sjat/boma - Forgejo: Beyond coding. We forge.

sjat/boma

Fork 0

Commit graph

Author	SHA1	Message	Date
sjat	c1323a3f29	feat(make): registry-login via vaulted Forgejo token (kaizen) scripts/registry-login.sh reads vault.forgejo.registry_token and pipes it to docker login --password-stdin (never echoed, never on argv); 'make registry-login' wires it with the venv binaries. Adds the operator-minted CHANGEME vault stub (fill via make edit-vault) and a per-machine prereq note in the claude-code-setup runbook, so 'make caddy-image-push'/'molecule-image-push' become agent-completable non-interactively. Consumes the 2026-06-15 signal in docs/FRICTION.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-17 17:50:07 +02:00
sjat	91713127cb	docs(kaizen): migrate gotchas to docs; curate FRICTION log (2026-06-10 review) - New docs/testing/gotchas.md (nft iif/iifname, Molecule ansible_host, apply-path coverage blind spot, render-nft-c pattern); pointer from ADR-008. - claude-code-setup.md gains "Environment gotchas" (hooks-need-restart, pre-commit stashes unstaged, rbw sync cache, zsh word-split). - FRICTION.md restructured into Open signals + a decisions ledger; consumed signals archived with where their resolution now lives. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-10 12:51:39 +02:00
sjat	abb5c7a12f	Make the Claude Code toolchain reproducible (TODO 10.7) Reviewed the Claude Code config against boma's capabilities and committed a reproducible, leaner toolchain: - .claude/settings.json now declares extraKnownMarketplaces + enabledPlugins so a fresh clone prompts to install the active set: superpowers, context7, terraform (we use TF, ADR-006), claude-md-management (doc/ADR-heavy). Drops code-simplifier. - Adds a conservative, read-only/verify permissions allowlist (git status/diff/log, make lint/test/check, pytest, rbw unlocked, ls/cat/rg/find) — mutations and outward/destructive commands stay gated, consistent with ADR-002. - docs/runbooks/claude-code-setup.md: per-machine bootstrap, the deferred enable-when plugins (security-guidance/semgrep, playwright, hookify, skill-creator), rbw/venv prerequisites, and a note to keep the dangerous-mode prompt on. Closes TODO 10.7. Plugin install remains a per-machine /plugin action (no native auto-install). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-04 21:41:54 +02:00

Author

SHA1

Message

Date

sjat

c1323a3f29

feat(make): registry-login via vaulted Forgejo token (kaizen)

scripts/registry-login.sh reads vault.forgejo.registry_token and pipes it to
docker login --password-stdin (never echoed, never on argv); 'make registry-login'
wires it with the venv binaries. Adds the operator-minted CHANGEME vault stub
(fill via make edit-vault) and a per-machine prereq note in the claude-code-setup
runbook, so 'make caddy-image-push'/'molecule-image-push' become agent-completable
non-interactively. Consumes the 2026-06-15 signal in docs/FRICTION.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-17 17:50:07 +02:00

sjat

91713127cb

docs(kaizen): migrate gotchas to docs; curate FRICTION log (2026-06-10 review)

- New docs/testing/gotchas.md (nft iif/iifname, Molecule ansible_host,
  apply-path coverage blind spot, render-nft-c pattern); pointer from ADR-008.
- claude-code-setup.md gains "Environment gotchas" (hooks-need-restart,
  pre-commit stashes unstaged, rbw sync cache, zsh word-split).
- FRICTION.md restructured into Open signals + a decisions ledger; consumed
  signals archived with where their resolution now lives.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-10 12:51:39 +02:00

sjat

abb5c7a12f

Make the Claude Code toolchain reproducible (TODO 10.7)

Reviewed the Claude Code config against boma's capabilities and committed a
reproducible, leaner toolchain:

- .claude/settings.json now declares extraKnownMarketplaces + enabledPlugins so a
  fresh clone prompts to install the active set: superpowers, context7, terraform
  (we use TF, ADR-006), claude-md-management (doc/ADR-heavy). Drops code-simplifier.
- Adds a conservative, read-only/verify permissions allowlist (git status/diff/log,
  make lint/test/check, pytest, rbw unlocked, ls/cat/rg/find) — mutations and
  outward/destructive commands stay gated, consistent with ADR-002.
- docs/runbooks/claude-code-setup.md: per-machine bootstrap, the deferred
  enable-when plugins (security-guidance/semgrep, playwright, hookify, skill-creator),
  rbw/venv prerequisites, and a note to keep the dangerous-mode prompt on.

Closes TODO 10.7. Plugin install remains a per-machine /plugin action (no native
auto-install).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-04 21:41:54 +02:00

3 commits