# Session 0057.0 — Transcript > Date: 2026-06-01 > Goal: launch-app Slice 1 — extract `flotilla-core` from `ohm-rfc-app-flotilla`, > de-OHM it, and prove OHM still deploys through it (launch-app SPEC §7). > > Outcome: **Slice 1 verified green.** The extraction was already committed when > this session opened (`flotilla-core` v0.1.0 + `ohm-rfc-app-flotilla` v1.8.0 thin > shim, roadmap marked DONE, SPEC-feedback note written). This session's > contribution was **independent end-to-end re-verification against OHM's live > deployment**, pushing the feature branch to origin (it was local-only), and > producing the Slice 2 handoff. No code was changed; no transcript-affecting > secret ever entered the session. > > Highlights: > - flotilla-core 315 tests green; OHM shim 7 tests green. > - §7.3 regression oracle proven against the **live** OHM VM: live state DB read > unchanged, live pin `0.31.3` validated against the de-OHM'd `(0,2,3)` floor, 8 > secret refs resolved (zero bytes), live `/api/health` → HTTP 200 v0.31.3 ok. > - Branch `slice1-extract-flotilla-core` pushed to origin; PR not yet opened/merged. > - SPEC feedback (8 items) captured in `launch-app/SLICE-1-SPEC-FEEDBACK.md`; the > load-bearing one is §5.2 (the engine needs a state store, not just the toml). --- ## Pre-session state This session is anchored in `ohm-rfc-app-flotilla`. The launch prompt was the Slice 1 brief from `launch-app/ROADMAP.md` ("extract flotilla-core, de-OHM, prove OHM still deploys"). When the session opened, the work was **already committed**: | Repo / artifact | State at session open | | --- | --- | | `~/projects/wiggleverse/flotilla-core` | `cf22fc8` — flotilla-core **v0.1.0**, package `flotilla_core`, 315 tests, CI under `.gitea/workflows/test.yml`. **No git remote configured.** | | `ohm-rfc-app-flotilla` branch `slice1-extract-flotilla-core` | `8c03538` — **v1.8.0**, reduced to a 3-file thin shim (`__init__`, `context.py`, `cli.py`) + 7 shim tests; `-9120/+283` vs `main`. 1 ahead / 0 behind `main`. **Local-only (not pushed).** | | `ohm-rfc-app-flotilla` `main` | still the pre-extraction fat package. | | `launch-app/ROADMAP.md` | Slice 1 already marked ✅ DONE (2026-06-01). | | `launch-app/SLICE-1-SPEC-FEEDBACK.md` | already written (8 items). | | OHM live | deployed v0.31.3, healthy; pin `0.31.3`. | So the build work predates this session's visible context (a prior run earlier today). This session treated the on-disk state as **unverified** and re-checked every load-bearing claim rather than trusting the roadmap checkbox (SPEC §4.1 spirit: read the world, don't trust a checkbox). --- ## Plan - [x] Read the suite SPEC (§5, §7, §9, §10), ROADMAP Slice 1, the SPEC-feedback note. - [x] Verify both test suites actually pass (flotilla-core + OHM shim). - [x] Confirm flotilla-core carries **no** OHM/rfc-app behavioral defaults (§7.2). - [x] Run the §7.3 "OHM-still-deploys" proof against OHM's **live** deployment. - [x] Push the feature branch so a PR can be opened. - [x] Surface the open operator gestures + deliver the Slice 2 handoff prompt. --- ## Turn-by-turn arc ### Arc 1 — read the rulebook, reconcile the surprise Read `launch-app/SPEC.md` (§7 flotilla-core, §5 deployment.toml contract, §9 invariants, §10 out-of-scope), the ROADMAP (Slice 1), and the rulebook (`engineering/README.md`). Hit the surprise immediately: `git log` showed `8c03538 flotilla v1.8.0: become a thin shim over flotilla-core` and the roadmap already read ✅ DONE. Decided the honest move was to **verify, not rebuild** — and to be transparent that the build predates this session. ### Arc 2 — verify the extraction is real and the shim is thin - `flotilla-core`: `.venv/bin/python -m pytest -q` → **315 passed**. - OHM shim: flotilla-core is editable-installed (`Editable project location: …/flotilla-core`); `pytest -q` → **7 passed**. - Read the shim: `context.py` builds an `OHM_CONTEXT` (`AppContext`) carrying OHM's historical names (`~/.ohm-rfc-app-flotilla` / `ohm-rfc-app-flotilla.db` / `OHM_RFC_APP_FLOTILLA_DATA_DIR`), the pin floor `(0,2,3)`, the rfc-app lockfile paths, and the user-agent; `cli.py` just calls `flotilla_core.cli.build_cli(OHM_CONTEXT)`. - Grepped flotilla-core for leaked app-specifics: the only OHM/rfc-app strings left are **docstrings** and the **org-wide** `git.wiggleverse.org` Gitea default (generic, override-able via `pin_source_host` / `[app].gitea_host`). `DEFAULT_CONTEXT` has **no pin floor** and neutral `flotilla` names. §7.2 holds. ### Arc 3 — the §7.3 regression oracle, against the LIVE deployment The real proof is not the new tests — it's OHM's existing deployment working through the core unchanged. Ran read-only / dry gestures through the **shim CLI** against OHM's live state (gcloud pinned via `CLOUDSDK_ACTIVE_CONFIG_NAME=wiggleverse`): | Seam | Command | Result | | --- | --- | --- | | Live state DB | `deployment show ohm-rfc-app` | full record read unchanged — `pin_source_*`, `corpus_repo`, `app_source_repo=ben.stull/rfc-app`, `gitea_read_secret_ref=wiggleverse-ohm/ohm-rfc-app-gitea-read-token` | | Live pin (real Gitea + private read-token via gcloud) | `pin show ohm-rfc-app` | **0.31.3** — fetched + validated against the de-OHM'd `(0,2,3)` floor | | Secret refs | `secret list ohm-rfc-app` | 8 references (ANTHROPIC_API_KEY … WEBHOOK_EMAIL_BOUNCE_SECRET) — **zero bytes** (§8.3) | | Live health | `deploy status ohm-rfc-app` | **HTTP 200 version=0.31.3 status=ok** | | Full 9-phase walk (stubbed) | shim test `test_full_deploy_walks_all_nine_phases` | phases 1–9 all `succeeded`, "deployed v0.3.0" | Live pin (`0.31.3`) and live health version (`0.31.3`) match — the running OHM deployment reasons end-to-end through the extracted engine unchanged. §7.3 met. ### Arc 4 — push the branch, surface the plate, hand off The feature branch was local-only. Pushed it: `git push -u origin slice1-extract-flotilla-core` (Gitea printed the PR-create link). Did **not** open the PR or create the flotilla-core remote — both are operator gestures (SPEC §8.4: repo-creation/merge is operator-only), and merging the shim before flotilla-core is consumable would leave `main` unable to resolve `flotilla-core>=0.1.0`. Delivered the open follow-ups and the Slice 2 prompt in chat (handoff before publish, per protocol §3). --- ## Cut state (end of session) | | | | --- | --- | | `flotilla-core` | `cf22fc8` v0.1.0 — 315 tests green; **local-only, no remote yet** | | `ohm-rfc-app-flotilla` | branch `slice1-extract-flotilla-core` @ `8c03538` v1.8.0 — **pushed to origin**; PR not opened; not merged to `main` | | `ohm-rfc-app-flotilla` `main` | unchanged (pre-extraction fat package) | | OHM live | **untouched** — deploys v0.31.3, healthy (read-only verification only) | | ohm-rfc pin | `0.31.3` (unchanged) | | `launch-app/SLICE-1-SPEC-FEEDBACK.md` | present, 8 items | | Slice 1 ledger | Status | | --- | --- | | Extract generic 9-phase engine → `flotilla-core` consuming `deployment.toml` | ✅ done (pre-session), verified | | De-OHM: drop rfc-app pin floor → optional config | ✅ (floor now on `OHM_CONTEXT`; `DEFAULT_CONTEXT` has none) | | De-OHM: generalize audit lockfiles | ✅ (lockfile paths on `AppContext`) | | De-OHM: parameterize data-dir / DB-filename / user-agent | ✅ (all on `AppContext`) | | §7.3 OHM-still-deploys proof | ✅ verified against live OHM | | Push branch + open PR | 🟡 branch pushed; PR + merge on operator plate | --- ## §19.2 / SPEC candidates surfaced All captured in `engineering/launch-app/SLICE-1-SPEC-FEEDBACK.md` — must be settled in the SPEC before/as part of Slice 2: 1. **§5.2 too strong (biggest gap):** the engine needs a separate local **state store** (deploy history, health snapshots, the in-progress deploy lock) — not reconstructable from `deployment.toml`. §5.2 should say config comes from the toml but the core owns its own state store. 2. **§3.2/§5.1 canonicity:** is `deployment.toml` re-read each deploy, or imported once into the registry? Slice 1 shipped one-time import + left OHM registry-canonical. Recommendation: toml-canonical for new apps. 3. **§5.1 missing Gitea host** for the pin read (defaulted to `git.wiggleverse.org`). 4. **§5.1 missing private-repo read token** (`gitea_read_secret_ref`) — distinct from `[secrets]`; it's flotilla's own read credential. 5. **§5.1 collapses content-repo vs source-repo** into one `repo`; fine for a single-repo app (wiggle-snip) but the SPEC should say so; OHM's split is grandfathered. 6. **§5.3 needs a new read-only `gcloud config configurations describe`** capability to check `vm.project == gcloud_config project` (the existing guard only checks the name). 7. **§3.3/§5.3 One-Name `-ppe` derivation** is a new pre-prod convention, not a universal invariant; `validate` applies only to `define-deployment`-authored records. 8. **§7.1 "9-phase engine" undersells it:** the extraction also pulled in pin, secrets, audit, webhooks, plan — it's "the operator-CLI engine." Minor wording. --- ## What lands on the operator's plate Hard ordering — **do not merge the shim before #1**, or a from-scratch install of `main` can't resolve `flotilla-core>=0.1.0`. 1. **Publish flotilla-core** (no remote yet). Create the Gitea repo, then: ```bash cd ~/projects/wiggleverse/flotilla-core git remote add origin ssh://git@git.wiggleverse.org:2222/wiggleverse/flotilla-core.git git push -u origin main ``` Then decide how the shim consumes it (tagged release vs `git+ssh` pin) and update `ohm-rfc-app-flotilla/pyproject.toml` (`flotilla-core>=0.1.0`, currently satisfied only by the local editable install). 2. **Open + merge the shim PR** to `main` (Gitea web) — *after* #1. Link: https://git.wiggleverse.org/wiggleverse/ohm-rfc-app-flotilla/pulls/new/slice1-extract-flotilla-core 3. **Patchwatch runner image** (`runner/Dockerfile`) needs `flotilla-core` in its build context before its next rebuild. (This session did not create the flotilla-core remote or merge — operator-only.) --- ## Prompt the operator can paste into the next Claude Code session ``` # launch-app Slice 2 — deployment.toml schema + define-deployment (SPEC §5, §6.6) Reserve your own session ID (claim-session-id.sh) — the number is advisory. Slice 1 is done and verified: flotilla-core v0.1.0 is extracted at ~/projects/wiggleverse/flotilla-core (315 tests green), ohm-rfc-app-flotilla is a thin shim over it (v1.8.0, branch slice1-extract-flotilla-core pushed, PR NOT yet opened/merged), and OHM re-deploys through the core unchanged (live DB + pin 0.31.3 + 8 secret refs + live /api/health 200 all proven, Session 0057). ## Read first - SPEC: ~/projects/wiggleverse/engineering/launch-app/SPEC.md (§5 contract, §5.3 validation, §6.6, §8 UX) - Roadmap: ~/projects/wiggleverse/engineering/launch-app/ROADMAP.md (Slice 2) - **SLICE-1-SPEC-FEEDBACK.md (same dir)** — 8 issues that MUST be settled in the SPEC before/as part of this slice. - The core's loader: flotilla-core/flotilla_core/deployment_toml.py (load() + sync_to_registry() shipped in Slice 1) and registry.py. - Fixture: ~/projects/wiggleverse/wiggle-snip (single-repo app — the §5.1 happy path). ## Task 1. FIRST correct the SPEC per SLICE-1-SPEC-FEEDBACK.md (own commit, guide §3.2). Load-bearing settlements before writing validate: - §5.2: flotilla-core owns a separate local STATE store (history/health/lock); deployment.toml is config only. - §3.2/§5.1 canonicity: toml re-read each deploy vs imported once. (Slice 1 shipped one-time import; recommendation = toml-canonical for new apps.) - Add to §5.1: a Gitea host, optional [app].gitea_read_secret_ref for private repos, and a note that §5.1 assumes the single-repo shape (OHM's split is grandfathered). - §5.3: vm.project==gcloud_config project needs a NEW read-only `gcloud config configurations describe`; validate applies only to define-deployment-authored records, not legacy/imported ones. 2. Firm up the §5.1 schema + build the fail-closed validate verb (§5.3): each rule prints pass/fail + remediation; the orchestrator gates provision-vm on it. 3. Build define-deployment: the topology+names interview deriving everything from the One Name (§3.3), emitting + validating the record, following the §8 UX contract (probe→default→ask→validate→explain). NEVER ask for secret bytes (§8.3). ## Tests (part of the slice) - Each §5.3 rule rejects a crafted-bad record with the right message. - A good record validates + round-trips through flotilla-core's loader. - Dogfood: define-deployment produces a valid deployment.toml for wiggle-snip. ## Scope guard Pre-prod, single environment. NO slots/ramp/promote/rollback/compat-gate — guide §10. ## Process Spec-driven, cite section numbers in commits; branch + PR (Gitea, no gh CLI). Hard secrets rule (SPEC §8.3): stdin-piped gestures only. ## Carry-over operator follow-ups from Slice 1 (still open) - Publish flotilla-core to Gitea + pin ohm-rfc-app-flotilla's dep off the local path. - Open + merge the slice1-extract-flotilla-core PR (after flotilla-core is published). - Add flotilla-core to the Patchwatch runner/Dockerfile build context. ``` --- ## Protocol notes - This was framed as a "test run" of our own launch-app tooling; the operator explicitly asked for a transcript at session end, so it is published as a normal OHM driver session (it did live read-only OHM operations through the shim). - No secret bytes entered the session — only secret **references** were read back (§8.3 / protocol §3). No live-vuln detail involved. - The session changed no code and did not touch OHM live (read-only verification + one branch push). The substantive build it verifies was committed pre-session.