# Session 0001.0 — Transcript

> App: engineering
> Date: 2026-06-03 (PST) · Start 16-59 · End 18-27
> Goal: ship dev-env v0.2 — the single-file HTTPS bootstrap (SPEC §8.3).
> Outcome: **shipped + merged to main** (PR #7, merge commit 9ae325d). Also
> registered `engineering` as an app (app.json) — this was the first session
> claimed through it.

This is the first session for the `engineering` app: registering it for session
tracking was a prerequisite, resolved at session start.

## Plan

Working branch `dev-env-v0.2-https-bootstrap` off `main`, in an isolated worktree
(the shared engineering checkout was held on a `slice3-*` branch by a concurrent
session). Two operator decisions, resolved up front via AskUserQuestion:

1. **Register engineering as an app first.** It had no `app.json`, so the
   session-claim tooling could not resolve where its transcripts live. Created
   `engineering/app.json` (One Name `engineering`; sessions → the shared
   `wiggleverse/session-history` repo, subdir `engineering`, numeric /
   folder-per-session / public).
2. **Bootstrap shape = single file + local self-update.** Build the amalgamated
   single file (committed at `dev-env/dist/wgl-devenv`, grabbable over HTTPS via a
   Gitea raw/ZIP mirror — no special host pinned). It embeds the bootstrap-subset
   runbooks (`base-tools` + `git-ssh`) so a bare laptop runs `doctor` + `git-ssh`.
   `self-update` auto-discovers the local engineering clone and `git pull`s over
   SSH to refresh the full runbook set (the HTTPS-then-SSH carve-out, SPEC §8.3).

## Pre-session state

- dev-env v0.1 was merged to `main` (PR #4): the doc-as-program engine + 4
  onboarding runbooks (`base-tools` → `git-ssh` → `repo-layout` →
  `claude-context`), 32-test stdlib `unittest` suite, the `ShellExecutor` DI seam,
  the secret-in-auto-fix lint, PASS/WARN/FAIL/SKIP, idempotency.
- SPEC was at `v0.0.1`; §8.3 deferred the single-file HTTPS bootstrap to v0.2.
- `engineering` was unregistered (no `app.json` anywhere).
- A concurrent session held the shared engineering checkout on
  `slice3-provision-vm-scaffold-gitea`.

## Turn-by-turn arc

1. **Session init.** Computed start (16-59 PST). The claim script could not
   resolve the app — `engineering` had no `app.json`. (Gotcha surfaced: the
   claim/publish scripts are now plugin-based at
   `~/.claude/plugins/cache/wiggleverse-dev-claude-plugin/.../skills/wgl-session-common/scripts/`,
   not the old `~/.claude/skills/...` path.)
2. **Read the SPEC/ROADMAP + the whole v0.1 package** to ground the design.
3. **Two operator questions** (AskUserQuestion): (a) how to handle the unregistered
   app → *register engineering first*; (b) HTTPS hosting → the operator redirected
   to "expect the engineering repo locally and pull from that," so a third focused
   question locked the shape → *single file + local self-update*.
4. **Registered engineering**: relocated the worktree under `~/git` so the new
   `app.json` was discoverable, wrote it, dry-ran then **claimed session 0001**
   (pushed the placeholder to `wiggleverse/session-history`).
5. **Spec-first**: SPEC → `v0.0.2` — §8.3 two obtain-stories over one source of
   truth; §8.4 generated-not-forked single file + drift guard; §8.5 bootstrap
   subset + self-update; §5.6 the `self-update` verb; §1.3 updated to admit
   `self-update` as a mutating verb. ROADMAP → v0.2 shipped.
6. **Build**: `tools/amalgamate.py` (inlines the `devenv` modules **verbatim** via
   a `sys.meta_path` finder + embeds the bootstrap subset → `dist/wgl-devenv`);
   `devenv/bootstrap.py` (single-file orchestration + runbook resolution: override
   → local clone → cache → embedded); `devenv/selfupdate.py` (`git pull` through
   the executor seam); `devenv/__main__.py` (makes `python3 -m devenv` work — a
   latent v0.1 README/bug gap); README + pyproject + .gitignore (track only
   `dist/wgl-devenv`).
7. **Tests**: +16 (amalgamation drift/round-trip, runbook resolution, self-update
   via `FakeExecutor`) → **48 green**; `subprocess` still only in `executor.py`.
   Smoke-tested the single file copied to `/tmp`: `doctor` 2/2 PASS,
   `run git-ssh --dry-run`, `self-update` fail-loud remediation. (One real-git
   end-to-end smoke test of `self-update` was denied by the sandbox; covered
   instead by the FakeExecutor unit tests + the proven SubprocessExecutor path.)
8. **Push + PR #7** (SSH-only, push-before-review). Created via the Gitea API
   helper (this is Gitea, not GitHub).
9. **Finalize (this wrap-up).** `main` had advanced — PR #6 ("retire the per-app
   operator-cli repo role") merged while this work was in flight. Checked: it
   touched only `README.md`; the schema `contains` enum still has `operator-cli`,
   so the `app.json` tag stayed valid. Gitea recomputed `mergeable` → True.
   **Merged PR #7** (merge commit, delete branch), cleaned up the worktree + local
   branch, updated memory.

## Cut state (end of session)

| Commit | Where | What |
|---|---|---|
| `6619c3b` | merged via #7 | Register engineering as an app (`app.json`) |
| `e4c06c6` | merged via #7 | dev-env v0.2: the single-file HTTPS bootstrap |
| `9ae325d` | `origin/main` | Merge commit for PR #7 |

- **PR #7 merged**, branch `dev-env-v0.2-https-bootstrap` deleted (remote + local),
  worktree `engineering-v0.2` removed.
- `main` is at `9ae325d`; v0.2 artifacts present (`dev-env/dist/wgl-devenv`,
  `dev-env/tools/amalgamate.py`, `devenv/bootstrap.py`, `devenv/selfupdate.py`,
  `app.json`).
- The concurrent `slice3-provision-vm-scaffold-gitea` checkout was left untouched.
- 48 tests green at merge.

## What lands on the operator's plate

- **Nothing blocking.** v0.2 is merged.
- **Hosting is a deliberate ops detail (not wired):** `dist/wgl-devenv` is on
  `main`, but no public HTTPS URL is published yet. To actually hand a bare laptop
  the `curl -fsSL <url>/wgl-devenv` line, decide where a readable mirror exposes
  the file (a readable Gitea raw/ZIP URL, or a public mirror) and confirm that URL
  serves it.
- **Deferred follow-up (flagged as a task chip):** the `engineering` repo root has
  no `CLAUDE.md` importing `@~/.claude/wiggleverse.md` (the always-on org-context
  wiring). Left out to keep PR #7 focused; worth a tiny separate PR.

## Prompt the operator can paste into the next session

```
Open dev-env v0.3 — the cloud + credentials runbooks. Run
/wgl-coding-session-init first (engineering is now a registered app — it'll claim
engineering/0002).

The dev-env CLI lives at engineering/dev-env/ on main (v0.1 + v0.2 shipped). Read
dev-env/SPEC.md (esp. §6.3 the hard-secrets rule, §2.3 `fix manual`) and
dev-env/ROADMAP.md (v0.3); see memory [[project_dev_env_cli]].

Goal: author two new runbooks — gcloud/ADC (the dedicated-profile-per-deployment
awareness, guide §8.4) and the Keychain Gitea-token runbook — both as `fix manual`
for the secret gestures (no secret bytes ever auto-run; the §5.5 lint enforces
it). The engine already supports them; this slice is runbook content + harvesting
the exact checks. Wire them into the `requires` DAG after git-ssh.

The single-file bootstrap subset stays base-tools + git-ssh; v0.3 runbooks are
full-set-only (fetched via self-update), so you only rebuild dist/wgl-devenv if you
change an embedded module or embedded runbook (a drift test enforces it). Keep the
suite green. Spec-first only if you touch invariants. Branch off main → PR (push
before review; SSH-only git). Use an isolated worktree (the slice3 session may
still hold the shared checkout).
```