app-identity-dogfood

Files (1)

• SKILL.md

SKILL.md (first lines)

# App Identity Dogfood (DEV, LastDB CLI)

This skill exercises the supported App Identity developer journey on the
deployed DEV stack:

1. `folddb login --env dev` establishes the developer identity and DevCert.
2. `folddb init brain` writes the local app manifest.
3. `folddb push --env dev` registers the app and publishes the brain schemas.
4. Snapshot/status checks prove the live registry has the owned brain schema
   set and the local manifest is in sync.

This file is the canonical runbook for commands. The older team-facing
`exemem-workspace/docs/dogfood/app-identity-dogfood-runbook.md` is historical
context and run log only until a separate docs PR refreshes it to point here.
When the two disagree, follow this skill.

Memory: `project_app_identity`, `project_fbrain`.

## Hard Safety Rules

1. DEV only. Every endpoint and credential must target the dev environment.
   Abort if anything resolves to prod.
2. Never use Tom's primary LastDB/Brain state. Do not read or write
   `$HOME/.lastdb`, `$HOME/.folddb`, `$HOME/.brain`, or the primary socket as
   part of this dogfood.
3. Use a dedicated persistent dogfood home, not a temp home, for the developer
   identity:
   `FOLDDB_HOME=$HOME/.last-stack/dogfood/app-identity/brain`.
   This is intentionally stable so reruns use the same owner key. Do not pass
   `folddb login --force` unless Tom explicitly asks for an owner rotation.
4. Keep secrets out of chat, Brain, Kanban, docs, logs, and PR bodies. If a run
   needs a raw API key, retrieve it from LastSecrets at the point of use and do
   not print it. Prefer an already-persisted key in the dedicated dogfood home
   or an invite path that stores the key into that home.
5. Do not run local registry services or destructive registry/data resets.
6. Do not stash, reset, clean, or otherwise modify shared worktrees.

## Fixed Dev Coordinates

| Thing | Value |
|---|---|
| dev schema service | `https://y0q3m6vk75.execute-api.us-west-2.amazonaws.com` |
| dev Exemem API | `https://ygyu7ritx8.execute-api.us-west-2.amazonaws.com` |
| dev region | `us-west-2` |
| dogfood app id | `brain` |
| dogfood handle | `app-identity-dogfood-brain` |
| dogfood home | `$HOME/.last-stack/dogfood/app-identity/brain` |
| brain schema source | `$HOME/code/edgevector/brain/src/schemas.ts` |
| brain pass set | Concept, Task, Design, Preference, Reference, Agent, Project, Spike, Sop |

The pass set is nine user-facing knowledge-record schemas. Include `Sop`.
Do not use the old eight-type list. `Decision` is intentionally outside this
dogfood pass while workspace guidance keeps decision writes disabled.

## Step 0 - Readiness Gate

Verify that the deployed dev routes are mounted before doing any writes:

```bash
SS=https://y0q3m6vk75.execute-api.us-west-2.amazonaws.com
EX=https://ygyu7ritx8.execute-api.us-west-2.amazonaws.com
code() { curl -s -o /dev/null -w '%{http_code}' "$@"; }

APPS=$(code -X POST "$SS/v1/apps" -H 'content-type: application/json' -d '{}')
DEVCERT=$(code -X POST "$EX/v1/dev-cert" -H 'content-type: application/json' -d '{}')
echo "apps=$APPS devcert=$DEVCERT"
```

Expected:

- `apps` is not `404`. `401`, `400`, or `422` means the route reached the
  Lambda and validation fired.
- `devcert` is `422` or `200`.

If either route is not ready, stop and file or reference the existing Kanban
gap. Do not report a dogfood pass.

## Step 1 - Isolate Persistent Dogfood State

Set the CLI home before every `folddb` command. This home is persistent across
runs by design; it owns the `brain` app registration.

```bash
export FOLDDB_HOME="$HOME/.last-stack/dogfood/app-identity/brain"
export FOLDDB_DISABLE_KEYCHAIN=1
mkdir -p "$FOLDDB_HOME"

echo "dogfood home: $FOLDDB_HOME"
test "$FOLDDB_HOME" != "$HOME/.lastdb"
test "$FOLDDB_HOME" != "$HOME/.folddb"
test "$FOLDDB_HOME" != "$HOME/.brain"

for sock in "$HOME/.lastdb/data/folddb.sock" "$HOME/.folddb/data/folddb.sock"; do
  if [ -S "$sock" ]; then
    echo "primary socket observed and left untouched: $sock"
  fi
done
```

Do not use `mktemp` for `FOLDDB_HOME`; a temporary home creates a new developer
owner and can fail the registry's first-write-wins ownership model.

## Step 2 - Login

Use the consolidated CLI credential boundary:

```bash
folddb login --env dev --handle app-identity-dogfood-brain
```

If the dedicated home already has a developer key and persisted API key, this
refreshes the dev cert and keeps the same owner identity.

If the command reports a missing API key, use the approved credential path for
the run:

- With an invite code: `folddb login --env dev --handle app-identity-dogfood-brain --invite "$INVITE_CODE"`.
- With an API key from LastSecrets: retrieve it point-of-use, pass it with
  `--api-key`, and do not echo it.

From EdgeVector/last-stack, MIT.

More from EdgeVector/last-stack