feat: Slice 0 — Auth + Task Capture Spine

.github/workflows/pr.yml

@@ -88,6 +88,37 @@ jobs:
       - uses: astral-sh/setup-uv@v3
         with:
           version: "0.11.x"
+
+      # Slice 0 integration tests (`db_client` fixture in
+      # apps/api/tests/conftest.py) need a real Postgres. We start it as a
+      # docker container with a per-run random password so no literal
+      # credential lives in source (keeps GitGuardian quiet). The fixture
+      # drops/recreates tables via Base.metadata per test, so no Alembic
+      # step is needed here — only the `lockin_test` DB.
+      - name: Start ephemeral Postgres with random password
+        run: |
+          PG_PWD=$(openssl rand -hex 24)
+          AUTH=$(openssl rand -hex 32)
+          echo "::add-mask::$PG_PWD"
+          echo "::add-mask::$AUTH"
+          docker run -d --name pg \
+            -e POSTGRES_USER=lockin \
+            -e POSTGRES_PASSWORD="$PG_PWD" \
+            -e POSTGRES_DB=lockin \
+            -p 5432:5432 \
+            postgres:16-alpine
+          for _ in $(seq 1 30); do
+            docker exec pg pg_isready -U lockin -d lockin >/dev/null 2>&1 && break
+            sleep 1
+          done
+          docker exec -e PGPASSWORD="$PG_PWD" pg \
+            psql -U lockin -d postgres -c "CREATE DATABASE lockin_test;"
+          {
+            echo "PG_PWD=$PG_PWD"
+            echo "DATABASE_URL=postgresql+asyncpg://lockin:$PG_PWD@localhost:5432/lockin"
+            echo "AUTH_SECRET=$AUTH"
+          } >> "$GITHUB_ENV"
+
       - run: pnpm install --frozen-lockfile
       - name: Regenerate Python event models
         run: |

.graphifyignore

@@ -0,0 +1,51 @@
+# Node / pnpm
+node_modules/
+.next/
+.turbo/
+.parcel-cache/
+
+# Build outputs
+dist/
+build/
+*.egg-info/
+
+# Python envs and caches
+.venv/
+venv/
+__pycache__/
+*.pyc
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.hypothesis/
+.uv-cache/
+
+# Test / coverage
+coverage/
+.coverage
+.coverage.*
+htmlcov/
+
+# Logs and env
+*.log
+.env
+.env.local
+.env.*.local
+
+# Secrets baselines (large generated JSON)
+.secrets.baseline
+.secrets.baseline.bak
+
+# IDE / OS
+.vscode/
+.idea/
+.DS_Store
+Thumbs.db
+
+# Graphify output
+graphify-out/
+
+# Storybook static build artifacts — Parcel-bundled vendor JS with mangled
+# symbol names; pure noise in the knowledge graph.
+packages/ui/storybook-static/
+**/storybook-static/

apps/api/alembic/versions/0003_tasks.py

@@ -0,0 +1,38 @@
+"""tasks
+
+Revision ID: 0003
+Revises: 0002
+Create Date: 2026-05-18
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID
+
+from alembic import op
+
+revision: str = "0003"
+down_revision: str | None = "0002"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "tasks",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True),
+        sa.Column("user_id", UUID(as_uuid=True), nullable=False, index=True),
+        sa.Column("title", sa.String(500), nullable=False),
+        sa.Column("source", sa.String(16), nullable=False, server_default="keyboard"),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.func.now(),
+            nullable=False,
+        ),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("tasks")

apps/api/app/api/v1/deps.py

@@ -1,12 +1,14 @@
-"""FastAPI dependency providers: DB sessions, current user, idempotency."""
+"""FastAPI dependency providers: DB sessions, Redis, event publisher."""
 
 from collections.abc import AsyncIterator
 from typing import Annotated
 
 from fastapi import Depends
+from redis.asyncio import Redis
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.db.session import AsyncSessionLocal
+from app.events.publisher import EventPublisher, get_redis
 
 
 async def _db_session() -> AsyncIterator[AsyncSession]:
@@ -15,3 +17,21 @@ async def _db_session() -> AsyncIterator[AsyncSession]:
 
 
 DbSession = Annotated[AsyncSession, Depends(_db_session)]
+
+
+async def _redis() -> AsyncIterator[Redis]:
+    redis = get_redis()
+    try:
+        yield redis
+    finally:
+        await redis.aclose()
+
+
+RedisDep = Annotated[Redis, Depends(_redis)]
+
+
+async def _event_publisher(redis: RedisDep) -> EventPublisher:
+    return EventPublisher(redis)
+
+
+EventPublisherDep = Annotated[EventPublisher, Depends(_event_publisher)]

apps/api/app/api/v1/router.py

@@ -2,10 +2,11 @@
 
 from fastapi import APIRouter
 
-from app.api.v1.routes import debug, health, me, webauthn
+from app.api.v1.routes import debug, health, me, tasks, webauthn
 
 api_router = APIRouter(prefix="/v1")
 api_router.include_router(health.router)
 api_router.include_router(me.router)
+api_router.include_router(tasks.router)
 api_router.include_router(webauthn.router)
 api_router.include_router(debug.router)

apps/api/app/api/v1/routes/tasks.py

@@ -0,0 +1,51 @@
+"""`/v1/tasks` — create and list a user's captured tasks."""
+
+from __future__ import annotations
+
+from uuid import UUID
+
+from fastapi import APIRouter, Response, status
+
+from app.api.v1.deps import DbSession, EventPublisherDep
+from app.core.auth import CurrentUserDep
+from app.core.identity import user_uuid
+from app.schemas.task import TaskCreate, TaskRead
+from app.services.task_service import TaskService
+
+router = APIRouter(prefix="/tasks", tags=["tasks"])
+
+
+@router.post("", response_model=TaskRead, status_code=status.HTTP_201_CREATED)
+async def create_task(
+    body: TaskCreate,
+    user: CurrentUserDep,
+    session: DbSession,
+    publisher: EventPublisherDep,
+) -> TaskRead:
+    service = TaskService(session)
+    task = await service.create(
+        publisher,
+        user_id=user_uuid(user.user_id),
+        title=body.title,
+        source=body.source,
+    )
+    return TaskRead.model_validate(task)
+
+
+@router.get("", response_model=list[TaskRead])
+async def list_tasks(user: CurrentUserDep, session: DbSession) -> list[TaskRead]:
+    service = TaskService(session)
+    tasks = await service.list_for_user(user_uuid(user.user_id))
+    return [TaskRead.model_validate(task) for task in tasks]
+
+
+@router.delete("/{task_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_task(
+    task_id: UUID,
+    user: CurrentUserDep,
+    session: DbSession,
+) -> Response:
+    service = TaskService(session)
+    # Idempotent: 204 whether or not the row existed.
+    await service.delete(user_id=user_uuid(user.user_id), task_id=task_id)
+    return Response(status_code=status.HTTP_204_NO_CONTENT)

apps/api/app/core/identity.py

@@ -0,0 +1,21 @@
+"""Map an external OAuth subject to a stable internal UUID.
+
+Auth is JWT-strategy: there is no `users` table, and the identity we receive
+is Google's `sub` claim — a numeric string, not a UUID. The event schema and
+every per-user table key on `UUID`. `user_uuid` derives a deterministic v5
+UUID from the subject so Postgres rows and the `task.created` event stream
+agree on one identifier per user.
+"""
+
+from __future__ import annotations
+
+from uuid import UUID, uuid5
+
+# Fixed namespace for user-identity derivation. Generated once for LockIn.
+# NEVER change this value — changing it re-keys every existing user.
+_USER_NAMESPACE = UUID("9f2a7c4e-0b1d-4e6a-8c3f-1a2b3c4d5e6f")
+
+
+def user_uuid(subject: str) -> UUID:
+    """Return the stable internal UUID for an OAuth subject (e.g. Google `sub`)."""
+    return uuid5(_USER_NAMESPACE, subject)

apps/api/app/db/models/__init__.py

@@ -6,5 +6,6 @@
 """
 
 from app.db.models.credential import WebauthnCredential  # noqa: F401
+from app.db.models.task import Task  # noqa: F401
 
-__all__ = ["WebauthnCredential"]
+__all__ = ["Task", "WebauthnCredential"]

apps/api/app/db/models/task.py

@@ -0,0 +1,31 @@
+"""Task rows — a user-captured unit of work.
+
+Slice 0 keeps this table intentionally minimal (YAGNI). Week 3–4 Scaffolding
+owns the expansion (`tenant_id`, `version`, `status`, indexes). Do not add
+those columns here.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime
+from uuid import UUID, uuid4
+
+from sqlalchemy import DateTime, String, func
+from sqlalchemy.dialects.postgresql import UUID as PgUUID
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base import Base
+
+
+class Task(Base):
+    __tablename__ = "tasks"
+
+    id: Mapped[UUID] = mapped_column(PgUUID(as_uuid=True), primary_key=True, default=uuid4)
+    user_id: Mapped[UUID] = mapped_column(PgUUID(as_uuid=True), index=True, nullable=False)
+    title: Mapped[str] = mapped_column(String(500), nullable=False)
+    source: Mapped[str] = mapped_column(String(16), nullable=False, server_default="keyboard")
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True),
+        server_default=func.now(),
+        nullable=False,
+    )

apps/api/app/schemas/__init__.py

@@ -1 +1 @@
-"""Pydantic v2 DTOs (request/response). Grouped by aggregate, added per slice."""
+"""API request/response Pydantic models. Not ORM models, not event models."""

apps/api/app/schemas/task.py

@@ -0,0 +1,29 @@
+"""Request/response contracts for the /v1/tasks endpoints."""
+
+from __future__ import annotations
+
+from datetime import datetime
+from typing import Literal
+from uuid import UUID
+
+from pydantic import BaseModel, ConfigDict, Field
+
+TaskSource = Literal["keyboard", "click", "voice", "mcp"]
+
+
+class TaskCreate(BaseModel):
+    """Body of `POST /v1/tasks`."""
+
+    title: str = Field(min_length=1, max_length=500)
+    source: TaskSource = "keyboard"
+
+
+class TaskRead(BaseModel):
+    """A task as returned by the API. Built from the ORM row."""
+
+    model_config = ConfigDict(from_attributes=True)
+
+    id: UUID
+    title: str
+    source: str
+    created_at: datetime