feat(web): add Directory and Settings workspaces

[salmonumbrella]

What changed

• Add a Directory workspace with durable-person search, contact and organization filters, last-contact controls, stable pagination, responsive person detail, profile maintenance, and history.
• Add bounded relationship networks, identity and imported-relationship review queues, explicit merge/split handling, person tracking, and a privacy-gated fact ledger.
• Add CardDAV account, address-book role, sync/history, conflict, and person-publication surfaces.
• Add a self-describing Settings workspace to Web and TUI for safe daemon, source, search, enrichment, and attachment-download controls.
• Add owner-only, write-only provider credential management with independent optimistic revisions. Stored values never cross the API response boundary.
• Add named Exa and SixtyFour enrichment policies, text and visual embedding configuration, and future-only large-group attachment rules. Host bootstrap credentials and sensitive paths remain read-only or outside the generic editor.

Why

Msgvault already had rich People and daemon configuration models, but maintaining them required the CLI, config files, or direct API calls. These workspaces make the safe, routine controls available in the browser and TUI while preserving provenance, optimistic concurrency, restart visibility, and secret boundaries.

Usage

Directory and Reviews are top-level Web workspaces. Select a person to inspect or maintain their profile, employment, relationships, network, files, tracking, publication, and merge history.

Settings is also a top-level Web workspace; press , in the TUI to open the keyboard-only Settings screen. Provider keys can be added, replaced, or removed without revealing their values. Save endpoint and model changes before credential changes when both revisions have moved. Named provider policy remains Web-only; the TUI exposes its current state as read-only.

Attachment controls affect future downloads only. A size limit of 0 is unlimited, while a positive participant cap skips conversations larger than that cap.

Closes #639

Screenshots

Settings

Embedding providers, write-only credentials, and restart metadata:

Named Exa and SixtyFour person-enrichment policies:

Future-only attachment rules by source, conversation scope, participant count, and size:

Directory and person workspace

Directory list, search, last-contact controls, and stable sorting:

Structured profile, service-scoped observation, tracking, and CardDAV publication state:

Responsive person drawer:

Profile editing, history, custom fields, employment, relationships, and bounded network:

Review and identity flows

CardDAV and operation history

[roborev-ci]

roborev: Combined Review (14f2506)

Verdict: 3 medium-severity issues require attention; no concrete security issues were identified.

Medium

• internal/api/carddav.go:485-525; internal/api/openapi.go:243-247 — Existing CardDAV response fields are removed or replaced, potentially breaking 2.x clients despite only a minor schema update. Preserve compatibility fields or version and document the replacement contract with a major-version change.

• web/src/lib/carddav/publication-controller.svelte.ts:154-191; web/src/lib/carddav/conflicts-controller.svelte.ts:240-302 — carddav_unavailable is treated as successful reconciliation. Propagate unavailable as an unknown/error outcome, and only report reconciliation after confirming valid server state.

• internal/store/person_directory.go:203-226,726-729 — Directory cursors validate display-name keys but omit match_quality, which is also part of the ordering and can cause skipped or duplicated results. Validate the full ordering tuple or bind cursors to a projection revision.

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 24m18s

[roborev-ci]

roborev: Combined Review (55b1029)

Verdict: Code is generally clean; one low-severity inconsistency was identified but omitted per the requested threshold.

No Medium, High, or Critical findings.

---

Reviewers: 2 done | Synthesis: codex, 5s | Total: 35m34s

[roborev-ci]

roborev: Combined Review (75bf0c0)

Verdict: One medium-severity issue was identified; no critical or high-severity findings were reported.

Medium

• Network projection can be incomplete or order-dependent — internal/store/person_network.go:150-169, 214-243
  The edge limit is applied per frontier node before filtering, deduplicating, hydrating ordering metadata, and applying public ordering. A high-degree earlier node can consume the limit and exclude a later candidate that should rank higher.
  Suggested fix: Build and filter the complete layer candidate set across all frontier nodes, hydrate ordering fields, deduplicate candidates, then apply deterministic ordering and the bounded limit.

---

Reviewers: 2 done | Synthesis: codex, 7s | Total: 15m36s

[roborev-ci]

roborev: Combined Review (c3d785c)

Verdict: No Medium, High, or Critical findings identified.

Reviewers found no material security issues. One Low-severity pagination issue was reported but omitted per the requested threshold.

---

Reviewers: 2 done | Synthesis: codex, 5s | Total: 14m52s

[roborev-ci]

roborev: Combined Review (9d3c381)

Verdict: One medium-severity issue requires attention.

• Medium — internal/store/carddav_publication.go:294-307: Nullable address_book_id and href columns are scanned into non-nullable int64 and string values. Valid unassigned publication rows can therefore cause scan errors and make the publication-status API fail. Scan into sql.NullInt64/sql.NullString and handle missing values as unpublished/unassigned without querying the address-book table.

---

Reviewers: 2 done | Synthesis: codex, 7s | Total: 22m4s

[roborev-ci]

roborev: Combined Review (5d9074e)

Verdict: One medium-severity issue found; no critical or high-severity issues.

Medium

• internal/store/person_network.go:201-247 — The edge budget is applied to raw adjacency IDs before hydration and public sorting. High-degree nodes may consume the source window with employment edges and omit relationship edges that should rank earlier under the advertised (hop, kind, label, node ID, edge ID) ordering. Apply the limit after deduplication and public sorting, or implement the bounded query with that ordering while retaining a separate work guard.

---

Reviewers: 2 done | Synthesis: codex, 7s | Total: 21m43s

[roborev-ci]

roborev: Combined Review (73db967)

Verdict: Medium-risk issues found: failed refreshes can leave stale CardDAV and tracking data actionable.

Medium

• web/src/lib/carddav/publication-controller.svelte.ts:185-212 — Failed publication-state refreshes preserve stale data while mutations remain enabled. Mark state unknown or require a successful, non-loading refresh before publish/unpublish.

• web/src/lib/directory/person-tracking-controller.svelte.ts:166-191 — Failed tracking refreshes leave the previous tracking value actionable. Disable mutations or mark tracking state unknown when refresh fails.

• web/src/lib/carddav/conflicts-controller.svelte.ts:125-136,217-237 — Failed conflict-detail reloads retain stale details while resolution remains enabled. Gate resolution on a current successful detail load.

• web/src/lib/carddav/controller.svelte.ts:286-345 — Failed status refreshes preserve stale status while canSync remains enabled. Mark status unknown or require no loading/error state before syncing.

• web/src/lib/carddav/controller.svelte.ts:297-307,359-383 — Failed book refreshes leave stale books displayed and actionable, potentially allowing role updates against obsolete IDs. Mark books unknown and disable role controls during loading or errors.

---

Reviewers: 2 done | Synthesis: codex, 7s | Total: 40m6s

[roborev-ci]

roborev: Combined Review (6a7540c)

Verdict: One medium-severity state-consistency issue remains.

Medium

• internal/api/settings.go:500-527, internal/api/settings_suppression.go:47 — Enabling enrichment persists the generated suppression credential before API-key confirmation and configuration validation complete. A rejected or stale settings update can mutate credential state despite the request failing. Defer persistence until validation and update succeed, or add transactional rollback handling.

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 15m50s

[roborev-ci]

roborev: Combined Review (56f16aa)

Verdict: One medium-severity robustness issue identified; no high or critical findings.

Medium

• internal/providercredentials/store.go:105-107 — EndpointOrigin accesses parsed.Scheme before checking the URL parse error. Malformed input can yield a nil URL and panic the request handler instead of returning validation feedback. Check err and parsed == nil before dereferencing.

---

Reviewers: 2 done | Synthesis: codex, 6s | Total: 32m30s

[roborev-ci]

roborev: Combined Review (a1f5c68)

The new Directory, Settings, and CardDAV paths remain protected by the existing authentication and CSRF controls, with credential values kept write-only and sensitive projections redacted.

No issues found.

---

Reviewers: 2 done | Synthesis: codex | Total: 49m46s

[salmonumbrella]

@wesm ready