# Session 0009.0 — Transcript

> App: dev-claude-plugin
> Start: 2026-06-04T00-13 (PST) · End: 2026-06-04T01-52 (PST)
> Status: **FINALIZED.**
> Goal: work open memory follow-ups for the dev-claude-plugin repo.
> Outcome: #1 memory-write settings carve-out + #2 create-app-json.md de-phantom
> both shipped (#2 as v0.9.1, merge `2e4ba34`); clean stop.

## Launch prompt

`/wgl-coding-session-init` → operator worked open follow-ups from memory, in order:
**#1 the memory-write settings carve-out**, then **#2 the dev-env CLI app.json verb**.

## Concurrency note

A **concurrent session 0010** claimed *after* this one and finalized first,
shipping **0.9.0** (discovery session bookend + unified `wgl-session-finalize` +
gate classifier-router) and merging to `origin/main` (`43e1cd9`) mid-session.
This session's local `main` advanced under it; #2's work landed on top as 0.9.1.

## Plan — follow-up #1 (memory-write settings carve-out)

Make this project's auto-memory dir (`~/.claude/projects/<repo>/memory/`)
writable by the Edit/Write tools so memory no longer needs a Bash workaround,
without weakening protection on the genuinely sensitive parts of `~/.claude/`.

Key finding (claude-code-guide / official docs): Claude Code evaluates
permissions **deny → ask → allow; deny always wins**, there is no negation
syntax, and specificity is irrelevant. So the memory note's stated "clean fix"
(an `allow` carve-out alone) does NOT work while the blanket
`Edit/Write(/Users/benstull/.claude/**)` deny stands. The deny must be narrowed.

Steps:
1. Narrow the blanket `~/.claude/**` deny → target only sensitive paths:
   `settings.json`, `settings.local.json`, `.credentials.json`, `plugins/**`,
   `skills/**`, `commands/**`, `wiggleverse.md`.
2. Add self-documenting allow carve-out
   `Edit/Write(/Users/benstull/.claude/projects/**/memory/**)`.
3. Verify: JSON valid; memory path matches no deny; `settings.json` still denied;
   Write tool reaches the memory dir mid-session with no prompt.

Scope note: user-level config change (`~/.claude/settings.json`), NOT a
plugin-repo change — no commit here, no `plugin.json` version bump.

## Outcome — follow-up #1

Done. Blanket deny narrowed + allow carve-out added; JSON validated; memory path
confirmed writable mid-session (throwaway `.perm-check` write succeeded with no
Bash, no prompt, then removed). Project memory updated to mark the follow-up
fixed. Side effect: pure runtime/scratch dirs under `~/.claude` (cache/,
sessions/, tasks/, …) are now writable too — acceptable; the deny's real purpose
was config/credentials/installed-code/customizations, all still denied. No repo
change (user-level `~/.claude/settings.json` only).

## Plan + arc — follow-up #2 (dev-env CLI app.json verb)

`create-app-json.md` carried a pointer claiming `app.json` "should be emitted by
the dev-env CLI" (a future verb), framing the inline gesture as a stopgap. Brought
into `superpowers:brainstorming`. The arc had a real correction worth recording:

1. First read of the world (engineering repo) found **no `dev-env` CLI and no
   spec** — concluded the pointer was vapor; operator leaned "de-phantom it."
2. Operator pushed to **search the whole session-history corpus**. That surfaced
   `engineering/0001`: a **real dev-env CLI shipped** (v0.1 + v0.2) at
   `engineering/dev-env/`. My "no CLI" read was an artifact of a **stale local
   checkout** sitting on `slice3-provision-vm-scaffold-gitea`, 13 commits behind
   `origin/main`. Lesson: confirm against `origin/main` before declaring absence.
3. Read the real `dev-env/SPEC.md`: it's a **laptop-onboarding doctor**
   (doc-as-program runbooks; verbs `doctor`/`run`/`list`/`status`/`lint`/
   `self-update`; read-mostly) — the **wrong home** for repo-manifest scaffolding.
   `launch-app`/`flotilla` is deployment-scoped (`deployment.toml`). The memory
   note's "add to `launch-app/ROADMAP.md`" was mis-routed. Historical contradiction
   noted: `corp/0001` wrongly concluded "dev-env CLI = flotilla, no separate CLI."
4. Decision (operator): **inline gesture is canonical; fix the wording**; build no
   verb; no engineering-repo change.

## Outcome — follow-up #2

`create-app-json.md` reworded (inline canonical, names both CLIs + why neither
hosts `app.json`); `plugin.json` 0.9.0 → 0.9.1; project memory follow-up #2 marked
RESOLVED with the stale-branch lesson. Branched `fix/create-app-json-dephantom`,
committed `c802ae0`, pushed, merged `--no-ff` to `main` (`2e4ba34`), pushed,
branch deleted (local + remote). `main` in sync with `origin/main`.

## Cut state (so far — session still open)

| Repo | Ref | Note |
| --- | --- | --- |
| wiggleverse-dev-claude-plugin | `2e4ba34` (main, pushed) | #2 merged; v0.9.1 |
| (n/a) `~/.claude/settings.json` | user-level | #1 carve-out; not a repo |

**On the operator's plate:** re-install the plugin to make 0.9.x live (carries
0.9.0 from session 0010 + this 0.9.1) — running sessions still use the 0.3.0 cache.

## Prompt the operator can paste into the next session

```
/wgl-coding-session-init

Resume the dev-claude-plugin repo. Read memory project_dev_claude_plugin.md +
MEMORY.md first. State: source is v0.9.1 on origin/main, but the INSTALLED plugin
still lags at the 0.3.0 cache — if you haven't already, run /plugin marketplace
update + install so the session gate, spec/discovery inits, and the renamed
wgl-session-finalize go live (that re-install is the top open item).

Last session's two follow-ups are DONE (memory-write ~/.claude carve-out;
create-app-json.md de-phantom). Pick from remaining backlog: (a) Workflow-recording
→ BDD bug filing idea; (b) spec-session seams — spec-RFC renderer deploy,
planner-project registration in the BDD planner's projects.json, BDD corpus under
bdd/. Heads-up: this repo runs concurrent sessions (0009 + 0010 overlapped today) —
at init, peek for in-flight sessions and fetch origin/main before branching.
```