feat: vault metabolism Phase 2 (structural health metrics + dashboard)

[cizer]

Phase 2 of the vault-metabolism plan in METABOLISM.md, stacked on the merged Phase 0-1 work. All structural, timestamp-free, and read-only: no scoring, no access signal, no decay (those stay gated behind the Phase 3 experiment).

2a — structural graph metrics (core/graph.go)

Over the Phase-0 resolved link graph (undirected projection, dangling links excluded, self-loops dropped, edges deduplicated):

• connected components via union-find (count + giant-component ratio)
• k-core coreness via Batagelj-Zaversnik peel (the durable-vs-transitory axis, exposed as data, not per-note noise)
• orphan/leaf and island detectors folded into hebb health

Orphans/leaves are flagged only in connective folders (2-Areas, 3-Resources) once stale; fresh capture and archives are never flagged. Islands are small components (size 2 to island_max_size) that are not the mainland (the largest component is excluded) and not wholly archived, so they never duplicate orphan findings, flag the giant component, or flag fresh single notes. New [health] config block for the folder lists, stale-days, and island size.

2b — the dashboard (hebb serve)

New GET /api/health returns {findings, stats} (refreshing the index like /api/search, behind the same loopback bind and DNS-rebinding Host guard, with a test covering it). The embedded page gains a worklist-first Health tab: findings grouped by type with counts, each row deep-linking to the note via obsidian://, ordered by an honest per-type proxy (no invented access-frequency ranking, that signal is Phase 3). Structural metric tiles sit below. No composite "health score", per the Goodhart rule. Search view unchanged.

Refinement caught by smoke-testing

The first cut of the island detector flagged the giant hub-and-spoke component and double-reported orphans as size-1 islands. Tightened so islands are size 2 to N and never the largest component, then re-verified against the real binary. (Folded into the 2a commit.)

Verification

gofmt, vet, build, test ./... all clean (uncached) after each step, plus a live hebb serve smoke confirming the endpoint, the dashboard markup, and a 403 on a foreign Host.

Next

Phase 3: the access-log observer plus the two-week falsification experiment that decides whether the scoring/decay half of the plan is real.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0603e97876

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

This PR implements Phase 2 of the vault-metabolism plan by extending vault health from Phase-1 content detectors into Phase-2 structural graph metrics (components + k-core + orphan/leaf/island findings) and wiring a new health dashboard into hebb serve via a new /api/health endpoint.

Changes:

• Add Phase 2a structural graph model + metrics and new detectors (orphans/leaves/islands) surfaced via core.RunHealthFull and CLI output.
• Add /api/health endpoint and UI “Health” tab to display grouped findings and structural metric tiles.
• Extend [health] config with thresholds/folder lists and update tests accordingly.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
web/server.go	Adds /api/health endpoint returning findings + graph stats envelope.
web/server_test.go	Adds endpoint shape/host-guard tests and a fixture vault for health.
web/index.html	Adds Health tab UI, rendering logic, and dashboard styling.
METABOLISM.md	Marks Phase 2 checklist item complete.
core/vaultconfig.go	Adds Phase 2a [health] config fields + defaulting accessors.
core/health.go	Introduces HealthResult + RunHealthFull, runs Phase 2a detectors, computes graph stats.
core/health_test.go	Adjusts “clean notes not flagged” test to only assert Phase 1 types.
core/graph.go	New graph implementation: build graph, components, coreness, orphan/leaf/island detection, and GraphStats.
core/graph_test.go	New tests covering graph construction, metrics, detectors, and config defaults.
cli/health.go	Extends hebb health JSON output envelope and prints structural summary line in text mode.
cli/health_test.go	Updates JSON/text tests for new envelope and structural summary line.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cizer]

Thanks both. All six addressed in 8c8324a (web) and 05ce760 (core/cli):

• hebb health --json reverted to a top-level []Finding array (its merged Phase 1 contract); graph stats stay on the text summary and the /api/health endpoint (05ce760).
• Health dashboard tabs now show on initial load, so the view is reachable without a search or the hash (8c8324a).
• Removed the total note-count tile (the vanity metric METABOLISM forbids); kept components, giant ratio, max k-core (8c8324a).
• Merged the duplicate class attribute on the refresh-health link (8c8324a).
• Island suppression now uses a new [health] archive_folders config (default 4-Archives) instead of the full expected-orphan list, matching the doc and the config comment; islands in Journal/Notes are reported again (05ce760).
• Corrected the GraphHealth doc comment to describe the real call paths (05ce760).

Also flagged a separate, pre-existing bug found in passing (not in this PR's scope): automation/generate-vault-digest.py selects notes by st_mtime, so a bulk rewrite or sync both hides real edits and floods the next run. Tracked for a follow-up; it is the same mtime-unreliability the Phase 3 access log addresses.

Full suite green; web changes verified with a live serve smoke. Resolving these threads.