Session 0057.0 — Transcript

Date: 2026-06-01 Goal: launch-app Slice 1 — extract flotilla-core from ohm-rfc-app-flotilla, de-OHM it, and prove OHM still deploys through it (launch-app SPEC §7).

Outcome: Slice 1 verified green. The extraction was already committed when this session opened (flotilla-core v0.1.0 + ohm-rfc-app-flotilla v1.8.0 thin shim, roadmap marked DONE, SPEC-feedback note written). This session's contribution was independent end-to-end re-verification against OHM's live deployment, pushing the feature branch to origin (it was local-only), and producing the Slice 2 handoff. No code was changed; no transcript-affecting secret ever entered the session.

Highlights:

flotilla-core 315 tests green; OHM shim 7 tests green.

§7.3 regression oracle proven against the live OHM VM: live state DB read unchanged, live pin 0.31.3 validated against the de-OHM'd (0,2,3) floor, 8 secret refs resolved (zero bytes), live /api/health → HTTP 200 v0.31.3 ok.

Branch slice1-extract-flotilla-core pushed to origin; PR not yet opened/merged.

SPEC feedback (8 items) captured in launch-app/SLICE-1-SPEC-FEEDBACK.md; the load-bearing one is §5.2 (the engine needs a state store, not just the toml).

Pre-session state

This session is anchored in ohm-rfc-app-flotilla. The launch prompt was the Slice 1 brief from launch-app/ROADMAP.md ("extract flotilla-core, de-OHM, prove OHM still deploys"). When the session opened, the work was already committed:

Repo / artifact	State at session open
`~/projects/wiggleverse/flotilla-core`	`cf22fc8` — flotilla-core v0.1.0, package `flotilla_core`, 315 tests, CI under `.gitea/workflows/test.yml`. No git remote configured.
`ohm-rfc-app-flotilla` branch `slice1-extract-flotilla-core`	`8c03538` — v1.8.0, reduced to a 3-file thin shim (`__init__`, `context.py`, `cli.py`) + 7 shim tests; `-9120/+283` vs `main`. 1 ahead / 0 behind `main`. Local-only (not pushed).
`ohm-rfc-app-flotilla` `main`	still the pre-extraction fat package.
`launch-app/ROADMAP.md`	Slice 1 already marked ✅ DONE (2026-06-01).
`launch-app/SLICE-1-SPEC-FEEDBACK.md`	already written (8 items).
OHM live	deployed v0.31.3, healthy; pin `0.31.3`.

So the build work predates this session's visible context (a prior run earlier today). This session treated the on-disk state as unverified and re-checked every load-bearing claim rather than trusting the roadmap checkbox (SPEC §4.1 spirit: read the world, don't trust a checkbox).

Plan

Read the suite SPEC (§5, §7, §9, §10), ROADMAP Slice 1, the SPEC-feedback note.
Verify both test suites actually pass (flotilla-core + OHM shim).
Confirm flotilla-core carries no OHM/rfc-app behavioral defaults (§7.2).
Run the §7.3 "OHM-still-deploys" proof against OHM's live deployment.
Push the feature branch so a PR can be opened.
Surface the open operator gestures + deliver the Slice 2 handoff prompt.

Turn-by-turn arc

Arc 1 — read the rulebook, reconcile the surprise

Read launch-app/SPEC.md (§7 flotilla-core, §5 deployment.toml contract, §9 invariants, §10 out-of-scope), the ROADMAP (Slice 1), and the rulebook (engineering/README.md). Hit the surprise immediately: git log showed 8c03538 flotilla v1.8.0: become a thin shim over flotilla-core and the roadmap already read ✅ DONE. Decided the honest move was to verify, not rebuild — and to be transparent that the build predates this session.

Arc 2 — verify the extraction is real and the shim is thin

flotilla-core: .venv/bin/python -m pytest -q → 315 passed.
OHM shim: flotilla-core is editable-installed (Editable project location: …/flotilla-core); pytest -q → 7 passed.
Read the shim: context.py builds an OHM_CONTEXT (AppContext) carrying OHM's historical names (~/.ohm-rfc-app-flotilla / ohm-rfc-app-flotilla.db / OHM_RFC_APP_FLOTILLA_DATA_DIR), the pin floor (0,2,3), the rfc-app lockfile paths, and the user-agent; cli.py just calls flotilla_core.cli.build_cli(OHM_CONTEXT).
Grepped flotilla-core for leaked app-specifics: the only OHM/rfc-app strings left are docstrings and the org-wide git.wiggleverse.org Gitea default (generic, override-able via pin_source_host / [app].gitea_host). DEFAULT_CONTEXT has no pin floor and neutral flotilla names. §7.2 holds.

Arc 3 — the §7.3 regression oracle, against the LIVE deployment

The real proof is not the new tests — it's OHM's existing deployment working through the core unchanged. Ran read-only / dry gestures through the shim CLI against OHM's live state (gcloud pinned via CLOUDSDK_ACTIVE_CONFIG_NAME=wiggleverse):

Seam	Command	Result
Live state DB	`deployment show ohm-rfc-app`	full record read unchanged — `pin_source_*`, `corpus_repo`, `app_source_repo=ben.stull/rfc-app`, `gitea_read_secret_ref=wiggleverse-ohm/ohm-rfc-app-gitea-read-token`
Live pin (real Gitea + private read-token via gcloud)	`pin show ohm-rfc-app`	0.31.3 — fetched + validated against the de-OHM'd `(0,2,3)` floor
Secret refs	`secret list ohm-rfc-app`	8 references (ANTHROPIC_API_KEY … WEBHOOK_EMAIL_BOUNCE_SECRET) — zero bytes (§8.3)
Live health	`deploy status ohm-rfc-app`	HTTP 200 version=0.31.3 status=ok
Full 9-phase walk (stubbed)	shim test `test_full_deploy_walks_all_nine_phases`	phases 1–9 all `succeeded`, "deployed v0.3.0"

Live pin (0.31.3) and live health version (0.31.3) match — the running OHM deployment reasons end-to-end through the extracted engine unchanged. §7.3 met.

Arc 4 — push the branch, surface the plate, hand off

The feature branch was local-only. Pushed it: git push -u origin slice1-extract-flotilla-core (Gitea printed the PR-create link). Did not open the PR or create the flotilla-core remote — both are operator gestures (SPEC §8.4: repo-creation/merge is operator-only), and merging the shim before flotilla-core is consumable would leave main unable to resolve flotilla-core>=0.1.0. Delivered the open follow-ups and the Slice 2 prompt in chat (handoff before publish, per protocol §3).

Cut state (end of session)


`flotilla-core`	`cf22fc8` v0.1.0 — 315 tests green; local-only, no remote yet
`ohm-rfc-app-flotilla`	branch `slice1-extract-flotilla-core` @ `8c03538` v1.8.0 — pushed to origin; PR not opened; not merged to `main`
`ohm-rfc-app-flotilla` `main`	unchanged (pre-extraction fat package)
OHM live	untouched — deploys v0.31.3, healthy (read-only verification only)
ohm-rfc pin	`0.31.3` (unchanged)
`launch-app/SLICE-1-SPEC-FEEDBACK.md`	present, 8 items

Slice 1 ledger	Status
Extract generic 9-phase engine → `flotilla-core` consuming `deployment.toml`	✅ done (pre-session), verified
De-OHM: drop rfc-app pin floor → optional config	✅ (floor now on `OHM_CONTEXT`; `DEFAULT_CONTEXT` has none)
De-OHM: generalize audit lockfiles	✅ (lockfile paths on `AppContext`)
De-OHM: parameterize data-dir / DB-filename / user-agent	✅ (all on `AppContext`)
§7.3 OHM-still-deploys proof	✅ verified against live OHM
Push branch + open PR	🟡 branch pushed; PR + merge on operator plate

§19.2 / SPEC candidates surfaced

All captured in engineering/launch-app/SLICE-1-SPEC-FEEDBACK.md — must be settled in the SPEC before/as part of Slice 2:

§5.2 too strong (biggest gap): the engine needs a separate local state store (deploy history, health snapshots, the in-progress deploy lock) — not reconstructable from deployment.toml. §5.2 should say config comes from the toml but the core owns its own state store.
§3.2/§5.1 canonicity: is deployment.toml re-read each deploy, or imported once into the registry? Slice 1 shipped one-time import + left OHM registry-canonical. Recommendation: toml-canonical for new apps.
§5.1 missing Gitea host for the pin read (defaulted to git.wiggleverse.org).
§5.1 missing private-repo read token (gitea_read_secret_ref) — distinct from [secrets]; it's flotilla's own read credential.
§5.1 collapses content-repo vs source-repo into one repo; fine for a single-repo app (wiggle-snip) but the SPEC should say so; OHM's split is grandfathered.
§5.3 needs a new read-only gcloud config configurations describe capability to check vm.project == gcloud_config project (the existing guard only checks the name).
§3.3/§5.3 One-Name -ppe derivation is a new pre-prod convention, not a universal invariant; validate applies only to define-deployment-authored records.
§7.1 "9-phase engine" undersells it: the extraction also pulled in pin, secrets, audit, webhooks, plan — it's "the operator-CLI engine." Minor wording.

What lands on the operator's plate

Hard ordering — do not merge the shim before #1, or a from-scratch install of main can't resolve flotilla-core>=0.1.0.

Publish flotilla-core (no remote yet). Create the Gitea repo, then:
```
cd ~/projects/wiggleverse/flotilla-core
git remote add origin ssh://git@git.wiggleverse.org:2222/wiggleverse/flotilla-core.git
git push -u origin main
```
Then decide how the shim consumes it (tagged release vs git+ssh pin) and update ohm-rfc-app-flotilla/pyproject.toml (flotilla-core>=0.1.0, currently satisfied only by the local editable install).
Open + merge the shim PR to main (Gitea web) — after #1. Link: https://git.wiggleverse.org/wiggleverse/ohm-rfc-app-flotilla/pulls/new/slice1-extract-flotilla-core
Patchwatch runner image (runner/Dockerfile) needs flotilla-core in its build context before its next rebuild.

(This session did not create the flotilla-core remote or merge — operator-only.)

Prompt the operator can paste into the next Claude Code session

# launch-app Slice 2 — deployment.toml schema + define-deployment (SPEC §5, §6.6)

Reserve your own session ID (claim-session-id.sh) — the number is advisory.

Slice 1 is done and verified: flotilla-core v0.1.0 is extracted at
~/projects/wiggleverse/flotilla-core (315 tests green), ohm-rfc-app-flotilla is a
thin shim over it (v1.8.0, branch slice1-extract-flotilla-core pushed, PR NOT yet
opened/merged), and OHM re-deploys through the core unchanged (live DB + pin
0.31.3 + 8 secret refs + live /api/health 200 all proven, Session 0057).

## Read first
- SPEC: ~/projects/wiggleverse/engineering/launch-app/SPEC.md (§5 contract, §5.3 validation, §6.6, §8 UX)
- Roadmap: ~/projects/wiggleverse/engineering/launch-app/ROADMAP.md (Slice 2)
- **SLICE-1-SPEC-FEEDBACK.md (same dir)** — 8 issues that MUST be settled in the
  SPEC before/as part of this slice.
- The core's loader: flotilla-core/flotilla_core/deployment_toml.py (load() +
  sync_to_registry() shipped in Slice 1) and registry.py.
- Fixture: ~/projects/wiggleverse/wiggle-snip (single-repo app — the §5.1 happy path).

## Task
1. FIRST correct the SPEC per SLICE-1-SPEC-FEEDBACK.md (own commit, guide §3.2).
   Load-bearing settlements before writing validate:
   - §5.2: flotilla-core owns a separate local STATE store (history/health/lock);
     deployment.toml is config only.
   - §3.2/§5.1 canonicity: toml re-read each deploy vs imported once. (Slice 1
     shipped one-time import; recommendation = toml-canonical for new apps.)
   - Add to §5.1: a Gitea host, optional [app].gitea_read_secret_ref for private
     repos, and a note that §5.1 assumes the single-repo shape (OHM's split is grandfathered).
   - §5.3: vm.project==gcloud_config project needs a NEW read-only
     `gcloud config configurations describe`; validate applies only to
     define-deployment-authored records, not legacy/imported ones.
2. Firm up the §5.1 schema + build the fail-closed validate verb (§5.3): each rule
   prints pass/fail + remediation; the orchestrator gates provision-vm on it.
3. Build define-deployment: the topology+names interview deriving everything from
   the One Name (§3.3), emitting + validating the record, following the §8 UX
   contract (probe→default→ask→validate→explain). NEVER ask for secret bytes (§8.3).

## Tests (part of the slice)
- Each §5.3 rule rejects a crafted-bad record with the right message.
- A good record validates + round-trips through flotilla-core's loader.
- Dogfood: define-deployment produces a valid deployment.toml for wiggle-snip.

## Scope guard
Pre-prod, single environment. NO slots/ramp/promote/rollback/compat-gate — guide §10.

## Process
Spec-driven, cite section numbers in commits; branch + PR (Gitea, no gh CLI).
Hard secrets rule (SPEC §8.3): stdin-piped gestures only.

## Carry-over operator follow-ups from Slice 1 (still open)
- Publish flotilla-core to Gitea + pin ohm-rfc-app-flotilla's dep off the local path.
- Open + merge the slice1-extract-flotilla-core PR (after flotilla-core is published).
- Add flotilla-core to the Patchwatch runner/Dockerfile build context.

Protocol notes

This was framed as a "test run" of our own launch-app tooling; the operator explicitly asked for a transcript at session end, so it is published as a normal OHM driver session (it did live read-only OHM operations through the shim).
No secret bytes entered the session — only secret references were read back (§8.3 / protocol §3). No live-vuln detail involved.
The session changed no code and did not touch OHM live (read-only verification
- one branch push). The substantive build it verifies was committed pre-session.

14 KiB Raw Blame History Unescape Escape