update 0061/SESSION-0061.0-TRANSCRIPT-2026-06-01T10-28--INPROGRESS.md
This commit is contained in:
@@ -2,11 +2,9 @@
|
||||
|
||||
> Date: 2026-06-01
|
||||
> Start: 2026-06-01T10-28 (PST implied)
|
||||
> Status: **PLACEHOLDER — claimed at session start; finalized at session end.**
|
||||
>
|
||||
> This file reserves session ID 0061. The driver replaces this body
|
||||
> with the full transcript before publishing, and renames the file to
|
||||
> its final SESSION-0061.0-TRANSCRIPT-2026-06-01T10-28--<end>.md form.
|
||||
> Goal: launch-app Slice 3 — build `provision-vm` (§6.7) + `scaffold-gitea-repos`
|
||||
> (§6.8), then dogfood them against wiggle-snip to a verified pre-prod `/api/health`.
|
||||
> Status: **IN PROGRESS.**
|
||||
|
||||
---
|
||||
|
||||
@@ -39,5 +37,116 @@ Constraints: pre-prod single env (NO slots/ramp/promote/rollback); hard secrets
|
||||
rule (stdin-piped secret set only); gcloud isolation (CLOUDSDK_ACTIVE_CONFIG_NAME
|
||||
per-process); parallel preview-environments line shares flotilla-core (worktree if
|
||||
touched); spec-driven (cite section numbers); branch + PR (Gitea, no gh CLI).
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Plan
|
||||
|
||||
- [x] Read SPEC §2/§6.7/§6.8, ROADMAP Slice 3, SESSION-PROTOCOL; claim session ID (0061).
|
||||
- [x] Map exactly what the deploy substrate must be (flotilla-core deploy.py phases 2–8).
|
||||
- [x] Reconcile flotilla-core reality vs the launch prompt (see Arc 1 — prompt was off).
|
||||
- [x] Build `provision-vm` skill (SKILL.md + provision-runtime.sh + read-deployment-params.py).
|
||||
- [x] Build `scaffold-gitea-repos` skill (SKILL.md + init-and-push.sh).
|
||||
- [x] Dogfood step 1: `scaffold-gcp-project` for wiggle-snip → validate WARN→PASS (6/6 PASS).
|
||||
- [ ] Operator gestures: new billing account; Gitea repo push; Cloudflare DNS token.
|
||||
- [ ] Dogfood: APIs → VM → provision-runtime → deploy → green /api/health → prove no-op re-run.
|
||||
- [ ] Update launch-app ROADMAP (close Slice 3) + SPEC if needed; branch + Gitea PR.
|
||||
- [ ] Finalize + publish this transcript (handoff prompt to operator first).
|
||||
|
||||
---
|
||||
|
||||
## Pre-session state
|
||||
|
||||
- launch-app SPEC v0.0.2; ROADMAP Slice 1 + 2 closed. Skills present:
|
||||
`scaffold-gcp-project` (§6.5), `define-deployment` (§6.6).
|
||||
- `wiggle-snip` (`~/projects/wiggleverse/wiggle-snip`) is built + tested, NOT a git
|
||||
repo, with a `deployment.toml` that validated 5 PASS + 1 WARN (gcloud config absent).
|
||||
- gcloud active on-disk pointer: `benstull-infra` (left untouched all session).
|
||||
|
||||
---
|
||||
|
||||
## Turn-by-turn arc
|
||||
|
||||
### Arc 1 — flotilla-core reality vs the launch prompt
|
||||
|
||||
The launch prompt said "flotilla-core v0.3.0 on main, tagged v0.3.0, 371 tests" with
|
||||
the `deployment scaffold|validate|import` verbs. **The real world (SPEC §4.1 — read
|
||||
the world, don't trust a checkbox) is different and the prompt is advisory:**
|
||||
|
||||
- `main` = `333e0ff` **v0.2.0 (per-PR preview environments, SPEC §15)** — pushed to
|
||||
`origin/main`. It does **not** carry the scaffold/validate verbs.
|
||||
- The Slice-2 work lives on branch **`slice2-schema-validate`** (`9b15b2a`,
|
||||
"flotilla-core v0.3.0: deployment.toml scaffold + fail-closed validate") in the
|
||||
isolated worktree `~/projects/wiggleverse/flotilla-core-slice2`, **rebased on top
|
||||
of** the preview-environments `main`, pushed to `origin/slice2-schema-validate`.
|
||||
**Not merged to main, not tagged.**
|
||||
|
||||
So the "v0.3.0 on main, tagged" claim is ahead of reality — it's on the branch. This
|
||||
session did **not** touch the flotilla-core checkout (the parallel preview-environments
|
||||
line owns `main`); it only *used* the slice2 worktree's CLI for the validate gate.
|
||||
|
||||
### Arc 2 — Build the two skills
|
||||
|
||||
Studied `flotilla-core/deploy.py` to pin down exactly what the 9-phase deploy expects
|
||||
to find on the VM (phases 2–8): install dir is a git clone owned by the service user;
|
||||
`backend/.venv`; node/npm/git; a systemd unit; `https://<domain>/api/health` through
|
||||
nginx. The skills lay **exactly** that substrate, no more (the deploy itself fetches /
|
||||
builds / writes .env / starts the unit).
|
||||
|
||||
Built under `~/projects/wiggleverse/engineering/launch-app/skills/`:
|
||||
|
||||
- **`provision-vm/`** — `SKILL.md` (gate→probe→ask→create VM→install→key→clone→
|
||||
Cloudflare→explain), `assets/provision-runtime.sh` (idempotent on-VM installer:
|
||||
service user, apt runtime, deploy key born-on-VM for private repos, clone, venv,
|
||||
systemd unit, nginx + self-signed origin TLS), `assets/read-deployment-params.py`
|
||||
(emits shell exports from the canonical toml — single source of truth, no bash
|
||||
re-derivation). Handles public (anon HTTPS clone) and private (deploy-key SSH)
|
||||
repos; `REPO_PRIVATE` derived from whether the record carries `gitea_read_secret_ref`.
|
||||
IAP-only SSH firewall (:22 ← 35.235.240.0/20 only); :80/:443 ← Cloudflare ranges.
|
||||
- **`scaffold-gitea-repos/`** — `SKILL.md` (share-vs-own Gitea recorded via
|
||||
`gitea_host`; visibility + bot choice; create repo → push → tag `v<VERSION>`; bind
|
||||
read credential / register deploy key — all operator-run, never asks for token
|
||||
bytes), `assets/init-and-push.sh` (idempotent: create repo via API if missing,
|
||||
`git init` + first commit, point origin, push, tag — token read from `$GITEA_TOKEN`,
|
||||
never an arg).
|
||||
|
||||
Both shell assets pass `bash -n`; the param reader round-trips wiggle-snip's toml.
|
||||
|
||||
### Arc 3 — Dogfood step 1: GCP foundation for wiggle-snip
|
||||
|
||||
Operator chose **full live bring-up** on a **new** billing account. Drove
|
||||
`scaffold-gcp-project` for wiggle-snip:
|
||||
|
||||
- Created GCP project `wiggle-snip` under org `wiggleverse.org` (592336083752).
|
||||
- Created the dedicated `wiggle-snip` gcloud profile **`--no-activate`**; populated
|
||||
account/project/region/zone scoped by `CLOUDSDK_ACTIVE_CONFIG_NAME` only. **Verified
|
||||
the active pointer stayed `benstull-infra`** — the two-layer rule held.
|
||||
- Re-ran `deployment validate`: **6/6 PASS, the gcloud-project WARN cleared** — the
|
||||
§4.2 gate for `provision-vm` is green.
|
||||
|
||||
Blocked here on the operator plate (below): a **new billing account** is Console-only,
|
||||
and APIs/VM can't proceed until billing links.
|
||||
|
||||
---
|
||||
|
||||
## What lands on the operator's plate (current)
|
||||
|
||||
1. **New billing account** (Console-only) → give me the account ID (not a secret) so I
|
||||
link it, or link it yourself: `gcloud billing projects link wiggle-snip
|
||||
--billing-account=<ID>`.
|
||||
2. **Gitea repo push** — export a `$GITEA_TOKEN` with org repo-create scope and either
|
||||
run, or let me run, `scaffold-gitea-repos/assets/init-and-push.sh --app-dir
|
||||
~/projects/wiggleverse/wiggle-snip --repo wiggleverse/wiggle-snip` (public; no
|
||||
`--private`). Pushes + tags `v0.1.0`.
|
||||
3. **Cloudflare DNS** — a `$CF_API_TOKEN` + `$CF_ZONE_ID` in your env for the proxied
|
||||
A record `ppe.wiggle-snip.wiggleverse.org` → the VM IP, SSL mode Full (provision
|
||||
Step 6). Never pasted into the conversation.
|
||||
|
||||
---
|
||||
|
||||
## Prompt the operator can paste into the next Claude Code session
|
||||
|
||||
```
|
||||
(to be written at finalize)
|
||||
```
|
||||
|
||||
Reference in New Issue
Block a user