add wiggleverse-www/0011/SESSION-0011.0-TRANSCRIPT-2026-06-11T08-10--2026-06-11T08-20.md + replace placeholder/variant SESSION-0011.0-TRANSCRIPT-2026-06-11T08-10--INPROGRESS.md

wiggleverse-www/0011/SESSION-0011.0-TRANSCRIPT-2026-06-11T08-10--2026-06-11T08-20.md

@@ -0,0 +1,75 @@
+# Session 0011.0 — Transcript
+
+> App: wiggleverse-www
+> Start: 2026-06-11T08-10 (PST)
+> End: 2026-06-11T08-20 (PST)
+> Type: planning-and-executing
+> Claude-Session: 75ed8255-3a55-4049-b438-f3e571918074
+> Status: FINALIZED
+
+## Launch prompt
+
+```
+Find the right scoped token in a secret and use it instead of the OHM bot's
+```
+
+## Plan
+
+> Anchor: direct operator instruction (least-privilege follow-up to session
+> 0010's deferred token-choice decision) — treated as a leaf `task`.
+
+Replace the org-owner-grade token in `wgl-www-finances-git-token` with a
+narrower one found in an existing secret; if none exists, propose the
+least-privilege alternative.
+
+## Pre-state
+
+- Session 0010 left `wgl-www-finances-git-token` v1 = a copy of
+  `ohm-rfc-app-gitea-bot-token`, flagged in its deferred decisions as broader
+  than the job needs.
+
+## Arc
+
+1. **Claimed session 0011.**
+2. **Audited every token-shaped secret across the org's GCP projects**
+   (wiggleverse-ohm, wiggleverse, wiggleverse-ecomm, wiggle-snip, rfc-app-ppe,
+   wiggleverse-ecomm-bdd-app). Probes kept bytes in-process; scope was read from
+   the API's scope-error messages, never from the token itself.
+3. **Findings:** no narrowly-scoped write token exists anywhere.
+   - `ohm-rfc-app-gitea-bot-token` and `planner-planner-gitea-token`: different
+     bytes, both `write:repository`, both **org-owner-grade** — admin/push on
+     `wiggleverse-org/corp`, `wiggleverse/session-history`,
+     `wiggleverse/ohm-content`, `wiggleverse/engineering`, and www.
+   - `*-gitea-read-token` ×4: read-only, cannot push.
+   - `wgl-gitea-issue-token`: `write:issue` only.
+   - `planner-planner-token`: not a valid Gitea credential.
+4. **Proposed the least-privilege path** (dedicated `finances-bot` user → write
+   collaborator on only wiggleverse-www → token minted on it → secret v2 →
+   verify → destroy v1) and handed the operator the stdin command.
+5. **Operator decision: DECLINED the bot — keep the current token** ("tokens are
+   gitea-wide; the write-repo token you have is as good as it gets"). Noted: a
+   dedicated bot user would effectively repo-scope it (the user's access is the
+   boundary), but the decision stands and is recorded in memory — don't re-raise
+   unless asked.
+
+## Cut state
+
+- No code, config, or cloud changes this session — audit + decision only.
+- `wgl-www-finances-git-token` stays at v1 (the OHM org-owner token); the
+  Cloud Run job is unchanged and verified from session 0010.
+- `main` = `3523623`, clean; no open PRs.
+
+## Deferred decisions
+
+- None — the one open call (token breadth) was decided explicitly by the
+  operator this session.
+
+## Operator plate
+
+- Unchanged from 0010: issue #11 (~Aug 1 activation), issue #9 (IRS letter).
+
+## Next-session prompt
+
+```
+/goal Work issue #7 — reframe the home "Builder" router card and the partner-page "developer" teasers to match the Give pitch (hands-on, business- and product-minded software architects, fully agentic spec-driven shop)
+```

wiggleverse-www/0011/SESSION-0011.0-TRANSCRIPT-2026-06-11T08-10--INPROGRESS.md

@@ -1,49 +0,0 @@
-# Session 0011.0 — Transcript
-
-> App: wiggleverse-www
-> Start: 2026-06-11T08-10 (PST)
-> Type: planning-and-executing
-> Claude-Session: 75ed8255-3a55-4049-b438-f3e571918074
-> Status: **PLACEHOLDER — claimed at session start; finalized at session end.**
->
-> This file reserves session ID 0011 for wiggleverse-www. The driver replaces this
-> body with the full transcript and renames the file to its final
-> SESSION-0011.0-TRANSCRIPT-2026-06-11T08-10--<end>.md form at session end.
-
-## Launch prompt
-
-```
-Find the right scoped token in a secret and use it instead of the OHM bot's
-
-```
-
-## Plan
-
-> Anchor: direct operator instruction (least-privilege follow-up to session 0010's
-> deferred token-choice decision) — treated as a leaf `task`.
-
-Replace the org-owner-grade token in `wgl-www-finances-git-token` with one minted
-on a dedicated `finances-bot` Gitea user whose only access is wiggleverse-www.
-
-## State (checkpoint, 2026-06-11 ~08:20 PST)
-
-- AUDIT DONE: no narrowly-scoped write token exists in ANY org project's secrets.
-  `ohm-rfc-app-gitea-bot-token` and `planner-planner-gitea-token` are different
-  bytes but BOTH org-owner-grade (admin/push on wiggleverse-org/corp,
-  session-history, ohm-content, engineering, www). Read tokens can't push;
-  `wgl-gitea-issue-token` is issue-scoped. `planner-planner-token` is not a valid
-  Gitea token. Probes leaked no bytes (scope read via the /user error message).
-- PLAN AGREED with operator: (1) operator creates `finances-bot` user (admin UI)
-  and mints a write:repository token on it; (2) agent grants the bot write on
-  wiggleverse/wiggleverse-www only (Keychain admin API token); (3) operator adds
-  the token as version 2 of `wgl-www-finances-git-token` via stdin (command
-  handed over); (4) agent re-probes breadth (should see exactly one repo),
-  runs the in-cloud DRY_RUN execution, then DESTROYS version 1 (broad token —
-  its bytes remain safe in its original ohm secret).
-- WAITING on the operator's gestures (1) and (3). Job reads `:latest`, so the
-  swap needs no job update.
-
-## Deferred decisions
-
-_None yet this session._
-