Version. 0.1 Date. 2026-05-28 Status. Working draft. Closes the 2026-05-28 cleanup session and opens the next arc.
This document closes the 2026-05-28 session and carries state into the next chat. The session set out to work four open items from the morning handoff in sequence. It closed the three cleanup items and correctly left the one architectural item — file upload through the in-engagement composer — for its own scoping arc, which is what the next chat opens.
What landed: the configuration-drift remediation (so a fresh checkout no longer reproduces three dev-environment problems), and the test-override audit (which found and fixed two more test fixtures that did not mirror production behaviour, and recorded one suite-wide fixture as a tracked design choice rather than touching it). Both are on origin/main across the engine and record repositories.
What this document opens: the file-upload-through-the-composer work. It is the architectural item. It does not get a quick fix — that pattern is exactly what produced the transaction bug that hid for two weeks. It opens as a scoping conversation, then a scoping note, then a Change Request, before any Claude Code execution.
What decision is needed at the start of the next session: whether to open item 3 now, and which of three named fix shapes to pursue (the scoping conversation chooses; nothing is pre-decided).
| Repository | Main head | What it is |
|---|---|---|
| Engine (loomworks-engine) | d5d57ee | The substrate. The config-drift .env.example fix, the RP-origin test decoupling, and the two test-fixture envelope fixes all landed here this session. |
| Operator Layer (loomworks) | 2186d13 | The Operator-facing frontend. Unchanged this session; still carries the /chat?project= route restoration from 2026-05-27. |
| Record (loomworks-record) | cd54c6c | The canonical document home. Queued-directions v0.19 and v0.20 landed here; v0.18 archived. |
All four services were listening when the session closed. PIDs below are a point-in-time snapshot; the engine worker cycles under --reload, so its worker PID will differ on inspection. If the next session opens on a fresh machine state, restart will be needed — and unlike the morning, the restart no longer reproduces the three configuration drifts, because the .env.example fix landed (run cp .env.example .env on a fresh checkout).
| Service | Port | PID (snapshot) | Note |
|---|---|---|---|
| Engine | 8000 | 62250 reloader, 68106 worker | Worker PID cycles under --reload; do not treat as stable |
| Operator Layer | 3001 | 27054 | |
| Workshop | 3000 | 34740 | Optional; the older four-room view |
| Storage (MinIO) | 9000 (interface), 9001 (console) | 37440 | Data dir /Users/dunin7/minio-data; dev-default credentials |
Unchanged from the morning. The production passkey path does not work against local dev — the Operator's credential row is a fixture, tracked as open work in §13.3 (see below). Use the dev shortcut: open http://localhost:3001/auth, enter person identifier 6d867b23-655a-440a-b377-e6bf4fb3882b, submit. Session lasts one hour.
The three dev-environment drifts no longer reproduce on a fresh checkout. The fix was a checked-in .env.example carrying the correct dev reference (LOOMWORKS_ENV=development, WEBAUTHN_RP_ORIGIN=http://localhost:3001, OBJECT_STORE_ACCESS_KEY/OBJECT_STORE_SECRET_KEY=minioadmin), with REPLACE_ME placeholders for the two real secrets — engine commit b793aef. The RP-origin test was decoupled from the ambient .env by monkeypatching the setting to a fixed value, so it is deterministic regardless of what the dev environment carries — engine commit 427c446.
Decision recorded: source-code defaults left unchanged on purpose. The RP origin default stays :3000 (production supplies the real origin via env); the object-store credentials stay empty strings (so source never carries credential-shaped values and fails closed rather than silently). The correct dev values live in the checked-in reference, not baked into source.
Recorded in queued-directions §13.2 as resolved (config-drift half). The credential-fixture half of the old §13.2 was promoted to its own first-class entry, §13.3.
The audit found every place the engine test suite overrides the database-session dependency and classified each against the production envelope (commit on clean return, roll back on exception). It surfaced three override sites beyond the six already-fixed upload-test fixtures:
test_phase_59_upload_streaming.py and test_phase_59_object_store_wiring.py, same upload endpoint, missed only because their assertions do not read substrate state back. Both brought to the production envelope — engine commit d5d57ee. All eight upload-test override fixtures now carry the identical envelope shape.tests/test_auth_dev.py was deliberately left unchanged: the auth-dev handler does no transaction-primitive work, so the envelope-less override cannot admit the bug class.tests/conftest.py api_client fixture was deliberately left unchanged and recorded as a tracked design choice (see below).Recorded in queued-directions §15.2 as resolved (audit executed), with the conftest finding as a new open structural item.
8396fa3): §13.2 config-drift half resolved; §13.3 created for the passkey work.cd54c6c): §15.2 audit closed; conftest design choice recorded and promoted to v0.21; v0.18 archived to archive/.Recorded at queued-directions §15.1, second sequenced action.
This is the architectural item and the reason the next chat exists. The upload affordance currently lives on the restored /chat?project= surface. The architecture specification names a different destination: upload through the in-engagement composer itself, so files arrive through the same surface as conversation. The in-engagement composer (CenterPane) is hand-built and does not currently reuse the upload components, so the port has surface implications likely to surface further gaps.
It is phase-shaped work, not a fix. It deserves a scoping conversation, then a scoping note, then a Change Request, before any execution. Do not approach it as a quick fix — that pattern is what produced the transaction bug that hid for two weeks.
Three fix shapes are already named in the record (§15.1). The scoping conversation chooses among them:
CenterPane) with the upload affordance.CenterPane to reuse the existing ChatView upload components.
How to open it: the next chat begins from current CenterPane-versus-ChatView state (ask Claude Code to retrieve both components' current shape before the scoping conversation, rather than relying on this handoff's summary), names the three shapes, and talks through consequences before a line of scope is written.
Recorded at queued-directions §13.3.
The dev passkey path is broken because the Operator's webauthn_credentials row is a 16-byte fixture, not a real registration. Resolving it has two halves: an engine-prep half Claude Code can build (verify the registration ceremony works against the dev RP-ID on localhost:3001; decide between registering fresh versus replacing the fixture row), and a ceremony half that is the Operator's own Touch ID action and cannot be performed by Claude Code. Open, not sequenced into a build phase. Dev sign-in stays on the /auth shortcut until it is scheduled.
Two findings are filed for the v0.21 methodology consolidation, travelling together whenever that consolidation happens:
Both are "structural-condition-that-will-hide-the-next-bug" findings. Neither travels with a build session; they fold into the v0.21 consolidation.
docs/inspections/engagement-navigation-v0_6-implementation-findings-v0_1.md (43,810 bytes, dated 2026-05-24) sits untracked in the engine repo. It predates this session and is not this session's work. Disposition is the Operator's call — commit, move into an archive location, or delete — and belongs to a future hygiene pass, not the item-3 arc.
loomworks-queued-directions-and-deferred-work-v0_20.md in the record repository. §13.2 (config-drift resolved), §13.3 (passkey work, open), §15.1 (item 3 + route-redisposition candidate), §15.2 (audit closed + conftest candidate).d5d57ee.2186d13.cd54c6c.loomworks-candidate-seed-v0_9 — foundation document, read first in any session touching settled commitments.loomworks-architecture-specification-v0_4.md — governs where the seed is silent; its section 13 ("Memory population surface unification") is the framing for item 3.CenterPane (the in-engagement composer) and the ChatView upload components, so the conversation begins from current code state rather than this handoff's summary..env.example fix landed this session, so cp .env.example .env configures a fresh checkout.For any Discovery record built from this session:
8fc2b76 record-head was stale by one commit (the handoff predated its own commit landing), and the propagation was caught and named rather than acted on blindly.DUNIN7 · Loomworks · Session Handoff 2026-05-28 Evening · v0.1