From 32b54ac3b040b1f1a72ad1951ef6144c03630575 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Tue, 20 Oct 2026 15:57:07 -0500 Subject: [PATCH] plans: Case 2 row briefs from Gosalyn's 51006710a (webby-0034 N1/N2 and webby-0035: row A README :711 one line per variable, C2-13 owns README :713 and says the precheck prints only variable names) --- docs/plans/2026-10-20_case2-rows.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/docs/plans/2026-10-20_case2-rows.md b/docs/plans/2026-10-20_case2-rows.md index 81140d017..fa147ae78 100644 --- a/docs/plans/2026-10-20_case2-rows.md +++ b/docs/plans/2026-10-20_case2-rows.md @@ -723,8 +723,10 @@ starts. ### Files owned `scripts/case2-install.sh`, `scripts/case2-precheck.sh` and `scripts/case2-unit.sh` (new), the template -`packages/cli/systemd/mosaic-stack.service.in` (new), and `packages/cli/tests/case2-install.test.mjs` -(new). +`packages/cli/systemd/mosaic-stack.service.in` (new), `packages/cli/tests/case2-install.test.mjs` +(new), and one line of `packages/cli/README.md`: at `:713`, "nothing in the repository creates or reads +it" changes to say that nothing creates it, that only the Case 2 precheck reads it, and that the +precheck prints only variable names, never values (webby-0034 N2, webby-0035). ### What ships @@ -891,9 +893,10 @@ its first turn, as `packages/cli/README.md:439-444` says. - `packages/cli/README.md`, after "A Pi session gets the same variables through the allowlist." (`:435`), one sentence: a Pi session on provider `zai` logs in with `ZAI_API_KEY`, which the allowlist passes. Like every allowlist variable, it reaches every session the host starts, Claude Code ones included, and a - shell inside any of them can read it. A second sentence where the README names - `claude-session.env` ("Unit"): the file holds every session provider key, not only Claude's - (webby-0032). + shell inside any of them can read it. Where the README names `claude-session.env` ("Unit", `:711`), + "The file holds one line" becomes "The file holds one line per variable", followed by a sentence + saying it holds every session provider key, not only Claude's (webby-0032, webby-0034 N1). Leave + `:713`, "nothing in the repository creates or reads it", alone. C2-13 owns that line. - One test in `session.test.mjs`: `ENV_ALLOW` includes `ZAI_API_KEY`, and `sessionEnv({ ZAI_API_KEY: "fixture-zai", ZAI_TOKEN: "t" }, run)` returns `ZAI_API_KEY` with the fixture value and no `ZAI_TOKEN`. The existing allowlist test (`:51-59`) stays as it is.