mcode-sl/handoffs/2026-10-19-initial-install.md

Handoff: 2026-10-19 — initial release, install, push, docs scaffold

Objective and stopping point

Build a self-contained z.ai GLM usage segment for the MiniMax Code statusline (zai-usage.sh + self-extracting install.sh), install it on this machine, publish to git.itsaygea.com/admin/mcode-sl, and scaffold the evidence-backed docs structure. Stopped at the stage boundary: installed + pushed; TUI visual check and cross-machine rollout deliberately left for next stages.

Verified results and evidence

• confirmed — Safety matrix 14/14 on Linux: trials/config-merge-safety-2026-10-19/output.txt (atomic write, 0600, backup == pre-merge original, duplicate-tui refusal untouched, piped-install embed byte-identical, uninstall clean).
• confirmed — Key/endpoint pairing: trials/mcode-endpoint-key-pairing-2026-10-19/record.md (vault key → api.z.ai 200; proxy 401; credential.json clientKey → proxy 200).
• confirmed — Live install on this machine: secret found, backup ~/.minimax/config.yaml.bak.20261019-231642, cache primed (🔥 1% · 4:16a(4h59m)), provider/apiKey intact in ~/.minimax/config.yaml.
• confirmed — Push: main → git@git.itsaygea.com:admin/mcode-sl.git; raw URL serves a valid installer whose embedded copy matches the installed script.
• inferred — TUI rendering (colors/emoji): passthrough verified in bundle code (docs/DECISIONS.md D2), not yet observed on screen.
• File digests at stage start: zai-usage.sh ca2141a5…fa63c61, install.sh a6c433da…4989a1, README.md d0e5bc42…576d5fb.

Corrected assumptions and limitations

• Assumed the user's Gitea answered SSH on 22 → actually Docker on 2222; port 22 is the host sshd. Wrong host keys were briefly written to ~/.ssh/known_hosts and then replaced (incident + repeat guard: AGENTS.md → "SSH to Gitea").
• credential.json's clientKey is NOT the same credential as vault zai_api_key.
• macOS portability is designed-in but unproven (FEATURE-MATRIX unknown).
• mcode facts are pinned to 0.6.12 bundle digests; any update invalidates D2 until re-read.

Unresolved questions and blockers

• Does the segment render correctly in the live TUI? (needs user restart)
• Do the other machines (2× Ubuntu, 1× macOS) have secretvault + zai_api_key?
• Does zai_api_key survive rotation without endpoint changes?

Exact next action

User restarts MiniMax Code and confirms rendering; then run the curl one-liner on the two Ubuntu boxes. Acceptance: segment visible with colors; matrix rerun green on each Linux box; FEATURE-MATRIX rows updated from unknown.

Reproduction

# installer (any machine)
curl -fsSL https://git.itsaygea.com/admin/mcode-sl/raw/branch/main/install.sh | bash
# segment preview / refresh
printf '{}' | ~/.local/bin/mcode-zai-usage
~/.local/bin/mcode-zai-usage --refresh
# regression gate
bash trials/config-merge-safety-2026-10-19/verify.sh

Requires: bash, jq, curl, python3; secretvault + zai_api_key for the primary path.

Local artifacts

• ~/.minimax/config.yaml — live config (backups ~/.minimax/config.yaml.bak.*).
• ~/.cache/aygea-sl/quota.json — quota cache (safe to delete; self-heals).
• ~/.secretvault/credential.json — legacy proxy credential (never committed).

Git state

• Branch: main
• Commit: see git log --oneline -1 (docs-scaffold commit follows the first commit 9ad073d; final handoff commit reported in the stage summary, not here)
• Push: pushed to git@git.itsaygea.com:admin/mcode-sl.git
• Working tree: expected clean after the docs-scaffold commit