.0 release (2026-04-23) covering the UI compliance audit, MCP Phase 3 cleanup, Weather Carrot-parity rework, system module web restoration, and Shopping module UX rework

v4.0 Deep Dive

Cloud Architecture and Durable Objects. The web pivot replaced D1 as the canonical data store with per-user UserWorkspaceDO Durable Objects. Each signed-in user gets an isolated DO instance that runs the TS dispatcher, migration runner, and full service layer against its own SQLite database. The migration runner checks a migrations meta-table on every cold start and applies any unapplied SQL files in order, so schema evolution is per-user and requires no coordinated migration window. The DO writes a structured one-line log per invocation covering command name, user ID, duration, outcome, and error code, enabling per-user and per-command observability via Cloudflare Logs without a separate analytics pipeline.

Dispatcher Portability. The same tryLocalDispatch(cmd, args) function runs on both runtimes. On desktop, invoke falls through to Tauri IPC for native-only commands (vault, keychain, filesystem dialogs, Sentinel sidecar) and routes through the TS dispatcher for everything else. On web, the client posts to POST /api/invoke and never calls Tauri at all. The StorageAdapter interface defines the SQL surface (query, exec, transaction); DesktopStorageAdapter calls Tauri's db_* commands via IPC, and DOStorageAdapter calls ctx.storage.sql synchronously inside the DO. Service classes receive a StorageAdapter instance at construction time and contain no if (isTauri) branches.

MCP Capability Gate. The capability-tier policy in mcpPolicy.ts uses a prefix-rule convention to classify commands without per-command annotations: delete_*, purge_*, and wipe_* map to destructive; get_* maps to read_light; list_* maps to read_heavy; and so on. The Worker enforces the gate on every MCP request and returns a 403 for destructive and none-classified commands before the DO is invoked. A snapshot test locks the capability table so any reclassification is visible in the diff. Per-tier response budgets prevent oversized tool responses from consuming excessive tokens in downstream LLM calls. A bytes-only D1 audit log records tool calls without capturing argument content, since search queries and contact lookups can carry PII.

Data Migration. The desktop vault (12,818 rows across the block, property, and relation schema) was exported via the Tauri db_* IPC bridge and re-imported via the DO's SQL surface using the same migration schema as the TS migration runner. Three edge cases required manual resolution: block IDs with clock-skew (ULIDs from two separate machines), property rows with orphaned parent IDs from deleted blocks, and search index rows that needed regeneration via FTS5 insert into block_search after the data load. Row counts were validated across all tables before and after to confirm zero data loss.

---

v3.0: The Pour

v3.0 Highlights

• Shipped production web app at crucible.belmonthomestead.com with CF Access and Entra SSO gating from day one; backed by per-user UserWorkspaceDO Durable Objects, each running an isolated SQLite instance with a TypeScript migration runner, eliminating the need for a shared database tier
• Ported 12,818 rows from the encrypted local desktop vault into production Durable Objects in a single migration with zero data loss, validating the StorageAdapter abstraction across both local SQLite (via Tauri db_* IPC) and DO SQLite (via ctx.storage.sql)
• Built and published crucible-mcp, a Rust stdio proxy distributed via a custom Homebrew tap with a GitHub Actions multi-arch pipeline (aarch64 + x86_64 macOS), exposing 90+ MCP tools to Claude Desktop, Claude Code, and any MCP-compatible client
• Designed and implemented a capability-tier policy that classifies all 352 dispatcher commands by naming-convention prefix into seven tiers; destructive operations are hard-blocked at the Worker so AI assistants cannot delete data via MCP, enforced by a snapshot-tested capability table in CI
• Deployed a remote Streamable-HTTP MCP transport at mcp.belmonthomestead.com/sse with a full OAuth PKCE flow via a CF Access SaaS façade, enabling ChatGPT Connector registration and surfacing 62 tools in the ChatGPT tool picker
• Wired 352 commands across 33 modules through the TS dispatcher in a single cutover, eliminating the Rust command surface for business logic and making the full feature set available on both desktop and web with a shared code path and no platform conditionals in service classes
• Implemented visitor mode with cross-user read-only access under /{username}/... URLs, enforced via a dispatcher guard that blocks writes for non-owner sessions and a SystemSwitcher lobby that routes viewers into a scoped shell
• Launched Budget Insights for Finance Hub: analyzes trailing 12-month transactions, maps free-text categories to an 11-way canonical taxonomy, recommends monthly budgets per category with High/Medium/Low confidence tiers and trend sparklines, and provides an adopt flow that diffs recommendations against existing budgets before writing

v3.0 Quick Highlights

• Live at crucible.belmonthomestead.com with CF Access + Entra SSO; demo at demo.belmonthomestead.com (no login required)
• Per-user UserWorkspaceDO Durable Objects as the canonical web store: isolated SQLite, TS migration runner, and full dispatcher per user
• 352 commands across 33 modules wired through the TS dispatcher; same code path on Tauri desktop and Cloudflare Worker
• 90+ tool MCP server distributed via Homebrew (brew install nocturnalprogress/crucible/crucible-mcp); remote Streamable-HTTP transport at mcp.belmonthomestead.com/sse for ChatGPT Connector (62 tools)
• Capability-tier policy blocks destructive MCP operations at the Worker; bytes-only D1 audit log; 120 req/60s per-user MCP rate limit isolated from UI traffic
• Visitor mode with /{username}/... URL namespace and read-only scoped shell for shared workspace links
• Budget Insights, Weather Carrot-parity (14-day, air quality, hurricane tracker, moon phase), Job Tracker overhaul (Pulse + Timeline + tabbed dialog), What-If dagre auto-layout, Shopping unified editor
• UI compliance enforced via lint: ModuleLayout mandatory on leaves, no core-to-module imports, shared component usage required

v3.0 Overview

Crucible v3.0 is the production chapter of a multi-year platform build. The v2.0 registry-driven desktop app evolved into a dual-platform system: the desktop Tauri client retained its local-first encrypted SQLite store, and a fully independent web application launched at crucible.belmonthomestead.com, backed by per-user Cloudflare Durable Objects running the same TypeScript dispatcher and services as the desktop. Data never passes through a shared database tier. Each signed-in user's workspace is a Durable Object with its own SQLite instance, migration runner, and invocation log.

The AI accessibility layer shipped in two forms. The crucible-mcp stdio binary, distributed via a Homebrew tap, proxies tool calls from Claude Desktop and Claude Code to the Worker over HTTPS, authenticating via Cloudflare Access JWTs. A separate remote Streamable-HTTP transport at mcp.belmonthomestead.com/sse adds a full OAuth PKCE flow via a CF Access SaaS façade, making Crucible registerable as a ChatGPT Connector with 62 tools visible in the tool picker. A capability-tier policy classifies every dispatcher command by naming convention, blocking destructive operations from MCP clients at the Worker so no AI assistant can delete data.

The TypeScript dispatcher introduced in Phase 4 is the backbone of the platform's portability. 352 commands across 33 modules route through the same handler layer on desktop and web. A StorageAdapter interface abstracts local Tauri IPC calls and DO's ctx.storage.sql so service code contains no platform conditionals. The business logic layer, the dispatcher, and the storage adapter form a three-layer stack that runs identically in both runtimes.

v3.0 Role Summary

• Sole developer, architect, designer, and DevOps engineer across all layers of a dual-platform production system. Designed and executed the web server-authoritative pivot, including the per-user Durable Object topology, the TypeScript migration runner, and the StorageAdapter abstraction that made the same service code run on both desktop and web. Owned the full MCP surface: designed the capability-tier policy, built and published the crucible-mcp Homebrew formula, implemented the remote Streamable-HTTP transport, and integrated with ChatGPT Connectors via OAuth PKCE. Managed Cloudflare infrastructure across Workers, Durable Objects, D1, Pages, and Access with no ops team. Shipped v0.6.0 covering the UI compliance audit, Weather Carrot-parity rework, Budget Insights, and MCP Phase 3 cleanup across a single release cycle.

v3.0 Technical Breakdown

Server-Authoritative Web Architecture. The web client posts every command to POST /api/invoke on the Cloudflare Worker, which routes to the caller's UserWorkspaceDO Durable Object. Each DO instance holds a per-user SQLite database managed by the TS migration runner: applied migrations are tracked in a migrations meta-table, new SQL files apply on first invoke, and the schema evolves per-user with no coordination across tenants. The DO writes a structured one-line log per invocation covering command name, user ID, duration, and outcome for Cloudflare Logs filtering. Business logic runs from the same TS dispatcher and service modules as the desktop; only the storage adapter differs.

TypeScript Dispatcher and StorageAdapter. The dispatcher maps snake_case command names to camelCase service methods via handler modules under localDispatch/modules/, each registering with registerAll() at startup. On desktop, DesktopStorageAdapter calls Tauri's db_query, db_exec, and db_transaction IPC commands. On web, DOStorageAdapter calls ctx.storage.sql inside the Durable Object. Service classes like BlockService, FinanceService, and ProjectsService receive a StorageAdapter instance and contain no platform conditionals. 352 commands across 33 modules are wired this way.

MCP Infrastructure. Two transports surface the 90+ tool catalog to AI clients. The stdio transport is crucible-mcp, a Rust binary that proxies to POST {api_url}/api/invoke with a Cloudflare Access JWT minted by cloudflared access token; distributed via a Homebrew tap (NocturnalProgress/homebrew-crucible) with a GitHub Actions pipeline building aarch64 and x86_64 macOS binaries on every mcp-v* tag. The remote transport is a Streamable-HTTP MCP server at mcp.belmonthomestead.com/sse with a full OAuth PKCE flow via a CF Access SaaS façade, enabling ChatGPT Connector registration. A capability-tier policy in mcpPolicy.ts classifies every command by naming convention into one of seven tiers; the Worker enforces the gate and returns a 403 for destructive or none-classified commands. A bytes-only audit log records tool calls to D1 without capturing arg content, and a per-user rate limit (120 req/60s) isolates MCP traffic from interactive UI traffic (600 req/60s).

Visitor Mode and URL Namespace. Signed-in users claim a username at /{username}/...; a legacy /personal alias upgrades to the canonical URL via replaceState on first load. Shared links open in visitor mode: the target user's UserWorkspaceDO serves read-only data, a dispatcher guard blocks write commands for non-owner sessions, and the client shell renders a scoped view without write actions. The SystemSwitcher component functions as a lobby for visitor sessions, routing viewers into the correct module context.

v3.0 Systems Used

• Cloudflare Workers + Durable Objects. Per-user UserWorkspaceDO instances as the canonical web store: isolated SQLite, TS migration runner, and full dispatcher execution per user. Worker routing via Hono with per-route middleware for rate limiting, CORS, and CF Access validation.
• MCP Capability-Tier Policy. Prefix-rule classification of all 352 dispatcher commands into seven tiers. Hard block at the Worker for destructive and none tiers. Per-tier response budgets (8K light, 16K heavy, 12K search, 1K writes) with paginate-hint truncation footers. Snapshot-tested capability table in CI via mcpPolicy.test.ts.
• OAuth PKCE + CF Access SaaS Integration. Remote MCP transport uses an OAuth authorization server façade backed by CF Access SaaS app validation. Upstream PKCE flow via CF Access authorize endpoint; code-exchange handled in the Worker; tokens never stored client-side. ChatGPT Connector registration verified against the resulting 62-tool surface.
• Homebrew Binary Distribution. Custom tap at NocturnalProgress/homebrew-crucible with a GitHub Actions pipeline building aarch64 and x86_64 macOS binaries on mcp-v* tags. Formula rewrites via a custom Python step handling the multi-arch on_arm and on_intel formula shape that off-the-shelf bump actions do not support.
• TS Dispatcher + StorageAdapter. 352 commands registered across 33 handler modules. DesktopStorageAdapter (Tauri db_* IPC) and DOStorageAdapter (ctx.storage.sql) share a common interface so service code is platform-agnostic. BlockService.createModuleItem() wraps block creation with property writes, FTS5 indexing, and event emission in a single transaction.
• XYFlow + Dagre. What-If scenario planner uses XYFlow for the interactive graph canvas with dagre-powered auto-layout replacing manual positioning. Node types cover decisions, outcomes, adjustments, and phases; edges carry directional weight labels.
• Recharts + D3-Sankey. Finance Hub data visualization: sparklines in Budget Insights, category flow diagrams in the Sankey view, and trend charts across the 9 Finance sub-views.
• Open-Meteo + NHC + NWS Pipeline. Weather module fetches from Open-Meteo (forecast, air quality, minutely), NWS (alerts), RainViewer (radar), and NHC (hurricanes via a Worker proxy for CORS bypass). Three-layer protection: property-backed DB cache per location, in-memory per-URL throttle, and Cloudflare Worker Cache API on the NHC proxy.

v3.0 Impact Results

• Shipped Crucible to production at crucible.belmonthomestead.com, evolving a local-only Tauri desktop app into a cloud-native platform backed by Cloudflare Workers, per-user Durable Objects, and a TypeScript dispatcher shared with the desktop client
• Ported 12,818 rows from the encrypted local desktop vault into production Durable Objects on the first migration with zero data loss, validating the StorageAdapter abstraction across both local and remote SQLite runtimes
• Wired 352 commands across 33 modules through the TS dispatcher in a single cutover, eliminating the Rust business-logic surface and making the full feature set available on both desktop and web with a shared code path
• Published crucible-mcp via a Homebrew tap with a GitHub Actions multi-arch build pipeline, enabling one-command installation of the MCP stdio proxy on Apple Silicon and Intel Macs
• Registered Crucible as a ChatGPT Connector with 62 tools via remote Streamable-HTTP MCP at mcp.belmonthomestead.com/sse, with full OAuth PKCE and a capability-tier policy blocking all destructive operations from AI clients
• Launched Budget Insights in Finance Hub: analyzes trailing 12-month transaction history, maps free-text categories to an 11-way canonical taxonomy, surfaces monthly and yearly budget recommendations with confidence tiers, and provides an adopt flow that diffs recommendations against existing budgets before writing
• Deployed UI compliance enforcement via lint, replacing reviewer-enforced conventions: every module leaf now mounts in ModuleLayout, core cannot import from modules, and shared UI components are enforced over bespoke reimplementations
• Cut v0.6.0 release (2026-04-23) covering the UI compliance audit, MCP Phase 3 cleanup, Weather Carrot-parity rework, system module web restoration, and Shopping module UX rework

v3.0 Deep Dive

Cloud Architecture and Durable Objects. The web pivot replaced D1 as the canonical data store with per-user UserWorkspaceDO Durable Objects. Each signed-in user gets an isolated DO instance that runs the TS dispatcher, migration runner, and full service layer against its own SQLite database. The migration runner checks a migrations meta-table on every cold start and applies any unapplied SQL files in order, so schema evolution is per-user and requires no coordinated migration window. The DO writes a structured one-line log per invocation covering command name, user ID, duration, outcome, and error code, enabling per-user and per-command observability via Cloudflare Logs without a separate analytics pipeline.

Dispatcher Portability. The same tryLocalDispatch(cmd, args) function runs on both runtimes. On desktop, invoke falls through to Tauri IPC for native-only commands (vault, keychain, filesystem dialogs, Sentinel sidecar) and routes through the TS dispatcher for everything else. On web, the client posts to POST /api/invoke and never calls Tauri at all. The StorageAdapter interface defines the SQL surface (query, exec, transaction); DesktopStorageAdapter calls Tauri's db_* commands via IPC, and DOStorageAdapter calls ctx.storage.sql synchronously inside the DO. Service classes receive a StorageAdapter instance at construction time and contain no if (isTauri) branches.

MCP Capability Gate. The capability-tier policy in mcpPolicy.ts uses a prefix-rule convention to classify commands without per-command annotations: delete_*, purge_*, and wipe_* map to destructive; get_* maps to read_light; list_* maps to read_heavy; and so on. The Worker enforces the gate on every MCP request and returns a 403 for destructive and none-classified commands before the DO is invoked. A snapshot test locks the capability table so any reclassification is visible in the diff. Per-tier response budgets prevent oversized tool responses from consuming excessive tokens in downstream LLM calls. A bytes-only D1 audit log records tool calls without capturing argument content, since search queries and contact lookups can carry PII.

Data Migration. The desktop vault (12,818 rows across the block, property, and relation schema) was exported via the Tauri db_* IPC bridge and re-imported via the DO's SQL surface using the same migration schema as the TS migration runner. Three edge cases required manual resolution: block IDs with clock-skew (ULIDs from two separate machines), property rows with orphaned parent IDs from deleted blocks, and search index rows that needed regeneration via FTS5 insert into block_search after the data load. Row counts were validated across all tables before and after to confirm zero data loss.

---

v2.0: The Forge

v2.0 Highlights

• Architected a registry-driven UI system with 7 extension point types and a Phase 2 service kernel featuring an EventBus with stats tracking, 5 kernel-level services, and a tiered module lifecycle, enabling 28 modules to compose into a unified workspace with zero switch statements in the shell
• Unified separate Projects and Knowledge Base systems into a single Entity primitive with templates, feature flags, tags, and multi-version support, reducing codebase complexity by consolidating two parallel data models
• Built a Career Platform comprising a CV Builder with ATS optimization and DOCX export, a Job Application Tracker with 10-status kanban pipeline, a Skills module with 64 seeded entries and tier/category classification, and a Presentations system with multi-entity relation linking
• Developed an MCP server as a Rust stdio binary exposing 89 tools for programmatic entity creation, search, tagging, section management, version control, finance tracking, travel, inventory, and skill contexts
• Engineered a standardized API surface with structured BelmontApiError (code, severity, actionable fields), typed input structs, shared ModuleItemResponse types, and a createModuleStore factory, migrating 140+ files to a centralized invoke layer
• Designed and implemented the Foundry design system with a three-accent palette (brass, teal, orange), HUD bracket decorations, clip-path headers, and a cohesive tactical aesthetic across 28 frontend modules
• Built the Horizon multi-system connectivity module with OAuth2 PKCE Entra ID integration, cross-system bridge detection, and a shared galaxy-renderer powering both the Graph View's sector layout and Horizon's multi-system canvas with Tone.js audio

v2.0 Quick Highlights

• Unified Entity system replacing separate Projects and KB Spaces with a single primitive supporting templates, tags, versions, and feature flags
• Registry-driven UI with 7 extension point types enabling pure composition and zero hardcoded view routing across 28 modules
• Phase 2 Kernel: service layer with EventBus, 5 kernel services (Activity, Neighborhood, Cross-References, Graph Health, Template Registry), System View diagnostics, tiered module lifecycle
• Career Platform: CV Builder, Job Tracker (10 statuses, kanban + table), Skills (64 entries, tier/category), Presentations (multi-entity linking)
• MCP server with 89 tools for AI-assisted entity creation, search, finance tracking, travel, inventory, and portfolio management
• Horizon multi-system connectivity: galaxy view with shell takeover, system switching, bridge detection, Entra ID OAuth2 PKCE contact sync
• Shared galaxy-renderer powering both Graph View (sector-based domain layout) and Horizon (multi-system canvas) with Tone.js audio
• Standardized API Surface: structured BelmontApiError, typed inputs, createModuleStore factory, searchable developer view with 21 error codes
• Foundry design system with three-accent palette, HUD brackets, clip-path headers, and tactical aesthetic
• Finance module with subscription tracking (11 categories, price history) and billing account management
• Travel module with interactive Leaflet maps, destination tracking, itinerary/expenses/bookings/packing/journal tabs
• 28 frontend modules with unified ModuleHeader toolbar, consistent create dialogs, and clearance-based data hiding

v2.0 Overview

BelmontOS v2 is a registry-driven desktop platform where 28 modules compose into a unified workspace through 7 extension point types and zero hardcoded routing. A unified Entity primitive replaced separate Projects and Knowledge Base systems, providing a single data model with templates, feature flags, tags, and multi-version tracking. The Phase 2 service kernel powers the system with an EventBus, 5 kernel-level services (Activity, Neighborhood, Cross-References, Graph Health, Template Registry), a System View for real-time diagnostics, and a tiered module lifecycle (T0 through T3).

The platform spans three capability domains. Career management includes a CV Builder with ATS optimization and DOCX export, a Job Application Tracker with 10-status kanban, a Skills module with 64 seeded entries, and a Presentations system with multi-entity linking. Personal operations cover finance tracking (subscriptions with price history, billing accounts), travel with interactive Leaflet maps and destination management, inventory tracking, and contacts with Entra ID sync via OAuth2 PKCE. System connectivity is handled by the Horizon module, a multi-system galaxy view with shell takeover, system switching, and cross-system bridge detection, powered by a shared galaxy-renderer that also drives the Graph View's sector-based domain layout with Tone.js audio.

An MCP server exposes 89 tools for AI-assisted entity management, and a Career API serves published portfolio data over HTTP. The entire frontend API surface is standardized with structured errors, typed inputs, and a Zustand store factory, covering 140+ migrated files.

v2.0 Role Summary

• Sole developer, architect, and designer across all system layers. Designed and implemented the unified entity migration that merged Projects and KB Spaces into a single data model with backward compatibility. Built the view registry system with 7 extension point types, enabling 28 modules to register views, block renderers, sidebar entries, and shell chrome overrides without modifying core code. Engineered the Phase 2 service kernel: an EventBus with stats tracking and handler pattern registration, 5 kernel-level services (Activity, Neighborhood, Cross-References, Graph Health, Template Registry), a System View providing real-time diagnostics, and a tiered module lifecycle (T0 through T3). Developed the full career platform: CV Builder with dual resume/portfolio modes, split section editor, and DOCX export; Job Application Tracker with kanban pipeline, Notion CSV import, and salary tracking; Skills module with seeded data, tier classification, and CV category grouping; Presentations system with multi-entity featured_in relations. Built the Horizon multi-system connectivity module with shell takeover, system switching, and cross-system bridge detection, integrating Entra ID via OAuth2 PKCE for Microsoft Graph user-to-contact sync. Created a shared galaxy-renderer module powering both the Graph View's sector-based domain layout and Horizon's multi-system canvas with Tone.js audio feedback. Developed the Travel module with interactive Leaflet maps, destination management, and 6 content tabs. Created the MCP server as a Rust stdio binary with 89 tools. Standardized the frontend API surface: structured BelmontApiError with code/severity/actionable fields, typed input structs, shared ModuleItemResponse types, a createModuleStore Zustand factory, and a searchable developer view. Migrated 140+ files from raw Tauri invoke calls to the centralized API layer. Built the Finance module with subscription tracking and billing account management. Led the Foundry design system overhaul and UX standards audit, enforcing 11px font floors, WCAG AA contrast ratios, M3 easing tokens, and a 100-step z-index scale.

v2.0 Technical Breakdown

Unified Entity System: The migration merged project and kb_space block types into a single entity type with a template property (project, knowledge-base, service-admin, blank) and feature flags (tasks, docs, tags, kanban, sections). Backward-compatible routing detects legacy block types and redirects to the entity detail view. Tags are stored as JSON arrays on entity blocks and indexed in Tantivy for faceted search. Version support uses project_version child blocks with an is_active flag; version-specific fields (subtitle, tech_stack, roles, platforms, systems_used) are stored on the version block and merged at read time.

View Registry Architecture: The viewRegistry.ts module provides a central registry with 7 extension point types: SpecialView (custom pages like Home, Trash, Settings), BlockTypeView (renderers for entity, task, daily-note block types), SidebarEntry (module sidebar items), ShellChrome (shell overrides for modes like Sentinel and Horizon), EntityTab (tabs on entity detail pages), EntityHeaderExtension (header components), and ActivityItem (activity bar entries). Modules push registrations via register.ts files during bootstrap.ts initialization. The shell resolves views by lookup, never by switch statement, achieving full dependency inversion across 28 modules.

Phase 2 Service Kernel: The kernel introduces a service layer with an EventBus that tracks total_emitted events, handler_count, per-type event histograms, and a circular buffer of recent events. Handlers register via pattern-based subscriptions. Five kernel-level services provide wiki infrastructure: Activity (EventBus event persistence to the events table), Neighborhood (BFS subgraph traversal for related content), Cross-References (unlinked mention detection across pages), Graph Health (orphan detection, dead link identification, cluster analysis), and Template Registry (module extension template management). The System View (__system__) provides a multi-tab diagnostic interface: Identity, Modules (with tier, category, active status), Event Bus (stats, histogram, handler patterns, recent event log), Database (block/property/relation counts, file size, encryption mode, WAL status), and Search (indexed document count, engine info). Module tiers (T0 through T3) classify lifecycle priority. The System View auto-refreshes every 10 seconds.

Standardized API Surface: The frontend API layer centers on client.ts, a typed invoke<T>() wrapper that converts Tauri IPC errors into BelmontApiError instances with code, severity (info, warning, error, critical), and actionable fields. On the Rust side, Create*Input and Update*Input structs with #[derive(Deserialize)] replace loose parameter lists. Shared response types (ModuleItemResponse, ModuleChildResponse) replaced 9+ duplicated interfaces across modules. Type helpers (getProp, getNumProp, getJsonProp, getTitle) consolidate property access. Per-module API files (finance.ts, contacts.ts, travel.ts, etc.) export typed CRUD objects. The createModuleStore factory generates Zustand stores with fetch, create, update, remove actions and optional sorting. A createDetailStore variant handles parent-child hierarchies. The API Surface developer view (__api_surface__) provides a searchable catalog of all Tauri commands with module grouping, parameter documentation, and an error code reference (21 documented codes).

Shared Galaxy Renderer: A unified canvas module (galaxy-renderer) powers both the Graph View and Horizon with a common rendering pipeline. The renderer provides GalaxyCanvas as its core component, with composable layers for node rendering (sun, planet, entity, orphan types), link rendering with animated pulses, and visual effects (coronas, glow, orbit rings). Sector-based layout allocates proportional angular wedges per domain (minimum 22.5 degrees). Concentric orbit rings position nodes by type: central sun at origin, domain planets at 200px, entities between 280px and 340px, orphans at 420px. A custom d3 force (forceSectorPull) applies angular and radial corrections per tick. Node radius scales with link count (0.6x + 3px minimum). Tone.js provides ambient audio feedback for interactions: node selection triggers tonal pads, system transitions play sweep effects.

Horizon Module: The Horizon multi-system view (__horizon__) renders multiple BelmontOS instances as galaxy systems on a shared canvas. Each system appears as a cluster of nodes with its own entity count, domain count, and bridge connections to other systems. The module uses ShellChrome registration for full shell takeover with dedicated breadcrumbs, sidebar, status bar, and title bar extension. A system switcher panel lists available systems (personal, partner, household, group) with connection status and snapshot metadata. Systems are built from contact data, with Entra ID-synced contacts providing organizational system definitions. Bridge edges visualize shared entities between systems. The view supports pan, zoom, and click-to-focus interactions via the shared galaxy-renderer.

Entra ID Integration: OAuth2 PKCE authentication flow against Microsoft Entra ID (Azure AD) enables user sign-in and Microsoft Graph API access. The implementation uses the authorization code flow with PKCE challenge/verifier pairs, handling the redirect callback via Tauri's deep link capability. Once authenticated, the system queries the Graph API /users endpoint to fetch organizational contacts, mapping Graph user fields (displayName, mail, jobTitle, department, officeLocation) to BelmontOS contact block properties. A periodic background sync refreshes contact data on a configurable interval. Synced fields are locked in the UI with visual indicators showing the data source, preventing accidental manual overwrites of authoritative directory data.

Graph View: The rewritten graph uses the shared galaxy-renderer with sector-based domain layout. Proportional arc allocation gives each domain an angular wedge sized by entity count (minimum 22.5 degrees). The custom d3 force function (forceSectorPull) applies per-tick corrections with tighter constraints (0.06 strength) on focused entities and weaker pull (0.015) on unfocused ones. Rendering uses radial gradient coronas for the sun, small planet bodies with rings for domains, and circle nodes with multi-color domain segment rings for cross-domain entities. Synthetic domains represent module-specific blocks (trips appear in a Travel sector). Domain-to-entity connector lines provide visual grouping.

Travel Module: Trip management uses trip blocks with properties for title, status (planning, upcoming, active, completed, cancelled), dates, budget, and currency. Each trip supports child blocks for destinations (city, state, country, dates, type), itinerary days, expenses (amount, currency, category, payment method), bookings (confirmation numbers, URLs), packing items (checked/unchecked), and journal entries. The TravelView renders tabs for All Trips, Upcoming, Past, Planning, and Map. The Map tab uses Leaflet to plot all destination coordinates on an interactive tile map with trip-colored markers and popup details. The TripPage provides 6 content tabs: Destinations, Itinerary, Expenses, Bookings, Packing, and Journal. Six MCP tools handle trip CRUD and destination management.

Inventory Module: Inventory tracking uses inventory_item blocks with 14 properties covering identity (name, category, group), purchase info (date, price, status), valuation (current value, insurance value), physical details (condition, location, serial number), and metadata (warranty expiry, URL, notes). Categories span electronics, furniture, appliances, tools, jewelry, clothing, collectibles, sports, musical, and other. The view provides category tab filtering, name search, and a create dialog. Five MCP tools support full CRUD operations.

CV Builder: Dual-mode builder supporting Resume (ATS-optimized, bullet-focused) and Portfolio (rich detail) output. The CVBuilderView component renders a tabbed interface with Projects, Skills, Presentations, and Profile sections. Each project entity's cv-bullets section provides STAR-format achievement bullets. A featured property on entities serves as the publish gate: only featured entities appear in the CV Builder and the Career API. DOCX export uses the docx library to generate formatted Word documents with proper heading hierarchy and bullet formatting.

Job Application Tracker: Built on the block model with job_application block type and properties for company, title, status, salary range, dates, and work type. The JobTrackerView component renders both kanban (drag-and-drop columns by status) and table views. Ten statuses track the full pipeline: Considering, To-Do, Applied, Screening, Interviewing, Offer, Accepted, No Response, Rejected, Withdrawn. Includes Notion CSV import for migrating existing job tracking data.

Skills Module: Uses skill_context blocks with JSON properties for tier (foundational, proficient, advanced, expert) and categories (languages, frameworks, tools, platforms, concepts, databases, cloud, design, testing, devops). A seed migration inserts 64 common skills across all categories. The SkillsView component groups skills by category with toggle controls and 160-character context entries. The CV Builder groups skills by category with tier badges for resume output.

Finance Module: Subscription tracking uses subscription blocks with properties for name, status (active, trial, paused, cancelled, expired), billing cycle (monthly, annual, quarterly, weekly), category (11 options), tier, amount, currency, payment method (10 options), and price history (JSON array of date/tier/amount entries). Billing accounts use billing_account blocks with account type, institution, last four digits, expiration, full billing address, and status. Subscriptions link to billing accounts for spend rollup. The UI provides modal edit dialogs, trial countdown indicators (color-coded by urgency), external URL launch, and category-colored badges.

KB Page Enhancements: Knowledge base pages gained a wiki-style Content tab with a TOCSidebar component that generates a table of contents from page headings, enabling in-page navigation. Category-based grouping, tag-based filtering with quick-select buttons, and a sortable document list with drag-to-reorder are available. Markdown import allows bulk content ingestion from external sources. A page status tracking system monitors draft, review, and published states.

MCP Server: A Rust stdio binary implementing the Model Context Protocol with 89 tools organized by domain: entity CRUD, project operations (versions, sections), search and tagging, page management, relations, properties, tasks, domains, job applications, presentations, skill contexts, subscriptions, billing accounts, inventory items, and trips with destinations. Used for AI-assisted entity creation, portfolio population, and data management.

Foundry Design System: Three-accent palette system using brass (warm gold), teal (information/links), and orange (warnings/actions). HUD bracket decorations frame key UI elements. Clip-path headers create angular, tactical silhouettes. The ModuleHeader component provides a consistent 2-row toolbar across all modules. ModuleLayout wraps module content with standardized padding and scroll behavior. Unified create dialogs use @radix-ui/react-dialog with consistent form layouts. RedactedText provides clearance-based data hiding across 6 modules for demonstration purposes. A UX standards audit enforced 11px font floors, WCAG AA contrast ratios, M3 easing tokens, asymmetric exit animations, and a 100-step z-index scale.

v2.0 Systems Used

• Unified Entity System: Merged Projects and KB Spaces into a single entity primitive with templates, tags, feature flags, and version support
• View Registry: Central registry for special views, block type renderers, sidebar entries, shell chrome overrides, entity tabs, and activity items enabling pure composition across 28 modules
• Phase 2 Kernel: Service layer with EventBus (stats, handler patterns, scheduler), 5 kernel services (Activity, Neighborhood, Cross-References, Graph Health, Template Registry), System View diagnostics, tiered module lifecycle (T0 through T3)
• MCP Server: Rust stdio binary implementing Model Context Protocol with 89 tools for programmatic entity creation, search, tagging, travel, inventory, finance, and section management
• Standardized API Surface: BelmontApiError with code/severity/actionable fields, typed input structs, ModuleItemResponse shared types, createModuleStore factory, and developer view
• Shared Galaxy Renderer: Unified canvas module powering Graph View and Horizon with sector layout, node/link rendering, effects pipeline, and Tone.js audio feedback
• Horizon Module: Multi-system galaxy view with shell takeover, system switching, bridge detection, and cross-system entity browsing
• Entra ID Integration: OAuth2 PKCE authentication with Microsoft Graph API user-to-contact sync, periodic background refresh, and field locking
• CV Builder: Dual-mode resume and portfolio builder with ATS optimization, section editor, featured flag publishing gate, and DOCX export
• Job Application Tracker: Kanban and table view pipeline with 10 statuses, salary tracking, deadline management, and Notion CSV import
• Skills Module: Skill tracking with tier/category classification, 160-character context entries, 64 seeded skills, and CV category grouping
• Foundry Design System: Three-accent palette system (brass, teal, orange) with HUD bracket decorations, clip-path headers, WCAG AA contrast, and tactical Division 2 aesthetic
• Career API: Axum HTTP endpoints serving published portfolio data including projects, skills, presentations, and profile for external consumption
• Finance Module: Subscription tracking with 11 categories, price history, and billing accounts with address tracking, institution linking, and spend rollup
• Travel Module: Trip management with interactive Leaflet maps, destination tracking, itinerary/expenses/bookings/packing/journal tabs, and 6 MCP tools
• Inventory Module: Asset tracking with 14 properties, 10 categories, purchase history, warranty tracking, and 5 MCP tools
• Graph View: Sector-based domain layout via shared galaxy-renderer with force-directed simulation, concentric orbit rings, multi-color domain segments, synthetic domains, and search
• Presentation System: CV presentations with multi-entity featured_in relation linking, featured/pinned toggles, and co-presenter support
• Block Data Model: Universal primitive with UUID v7 IDs, block_type, parent_id, content, typed properties, and relations
• Theme Engine: Multi-layered theming with 4 style themes, 10+ color palettes, per-theme hover effects, animations, and typography
• SQLCipher Encryption: Database-level encryption with Argon2id key derivation and OS keychain storage

v2.0 Impact Results

• Consolidated two parallel data models (Projects + KB Spaces) into a single unified entity system, reducing code duplication and simplifying the data layer
• Expanded from 9 to 28 frontend modules, covering career management, finance, travel, contacts, inventory, culinary, maintenance, multi-system connectivity, and more
• Built an MCP server with 89 tools enabling AI-assisted entity creation, reducing manual portfolio population from hours to minutes per project
• Achieved full registry-driven UI composition with zero switch statements in the shell, making new module integration a single registration call
• Standardized the entire frontend API surface with structured errors, typed inputs, and a store factory, migrating 140+ files to a centralized invoke layer
• Unified Graph View and Horizon into a shared galaxy-renderer module, eliminating rendering code duplication and enabling multi-system visualization
• Integrated Entra ID via OAuth2 PKCE for automated contact sync from Microsoft 365 organizational directories
• Resolved 25+ hardcoded color violations and 60+ style inconsistencies during the Foundry design system audit, plus enforced WCAG AA contrast and 11px font floors
• 105 commits over 20 days of active development, delivering a feature-complete personal OS alpha with 89 MCP tools and 21 block types

v2.0 Deep Dive

Entity Unification Migration: The migration from separate project and kb_space block types to a unified entity type required a multi-phase approach. Phase 0 added the entity block type, template property, and feature flags while keeping backward-compatible routing. Phase 1 indexed tags in Tantivy. Phase 2 built the unified entity browser and detail UI. Phase 3 expanded the MCP server with entity-aware tools. Phase 5 removed legacy project/KB references. The key design decision was using feature flags (tasks, docs, tags, kanban, sections) on entity blocks rather than rigid templates, allowing entities to gradually adopt capabilities without forced schema migration.

Version System Design: Entity versions are project_version child blocks with an is_active boolean. Version-specific fields (subtitle, tech_stack, roles, platforms, systems_used) live on the version block, while shared fields (title, org, status, featured, start_date) live on the entity. The get_project API merges active version fields into the response. Each version owns its own set of project_section child blocks (cv-bullets, overview, technical-breakdown, etc.), created via create_project_version which can optionally copy sections from an existing version. The set_active_version command deactivates all other versions atomically.

Registry Architecture Deep Dive: The view registry (viewRegistry.ts) stores registrations in typed Map objects keyed by string identifiers. SpecialView entries map IDs like __home__ to React components. BlockTypeView entries map block type strings to renderers. ShellChrome entries provide full shell override components (TitleBar, Sidebar, StatusBar) for modes like Sentinel and Horizon. The bootstrap.ts file imports all module register.ts files, which push registrations at app startup. The Shell component resolves the active view by checking special view IDs first, then falling back to block type lookup, then to the default page editor. This eliminates all conditional rendering logic from the shell.

Phase 2 Kernel Architecture: The service kernel was built to provide observability and lifecycle management without coupling modules to each other. The EventBus tracks four key metrics: total_emitted (cumulative event count), handler_count (registered listeners), events_per_type (histogram by event type), and recent_events (circular buffer with ID, type, and timestamp). Handlers register with pattern-based subscriptions, stored as HandlerInfo records. Five kernel-level services extend this foundation: the Activity service persists EventBus events to a dedicated events table for historical queries; Neighborhood performs BFS subgraph traversal to surface related content within N hops; Cross-References scans page content for unlinked mentions of entity titles; Graph Health detects orphan blocks, dead links, and disconnected clusters; and Template Registry manages module extension templates for entity creation. The System View renders five diagnostic tabs (Identity, Modules, Event Bus, Database, Search), each pulling real-time data from Tauri IPC commands. Module tiers (T0: core, T1: essential, T2: standard, T3: optional) classify startup priority and dependency ordering. The view auto-refreshes every 10 seconds via interval-based polling.

API Surface Standardization: The standardization effort addressed a key maintenance issue: 140+ frontend files were making raw @tauri-apps/api/core invoke calls with inconsistent error handling. The solution introduced three layers. First, client.ts provides a single typed invoke<T>() function that parses Tauri IPC errors into BelmontApiError instances. Second, per-module API files (finance.ts, contacts.ts, travel.ts, etc.) export typed CRUD objects that call invoke with correct command names and parameters. Third, createModuleStore generates Zustand stores from an API object, providing fetch, create, update, and remove actions with automatic state management. On the Rust side, Create*Input and Update*Input structs replaced loose parameter lists, and helpers::to_ipc_error serializes errors with structured code, severity, and actionable fields. The developer view (__api_surface__) catalogs all commands with descriptions, parameters, and an error code reference covering 21 documented error conditions.

Shared Galaxy Renderer Architecture: The galaxy-renderer module was extracted from the Graph View to provide a reusable canvas for any galaxy-style visualization. The core component, GalaxyCanvas, accepts a typed graph data structure (nodes with type, position, domain affiliation; links with source, target, type) and renders through composable layers. The node renderer dispatches by type: sun nodes get radial gradient coronas with glow effects, planet nodes get bodies with decorative orbital rings, entity nodes get circles with multi-color domain segment arcs, and orphan nodes get dimmed circles at the outer orbit. The link renderer draws edges with animated pulse effects along the path. Sector layout logic allocates proportional angular wedges per domain (minimum 22.5 degrees), with concentric orbit rings at fixed radii (200px planets, 280-340px entities, 420px orphans). A custom d3 force function (forceSectorPull) applies per-tick angular and radial corrections. Tone.js integration provides ambient audio feedback: node selection triggers pitched tonal pads, system transitions play frequency sweep effects, and ambient drone loops set the spatial mood. The renderer exports shared types (GalaxyNode, GalaxyLink, GalaxyConfig) consumed by both Graph View and Horizon.

Horizon Module Architecture: Horizon (__horizon__) renders a multi-system galaxy canvas where each BelmontOS instance appears as a distinct system cluster. The module registers a ShellChrome override providing dedicated breadcrumbs, a sidebar with system list and connection controls, a status bar showing active system metrics, and a title bar extension with system switching. Systems are defined as HorizonSystem objects containing an ID, label, type (personal, partner, household, group), connection status, and a snapshot of entity/domain counts. The primary system loads real graph data from the local database; secondary systems are built from contact data, with Entra ID-synced contacts providing organizational graph definitions. Bridge edges connect shared entities across systems, visualized as cross-cluster links on the canvas. The GalaxyView component within Horizon feeds system graph data into the shared GalaxyCanvas, with per-system color theming and separate sector calculations. Pan, zoom, and click-to-focus interactions work across the unified canvas.

Entra ID Integration Architecture: The Entra ID integration implements the OAuth2 Authorization Code flow with PKCE (Proof Key for Code Exchange) for secure desktop authentication. The flow begins with generating a cryptographic code verifier and its SHA-256 challenge. The authorization URL targets the Microsoft identity platform's /authorize endpoint with the User.Read and User.ReadBasic.All scopes. Tauri's shell plugin opens the system browser for user consent. The redirect callback (a custom protocol URI) captures the authorization code, which is exchanged for access and refresh tokens via the /token endpoint. Token storage uses the OS keychain via the keyring crate. Once authenticated, a background task queries the Microsoft Graph /users endpoint, mapping each directory user to a BelmontOS contact block. Field mapping covers displayName to title, mail to email, jobTitle, department, and officeLocation to corresponding contact properties. A sync_source: "entra" property marks synced contacts, and the UI renders locked field indicators with a cloud badge showing the data origin. Periodic background sync runs on a configurable interval, updating existing contacts by matching on email address and creating new ones for directory additions.

Graph View Solar System Design: The rewritten Graph View consumes the shared galaxy-renderer, feeding it domain and entity data from the local database. Synthetic domains extend the graph for module-specific blocks: trips appear in a Travel sector (cyan), and other module blocks get domain-colored groupings. Domain-to-entity connector lines provide visual hierarchy within sectors. The custom d3 force function (forceSectorPull) applies per-tick corrections: angular pull toward the sector midpoint and radial pull toward the target orbit ring. Force strength varies by focus state (0.06 for focused sector members, 0.015 for unfocused). Node size scales with link count (0.6x + 3px minimum). The sun node renders with a radial gradient corona, glow effect, and core circle. Domain nodes show as planet bodies with decorative rings. Entity nodes display multi-color segment rings when they belong to multiple domains, with each segment proportional to the domain's ring color.

Travel Module Architecture: The travel module uses trip blocks as the parent container, with child blocks for each sub-feature. Destination blocks store city, state, country, arrival/departure dates, destination type (hotel, beach house, Airbnb, campground, resort, family home, rental home, cabin, other), and notes. The TravelView top-level component provides 5 filter tabs (All Trips, Upcoming, Past, Planning, Map) backed by status and date filtering logic. The Map tab initializes a Leaflet tile map instance, geocodes all destination cities, and plots them as markers with trip-colored icons; clicking a marker shows a popup with trip name, dates, and destination details. The TripPage detail view renders 6 content tabs: Destinations (a section for adding/editing destination entries), Itinerary (day-by-day planning), Expenses (amount, currency, category, payment method with running totals), Bookings (confirmation numbers, provider URLs, dates), Packing (checklist with checked/unchecked state), and Journal (free-form travel notes). Trip metadata displays status badge, date range, budget with currency, and destination count. Six MCP tools handle the full lifecycle: create_trip, list_trips, get_trip, update_trip, delete_trip, and add_trip_destination.

Inventory Module Architecture: The inventory module uses inventory_item blocks with 14 typed properties. Items are organized by category (electronics, furniture, appliances, tools, jewelry, clothing, collectibles, sports, musical, other) and optionally grouped (e.g., "PC Build", "Kitchen"). Purchase tracking records date, price, and status (purchased, wishlist, ordered, returned). Valuation fields track current estimated value and insurance replacement value separately. Physical metadata includes condition (new, excellent, good, fair, poor), location (home, office, storage, vehicle), serial number, warranty expiry date, and a product URL. The frontend view provides category tab filtering, a name search input, and a create dialog for new items. Five MCP tools (list, get, create, update, delete) enable AI-assisted inventory management.

Finance Module Architecture: The Finance module uses the block model with two block types. subscription blocks carry 14 properties covering identity (name, URL), billing (amount, currency, cycle, payment method, billing account link), status (active, trial, paused, cancelled, expired), and metadata (category, tier, start/end dates, notes). A history JSON property stores an array of price change entries ({date, tier, amount, notes}) for tracking rate changes over time. billing_account blocks carry account type, institution, last four digits, expiration, full billing address (street, city, state, ZIP, country), and status. Subscriptions link to billing accounts via a billing_account_id property, enabling spend aggregation per account. The UI uses modal edit dialogs (consistent with the project-wide preference), trial countdown indicators with urgency coloring (red under 3 days, yellow under 7), and category-colored status badges.

MCP Server Architecture: The MCP server is a separate Rust binary (bos-server) that communicates via stdio using the Model Context Protocol. Each of the 89 tools is a function that opens a direct SQLite connection to the BelmontOS database file. Tools are organized by domain: entity lifecycle, project operations (versions, sections), search and discovery, page content, relations, properties, tasks, domains, job applications, presentations, skill contexts, subscriptions, billing accounts, inventory items, and trips with destinations. The server uses serde_json for request/response serialization and returns structured results with IDs for follow-up operations.

CV Builder Implementation: The CVBuilderView renders a tabbed interface. The Projects tab lists all entities with featured: true, showing each project's cv-bullets section content. The Skills tab groups skill_context blocks by category with tier badges. The Presentations tab lists cv_presentation blocks with pinned entries at the top. The Profile tab displays user profile data (name, title, summary, links). DOCX export traverses this structure to generate a formatted Word document using the docx library with proper heading levels, bullet formatting, and section breaks. The featured property on entities and the pinned property on presentations serve as publish gates, determining what appears in the CV and the Career API.

Career API: An Axum HTTP server exposes /api/portfolio/published which queries all featured entities, merges active version data (including section content), and returns a JSON payload suitable for external portfolio sites. The section flattening logic handles both versioned and unversioned entities, resolving section content from version-specific project_section blocks. Additional endpoints serve skills, presentations, and profile data. This API powers the PortfolioOS site generation pipeline.

Foundry Design System: The design audit identified 25+ instances of hardcoded colors, inconsistent spacing, and style violations. The fix involved extracting all colors to CSS custom properties organized in the three-accent system: brass (--accent-primary) for primary actions, teal (--accent-secondary) for information and links, orange (--accent-tertiary) for warnings and destructive actions. Chrome was reduced: breadcrumbs merged into the tab bar, the StatusBar was simplified, header height was reduced. Stat cards were redesigned with consistent sizing. ModuleHeader provides a standard 2-row toolbar (title + actions on row 1, filters + view toggles on row 2). ModuleLayout wraps content with standardized padding and scroll behavior. RedactedText applies a clearance-based blur effect across 6 modules for demonstration and privacy purposes. A subsequent UX standards audit enforced 11px font floors, WCAG AA contrast ratios, M3 easing tokens (standard, emphasized, emphasized-decelerate, emphasized-accelerate), asymmetric exit animations, and a 100-step z-index scale (100 dropdowns, 200 sticky, 300 overlays, 400 modals, 500 tooltips, 600 notifications, 900 devtools).

---

v1.0: Ignition

v1.0 Highlights

• Designed and built a local-first desktop operating system using Tauri v2 (Rust + React 19) with SQLCipher encryption, Tantivy full-text search, and a universal block-based data model
• Engineered a modular architecture with the BelmontModule Rust trait enabling 9 independent feature modules with lifecycle hooks and extension registrations
• Built a rich text editor on TipTap/ProseMirror with custom extensions for WikiLinks, slash commands, drag-and-drop reordering, Mermaid diagrams, and table support
• Implemented 4 game-inspired style themes (Division 2, Cyberpunk 2077, Destiny 2, Watch Dogs 2) with 10 color palettes, per-theme hover effects, and Framer Motion page transitions
• Integrated Argon2id key derivation with OS keychain storage for transparent database encryption across macOS, Windows, and Linux

v1.0 Quick Highlights

• Cross-platform desktop app (macOS, Windows, Linux) with Rust backend and React 19 frontend via Tauri v2
• Universal block primitive with UUID v7 IDs, typed properties, and inter-block relations powering all data
• SQLCipher encryption with Argon2id key derivation and OS keychain integration
• TipTap editor with WikiLinks, slash commands, drag handles, Mermaid diagrams, and table support
• 4 game-inspired style themes with 10 color palettes and per-theme animations
• 9 functional modules with Rust trait-based lifecycle management and extension hooks

v1.0 Overview

BelmontOS is a modular, local-first "life operating system" built as a cross-platform desktop app with Tauri v2. The alpha foundation established the core kernel: a universal block-based data model, TipTap rich text editor, SQLCipher-encrypted database, and Tantivy full-text search. It shipped with 9 functional modules covering project management, task tracking, daily notes, time tracking, knowledge base articles, graph visualization, color palette editing, application settings, and security monitoring. The UI features a Division 2-inspired tactical aesthetic with 4 game-inspired style themes and 10 color palettes, each with unique hover effects and Framer Motion page transitions.

v1.0 Role Summary

• Sole developer, architect, and designer. Designed the entire system architecture from the block data model through the module trait system to the themed UI layer. Built all five Rust crates (bos-core, bos-db, bos-search, bos-crypto, bos-tauri) and the full React frontend. Created custom TipTap editor extensions for WikiLinks, slash commands, and drag-and-drop block reordering. Designed and implemented the multi-theme system with per-theme hover effects, click feedback, typography, and Framer Motion animations. Architected the Sentinel security sidecar as a Python/FastAPI process with its own SQLite database.

v1.0 Technical Breakdown

Block Data Model: Every piece of data in BelmontOS is a Block with a UUID v7 id, block_type discriminator, optional parent_id for hierarchy, content text, and separate Property and Relation tables. This universal primitive powers pages, projects, tasks, daily notes, color palettes, and settings without requiring separate schemas per feature.

Rust Crate Architecture: The backend is organized as a Cargo workspace with five crates. bos-core defines domain models, the BelmontModule trait, event types, and error handling. bos-db wraps rusqlite with SQLCipher for encrypted storage in WAL mode, providing repositories for blocks, properties, and relations plus a migration runner. bos-search integrates Tantivy for full-text indexing with incremental updates on block changes and snippet-highlighted search results. bos-crypto handles Argon2id key derivation, OS keychain storage via the keyring crate, and per-visibility-tier encryption. bos-tauri is the desktop binary that registers all IPC commands and manages application lifecycle.

TipTap Editor: The editor builds on TipTap (ProseMirror) with custom extensions: WikiLink for bidirectional page linking with hover preview, SlashMenu for "/" command insertion, DragHandle for block reordering, BubbleMenu for floating format controls, MermaidNodeView for diagram rendering, and table extensions with resize handles and header styling. Editor saves are debounced at 500ms with an onForceSave bypass for link creation.

Module System: Each module implements the BelmontModule trait with lifecycle hooks (on_init, on_start, on_stop) and extension registrations. The frontend mirrors this with a module store tracking enabled/disabled state and sidebar favoriting. Nine modules shipped: Projects (kanban, dashboard, timeline), Tasks (status, priority, due dates), Daily Notes (auto-created by date), Time Tracking (global timer with entries), Graph View (D3 force-directed), Knowledge Base (spaces and articles), Color Palettes (editor with hex/RGB), Settings (vault, security, appearance), and Sentinel (mock security monitoring).

Theme Engine: Four style themes define CSS custom properties for radii, shadows, glows, fonts, transitions, and clip-paths. Ten color palettes are locked to their parent style. Per-theme hover effects include target lock-on (Division), neon flicker with chromatic aberration (Cyberpunk), bloom breathing (Destiny), and jitter glitch (Watch Dogs). Framer Motion handles page-enter transitions and staggered list animations.

v1.0 Systems Used

• Block Data Model: Universal primitive with UUID v7 IDs, block_type, parent_id, content, typed properties, and relations powering all data in the system
• BelmontModule Trait: Rust trait with lifecycle hooks and extension registrations enabling modular feature composition without direct inter-module dependencies
• TipTap Editor: ProseMirror-based rich text editor with custom extensions for WikiLinks, slash commands, drag handles, and Mermaid diagrams
• Tab Manager: Zustand-persisted tab system with context menus, keyboard navigation, and cross-restart persistence via localStorage
• Command Palette: Cmd+K search interface backed by Tantivy full-text indexing with snippet highlighting
• Theme Engine: Multi-layered theming system with 4 style themes, 10 color palettes, per-theme hover effects, animations, and typography
• SQLCipher Encryption: Database-level encryption with Argon2id key derivation and OS keychain storage for transparent at-rest protection
• Sentinel Sidecar: Python FastAPI process for security monitoring with its own SQLite database, spawned and managed by Tauri

v1.0 Impact Results

• Delivered 9 functional modules in the initial alpha, covering project management, task tracking, daily notes, time tracking, knowledge base, graph visualization, color palettes, settings, and security monitoring
• Shipped 6 alpha releases (0.1.0-alpha.0 through 0.1.0-alpha.6) in a single development sprint, establishing the full core kernel
• Achieved full offline functionality with zero cloud dependencies, all data encrypted at rest via SQLCipher
• Built a rich text editor competitive with commercial tools, supporting tables, columns, WikiLinks, Mermaid diagrams, slash commands, and drag-and-drop reordering

v1.0 Deep Dive

Data Architecture: BelmontOS uses a single SQLite database encrypted via SQLCipher with WAL mode enabled for concurrent read performance. The schema centers on three tables: blocks (universal primitive), properties (key-value pairs on any block with text, number, and date types), and relations (block-to-block links with a relation_type label). This design eliminates the need for module-specific schemas; new features compose entirely through block types and properties. UUID v7 IDs provide sortable, time-ordered identifiers without a central sequence.

Encryption Pipeline: When the user sets a vault password, bos-crypto derives a 256-bit key using Argon2id (memory-hard to resist GPU attacks) and stores it in the OS keychain via the keyring crate (macOS Keychain, Windows Credential Manager, Linux Secret Service). SQLCipher applies AES-256-CBC page-level encryption transparently. The vault can be locked at any time, clearing the in-memory key and requiring re-authentication.

Search Engine: Tantivy provides full-text search with a custom schema indexing block content, titles, and tags. The indexer runs incrementally on block create/update/delete events. The CommandPalette component sends queries through Tauri IPC, receives ranked results with highlighted snippets, and renders them in a cmdk-powered overlay triggered by Cmd+K.

Editor Extensions: The WikiLink extension uses a TipTap Mark with inclusive: false to prevent the mark from extending beyond the link boundary. It parses [[page name]] syntax, resolves to block IDs, and renders a hover preview card via tippy.js. The SlashMenu extension uses TipTap's Suggestion plugin with a unique PluginKey (critical to avoid conflicts with other suggestion plugins) to render a filterable command list. DragHandle adds a grab handle to each top-level block node for visual reordering. MermaidNodeView inserts Mermaid syntax as a fenced code block and renders the diagram in a ProseMirror NodeView.

Module Lifecycle: The BelmontModule trait defines on_init, on_start, and on_stop hooks. Modules are registered in lib.rs and initialized during Tauri setup. On the frontend, each module has a register.ts file that pushes view components, sidebar entries, and block type renderers into a global registry. The moduleStore (Zustand) tracks which modules are enabled and which are favorited for sidebar pinning.

Theme Architecture: Themes operate at two levels: style themes define structural CSS variables (border-radius, shadow style, font family, transition timing, clip-path shapes), while color palettes define the color variables (background, foreground, accent, border). A data-style attribute on the root element switches structural themes, while a data-palette attribute switches colors. Framer Motion's AnimatePresence wraps page transitions with theme-specific enter/exit animations.