135 lines
8.1 KiB
Markdown
135 lines
8.1 KiB
Markdown
# SESSION-0010.0 — R03 Locations + flotilla secret-files + config-onboarding spec + wildcard-TLS wiring
|
||
|
||
**Date:** 2026-06-02
|
||
**Driver:** Ben (ben@wiggleverse.org)
|
||
**Repos touched:** `wiggleverse-ecomm` (impl, branch `r01-store-settings`),
|
||
`flotilla-core` (`main`), `rfc-app` (`main`), `wiggleverse-ecomm-bdd-release-planner-app`
|
||
(`main`), plus Claude memory.
|
||
**Outcome:** R03 Locations shipped (committed, unmerged); flotilla-core gained a
|
||
`secret-file` feature (v0.4.0, pushed) for TLS-cert delivery; config/secret
|
||
onboarding UX spec'd (not built); ohm/planner nginx wired to the wildcard cert
|
||
(pushed); the git/secrets working model was clarified across memory.
|
||
|
||
Transcript-honest per the engineering guide — wrong turns included.
|
||
|
||
---
|
||
|
||
## What happened (in order)
|
||
|
||
1. **"Build R03 — Locations (core)."** Read memory + the impl repo, grounded in OHM
|
||
(Location = embodied physical venue of the Commercial Relationship; the
|
||
last-active + set-primary invariants = Duty of Care / Dignity in Commerce).
|
||
GOTCHA: **OHM was unreachable from the sandbox** (`ohm.wiggleverse.org` DNS
|
||
no-answer) — grounded in the concepts already in memory + the SPEC link targets
|
||
instead, and flagged it for re-verification. Built the 4 dependency-free
|
||
scenarios (`13.07.0001/0002/0003/0006`): migration `0004_locations.sql`
|
||
(single-primary as a **partial unique index**), `app/locations.py` (mirrors
|
||
staff.py), seed of one primary "Main location", REST BFF + GraphQL
|
||
(`Store.locations` + add/update/setPrimary/delete), and a Locations admin UI.
|
||
Decision: filed under the existing **`settings`** section (no new section).
|
||
**46 tests** green (38 + 8); all four scenarios browser-verified (the OTC 60s
|
||
cooldown bit again — a curl smoke-test consumed the owner's code, worked around
|
||
by polling for a fresh `dev_code` then verifying via in-page fetch). SPEC → v0.5
|
||
(§9 + §5 rows), README + `/api/health`→R03. Commit `5b3e946` (unmerged).
|
||
|
||
2. **"I have the *.wiggleverse.org cert — command to load the key into the right
|
||
secret? It'll impact other apps. Huh, bdd.ecomm works fine."** Corrected two
|
||
misconceptions: a single-level wildcard does **NOT** cover the nested
|
||
`bdd.ecomm.wiggleverse.org` (two labels) — bdd works because of its *own* certbot
|
||
cert, grey-cloud; and **no app reads a cert from a secret today** (all use certbot
|
||
on the VM; flotilla had zero TLS code). Gave the safe `gcloud secrets … --data-file`
|
||
gesture but flagged there was no consumer.
|
||
|
||
3. **"Why not put the cert in a secret and have flotilla deploy it to nginx?"** →
|
||
honest reassessment: good idea, I'd been over-cautious. Walked the build-vs-buy
|
||
shape (renewal ownership turns on Origin-CA-vs-LE; cross-project secret access is
|
||
the real wrinkle; security is a wash). **"Build it into flotilla — go for it."**
|
||
|
||
4. **flotilla-core `secret-file` feature.** Discovered the two apps run *different*
|
||
flotilla generations (ohm = thin shim over flotilla-core; planner = bespoke
|
||
`planner_flotilla`) → built into **flotilla-core** (shared, future-facing).
|
||
Migration `010`, `registry.bind/list/unbind_secret_file`, `[[secret_file]]` in
|
||
`deployment.toml`, **phase 6 extended** (atomic root write via sudo, bytes over
|
||
stdin, zeroed + redacted, dedup'd reload, fail-stop), plan + a `secret-file` CLI
|
||
group (`bind`/`set`/`unbind`/`list`). 366 tests; ohm shim inherits the verb free.
|
||
|
||
5. **"How is it set up for other apps?"** Confirmed from code: secrets → `.env` only;
|
||
TLS entirely out-of-band (certbot). So secret-files is genuinely new flotilla
|
||
surface, not a switch-flip.
|
||
|
||
6. **"Add a UX to manage config + secrets, per app type, with provider instructions.
|
||
Stop using a Claude skill — make it deterministic. Spotify open-sourced something
|
||
— build or buy?"** Researched (web worked; only internal hosts fail DNS):
|
||
Spotify = **Backstage** (IDP framework, Scaffolder; secrets weak, 2–4 FTEs / 6–12
|
||
mo — too heavy); Infisical/Doppler solve *storage* (GCP SM already covers).
|
||
Verdict: **build** — the app-type-aware required-config + provider instructions is
|
||
bespoke. **"Spec the manifest schema and two verbs."** Wrote
|
||
`flotilla-core/docs/config-onboarding-spec.md` (manifest + `init` + `config
|
||
doctor` + seed `cloudflare-proxied-vm`/`wildcard-tls` manifests). Locked
|
||
decisions: PEM via **local file path**; `deploy` **gates on doctor by default**
|
||
with `--skip-config-check`, doctor also standalone.
|
||
|
||
7. **nginx wiring.** Rewired ohm (`ohm.wiggleverse.org.conf` — was the pre-certbot
|
||
template; now an explicit 80→443 vhost) and planner (`planner.conf` for
|
||
`rfc.wiggleverse.org`) to the wildcard at `/etc/ssl/{certs,private}/`. Committed
|
||
`34a65e0` (rfc-app) + `ddb27eb` (planner).
|
||
|
||
8. **/finalize → commit + push.** Committed the flotilla feature (`014c0f3`) + spec
|
||
(`cd729f1`). Ben: **"push the unpushed commits."** rfc-app + planner pushed
|
||
clean. **flotilla-core push REJECTED** — a parallel **PR #1** had merged a
|
||
*different* "v0.3.0" (deployment.toml scaffold + fail-closed `validate`) and
|
||
**tagged v0.3.0**.
|
||
|
||
- ⚠️ **Wrong turn:** rebased onto it; resolved the top-of-file `deployment_toml.py`
|
||
conflicts but **missed a third conflict region** (in `sync_to_registry`) and
|
||
`git add`+`--continue` committed it **with conflict markers** (broken code).
|
||
Caught it immediately (not pushed). Resolved properly (merged my secret-file
|
||
binding into their reconciling sync + extended the prune logic), **renumbered my
|
||
release 0.3.0 → 0.4.0** (0.3.0 was taken+tagged), back-filled a CHANGELOG stub
|
||
for their release, and **rebuilt clean linear history** (`git reset --soft` —
|
||
no force, no broken intermediate). **394 tests** green (mine + theirs). Pushed
|
||
`b77dd7a`. No force-push anywhere; their PR untouched.
|
||
|
||
9. **"I don't want to push/merge myself — remove that guidance."** Found the rule
|
||
was **self-contradictory** in memory (engineering-pattern already said merge was
|
||
mine; ecomm files still called it "operator-only for Ben"). Fixed all of them.
|
||
Then **"remove that from working-preferences"** (don't duplicate the git rule
|
||
there) — removed it; canonical home is `wiggleverse-engineering-pattern`. Then
|
||
**"update engineering-pattern to match: operator only wants secrets; otherwise
|
||
Claude can do everything but lays out a plan and gets approval."** Settled model
|
||
recorded: **operator owns secrets only; everything else is Claude's to do, gated
|
||
by plan + approval for consequential actions; local/reversible work needs none.**
|
||
|
||
10. **"What's next?"** → recommended the **ohm wildcard-TLS cutover** (highest value
|
||
+ first real dogfood of secret-files). **"Go with it, but in a new session —
|
||
finalize this one."** Verified all repos clean/in-sync; set the ▶NEXT pointer in
|
||
memory. Wrote this transcript.
|
||
|
||
---
|
||
|
||
## State at wrap
|
||
|
||
| Repo | Branch | State |
|
||
|---|---|---|
|
||
| `wiggleverse-ecomm` | `r01-store-settings` | R03 committed `5b3e946`; unmerged (R01+auth+R02+GraphQL+R03 ride together) |
|
||
| `flotilla-core` | `main` | `b77dd7a` pushed — **v0.4.0** secret-files + onboarding spec |
|
||
| `rfc-app` | `main` | `34a65e0` pushed (ohm nginx → wildcard) |
|
||
| `…-bdd-release-planner-app` | `main` | `ddb27eb` pushed (rfc.wiggleverse.org nginx → wildcard) |
|
||
|
||
## Next session — the ohm wildcard-TLS cutover
|
||
|
||
1. **Decide cross-project secret access first** — one shared `*.wiggleverse.org`
|
||
secret + `secretAccessor` grants to each VM's SA, vs one copy per project.
|
||
2. Ben runs `flotilla secret-file set` with the cert key + fullchain (NO SECRETS:
|
||
his gesture; bytes never transit Claude).
|
||
3. Claude lays out the cutover step plan for approval, then deploys ohm.
|
||
4. Ben flips Cloudflare → Full(strict) + orange-cloud on `ohm` (Origin-CA cert only
|
||
validates behind the proxy — do cert+proxy together).
|
||
5. `certbot delete --cert-name ohm.wiggleverse.org`.
|
||
|
||
Then back to **R04 — Product create & lifecycle** (next ecomm release).
|
||
|
||
**Open follow-ups:** teach flotilla `validate` about `[[secret_file]]` refs;
|
||
migrate the planner off bespoke `planner_flotilla` onto flotilla-core; re-verify
|
||
R03 OHM citations when `ohm.wiggleverse.org` is reachable.
|