Web-first resurrection: UI builds and runs on the WASM Rust core, real CI, docs truth reset

.github/dependabot.yml

@@ -8,3 +8,14 @@ updates:
       actions:
         patterns:
           - "*"
+  # Rust core crate. NOTE: deliberately no entry for /desktop — its path
+  # dependency on an external sibling checkout (../../gossamer) would make
+  # dependabot error.
+  - package-ecosystem: "cargo"
+    directory: "/core"
+    schedule:
+      interval: "weekly"
+    groups:
+      cargo:
+        patterns:
+          - "*"

.github/workflows/README.md

@@ -0,0 +1,33 @@
+<!-- SPDX-License-Identifier: CC-BY-SA-4.0 -->
+# Workflows
+
+## Product CI (required checks)
+
+These build and test the actual product and are self-contained — they run
+anywhere, including forks:
+
+| Workflow | What it verifies |
+|---|---|
+| `rust-ci.yml` | `cargo fmt --check`, `clippy -D warnings`, `cargo test` (unit + golden contract + property tests), wasm32 build + wasm-bindgen |
+| `ui-ci.yml` | ReScript compile under Deno, wasm core build, `deno test` (TEA update tests + golden-fixture contract tests), esbuild bundle, `deno lint` |
+
+The same commands run locally: `just test`, `just build`, `just check`
+(or the underlying `deno task …` / `cargo …` equivalents).
+
+## Estate workflows (expected to no-op or fail outside hyperpolymath)
+
+Everything else in this directory is governance/scanning plumbing tied to
+private or sibling `hyperpolymath` repos (`standards` reusable workflows,
+`hypatia`, `casket-ssg`, `a2ml`/`k9` validate actions, `.git-private-farm`,
+`boj-server`). On forks or in isolated environments they cannot run and are
+**not** indicators of product health:
+
+`boj-build.yml`, `casket-pages.yml`, `dogfood-gate.yml`, `governance.yml`,
+`hypatia-scan.yml`, `instant-sync.yml`, `mirror.yml`,
+`push-email-notify.yml`, `secret-scanner.yml`
+
+`codeql.yml` and `scorecard.yml` are standard GitHub scanning and run
+anywhere.
+
+Branch protection should require `rust-ci` and `ui-ci`; estate workflows
+should stay non-required.

.github/workflows/rust-ci.yml

@@ -0,0 +1,66 @@
+# SPDX-License-Identifier: MPL-2.0
+# Product CI (Rust): the load-bearing build/test workflow for core/.
+# desktop/ is intentionally NOT built here — it needs a sibling checkout of
+# hyperpolymath/gossamer (see desktop/README.md) and is excluded from the
+# workspace in the root Cargo.toml.
+name: rust-ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: rust-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: fmt + clippy + test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Install stable toolchain
+        run: |
+          rustup toolchain install stable --profile minimal --component rustfmt --component clippy
+          rustup default stable
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: |
+            ~/.cargo/registry
+            target
+          key: rust-test-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+      - name: Format check
+        run: cargo fmt --check
+      - name: Clippy (including the wasm feature, compiled for host)
+        run: cargo clippy --all-targets --features wasm -- -D warnings
+      - name: Tests (unit + golden contract + property)
+        run: cargo test
+
+  wasm:
+    name: wasm build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Install stable toolchain with wasm target
+        run: |
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+          rustup target add wasm32-unknown-unknown
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/bin
+            target
+          key: rust-wasm-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+      - name: Install wasm-bindgen-cli
+        run: command -v wasm-bindgen >/dev/null || cargo install wasm-bindgen-cli --version 0.2.126 --locked
+      - name: Build core for wasm32
+        run: cargo build --release --target wasm32-unknown-unknown --features wasm -p nexia-core
+      - name: Generate JS bindings
+        run: wasm-bindgen target/wasm32-unknown-unknown/release/nexia_core.wasm --target web --no-typescript --out-dir web/wasm

.github/workflows/ui-ci.yml

@@ -0,0 +1,64 @@
+# SPDX-License-Identifier: MPL-2.0
+# Product CI (UI/web): compiles the ReScript UI under Deno, builds the wasm
+# core, runs the UI + contract tests, and produces the web bundle.
+name: ui-ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ui-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-test:
+    name: rescript + wasm + deno test + bundle
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install Deno
+        run: |
+          curl -fsSL https://deno.land/install.sh | DENO_INSTALL="$HOME/.deno" sh -s v2.9.1
+          echo "$HOME/.deno/bin" >> "$GITHUB_PATH"
+
+      - name: Install stable Rust with wasm target
+        run: |
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+          rustup target add wasm32-unknown-unknown
+
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/bin
+            target
+          key: rust-wasm-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+
+      - name: Install wasm-bindgen-cli
+        run: command -v wasm-bindgen >/dev/null || cargo install wasm-bindgen-cli --version 0.2.126 --locked
+
+      - name: Install JS dependencies (Deno-only, npm registry)
+        run: deno task setup
+
+      - name: Compile ReScript
+        run: deno task build:res
+
+      - name: Build wasm core
+        run: deno task build:wasm
+
+      - name: UI + contract tests
+        run: deno task test:ui
+
+      - name: Bundle web app
+        run: deno task build:web
+
+      - name: Lint
+        run: deno lint

.gitignore

@@ -40,6 +40,13 @@ erl_crash.dump
 # ReScript
 /lib/bs/
 /.bsb.lock
+ui/lib/
+ui/src/**/*.res.js
+ui/tests/**/*.res.js
+
+# Generated web artifacts
+web/dist/
+web/wasm/
 
 # Python (SaltStack only)
 __pycache__/

.machine_readable/6a2/STATE.a2ml

@@ -5,10 +5,11 @@
 [metadata]
 project = "nexia-list"
 version = "0.1.0"
-last-updated = "2026-03-15"
+last-updated = "2026-07-02"
 status = "active"
 
 [project-context]
 name = "nexia-list"
-completion-percentage = 0
-phase = "In development"
+completion-percentage = 35
+phase = "active development — web-first build resurrection"
+focus = "wasm core integration (wasm-bindgen bridge to browser), then product CI, tests, canvas drag-and-drop, PWA (service worker)"

.machine_readable/INTENT.contractile

@@ -35,38 +35,36 @@
 
   ; === Purpose (what this repo IS) ===
   (purpose
-    "{{ONE_PARAGRAPH_PURPOSE}}"
+    "Nexia is a local-first, spatial personal knowledge management tool: notes arranged on a spatial canvas, first-class bidirectional links between them, and (planned) agents implemented as persistent queries that continuously organise the notebook. It is web-first — a ReScript TEA-style UI drives a Rust core compiled to WASM in the browser — and all user data lives on the user's device in human-readable JSON."
   )
 
   ; === Anti-Purpose (what this repo is NOT — prevents scope creep) ===
   (anti-purpose
-    "{{ONE_PARAGRAPH_ANTI_PURPOSE}}"
-    ; Examples:
-    ; "This is NOT a general-purpose database — it solves one specific problem."
-    ; "This is NOT a framework — it is a library with a focused API."
-    ; "This does NOT handle authentication — that is delegated to [other repo]."
+    "This is NOT a cloud or SaaS product — no server-side component, no account, no required network. It does NOT do real-time collaboration — local-first means single-user focus. It must NOT introduce vendor lock-in — data is always exportable in open formats. It is NOT an outliner clone — the spatial canvas and link graph are the primary organising metaphors, not a hierarchy."
   )
 
   ; === Key Architectural Decisions That Must Not Be Reversed ===
   (architectural-invariants
-    ; *REMINDER: List the foundational decisions*
-    ; ("Idris2 for ABI definitions — dependent types prove interface correctness")
-    ; ("Zig for FFI — zero-cost C ABI compatibility")
-    ; ("Elixir for supervision — OTP fault tolerance")
+    ("Web-first: the browser is the primary target; desktop (Gossamer) is an optional external shell over the same bundle")
+    ("The Rust core is the single source of truth for note/notebook semantics — the UI must not fork the data model")
+    ("Rust core is compiled to WASM (wasm-bindgen) so the browser runs the real engine")
+    ("Deno is the only JS runtime/package manager — no npm/bun/yarn/pnpm CLIs")
+    ("Local-first: no core feature may require network access")
+    ("User data stored in human-readable JSON")
   )
 
   ; === Sensitive Areas (if in doubt, ask) ===
   (ask-before-touching
-    ; *REMINDER: List areas where LLMs should check before modifying*
-    ; "src/abi/ — formal proofs, changes require re-verification"
-    ; "ffi/zig/ — C ABI boundary, changes affect all language bindings"
-    ; ".machine_readable/ — checkpoint files, format is specified"
+    ".machine_readable/ — checkpoint files, format is specified"
+    ".github/workflows/ — estate governance workflows; removal requires approval"
+    "LICENSE and SPDX headers — never remove or modify"
+    "core/src/ data model — semantics mirrored by the UI; changes ripple across the WASM boundary"
   )
 
   ; === Ecosystem Position ===
   (ecosystem
-    (belongs-to "{{MONOREPO_OR_STANDALONE}}")
-    (depends-on ("{{DEP1}}" "{{DEP2}}"))
-    (depended-on-by ("{{CONSUMER1}}" "{{CONSUMER2}}"))
+    (belongs-to "standalone repo within the hyperpolymath estate")
+    (depends-on ("gossamer (optional — desktop shell only, external sibling checkout)"))
+    (depended-on-by ())
   )
 )

.machine_readable/agent_instructions/methodology.a2ml

@@ -55,7 +55,7 @@ perfective = 10   # % for SPDX headers, doc updates, formatting, style
 # Customise this per project — the template default is generic.
 
 [methodology.unique-strength]
-description = "{{PROJECT_UNIQUE_STRENGTH}}"
+description = "Typed end-to-end: the Rust core compiled to WASM is the single source of truth for note/notebook semantics, driven by an exhaustively pattern-matched TEA-style ReScript UI — no type drift between engine and interface"
 deepen-not-broaden = true
 
 # ============================================================================

.tool-versions

@@ -1 +1,2 @@
 just 1.36.0
+deno 2.9.1

.well-known/ai.txt

@@ -12,9 +12,9 @@ Allow: /
 Manifest: /0-AI-MANIFEST.a2ml
 
 # Machine-readable metadata
-Metadata: /.machine_readable/STATE.scm
-Metadata: /.machine_readable/META.scm
-Metadata: /.machine_readable/ECOSYSTEM.scm
+Metadata: /.machine_readable/6a2/STATE.a2ml
+Metadata: /.machine_readable/6a2/META.a2ml
+Metadata: /.machine_readable/6a2/ECOSYSTEM.a2ml
 
 # License
 License: MPL-2.0

0-AI-MANIFEST.a2ml

@@ -48,22 +48,26 @@ Bot-specific instructions for:
 
 ## REPOSITORY STRUCTURE
 
-Nexia is a cross-platform personal knowledge management tool inspired by
-Tinderbox. It provides spatial canvas note arrangement, bidirectional linking,
-intelligent agents, and prototype inheritance. Built with Rust core, ReScript
-TEA UI, Tauri 2.0 desktop/mobile shell, and WASM/PWA web deployment.
+Nexia is a local-first, web-first personal knowledge management tool inspired
+by Tinderbox. It provides spatial canvas note arrangement, bidirectional
+linking, and (planned) intelligent agents and prototype inheritance. Built
+with a Rust core compiled to WASM (wasm-bindgen), a ReScript TEA-style UI on
+@rescript/react, and Deno 2 tooling. Desktop is an OPTIONAL Gossamer shell
+requiring an external sibling checkout; it is not built in this repo's CI.
 
 ```
 nexia-list/
 ├── 0-AI-MANIFEST.a2ml         # THIS FILE (start here)
 ├── README.adoc                 # Project overview
-├── core/                       # Rust core engine (graph, search, storage)
+├── core/                       # Rust core engine (notes, backlinks, search, JSON storage)
 │   └── src/
-├── ui/                         # ReScript TEA application
+├── ui/                         # ReScript TEA-style application
 │   └── src/
-├── desktop/                    # Tauri 2.0 desktop shell
+├── scripts/                    # Deno build/dev scripts (esbuild)
+├── desktop/                    # OPTIONAL Gossamer shell (external; not built in CI)
 │   └── src/
-├── web/                        # Browser/PWA build
+├── web/                        # Browser build (bundle output in dist/)
+├── docs/adr/                   # Architecture decision records
 ├── .machine_readable/          # SCM files (6 files)
 │   ├── .machine_readable/6a2/STATE.a2ml
 │   ├── .machine_readable/6a2/META.a2ml