add engineering/0001/SESSION-0001.0-TRANSCRIPT-2026-06-03T16-59--2026-06-03T18-27.md + replace placeholder/variant SESSION-0001.0-TRANSCRIPT-2026-06-03T16-59--INPROGRESS.md

engineering/0001/SESSION-0001.0-TRANSCRIPT-2026-06-03T16-59--2026-06-03T18-27.md

@@ -0,0 +1,134 @@
+# Session 0001.0 — Transcript
+
+> App: engineering
+> Date: 2026-06-03 (PST) · Start 16-59 · End 18-27
+> Goal: ship dev-env v0.2 — the single-file HTTPS bootstrap (SPEC §8.3).
+> Outcome: **shipped + merged to main** (PR #7, merge commit 9ae325d). Also
+> registered `engineering` as an app (app.json) — this was the first session
+> claimed through it.
+
+This is the first session for the `engineering` app: registering it for session
+tracking was a prerequisite, resolved at session start.
+
+## Plan
+
+Working branch `dev-env-v0.2-https-bootstrap` off `main`, in an isolated worktree
+(the shared engineering checkout was held on a `slice3-*` branch by a concurrent
+session). Two operator decisions, resolved up front via AskUserQuestion:
+
+1. **Register engineering as an app first.** It had no `app.json`, so the
+   session-claim tooling could not resolve where its transcripts live. Created
+   `engineering/app.json` (One Name `engineering`; sessions → the shared
+   `wiggleverse/session-history` repo, subdir `engineering`, numeric /
+   folder-per-session / public).
+2. **Bootstrap shape = single file + local self-update.** Build the amalgamated
+   single file (committed at `dev-env/dist/wgl-devenv`, grabbable over HTTPS via a
+   Gitea raw/ZIP mirror — no special host pinned). It embeds the bootstrap-subset
+   runbooks (`base-tools` + `git-ssh`) so a bare laptop runs `doctor` + `git-ssh`.
+   `self-update` auto-discovers the local engineering clone and `git pull`s over
+   SSH to refresh the full runbook set (the HTTPS-then-SSH carve-out, SPEC §8.3).
+
+## Pre-session state
+
+- dev-env v0.1 was merged to `main` (PR #4): the doc-as-program engine + 4
+  onboarding runbooks (`base-tools` → `git-ssh` → `repo-layout` →
+  `claude-context`), 32-test stdlib `unittest` suite, the `ShellExecutor` DI seam,
+  the secret-in-auto-fix lint, PASS/WARN/FAIL/SKIP, idempotency.
+- SPEC was at `v0.0.1`; §8.3 deferred the single-file HTTPS bootstrap to v0.2.
+- `engineering` was unregistered (no `app.json` anywhere).
+- A concurrent session held the shared engineering checkout on
+  `slice3-provision-vm-scaffold-gitea`.
+
+## Turn-by-turn arc
+
+1. **Session init.** Computed start (16-59 PST). The claim script could not
+   resolve the app — `engineering` had no `app.json`. (Gotcha surfaced: the
+   claim/publish scripts are now plugin-based at
+   `~/.claude/plugins/cache/wiggleverse-dev-claude-plugin/.../skills/wgl-session-common/scripts/`,
+   not the old `~/.claude/skills/...` path.)
+2. **Read the SPEC/ROADMAP + the whole v0.1 package** to ground the design.
+3. **Two operator questions** (AskUserQuestion): (a) how to handle the unregistered
+   app → *register engineering first*; (b) HTTPS hosting → the operator redirected
+   to "expect the engineering repo locally and pull from that," so a third focused
+   question locked the shape → *single file + local self-update*.
+4. **Registered engineering**: relocated the worktree under `~/git` so the new
+   `app.json` was discoverable, wrote it, dry-ran then **claimed session 0001**
+   (pushed the placeholder to `wiggleverse/session-history`).
+5. **Spec-first**: SPEC → `v0.0.2` — §8.3 two obtain-stories over one source of
+   truth; §8.4 generated-not-forked single file + drift guard; §8.5 bootstrap
+   subset + self-update; §5.6 the `self-update` verb; §1.3 updated to admit
+   `self-update` as a mutating verb. ROADMAP → v0.2 shipped.
+6. **Build**: `tools/amalgamate.py` (inlines the `devenv` modules **verbatim** via
+   a `sys.meta_path` finder + embeds the bootstrap subset → `dist/wgl-devenv`);
+   `devenv/bootstrap.py` (single-file orchestration + runbook resolution: override
+   → local clone → cache → embedded); `devenv/selfupdate.py` (`git pull` through
+   the executor seam); `devenv/__main__.py` (makes `python3 -m devenv` work — a
+   latent v0.1 README/bug gap); README + pyproject + .gitignore (track only
+   `dist/wgl-devenv`).
+7. **Tests**: +16 (amalgamation drift/round-trip, runbook resolution, self-update
+   via `FakeExecutor`) → **48 green**; `subprocess` still only in `executor.py`.
+   Smoke-tested the single file copied to `/tmp`: `doctor` 2/2 PASS,
+   `run git-ssh --dry-run`, `self-update` fail-loud remediation. (One real-git
+   end-to-end smoke test of `self-update` was denied by the sandbox; covered
+   instead by the FakeExecutor unit tests + the proven SubprocessExecutor path.)
+8. **Push + PR #7** (SSH-only, push-before-review). Created via the Gitea API
+   helper (this is Gitea, not GitHub).
+9. **Finalize (this wrap-up).** `main` had advanced — PR #6 ("retire the per-app
+   operator-cli repo role") merged while this work was in flight. Checked: it
+   touched only `README.md`; the schema `contains` enum still has `operator-cli`,
+   so the `app.json` tag stayed valid. Gitea recomputed `mergeable` → True.
+   **Merged PR #7** (merge commit, delete branch), cleaned up the worktree + local
+   branch, updated memory.
+
+## Cut state (end of session)
+
+| Commit | Where | What |
+|---|---|---|
+| `6619c3b` | merged via #7 | Register engineering as an app (`app.json`) |
+| `e4c06c6` | merged via #7 | dev-env v0.2: the single-file HTTPS bootstrap |
+| `9ae325d` | `origin/main` | Merge commit for PR #7 |
+
+- **PR #7 merged**, branch `dev-env-v0.2-https-bootstrap` deleted (remote + local),
+  worktree `engineering-v0.2` removed.
+- `main` is at `9ae325d`; v0.2 artifacts present (`dev-env/dist/wgl-devenv`,
+  `dev-env/tools/amalgamate.py`, `devenv/bootstrap.py`, `devenv/selfupdate.py`,
+  `app.json`).
+- The concurrent `slice3-provision-vm-scaffold-gitea` checkout was left untouched.
+- 48 tests green at merge.
+
+## What lands on the operator's plate
+
+- **Nothing blocking.** v0.2 is merged.
+- **Hosting is a deliberate ops detail (not wired):** `dist/wgl-devenv` is on
+  `main`, but no public HTTPS URL is published yet. To actually hand a bare laptop
+  the `curl -fsSL <url>/wgl-devenv` line, decide where a readable mirror exposes
+  the file (a readable Gitea raw/ZIP URL, or a public mirror) and confirm that URL
+  serves it.
+- **Deferred follow-up (flagged as a task chip):** the `engineering` repo root has
+  no `CLAUDE.md` importing `@~/.claude/wiggleverse.md` (the always-on org-context
+  wiring). Left out to keep PR #7 focused; worth a tiny separate PR.
+
+## Prompt the operator can paste into the next session
+
+```
+Open dev-env v0.3 — the cloud + credentials runbooks. Run
+/wgl-coding-session-init first (engineering is now a registered app — it'll claim
+engineering/0002).
+
+The dev-env CLI lives at engineering/dev-env/ on main (v0.1 + v0.2 shipped). Read
+dev-env/SPEC.md (esp. §6.3 the hard-secrets rule, §2.3 `fix manual`) and
+dev-env/ROADMAP.md (v0.3); see memory [[project_dev_env_cli]].
+
+Goal: author two new runbooks — gcloud/ADC (the dedicated-profile-per-deployment
+awareness, guide §8.4) and the Keychain Gitea-token runbook — both as `fix manual`
+for the secret gestures (no secret bytes ever auto-run; the §5.5 lint enforces
+it). The engine already supports them; this slice is runbook content + harvesting
+the exact checks. Wire them into the `requires` DAG after git-ssh.
+
+The single-file bootstrap subset stays base-tools + git-ssh; v0.3 runbooks are
+full-set-only (fetched via self-update), so you only rebuild dist/wgl-devenv if you
+change an embedded module or embedded runbook (a drift test enforces it). Keep the
+suite green. Spec-first only if you touch invariants. Branch off main → PR (push
+before review; SSH-only git). Use an isolated worktree (the slice3 session may
+still hold the shared checkout).
+```

engineering/0001/SESSION-0001.0-TRANSCRIPT-2026-06-03T16-59--INPROGRESS.md

@@ -1,20 +0,0 @@
-# Session 0001.0 — Transcript
-
-> App: engineering
-> Start: 2026-06-03T16-59 (PST)
-> Status: **PLACEHOLDER — claimed at session start; finalized at session end.**
->
-> This file reserves session ID 0001 for engineering. The driver replaces this
-> body with the full transcript and renames the file to its final
-> SESSION-0001.0-TRANSCRIPT-2026-06-03T16-59--<end>.md form at session end.
-
-## Launch prompt
-
-```
-Start dev-env v0.2 — the single-file HTTPS bootstrap.
-
-Build v0.2 of the dev-env CLI (engineering/dev-env/; v0.1 on main). Goal (SPEC §8.3): resolve the chicken-and-egg — the tool sets up git/SSH but a brand-new laptop has neither. Deliver a single, self-contained stdlib Python file an engineer can fetch over HTTPS and run with zero install on stock macOS python3 >= 3.9. That one file must run doctor and the git-ssh runbook; once SSH works, --self-update re-obtains the full runbook set over SSH (the sanctioned HTTPS-then-SSH carve-out).
-
-Constraints: don't regress v0.1 (package layout + 32-test suite green; single-file generated from the devenv package via an amalgamate build step, not a hand fork). Hold every v1 invariant: pure stdlib, ShellExecutor DI seam, hard-secrets-rule lint, PASS/WARN/FAIL/SKIP, idempotency. Bump SPEC to v0.0.2 recording the bootstrap decision; move v0.2 to shipped in ROADMAP. Spec-first, then build; branch off main -> PR (push before review; SSH-only). Isolated worktree (concurrent session holds engineering on slice3-*). Open question: where the HTTPS-fetchable file is hosted.
-
-```