chore(google-keep): mark v1 implemented, file live-setup VERIFY, record in spec

2 files changed, 27 insertions, 4 deletions

diff --git a/docs/specs/google-keep-emacs-integration-spec.org b/docs/specs/google-keep-emacs-integration-spec.org
index 91fbeb10a..376522ab4 100644
--- a/docs/specs/google-keep-emacs-integration-spec.org
+++ b/docs/specs/google-keep-emacs-integration-spec.org
@@ -4,7 +4,7 @@
 #+TODO: TODO | DONE SUPERSEDED CANCELLED
 
 * Metadata
-| Status   | Ready (2 review rounds; implementing v1)                    |
+| Status   | v1 implemented (Phases 1-3); live setup pending; v2 next    |
 |----------+------------------------------------------------------------|
 | Owner    | Craig                                                      |
 |----------+------------------------------------------------------------|
@@ -214,3 +214,7 @@ The immediate next increment after v1 lands. A write subcommand on the bridge (g
 - What: fresh readiness pass on the revised spec. Verified the round-1 resolutions are coherent (data/keep.org consistent throughout, the JSON schema is the single referenced contract, the async/sentinel + stderr-token story lines up across Design/Phase 2/acceptance). Confirmed cj/auth-source-secret-value (host &optional user) exists and is buildable as written, and that the data/keep.org constant matches user-constants.el's gcal-file form. No new findings.
 - Why: confirms the spec is implementation-ready after two rounds.
 - Artifacts: this spec. Verdict: Ready.
+** 2026-06-25 Thu @ 01:30:00 -0400 — Claude — implementer
+- What: built v1 (Phases 1-3) in a no-approvals speedrun. Phase 1: the gkeepapi bridge (scripts/google-keep/keep-bridge.py) emitting the pinned JSON schema, degrading with a stderr reason token; 12 Python tests. Phase 2: the elisp pure core (parse/tag/heading/render, extractable) + cj/keep-refresh (async make-process + sentinel, atomic temp-then-rename to keep-file, stderr-token to display-warning); 15 ERT tests. Phase 3: keep-file constant in user-constants.el, C-c k prefix (refresh/open), executable warning, required in init.el. validate-modules clean; no-token path degrades without error.
+- Why: spec was Ready and Craig green-lit a no-approvals build of v1.
+- Artifacts: scripts/google-keep/keep-bridge.py + test; modules/google-keep-config.el + tests/test-google-keep-config.el; user-constants.el; init.el. Remaining: the one-time gkeepapi + master-token setup (a VERIFY under todo.org Manual testing), then v2.
diff --git a/todo.org b/todo.org
index 0d2c70cf8..76f74b579 100644
--- a/todo.org
+++ b/todo.org
@@ -67,6 +67,24 @@ CLOSED: [2026-06-25 Thu]
 A recurring event declined for just one occurrence synced out with =:STATUS: accepted= (chime then faithfully showed it). Root cause (diagnosed by a chime session, 2026-06-24): =calendar-sync--apply-single-exception= merged the override's =:attendees= but never re-derived =:status=, so the occurrence kept the series master's accepted status, and =calendar-sync--filter-declined= (which keys off =:status=) didn't drop it. Fix (TDD): in =apply-single-exception=, when overriding =:attendees=, re-derive =:status= via =calendar-sync--find-user-status= against =calendar-sync-user-emails=. Four new tests in =test-calendar-sync--apply-single-exception.el= (declined → "declined"; no-attendee override → inherited intact; accepted override → accepted; override without the user → inherited intact); recurrence + find-user-status + integration suites unchanged. Live-reloaded; a manual re-sync ran clean. The specific 2026-06-24 Arusyak occurrence is past now (its RECURRENCE-ID override aged out of the feed), so the live confirmation lands on the next single-occurrence decline.
 ** PROJECT [#A] Manual testing and validation
 Exercised once the phases above land.
+*** VERIFY Google Keep v1 live setup and first fetch
+What we're verifying: read-only v1 fetches real Keep notes and renders =data/keep.org= once the one-time gkeepapi + master-token setup is done. The code and 27 tests (12 Python + 15 ERT) are green; this is the live-credential step only Craig can run.
+- Install the client into the interpreter =cj/keep-python= uses: =pip install gkeepapi= (or pipx).
+- Obtain a Google master token (one-time, via gkeepapi's current login/gpsoauth flow against your account).
+- Set your email:
+#+begin_src emacs-lisp
+(setq cj/keep-email "you@gmail.com")
+#+end_src
+- Add the token to =~/.authinfo.gpg= (line: =machine google-keep login you@gmail.com password <master-token>=), then clear the auth cache so the daemon sees it:
+#+begin_src emacs-lisp
+(auth-source-forget-all-cached)
+#+end_src
+- Fetch (or press =C-c k r=):
+#+begin_src emacs-lisp
+(cj/keep-refresh)
+#+end_src
+- Open the result with =C-c k o=.
+Expected: =data/keep.org= lists your Keep notes, pinned first, each a header with title/body, labels as org tags, a property drawer (=:KEEP_ID:= / =:UPDATED:= / ...), and an "open in Keep" link. A missing piece (gkeepapi / token / auth) shows a clear =*Warnings*= message naming it, not a crash.
 *** TODO theme-studio preview-locate discoverability read
 What we're verifying: the locate hover/flash actually feels discoverable in a live frame — the subjective read the deterministic gates can't make.
 - Open theme-studio in Chrome (=make theme-studio-open=, or open theme-studio.html).
@@ -3760,9 +3778,10 @@ These may override useful defaults - review and pick better bindings:
 :END:
 Display slack.el message and thread buffers in a dedicated popup window (side or bottom) and reuse that one window instead of spawning a new window per buffer. Likely a =display-buffer-alist= rule (or popper integration) in =modules/slack-config.el=.
 
-** TODO [#C] google-keep in-editor integration — build, module-to-package :feature:
-Build a native Keep integration: an org page of notes (each note an org header), read-only in v1, a gkeepapi Python subprocess bridge for data (the MCP is agent-only, not callable from elisp), auth via authinfo.gpg, eventually extracted to a standalone package. vNext: read-write, the org-capture-style popup, list rendering.
-Spec: [[file:docs/specs/google-keep-emacs-integration-spec.org][google-keep-emacs-integration-spec.org]]. All five decisions resolved 2026-06-25 (org page; read-only v1 then read-write v2 immediately after; gkeepapi sole bridge; authinfo.gpg auth; extractable core + glue). In spec-review before implementation.
+** DOING [#C] google-keep in-editor integration — build, module-to-package :feature:
+v1 (read-only) implemented and tested (Phases 1-3): the gkeepapi Python bridge (=scripts/google-keep/keep-bridge.py=, 12 tests), the elisp core + =cj/keep-refresh= renderer with atomic writes and async make-process (=modules/google-keep-config.el=, 15 ERT tests), un-orphaned under a =C-c k= prefix, graceful warning when gkeepapi/token/auth is missing. The pure JSON-to-org core is kept extractable per the spec. Live fetch needs the one-time gkeepapi + master-token setup — see "Google Keep v1 live setup and first fetch" under Manual testing and validation.
+Next: v2 (read-write — create/edit back to Keep, with a staleness guard) per the spec, the immediate follow-on once the live read is confirmed. Later: list/checkbox rendering, package extraction.
+Spec: [[file:docs/specs/google-keep-emacs-integration-spec.org][google-keep-emacs-integration-spec.org]] (Ready, 2 review rounds; all five decisions resolved 2026-06-25).
 ** TODO [#D] Theme Studio nerd-icons vNext follow-ups :feature:
 Deferred from [[file:docs/specs/theme-studio-nerd-icons-colors-spec.org][theme-studio-nerd-icons-colors-spec.org]]: extend the legend to
 buffer-mode and command/symbol categories if the file set proves insufficient;