refactor(scribe): retire calendar/events + person/place/list entities (backend)

Narrow Scribe to a Claude-Code work system-of-record (milestone #194,
decision note #1759). Wholesale removal per rule #22 — backend + schema half.

Calendar/events + CalDAV: delete models/event, services/{events,caldav,
caldav_sync}, routes/events, mcp/tools/events; strip event branches from
backup (bump v3->v4), dashboard (upcoming_events), trash, recent, and the
mcp server read-only allowlist + instructions.

Typed entities (person/place/list): delete mcp/tools/entities; drop the
notes.metadata (entity_meta) column from model/service/routes and the
knowledge browse service. note_type STAYS — it also marks 'process' notes.

Scheduler: event_scheduler -> recurrence_scheduler, keeping only the
recurring-task spawn job (drops event reminders + CalDAV sync).

Schema: migration 0069 drops the events table + notes.metadata column +
orphan caldav settings rows (faithful downgrade recreates them).

KEEP: recurrence.py (task recurrence), notifications task reminders, graph
view, and every work surface. Frontend + plugin/docs true-up follow next.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BPtbSzA4JLMAKgFZ8VTg7Q

src/scribe/routes/events.py

@@ -1,142 +0,0 @@
-"""Calendar events REST API."""
-from __future__ import annotations
-
-from datetime import datetime, timezone
-
-from quart import Blueprint, g, jsonify, request
-
-from scribe.auth import login_required
-import scribe.services.events as events_svc
-
-events_bp = Blueprint("events", __name__, url_prefix="/api/events")
-
-
-def _parse_dt(value: str) -> datetime:
-    """Parse ISO 8601 datetime string, ensuring UTC-awareness."""
-    dt = datetime.fromisoformat(value.replace("Z", "+00:00"))
-    if dt.tzinfo is None:
-        dt = dt.replace(tzinfo=timezone.utc)
-    return dt
-
-
-def _get_current_user_id() -> int:
-    return g.user.id
-
-
-@events_bp.get("")
-@login_required
-async def list_events():
-    date_from_str = request.args.get("from")
-    date_to_str = request.args.get("to")
-    if not date_from_str or not date_to_str:
-        return jsonify({"error": "from and to query params are required"}), 400
-    try:
-        date_from = _parse_dt(date_from_str)
-        date_to = _parse_dt(date_to_str)
-    except ValueError:
-        return jsonify({"error": "Invalid datetime format"}), 400
-    events = await events_svc.list_events(
-        user_id=_get_current_user_id(),
-        date_from=date_from,
-        date_to=date_to,
-    )
-    return jsonify(events)
-
-
-@events_bp.post("")
-@login_required
-async def create_event():
-    data = await request.get_json() or {}
-    if not data.get("title") or not data.get("start_dt"):
-        return jsonify({"error": "title and start_dt are required"}), 400
-    try:
-        start_dt = _parse_dt(data["start_dt"])
-        end_dt = _parse_dt(data["end_dt"]) if data.get("end_dt") else None
-    except ValueError:
-        return jsonify({"error": "Invalid datetime format"}), 400
-    try:
-        event = await events_svc.create_event(
-            user_id=_get_current_user_id(),
-            title=data["title"],
-            start_dt=start_dt,
-            end_dt=end_dt,
-            duration_minutes=data.get("duration_minutes"),
-            all_day=data.get("all_day", False),
-            description=data.get("description", ""),
-            location=data.get("location", ""),
-            color=data.get("color", ""),
-            recurrence=data.get("recurrence"),
-            project_id=data.get("project_id"),
-            reminder_minutes=data.get("reminder_minutes"),
-        )
-    except ValueError as exc:
-        return jsonify({"error": str(exc)}), 400
-    return jsonify(event.to_dict()), 201
-
-
-@events_bp.get("/<int:event_id>")
-@login_required
-async def get_event(event_id: int):
-    event = await events_svc.get_event(
-        user_id=_get_current_user_id(),
-        event_id=event_id,
-    )
-    if event is None:
-        return jsonify({"error": "Event not found"}), 404
-    return jsonify(event.to_dict())
-
-
-@events_bp.patch("/<int:event_id>")
-@login_required
-async def update_event(event_id: int):
-    data = await request.get_json() or {}
-    fields: dict = {}
-    for str_field in ("title", "description", "location", "color", "recurrence"):
-        if str_field in data:
-            fields[str_field] = data[str_field]
-    for bool_field in ("all_day",):
-        if bool_field in data:
-            fields[bool_field] = data[bool_field]
-    for int_field in ("project_id", "reminder_minutes", "duration_minutes"):
-        if int_field in data:
-            fields[int_field] = data[int_field]
-    for dt_field in ("start_dt", "end_dt"):
-        if dt_field in data:
-            if data[dt_field] is None:
-                # Explicit null clears the field (e.g. removing end_dt)
-                fields[dt_field] = None
-            elif data[dt_field]:
-                try:
-                    fields[dt_field] = _parse_dt(data[dt_field])
-                except ValueError:
-                    return jsonify({"error": f"Invalid datetime for {dt_field}"}), 400
-    try:
-        event = await events_svc.update_event(
-            user_id=_get_current_user_id(),
-            event_id=event_id,
-            **fields,
-        )
-    except ValueError as exc:
-        return jsonify({"error": str(exc)}), 400
-    if event is None:
-        return jsonify({"error": "Event not found"}), 404
-    return jsonify(event.to_dict())
-
-
-@events_bp.delete("/<int:event_id>")
-@login_required
-async def delete_event(event_id: int):
-    from scribe.services.trash import delete as trash_delete
-    batch = await trash_delete(_get_current_user_id(), "event", event_id)
-    if batch is None:
-        return jsonify({"error": "Event not found"}), 404
-    return "", 204
-
-
-@events_bp.post("/sync")
-@login_required
-async def sync_caldav():
-    """Trigger a CalDAV pull sync for the current user."""
-    from scribe.services.caldav_sync import sync_user_events
-    result = await sync_user_events(user_id=_get_current_user_id())
-    return jsonify(result)

src/scribe/routes/knowledge.py

@@ -1,4 +1,4 @@
-"""Unified Knowledge endpoint — notes, people, places, lists in one queryable feed."""
+"""Unified Knowledge endpoint — notes, tasks, plans, and processes in one queryable feed."""
 import logging
 
 from quart import Blueprint, jsonify, request
@@ -10,7 +10,7 @@ logger = logging.getLogger(__name__)
 
 knowledge_bp = Blueprint("knowledge", __name__, url_prefix="/api/knowledge")
 
-_VALID_TYPES = {"note", "person", "place", "list", "task", "plan", "process"}
+_VALID_TYPES = {"note", "task", "plan", "process"}
 _VALID_SORTS = {"modified", "created", "alpha", "type"}
 
 
@@ -20,7 +20,7 @@ async def list_knowledge():
     """Return paginated knowledge objects with optional filtering.
 
     Query params:
-      type        — one of note|person|place|list (omit for all, excludes tasks)
+      type        — one of note|task|plan|process (omit for all)
       tags        — comma-separated tag filter (AND logic)
       sort        — modified|created|alpha|type (default: modified)
       q           — search query (semantic when provided, keyword fallback)

src/scribe/routes/notes.py

@@ -95,7 +95,6 @@ async def create_note_route():
             project_id = proj.id
 
     note_type = data.get("note_type", "note")
-    entity_meta = data.get("metadata") or None
 
     try:
         note = await create_note(
@@ -111,7 +110,6 @@ async def create_note_route():
             priority=priority,
             due_date=due_date,
             note_type=note_type,
-            entity_meta=entity_meta,
         )
     except ValueError as e:
         return jsonify({"error": str(e)}), 400
@@ -206,9 +204,6 @@ async def update_note_route(note_id: int):
     for key in ("title", "body", "description", "parent_id", "project_id", "milestone_id", "status", "priority", "note_type"):
         if key in data:
             fields[key] = data[key]
-    if "metadata" in data:
-        fields["entity_meta"] = data["metadata"] or None
-
     if "due_date" in data:
         if data["due_date"]:
             result = parse_iso_date(data["due_date"], "due_date")
@@ -248,8 +243,6 @@ async def patch_note_route(note_id: int):
     for key in ("title", "body", "description", "parent_id", "project_id", "milestone_id", "status", "priority", "note_type"):
         if key in data:
             fields[key] = data[key]
-    if "metadata" in data:
-        fields["entity_meta"] = data["metadata"] or None
     if "due_date" in data:
         if data["due_date"]:
             result = parse_iso_date(data["due_date"], "due_date")

src/scribe/routes/settings.py

@@ -1,47 +1,19 @@
-"""User settings + integrations (CalDAV, SearXNG status).
+"""User settings + integrations (SearXNG status).
 
 Chat-model picker endpoints (/models), KV-cache priming, and journal-schedule
 hooks were removed in Phase 8 alongside the chat/journal subsystems.
 """
-import ipaddress
 import logging
-import socket
-from urllib.parse import urlparse
 
 from quart import Blueprint, jsonify, request
 
 from scribe.auth import login_required, get_current_user_id
 from scribe.config import Config
-from scribe.services.caldav import CALDAV_SETTING_KEYS, get_caldav_config, test_connection
 from scribe.services.settings import delete_setting, get_all_settings, get_setting, set_settings_batch
 
 logger = logging.getLogger(__name__)
 
 
-def _is_private_url(url: str) -> bool:
-    """SSRF-blocking helper: returns True for URLs that resolve to private,
-    loopback, or link-local addresses. Inlined here after services/llm.py
-    (the original home) was removed in Phase 8."""
-    try:
-        host = urlparse(url).hostname
-        if not host:
-            return True
-        # Resolve to all addresses; reject if any is private/loopback/link-local.
-        infos = socket.getaddrinfo(host, None)
-        for family, *_rest, sockaddr in infos:
-            ip_str = sockaddr[0]
-            try:
-                ip = ipaddress.ip_address(ip_str)
-            except ValueError:
-                continue
-            if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved:
-                return True
-    except Exception:
-        # Conservative: if we can't resolve, treat as private (reject).
-        return True
-    return False
-
-
 settings_bp = Blueprint("settings", __name__, url_prefix="/api/settings")
 
 
@@ -76,52 +48,6 @@ async def update_settings_route():
     return jsonify(settings)
 
 
-@settings_bp.route("/caldav", methods=["GET"])
-@login_required
-async def get_caldav():
-    uid = get_current_user_id()
-    config = await get_caldav_config(uid)
-    if config.get("caldav_password"):
-        config["caldav_password"] = "********"
-    return jsonify(config)
-
-
-@settings_bp.route("/caldav", methods=["PUT"])
-@login_required
-async def update_caldav():
-    uid = get_current_user_id()
-    data = await request.get_json()
-
-    # Validate CalDAV URL before saving — block internal/private addresses
-    if "caldav_url" in data:
-        url = str(data.get("caldav_url") or "").strip()
-        if url:
-            parsed_scheme = url.split("://")[0].lower() if "://" in url else ""
-            if parsed_scheme not in ("http", "https"):
-                return jsonify({"error": "CalDAV URL must use http or https"}), 400
-            if _is_private_url(url):
-                return jsonify({"error": "CalDAV URL must not point to an internal or private address"}), 400
-
-    settings_to_save = {}
-    for key in CALDAV_SETTING_KEYS:
-        if key in data:
-            if key == "caldav_password" and data[key] == "********":
-                continue
-            settings_to_save[key] = str(data[key])
-
-    if settings_to_save:
-        await set_settings_batch(uid, settings_to_save)
-    return jsonify({"status": "ok"})
-
-
-@settings_bp.route("/caldav/test", methods=["POST"])
-@login_required
-async def test_caldav():
-    uid = get_current_user_id()
-    result = await test_connection(uid)
-    return jsonify(result)
-
-
 @settings_bp.route("/search", methods=["GET"])
 @login_required
 async def test_search():