# Session 0078.0 — Transcript

> App: ohm
> Start: 2026-06-06T00-46 (PST)
> Type: coding
> Status: **FINALIZED.**

## Launch prompt

```
s5 — in-app create-project + the global directory: the global-Owner
create-project action (bot provisions a Gitea content repo + commits to
projects.yaml), plus the deployment-directory role-aware empty states.
Completes @S5 (C3.1–C3.2), per
docs/design/2026-06-05-three-tier-projects-collections.md Part E (S5).
```

## Plan

**Goal:** §22 three-tier slice **S5** — in-app create-project + the global
directory. Completes `@S5` (C3.1, C3.2), per
`docs/design/2026-06-05-three-tier-projects-collections.md` Part E (S5).
Branch `feat/s5-create-project-global-directory`. Release v0.44.0 (minor,
non-breaking — additive endpoint + UI, no migration).

Backend: `auth.can_create_project`; `bot.create_project` (provision content
repo + commit `projects.yaml`); `POST /api/projects` + `viewer.can_create_project`
+ `default_project_readable` on `GET /api/deployment` (api_deployment gains
gitea+bot); api.py call site.
Frontend: `api.createProject`; `DeploymentProvider` (viewer +
defaultProjectReadable + refresh); `DeploymentLanding` redirect on
defaultProjectReadable; `Directory.jsx` role-aware empty states +
`CreateProjectModal`.
Tests + docs: backend `test_create_project_vertical.py`; frontend
`Directory.test.jsx`; CHANGELOG 0.44.0 + VERSION + package.json bump.

## Pre-state

- `main` clean and pushed, `origin/main = 2696e64` (S4 / v0.43.0 merged).
- Three-tier slices S1–S4 shipped (v0.40.0–v0.43.0); S5 the next slice per the
  design doc Part E. No in-flight sessions for ohm.

## Session arc (turn by turn)

1. **Session gate + claim.** Classified the launch prompt as a *coding* session;
   ran `wgl-session-coding-init`. Computed start (2026-06-06T00-46 PST), peeked
   (no in-flight ohm sessions), claimed **session 0078** (atomic push to
   `wiggleverse/session-history`). Verified the `@~/.claude/wiggleverse.md`
   stub present and a clean pushed `main` baseline.

2. **Read the design + the shipped surface.** Read Part E (S5) and Part C.3
   (C3.1–C3.2). Then read the S2 create-collection vertical (the template):
   `api_collections.py`, `bot.create_collection`, `registry.py`
   (`parse_registry` still requires per-project `type`/`content_repo`),
   `projects.py`, `collections.py`, `gitea.py` (`create_org_repo`,
   `read_file`/`update_file`), the auth capability layer
   (`can_create_collection`, `effective_scope_role`, `_DEPLOYMENT_SUPERUSER_ROLES`,
   the `scope_type='global'` model), `api_deployment.py`, the FakeGitea test
   harness, and the frontend (`Directory.jsx`, `CollectionDirectory.jsx`,
   `CreateCollectionModal.jsx`, `DeploymentProvider.jsx`, App's
   `DeploymentLanding`).

3. **Branch + plan.** Cut `feat/s5-create-project-global-directory`; mirrored
   the plan into the transcript.

4. **Backend.** Added `auth.can_create_project` (global-Owner gate);
   `bot.create_project` (provision repo + seed README + commit `projects.yaml` +
   audit log); `POST /api/projects` in `api_deployment.py` (read-recompose-commit
   the registry, then re-mirror) and the `viewer` + `default_project_readable`
   fields on `GET /api/deployment`; updated the api.py call site.

5. **Backend tests.** Wrote `test_create_project_vertical.py` (12 cases). First
   run: 1 failure — the README assertion. Root cause: the FakeGitea seeds `main`
   on repo creation (real Gitea with `auto_init=False` does not), so the bot's
   `get_branch`-based seed condition skipped. Fixed by keying the seed on
   README-absence instead — robust for both the empty real repo and the fake.
   12/12 green; full backend suite **516 passed**.

6. **Frontend.** `api.createProject`; `DeploymentProvider` surfaces `viewer` +
   `defaultProjectReadable` + `refresh`; `DeploymentLanding` redirects into the
   default only when readable; `Directory.jsx` role-aware empty states + an
   Owner-only "New project" control + `CreateProjectModal`. Extended
   `Directory.test.jsx` (7 cases). Frontend **30 passed**; `vite build` compiles.

7. **Version + docs.** VERSION + `frontend/package.json` → 0.44.0; CHANGELOG
   0.44.0 entry (non-breaking, "no operator action required"); marked S5 shipped
   in the design doc Part E.

8. **Ship.** Committed; pushed to `origin`; opened **PR #22** via the Gitea API
   (token from Keychain, never echoed); confirmed mergeable; merged via the API;
   FF-synced local `main` (= `b073738`) and deleted the feature branch.

## Deferred decisions

Three low-confidence calls, all reasonable, none blocking — surfaced at closeout:

- **Default project visibility = `public`** for the create-project body (vs the
  registry parser's `gated` default). Rationale: the point of standing up a
  project from the UI is for it to be seen; an Owner narrows it afterwards.
  Alternative: default `gated` (safer-by-default) — would make every new project
  invisible until explicitly opened.
- **Default `content_repo` = `<id>-content`.** A derived, deployment-neutral
  name; the body allows an override. Alternative: require the operator to name it.
- **README seed keyed on README-absence, not branch-absence.** Needed to bridge
  the FakeGitea (auto-seeds `main` on create) vs real Gitea (`auto_init=False`,
  no branch) discrepancy so the seed runs in both. Equivalent outcome (a `main`
  with a README); idempotent because create-project is duplicate-guarded.

## Cut state

- **Shipped:** §22 S5 = v0.44.0. `origin/main = b073738` (PR #22 merged).
  `@S5` (C3.1–C3.2) complete. Local `main` clean and synced.
- **Tests:** backend 516 passed; frontend 30 passed; frontend build green.
- **No migration**, no change to existing read/write/authz outcomes.

## Next-session prompt

```
/goal S6 — the final §22 three-tier slice: per-type frontmatter + surfaces
keyed on the collection's type, request-to-join + cross-collection inbox,
per-collection enabled_models, the registry + .collection.yaml format in
docs/DEPLOYMENTS.md, two-project/multi-collection e2e, the §20.4 changelog,
and the SPEC merge (apply Part A + Part D, landing the S3 §B.1/§B.3 keystone
reinterpretation). Per docs/design/2026-06-05-three-tier-projects-collections.md
Part E (S6).
```

## Operator plate

- S5 shipped end-to-end from the UI: a global Owner can create a project; the
  bot provisions the content repo and commits to `projects.yaml`; the directory
  shows role-aware empty states.
- S6 is the last slice and includes the **SPEC merge** — that is where the S3
  keystone reinterpretation of §B.1/§B.3 (a plain granted account is not a
  global writer; the implicit-public baseline is grandfathered onto the `default`
  collection only) must finally land in `SPEC.md`.