Session 0061.0 — Transcript

Date: 2026-06-01 Start: 2026-06-01T10-28 (PST implied) Goal: launch-app Slice 3 — build provision-vm (§6.7) + scaffold-gitea-repos (§6.8), then dogfood them against wiggle-snip to a verified pre-prod /api/health. Status: IN PROGRESS.

Launch prompt

launch-app Slice 3 — provision-vm + scaffold-gitea-repos (SPEC §2, §6.7, §6.8)

State (after Slice 2 / session 0060, 2026-06-01):
- launch-app SPEC is v0.0.2; ROADMAP Slice 2 closed.
- Skills exist: scaffold-gcp-project (§6.5), define-deployment (§6.6).
- flotilla-core v0.3.0 on wiggleverse/flotilla-core main (private, tagged v0.3.0):
  deployment scaffold|validate|import + gcloud.describe_config, 371 tests green.
  Sits atop a parallel preview-environments line (still active).
- ohm-rfc-app-flotilla main is the v1.8.0 thin shim, dep pinned flotilla-core>=0.3.0.
- wiggle-snip (~/projects/wiggleverse/wiggle-snip, NOT a git repo) has a validated
  deployment.toml. The §5.3 validate gate is built + proven.

Task:
1. Run scaffold-gcp-project for wiggle-snip FIRST (clears the dogfood WARN).
2. Build provision-vm (§6.7): micro VM (IAP-only, no public :22), runtime install
   (Python, Node, nginx, systemd unit), TLS via Cloudflare. Idempotent. Gates on
   flotilla-core deployment validate.
3. Build scaffold-gitea-repos (§6.8): repo set + bot user/token; record whether
   pre-prod uses its own Gitea or shares.
4. Proof: fresh micro VM up, /api/health reachable through nginx after a hand-run
   deploy, re-running the skill is a no-op.

Constraints: pre-prod single env (NO slots/ramp/promote/rollback); hard secrets
rule (stdin-piped secret set only); gcloud isolation (CLOUDSDK_ACTIVE_CONFIG_NAME
per-process); parallel preview-environments line shares flotilla-core (worktree if
touched); spec-driven (cite section numbers); branch + PR (Gitea, no gh CLI).

Plan

Read SPEC §2/§6.7/§6.8, ROADMAP Slice 3, SESSION-PROTOCOL; claim session ID (0061).
Map exactly what the deploy substrate must be (flotilla-core deploy.py phases 2–8).
Reconcile flotilla-core reality vs the launch prompt (see Arc 1 — prompt was off).
Build provision-vm skill (SKILL.md + provision-runtime.sh + read-deployment-params.py).
Build scaffold-gitea-repos skill (SKILL.md + init-and-push.sh).
Dogfood step 1: scaffold-gcp-project for wiggle-snip → validate WARN→PASS (6/6 PASS).
Operator gestures: new billing account; Gitea repo push; Cloudflare DNS token.
Dogfood: APIs → VM → provision-runtime → deploy → green /api/health → prove no-op re-run.
Update launch-app ROADMAP (close Slice 3) + SPEC if needed; branch + Gitea PR.
Finalize + publish this transcript (handoff prompt to operator first).

Pre-session state

launch-app SPEC v0.0.2; ROADMAP Slice 1 + 2 closed. Skills present: scaffold-gcp-project (§6.5), define-deployment (§6.6).
wiggle-snip (~/projects/wiggleverse/wiggle-snip) is built + tested, NOT a git repo, with a deployment.toml that validated 5 PASS + 1 WARN (gcloud config absent).
gcloud active on-disk pointer: benstull-infra (left untouched all session).

Turn-by-turn arc

Arc 1 — flotilla-core reality vs the launch prompt

The launch prompt said "flotilla-core v0.3.0 on main, tagged v0.3.0, 371 tests" with the deployment scaffold|validate|import verbs. The real world (SPEC §4.1 — read the world, don't trust a checkbox) is different and the prompt is advisory:

main = 333e0ff v0.2.0 (per-PR preview environments, SPEC §15) — pushed to origin/main. It does not carry the scaffold/validate verbs.
The Slice-2 work lives on branch slice2-schema-validate (9b15b2a, "flotilla-core v0.3.0: deployment.toml scaffold + fail-closed validate") in the isolated worktree ~/projects/wiggleverse/flotilla-core-slice2, rebased on top of the preview-environments main, pushed to origin/slice2-schema-validate. Not merged to main, not tagged.

So the "v0.3.0 on main, tagged" claim is ahead of reality — it's on the branch. This session did not touch the flotilla-core checkout (the parallel preview-environments line owns main); it only used the slice2 worktree's CLI for the validate gate.

Arc 2 — Build the two skills

Studied flotilla-core/deploy.py to pin down exactly what the 9-phase deploy expects to find on the VM (phases 2–8): install dir is a git clone owned by the service user; backend/.venv; node/npm/git; a systemd unit; https://<domain>/api/health through nginx. The skills lay exactly that substrate, no more (the deploy itself fetches / builds / writes .env / starts the unit).

Built under ~/projects/wiggleverse/engineering/launch-app/skills/:

provision-vm/ — SKILL.md (gate→probe→ask→create VM→install→key→clone→ Cloudflare→explain), assets/provision-runtime.sh (idempotent on-VM installer: service user, apt runtime, deploy key born-on-VM for private repos, clone, venv, systemd unit, nginx + self-signed origin TLS), assets/read-deployment-params.py (emits shell exports from the canonical toml — single source of truth, no bash re-derivation). Handles public (anon HTTPS clone) and private (deploy-key SSH) repos; REPO_PRIVATE derived from whether the record carries gitea_read_secret_ref. IAP-only SSH firewall (:22 ← 35.235.240.0/20 only); :80/:443 ← Cloudflare ranges.
scaffold-gitea-repos/ — SKILL.md (share-vs-own Gitea recorded via gitea_host; visibility + bot choice; create repo → push → tag v<VERSION>; bind read credential / register deploy key — all operator-run, never asks for token bytes), assets/init-and-push.sh (idempotent: create repo via API if missing, git init + first commit, point origin, push, tag — token read from $GITEA_TOKEN, never an arg).

Both shell assets pass bash -n; the param reader round-trips wiggle-snip's toml.

Arc 3 — Dogfood step 1: GCP foundation for wiggle-snip

Operator chose full live bring-up on a new billing account. Drove scaffold-gcp-project for wiggle-snip:

Created GCP project wiggle-snip under org wiggleverse.org (592336083752).
Created the dedicated wiggle-snip gcloud profile --no-activate; populated account/project/region/zone scoped by CLOUDSDK_ACTIVE_CONFIG_NAME only. Verified the active pointer stayed benstull-infra — the two-layer rule held.
Re-ran deployment validate: 6/6 PASS, the gcloud-project WARN cleared — the §4.2 gate for provision-vm is green.

Blocked here on the operator plate (below): a new billing account is Console-only, and APIs/VM can't proceed until billing links.

What lands on the operator's plate (current)

New billing account (Console-only) → give me the account ID (not a secret) so I link it, or link it yourself: gcloud billing projects link wiggle-snip --billing-account=<ID>.
Gitea repo push — export a $GITEA_TOKEN with org repo-create scope and either run, or let me run, scaffold-gitea-repos/assets/init-and-push.sh --app-dir ~/projects/wiggleverse/wiggle-snip --repo wiggleverse/wiggle-snip (public; no --private). Pushes + tags v0.1.0.
Cloudflare DNS — a $CF_API_TOKEN + $CF_ZONE_ID in your env for the proxied A record ppe.wiggle-snip.wiggleverse.org → the VM IP, SSL mode Full (provision Step 6). Never pasted into the conversation.

Prompt the operator can paste into the next Claude Code session

(to be written at finalize)

7.5 KiB Raw Blame History Unescape Escape