# Session 0026.0 — Transcript

> App: dev-claude-plugin
> Start: 2026-06-07T09-50 (PST)
> Type: coding
> Status: **PLACEHOLDER — claimed at session start; finalized at session end.**
>
> This file reserves session ID 0026 for dev-claude-plugin. The driver replaces this
> body with the full transcript and renames the file to its final
> SESSION-0026.0-TRANSCRIPT-2026-06-07T09-50--<end>.md form at session end.

## Launch prompt

```
/goal next → resume stored Next /goal: Implement SP1 — feedback as Gitea issues
from the approved design docs/superpowers/specs/2026-06-07-feedback-as-gitea-issues-design.md,
on the already-pushed branch feat/feedback-as-gitea-issues. Run writing-plans from
the spec → executing-plans. Ship 0.19.0.

```

## Plan

**Goal:** Implement SP1 — feedback as Gitea issues — per the approved design
`docs/superpowers/specs/2026-06-07-feedback-as-gitea-issues-design.md`, on branch
`feat/feedback-as-gitea-issues`. Ship 0.19.0.

Move plugin feedback OUT of the in-repo `feedback/` file corpus INTO Gitea issues
on `wiggleverse/wiggleverse-dev-claude-plugin`:

1. **Label model** — `ensure-feedback-labels.sh` creates canonical labels
   idempotently (`triaged:accepted`, `resolution:done|declined|duplicate`,
   `type:bug|friction|enhancement|idea`, `severity:low|medium|high`).
2. **Scripts as thin `gitea-api.sh` wrappers** — `file-feedback.sh` (replaces
   `record-feedback.sh`), rewritten `list-feedback.sh`, rewritten
   `set-feedback-status.sh`.
3. **Skill rewrites** — `wgl-dev-plugin-feedback` (capture) files an issue;
   `wgl-dev-plugin-review-feedback` (review) points at issues + label model
   (direct triage-and-fix kept for SP1; SP2 note).
4. **Migration** — 4 existing `new` notes → issues; delete note files; repurpose
   `feedback/README.md` for the issue-based corpus.
5. **New SessionStart hook** `hooks/feedback-notice` — plugin-repo-only, fail-open,
   counts open issues, nudges `/goal feedback`.
6. **Housekeeping** — `plugin.json` 0.18.0→0.19.0; CLAUDE.md hooks inventory 3→4 +
   feedback-in-issues note.

Process: `writing-plans` from the design → `executing-plans`. SP2 (`/goal feedback`
orchestrator) is deferred.

## Progress checkpoint (2026-06-07, blocked on token scope)

Plan written + committed (`docs/superpowers/plans/2026-06-07-feedback-as-gitea-issues.md`).
**8 of 11 tasks done and pushed** on `feat/feedback-as-gitea-issues` (10 commits ahead
of main, all offline-verified `bash -n` / dry-run / fail-open):

- ✅ T1 `ensure-feedback-labels.sh` · ✅ T2 `file-feedback.sh` (replaces `record-feedback.sh`)
  · ✅ T3 `list-feedback.sh` rewrite · ✅ T4 `set-feedback-status.sh` rewrite
- ✅ T5 `hooks/feedback-notice` + `hooks.json` (fail-open verified) · ✅ T6 capture skill
  · ✅ T7 review skill · ✅ T8 `feedback/README.md` repurposed · ✅ T10 `plugin.json`→0.19.0 + CLAUDE.md hooks 3→4
- ⛔ T9 live migration (create 11 labels, scratch-issue lifecycle test, file 4 issues, delete 4 note files)
  and T11 ship 0.19.0 — **BLOCKED**.

**Blocker:** every `/issues` + `/labels` API call returns **403**. The Keychain token
`wgl-gitea-token-git.wiggleverse.org` (and legacy `ohm-gitea-token`) has repo perms but
**not the `issue` OAuth scope**. The design's feasibility check read the repo *permission*
object, which does not imply token scope. Scripts/hook thread an issue-scoped token via
`gitea-api.sh --token-service`, default service `wgl-gitea-issues-readwrite-token`
(env `WGL_FEEDBACK_TOKEN_SERVICE`). Operator said they added that Keychain entry, but it is
**not resolvable** via `security find-generic-password -s wgl-gitea-issues-readwrite-token`
in either login or System keychain (likely added to a non-search-list keychain, e.g. iCloud,
or the add errored). **Resume:** operator adds it to the login keychain
(`security add-generic-password -U -a "$USER" -s wgl-gitea-issues-readwrite-token -w`), then
run T9 (migration) → T11 (ship). All offline code is final and pushed.

## Deferred decisions

_Autonomous-mode low-confidence calls the driver made and would have
liked operator input on. Appended as the session runs; surfaced at
finalize. Empty if none._

- **Token-scope gap vs. the approved design.** The design declared SP1 feasibility
  "verified live" on the repo `permissions:{admin,push,pull}` object — but that is the
  user's role on the repo, not the token's OAuth scopes. The issue/label endpoints need
  the `issue` scope, which the resolved token lacks (403). Handled by introducing a
  dedicated issue-scoped Keychain entry selected via `--token-service`
  (`WGL_FEEDBACK_TOKEN_SERVICE`), keeping git transport / gitea-admin on their own token.
  This is a correctness deviation from the design's single-token assumption; logged here
  and documented in the plan. *(A good candidate to file as a feedback ISSUE once the
  flow is live — the design's feasibility-check method missed token scope.)*
- **Review status edits ride the API, not the PR.** The design said review status edits
  "ride in the same branch→PR." With issues (not tree files) the label/comment/close
  happen immediately via the API; only the code change rides the PR. Documented honestly
  in the rewritten review skill + `feedback/README.md`.
- **Script `gitea-api.sh` resolution.** Scripts resolve `gitea-api.sh` relative to their
  own dir with a `${CLAUDE_PLUGIN_ROOT}` fallback (vs. the design's bare
  `${CLAUDE_PLUGIN_ROOT}/…`), so they run from a source checkout where that var is unset.