# Session 0036.0 — Transcript

> Date: 2026-05-29
> Goal: OHM roadmap driver. Verify live state; advance any genuinely
> unblocked item; the handoff flagged #21A (Amplitude deep audit) /
> #20B (email deliverability) as the cleanest work *if* now date-unblocked.
>
> Outcome: **No code shipped — and that was the right call.** The
> date-gated items (#21A empirical, #20B Phase B) are still gated to
> ~06-04 (today is 05-29). The one slice of #21A that needs *no* live
> data — the replay "Must mask" audit — turned out to be **already
> satisfied** by Amplitude's default mask level, so there was nothing to
> fix. Net deliverables: (1) ran the static slice of #21A Part A to a
> conclusion (taxonomy / consent / identify / replay-masking all verified
> clean); (2) corrected a subagent's over-reported "secret-field replay
> leak" before it could mislead a future session into over-masking;
> (3) reconciled two stale ROADMAP rows — struck #27 (it *was* deployed,
> deploys.id=33) and recorded the #21 static-audit findings. One commit
> to `ohm-rfc` (`6cf7e41`). OHM untouched, healthy at v0.29.0.

---

## Pre-session state

- **OHM live**: v0.29.0, `/api/health` → `{"version":"0.29.0","status":"ok"}`, deploys.id=40 (succeeded 2026-05-29 03:12). Healthy.
- **ohm-rfc pin** (`.rfc-app-version`): `0.29.0`. Matches live.
- **flotilla**: repo at v1.3.0; the installed `.venv` binary self-reports `1.1.0` (stale editable/install — cosmetic, the verbs all work; noted as a §19.2-ish nicety).
- **ohm-rfc shared checkout**: **dirty** — `M PHILOSOPHY.md`, untracked `OPERATIONAL-MODEL.md`. Not mine; another session/operator has in-progress work there. (Drove the worktree decision below.)
- **Other in-flight sessions** (per the claim script's scan of the published repo): stale `--INPROGRESS` placeholders for **0026** and **0027** (both dated 2026-05-28T13-46 — long abandoned). No overlap with this session.
- **Claimed**: session **0036** via `claim-session-id.sh` (placeholder pushed to `wiggleverse/ohm-session-history` at `fe468eb`).

---

## Turn-by-turn arc

### Arc 1 — Read in, verify live state

Read `ohm-rfc/ROADMAP.md` (all 2245 lines), `SESSION-PROTOCOL.md` §7 +
the start/end checklist, and CLAUDE.md. Verified live state directly:
`flotilla deploy status` → HTTP 200 v0.29.0; pin = 0.29.0; health ok.
Confirmed the handoff's picture.

Mapped the unblocked surface. Today is **2026-05-29**; the two
date-gates (#21A empirical taxonomy audit, #20B DMARC Phase B) both want
**≥1 week of data ⇒ ~06-04** — still in the future. #22 (consent copy)
needs operator-drafted + counsel copy. #31b needs operator screenshots.
#33 is operator-led repo moves. #34 is inventoried-and-recommend-close
(an operator acceptance, not mine to strike). So the only candidate for
autonomous work was the **non-data-gated slice of #21A Part A** — the
replay-masking / DOM-hygiene / prop-consistency audit, which is static
code analysis.

### Arc 2 — #21A static audit (Explore subagent) + a correction

Dispatched a read-only Explore subagent over `rfc-app` to map the
`@amplitude/unified` wrapper, the event taxonomy, and masking of
sensitive inputs. It came back with a dramatic report: OTC code field,
email inputs, beta first/last/why fields, and all RFC/PR/comment compose
textareas **unmasked** at `sessionReplay.sampleRate:1` — flagged
CRITICAL "secret-field replay leaks."

**I did not trust it.** The report's central premise was "only
`type=password` is masked by default" — that's the raw **rrweb**
default, not necessarily Amplitude's wrapper default. Getting the masking
API right is exactly the kind of fact to verify before shipping a "fix,"
so I fetched the Amplitude Session Replay privacy docs.

**The docs flipped the conclusion.** Amplitude's default
`defaultMaskLevel` is **`'medium'`**, which *"masks all form fields and
text inputs"* (textareas included) and *"captures all other text
as-is."* So at the current config:

- OTC code (`type=text`), passcode (`type=password`), all email inputs,
  beta first/last name, the beta "why" textarea, and **every**
  RFC/PR/comment compose textarea are **already masked**. The #21A
  "Must mask" list is **already satisfied** — there is no leak.
- The Turnstile widget is a **cross-origin iframe**; rrweb cannot record
  its contents regardless.
- The magic-link claim token lives in the URL, not the DOM; replay
  records DOM, not the URL bar.

The subagent's CRITICAL findings were false positives built on the wrong
default. The genuinely-OK areas it checked held up: event taxonomy is
consistent (Title-Case event names, snake_case props, kebab-case enum
values, **zero PII in props**), and consent-gating + identify-lifecycle
(identify-before-track on sign-in/invite-claim, `reset()` on sign-out)
are correct in `frontend/src/lib/analytics.js` + `App.jsx`.

**The one real, non-data-gated finding**: Medium captures *rendered*
page text as-is — submitted RFC bodies, displayed comments, and the
signed-in display name ("Welcome, Ben Stull.") appear in replays. The
roadmap explicitly frames this as a **per-surface privacy decision to
document in SPEC §21** — operator judgment, not an autonomous fix.
Masking it (Conservative level) would gut replay's usefulness; that
trade-off is the operator's to make, best made alongside the data-gated
empirical audit at ~06-04.

**Decision: ship no code.** There's no bug to fix, and the only open
item is an operator privacy decision. Shipping belt-and-suspenders
masking config to the live deploy unsupervised, for a non-bug, would be
over-reach. The honest, valuable outcome is to record the audit
conclusion and the correction so the next session doesn't chase it.

### Arc 3 — ROADMAP reconciliation (the real deliverable)

Two rows were stale and would mislead the next driver:

- **#27 (Haiku tag suggestions, v0.24.0)** said *"NOT YET DEPLOYED —
  deploys frozen behind the #1 VM-rename `/opt/ohm-app` blocker."* But
  `flotilla deploy log` shows **deploys.id=33, v0.24.0, succeeded
  2026-05-28 20:48:32**, and the code is live in v0.29.0. The "blocker"
  was already moot — #1 landed `/opt/ohm-rfc-app` back in Session 0022.0.
  And `flotilla secret list` confirms **`ANTHROPIC_API_KEY` is bound**
  (`wiggleverse-ohm/ohm-rfc-app-anthropic-api-key@latest`). Struck the
  row; left the #22 counsel-pass on the disclosure wording as a
  non-blocking open follow-up. (This is the exact stale-row trap the #19
  row already documented — a prior handoff recommended already-done work.)

- **#21 Part A** got the Session 0036 static-audit conclusion appended,
  including the over-reported-leak correction and the one open privacy
  decision.

Did the edit in an **isolated worktree** (`ohm-rfc-wt-0036`, off
`origin/main`) per the parallel-git discipline — the shared checkout was
dirty with another session's `PHILOSOPHY.md`/`OPERATIONAL-MODEL.md` work,
which I left untouched. Committed (`033b049`), rebased on latest
`origin/main`, pushed `HEAD:main` → **`6cf7e41`**. Removed the worktree +
temp branch. Verified the shared checkout's dirty state survived
(now just `behind 1`).

---

## Cut state (end of session)

| | |
| --- | --- |
| ohm-rfc | `6cf7e41` — ROADMAP reconcile: #27 struck (deployed), #21 Part-A static audit recorded. No pin change. |
| rfc-app | untouched — `8a94e26` (v0.29.0) |
| flotilla | untouched — v1.3.0 |
| OHM live | deploys.id=40, v0.29.0, **healthy** |
| ohm-rfc pin | 0.29.0 (unchanged) |
| ohm-rfc shared checkout | dirty work preserved (`PHILOSOPHY.md` / `OPERATIONAL-MODEL.md`), now `behind 1` — owner should `git pull --rebase` |

| Item ledger | Status |
| --- | --- |
| #27 Haiku tags (v0.24.0) | ✅ already shipped + deployed (deploys.id=33) — ROADMAP now reflects it |
| #21A Part A — static slice | ✅ audited clean; must-mask already satisfied; no fix needed |
| #21A Part A — empirical + rendered-text privacy decision | ⏸ gated to ~06-04 (live data) + operator privacy call |
| #20B DMARC Phase B | ⏸ gated to ~06-04 (≥1wk clean `rua` data) |
| #22, #31b, #33, #34 | ⏸ operator-led / operator-gated |

---

## §19.2 / process candidates surfaced

1. **Subagent fact-check discipline.** A read-only Explore subagent
   confidently reported CRITICAL replay leaks based on a wrong assumption
   about a third-party SDK's default. The driver caught it only by
   verifying against vendor docs. Lesson (already implicit, worth
   restating): subagent findings about external-library *behavior* are
   hypotheses to verify, not conclusions to act on — especially before a
   live deploy.

2. **Stale `.venv` flotilla binary.** The installed
   `ohm-rfc-app-flotilla` self-reports `1.1.0` while the repo is at
   v1.3.0. Harmless today (verbs work), but a `pip install -e .` refresh
   would stop the version string from lying. Minor ops nicety.

3. **Abandoned `--INPROGRESS` placeholders (0026, 0027).** Two claimed-
   but-never-finalized slots from 2026-05-28T13-46 linger in the
   published repo. Per §7 they're harmless (numbers never reused), but a
   periodic sweep to either finalize-or-tombstone abandoned claims would
   keep the sessions browser (#30) tidy.

---

## What lands on the operator's plate

1. **#21A rendered-text privacy decision** (the only non-data-gated
   Part-A item): Amplitude session replay currently records *rendered*
   page text as-is (RFC bodies, comments, your display name) — inputs are
   already masked. Decide per-surface whether that's acceptable and
   document the call in SPEC §21. Best made alongside the empirical audit
   at ~06-04.

2. **#27 disclosure wording** (non-blocking): the Anthropic disclosure on
   the propose-RFC modal already ships and is honest; the #22 counsel
   pass on its wording still applies — fold it into #22's broader copy
   review rather than treat it as a separate gesture.

3. **ohm-rfc shared checkout**: your in-progress `PHILOSOPHY.md` /
   `OPERATIONAL-MODEL.md` work is intact but `behind 1` after this
   session's push — `git pull --rebase` when you pick it back up.

4. **Nothing else changed.** No deploy, no secret, no pin move this
   session.

---

## Prompt the operator can paste into the next Claude Code session

```
OHM roadmap driver, parallel-safe. Claim your own ID first (advisory);
read ohm-infra/SESSION-PROTOCOL §7 + ohm-rfc/ROADMAP.md; verify live state.

STATE (end of 0036): OHM live at v0.29.0 (deploys.id=40, healthy), pin
0.29.0, flotilla v1.3.0. Session 0036 shipped NO code — it verified state,
ran the static (no-data-needed) slice of #21A Part A to a clean
conclusion, and reconciled two stale ROADMAP rows (struck #27 — it WAS
deployed, deploys.id=33, ANTHROPIC_API_KEY bound; recorded #21 Part-A
findings). One ohm-rfc commit: 6cf7e41.

KEY #21A FINDING for the next driver: the replay "Must mask" list is
ALREADY satisfied — @amplitude/unified defaults to defaultMaskLevel
'medium', which masks all form fields + textareas (OTC/passcode/email/
beta-why/compose all masked at sampleRate:1); Turnstile is a cross-origin
iframe. DO NOT "fix" replay masking — a subagent over-reported leaks
assuming rrweb's password-only default; the wrapper default already
covers it. The ONLY open static item is an OPERATOR privacy decision:
Medium captures RENDERED text as-is (RFC bodies, comments, display name).

Still blocked: #21A empirical taxonomy audit + #20B DMARC Phase B are
date-gated — they want ~1 week of data (≈06-04); check the calendar and
the rua reports before picking them. #22 needs operator-drafted +
counsel copy; #31b needs operator screenshots; #33 operator-led repo
moves; #34 inventoried (recommend-close — an operator acceptance).

If 06-04 has arrived: #21A Part A (empirical taxonomy + the rendered-text
SPEC §21 decision, with the optional defense-in-depth of making
defaultMaskLevel:'medium' explicit + blockSelector:['.turnstile-widget'])
and #20B Phase B (DMARC p=none → p=quarantine) are the cleanest work.

Heads-up: ohm-rfc's shared checkout may carry another session's dirty
PHILOSOPHY.md/OPERATIONAL-MODEL.md work — use an isolated worktree for
any git mutation. Hard rules unchanged: never ask for secret bytes;
transcript is the final step; deliver the next handoff in chat before
publishing.
```

---

## Session close

Operator reviewed the handoff in chat and called the session. No further
work followed the ROADMAP reconcile — this re-finalize only stamps the
true end time and records the close. Cut state above stands: OHM healthy
at v0.29.0, ohm-rfc at `6cf7e41`, no deploy/secret/pin change.
