feat: wire Mist domain end-to-end into MuseHub server

Overview

The Mist domain plugin (`muse/plugins/mist/plugin.py`) is fully implemented and registered in the plugin registry, but it is not wired into the MuseHub server's push pipeline, intel indexing, profile canvas, or documentation layer. This ticket tracks all work needed to make Mist a first-class domain alongside `code` and `midi`.

All phases must be TDD: write the failing test first, then the implementation.

Phase 1 — Intel pipeline: dispatch + provider

Gap: `job_types_for_push(domain_id)` in `musehub/services/musehub_intel_providers.py` only branches on `"code"` and `"midi"`. Mist repos never get an intel job dispatched. `_PROVIDER_REGISTRY` has no `"intel.mist"` entry.

Work:

1. Add `elif "mist" in (domain_id or ""):` branch in `job_types_for_push` returning `"intel.mist"`.
2. Implement `intel_mist_provider(job)` — iterate snapshot manifest, call `extract_mist_symbol_anchors()` on each artifact blob, persist anchors to the intel store (same pattern as `intel_code_provider`).
3. Register `"intel.mist": intel_mist_provider` in `_PROVIDER_REGISTRY`.

TDD requirements:

• `test_job_types_for_push_mist_domain` — asserts `"intel.mist"` is in the returned list when `domain_id="mist"`.
• `test_intel_mist_provider_extracts_anchors` — seeds a mist repo snapshot with at least two artifact blobs, runs the provider, asserts anchors are persisted with correct `artifact_id`, `line`, `name`.
• `test_intel_mist_provider_ignores_non_mist_artifact` — binary blob with no anchor-bearing content produces zero anchors, no crash.
• `test_job_types_for_push_code_and_midi_unaffected` — regression: existing domain dispatch is unchanged.

Phase 2 — Push validator: Mist domain validation

Gap: `musehub/services/musehub_push_validator.py` does not invoke `MistPlugin` to validate incoming mist repo pushes. Malformed artifact filenames (path traversal, null bytes, ANSI escapes) are accepted silently.

Work:

1. After domain detection returns `"mist"`, call `MistPlugin().schema()` to validate incoming snapshot manifest paths via `_validate_mist_filename()`.
2. Reject pushes with 422 and a structured error payload listing all invalid paths.
3. Return 200 with a `"warnings"` list for recoverable issues (e.g. undetectable artifact type).

TDD requirements:

• `test_push_validator_rejects_path_traversal_artifact` — filename with `../` → 422.
• `test_push_validator_rejects_null_byte_filename` — filename with `\x00` → 422.
• `test_push_validator_rejects_ansi_escape_filename` — filename with ESC sequence → 422.
• `test_push_validator_accepts_valid_mist_snapshot` — clean snapshot → 200.
• `test_push_validator_mist_warning_for_unknown_artifact_type` — artifact with no detectable type → 200 with non-empty `warnings`.

Phase 3 — Snapshot indexer: symbol anchor extraction on push

Gap: After a mist repo push lands, the snapshot indexer does not extract and store symbol anchors. Search and grep across mist repos return no results.

Work:

1. In the post-push snapshot indexer (wherever code/midi symbol extraction runs), add a mist branch that calls `extract_mist_symbol_anchors(filename, content)` for each artifact in the manifest.
2. Persist anchors with the same schema used for code symbols.
3. Ensure idempotent re-index (same push twice → same anchor set, no duplicates).

TDD requirements:

• `test_snapshot_indexer_extracts_mist_anchors_on_push` — push a mist repo, assert anchor rows exist with correct artifact path and anchor names.
• `test_snapshot_indexer_mist_reindex_is_idempotent` — index same snapshot twice, row count unchanged.
• `test_snapshot_indexer_code_and_midi_unaffected` — regression: code and midi anchor extraction still works.

Phase 4 — JSON API router: explicit inclusion in main.py

Gap: The Mist JSON API router (`musehub/api/routes/musehub/mists.py`) is auto-discovered via the package `init.py` scan rather than being explicitly included in `musehub/main.py` like `api_identities_router`, `api_orgs_router`, etc. Auto-discovery is fragile and bypasses the canonical registration pattern.

Work:

1. Import `musehub.api.routes.musehub.mists` in `musehub/main.py`.
2. Add `app.include_router(mists_router)` alongside the other explicitly included routers.
3. Verify the `/api/mists` surface is reachable via the OpenAPI schema.

TDD requirements:

• `test_mists_router_is_registered_in_openapi_schema` — GET `/openapi.json`, assert `/api/mists` paths are present.
• `test_mists_router_returns_200_for_list_endpoint` — GET `/api/mists` returns 200 (not 404).

Phase 5 — Profile activity canvas: Mist domain grid

Gap: `musehub/services/musehub_profile.py` has `_build_mist_domain_grid()` but it is only invoked for `"audio"` and `"midi"` artifact types, not for repos with `domain="mist"`. Mist repos do not appear in the profile canvas.

Work:

1. In the profile canvas builder, add a branch for `domain == "mist"` that calls `_build_mist_domain_grid()`.
2. Ensure the grid data structure is consistent with the `"code"` and `"midi"` grids (same field names).
3. Handle empty mist repos gracefully (return zero-cell grid, not an exception).

TDD requirements:

• `test_profile_canvas_includes_mist_repo` — profile for identity with a mist repo includes a mist grid entry.
• `test_profile_canvas_mist_grid_fields` — grid entry has required fields (`domain`, `artifact_count`, `last_activity`).
• `test_profile_canvas_empty_mist_repo` — mist repo with zero artifacts → grid entry with `artifact_count=0`, no crash.
• `test_profile_canvas_code_and_midi_grids_unaffected` — regression.

Phase 6 — HTML docs page: /muse/mists

Gap: `docs/reference/mist-domain.md` is a comprehensive reference document but there is no HTML template or server route serving it at `/muse/mists`. The Mist domain is invisible in the documentation UI.

Work:

1. Create `musehub/templates/muse/mists.html` (or the equivalent path per the existing docs template convention).
2. Add a route in the UI router serving `GET /muse/mists`.
3. Ensure the page is linked from the main `/muse` docs index.
4. Content must cover: Concepts, URL schema, artifact types, CLI reference, REST API surface, agent publishing workflow, forking, embedding, content addressing, security model, limits — all already documented in the md file.

TDD requirements:

• `test_docs_mists_page_returns_200` — GET `/muse/mists` returns 200 with content-type `text/html`.
• `test_docs_mists_page_contains_key_sections` — response body contains the strings `"Mist"`, `"artifact"`, `"content-addressed"`.
• `test_docs_index_links_to_mists` — GET `/muse` response body contains a link to `/muse/mists`.

Phase 7 — Rate limiting audit

Gap: The Mist API endpoints have not been audited against the rate limiting policy applied to code and identity endpoints.

Work:

1. Audit all `/api/mists/*` endpoints for `@limiter.limit()` decorators.
2. Apply `AUTH_LIMIT` to mutating endpoints (POST, PATCH, DELETE).
3. Apply `STANDARD_LIMIT` (or equivalent) to read endpoints.
4. Ensure the limiter key function uses the authenticated identity handle, not IP, for authenticated endpoints.

TDD requirements:

• `test_mists_mutating_endpoints_have_rate_limits` — POST/PATCH/DELETE endpoints on mists are rate-limited (429 after N+1 requests from same identity).
• `test_mists_read_endpoints_under_rate_limit` — GET endpoints return 200 under threshold.

Phase 8 — End-to-end smoke test

A single integration test that exercises the full path: push a mist repo → intel jobs fire → anchors indexed → profile canvas updated → JSON API returns artifact → docs page reachable.

TDD requirements:

• `test_mist_domain_full_push_to_query_pipeline` — push mist repo with 3 artifacts, assert: intel job created, anchors persisted, profile canvas has mist grid, `GET /api/mists/{handle}/identity` returns artifacts, `GET /muse/mists` returns 200.

Acceptance Criteria

• All 8 phases implemented and green.
• No test uses mocks for the database (real SQLite in-process, same pattern as existing identity tests).
• `muse code test --json` runs only affected tests and all pass.
• `GET /openapi.json` lists all `/api/mists/*` paths.
• `GET /muse/mists` returns 200 with complete docs content.
• Push of a mist repo with a path-traversal filename returns 422.
• Profile canvas for an identity with a mist repo contains a mist grid entry.

References

• Plugin: `muse/plugins/mist/plugin.py`
• Registry: `muse/plugins/registry.py` (already registered)
• Intel providers: `musehub/services/musehub_intel_providers.py`
• Push validator: `musehub/services/musehub_push_validator.py`
• Profile service: `musehub/services/musehub_profile.py`
• JSON API router: `musehub/api/routes/musehub/mists.py`
• Docs reference: `docs/reference/mist-domain.md`