From cd5827cca7116927a108f388dec3005a11737e2c Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 28 Aug 2026 19:50:25 +0000 Subject: [PATCH] chore: untrack plan-4-kickoff-prompt.md (user's local prompt notes, not repo content) --- docs/superpowers/plan-4-kickoff-prompt.md | 108 ---------------------- 1 file changed, 108 deletions(-) delete mode 100644 docs/superpowers/plan-4-kickoff-prompt.md diff --git a/docs/superpowers/plan-4-kickoff-prompt.md b/docs/superpowers/plan-4-kickoff-prompt.md deleted file mode 100644 index 553ce85..0000000 --- a/docs/superpowers/plan-4-kickoff-prompt.md +++ /dev/null @@ -1,108 +0,0 @@ -Continue VolcanicCore development. Plans 1, 2, and 3 are shipped and pushed to -origin. Head is `7854cb0` on `main`; the last plan-close commit is -`docs: close out Plan 3 — React SPA live`. Backend is 74/74 (`dotnet test`), -frontend is 20/20 (`pnpm --dir frontend test`), and the Playwright happy-path -smoke passes (`pnpm --dir frontend test:e2e`). - -Read the following in order before writing anything: -- `CLAUDE.md` — current status, invariants (esp. the SPA-bundles-into-wwwroot - and MapFallbackToFile-goes-last rules), and the working style that shipped - Plans 1, 2, and 3 cleanly (superpowers:brainstorming for design if the shape - isn't obvious, superpowers:writing-plans for the plan doc, - superpowers:subagent-driven-development for execution — auto mode, no - per-task confirmation). -- `docs/superpowers/specs/2026-08-28-volcaniccore-workflow-engine-design.md` — - §8 (Deployment) and §1 (Architecture) especially. The design already commits - to single-container Coolify, `/data` volume, single ASP.NET Core 9 process. -- `docs/superpowers/plans/2026-08-29-plan-2-workflow-engine.md` and - `docs/superpowers/plans/2026-08-30-plan-3-react-spa.md` — for cadence and - file-structure conventions. -- `docs/superpowers/followups.md` — cross-plan items. Two Plan-4 items are - already listed (forwarded-headers/secure-cookie behind Traefik + boot-time - re-seed on legacy plaintext `admin.password_hash_source`). Plan 4 MUST clear - both. - -Read these skills before authoring: -- `preparing-dotnet-react-app-for-coolify` — Dockerfile pattern, docker-compose - conventions, `expose: [8080]`, `SERVICE_FQDN_APP`, named volume, static-file - serving env-var overrides. -- `deploying-to-coolify-via-api` — v4 REST API for creating/updating apps, - `deploy.json` for non-secret config, project/server discovery, HTTP-probe - verification. - -Author **Plan 4 — Container + Coolify deploy** using superpowers:writing-plans, -then execute it with superpowers:subagent-driven-development (same cadence as -Plans 1, 2, 3 — auto mode, no per-task confirmation, TDD per task where it -applies, two-stage reviews for substantive tasks and combined lightweight -reviews for mechanical ones, conventional-commits messages). - -Plan 4 must cover, at minimum: - -- **Multi-stage Dockerfile** in the repo root: pnpm-installs + Vite build the - SPA into a scratch stage's `/build/wwwroot`, `dotnet publish` the API in a - separate stage using `sdk:9.0`, final runtime image based on the .NET 9 - runtime (or aspnet:9.0 — distroless if it plays nicely with IronPython's - P/Invoke; if not, `mcr.microsoft.com/dotnet/aspnet:9.0` is fine — call it out - in the plan). Copy the SPA build output into `/app/wwwroot`. `EXPOSE 8080`. - `ENTRYPOINT ["dotnet", "VolcanicCore.Api.dll"]`. -- **docker-compose.yml** at repo root, Coolify-flavored per the skill: single - service, `expose: [8080]`, named volume mounted at `/data`, env passed - through (`ADMIN_PASSWORD`, `ENCRYPTION_KEY`, retention/timeout knobs, - `DATA_DIRECTORY=/data`), `SERVICE_FQDN_APP` for the domain, Traefik labels - only when the domain is set. -- **`Program.cs` — `UseForwardedHeaders` wired before `UseAuthentication`.** - Configure `ForwardedHeaders.XForwardedProto | XForwardedFor`, - `KnownNetworks` + `KnownProxies` cleared so the Coolify/Traefik reverse - proxy is trusted inside the container network. Cookie config stays - `SameSite=Lax` but `Secure` starts flipping to `Always` behind TLS. Add - xUnit tests that prove the middleware sees `X-Forwarded-Proto: https` and - reports `Request.Scheme == "https"`. -- **Boot-time re-seed on legacy plaintext `admin.password_hash_source`.** - Wrap the `repo.Get(PasswordSourceKey)` call in `AdminBootstrap.Seed` in a - `try/catch (CryptographicException)` — treat "can't decrypt" as "row is in - the pre-Plan-2 plaintext format, treat as unset" so the boot re-seeds - cleanly. Add a test that seeds a plaintext row directly into `admin_config` - and asserts `AdminBootstrap.Seed` fixes it up on next boot. -- **`deploy.json`** at repo root (or under a `deploy/` dir) capturing project - UUID, server UUID, planned domain, non-secret app env vars — populated once - from Coolify project/server discovery (Task in the plan asks the user for - the domain). -- **Coolify deploy — CREATE the app via v4 API** if it doesn't exist yet, PATCH - its git config + env vars, then trigger a deploy fire-and-forget per the - global CLAUDE.md rule. Verify the deployment id came back; DO NOT poll the - build. Instead, the plan's Playwright smoke can be reused later against - the live URL as a follow-up sanity — do NOT block on it in this plan. -- **CI story for the Playwright smoke.** If GitHub Actions / Gitea Actions - aren't wired yet, add a lightweight workflow (or note in followups.md that - it lands in a Plan-5 CI task). Either way, make sure the Playwright browser - install step is documented. -- **README-ish** — the plan's close-out task should extend `CLAUDE.md` with the - live URL, the current deploy invocation, and any new invariants the Docker - build introduces. - -After Plan 4 executes cleanly, the app is live at its Coolify FQDN and the -close-out commit is on `main`. This is the end of the initial-launch scope. - -Working invariants that MUST NOT be relearned from scratch: -- Working branch: `main`. No feature branches. -- Every commit needs `-c user.email="claude@volcanic" -c user.name="Claude"`. -- All the Plan-1/2/3 invariants in CLAUDE.md: cookie auth is in the .NET 9 - shared framework (do NOT add `Microsoft.AspNetCore.Authentication.Cookies` - as a PackageReference); test parallelism stays off; env-var loop honors - pre-set config; `WebhookRegistry` / `WebhookRouter` live in `.Core`; - `TriggerActivationSink` is fire-and-forget; SPA bundles into - `src/VolcanicCore.Api/wwwroot/`; `MapFallbackToFile` stays the LAST `Map*` - call; `vite.config.ts` needs `/// ` on line 1. -- Global CLAUDE.md: deploys are fire-and-forget via the Coolify v4 API — do - NOT poll the build, do NOT block on the FQDN. The API returns a deployment - id; that's the success signal. - -Env vars available in the session: `COOLIFY_URL`, `COOLIFY_KEY`, `GIT_URL`, -`GIT_USER`, `GIT_KEY`. Use the `deploying-to-coolify-via-api` skill for the -splice-credentials-into-git-URL and stderr-redaction patterns. - -Start by pulling latest, reading CLAUDE.md + followups + the two skills above, -confirming `dotnet test` is 74/74 and `pnpm --dir frontend test` is 20/20 -before authoring Plan 4. Ask the user for the intended Coolify domain -(e.g. `volcaniccore.tes.gd`) BEFORE the plan gets to the `deploy.json` -creation task — that's a decision only they can make.