---
phase: 02-claude-code-beachhead
plan: 01
subsystem: walkthrough-and-regression
tags: [walkthrough, screencast, cci-01, cci-02, no-regression, human-gated]
type: execute
wave: 2
depends_on: [02, 03]
files_modified:
  - .planning/phases/02-claude-code-beachhead/cci-01-walkthrough.mp4
  - README.md
  - app/guides/claude-code/page.js
autonomous: false
requirements: [CCI-01, CCI-02]

must_haves:
  truths:
    - "The `claude-code-starter` policy pack tests (`__tests__/unit/claude-code-starter-pack.test.js`) pass at the end of Phase 2 — CCI-02 no regression"
    - "The full `npm test` suite passes at the end of Phase 2 with no failures attributable to 02-02 or 02-03 work"
    - "A recorded walkthrough on Wes's Windows/WSL machine goes from fresh `git clone` to first approved Claude Code tool call visible in Discord in ≤5:00 wall clock"
    - "The walkthrough artifact is saved at `.planning/phases/02-claude-code-beachhead/cci-01-walkthrough.mp4` (or an external Loom link captured in the plan summary)"
    - "During the walkthrough, tapping Approve on the Discord DM causes Claude Code's `dashclaw_wait_for_approval` MCP tool to return within ≤10s phone-to-resolution round-trip (the SPEC CCI-03 manual verification criterion)"
    - "A ≤3-minute public screencast showing install + first Discord approval is published (Loom unlisted-but-public OR YouTube Unlisted) and the URL backfills the `<SCREENCAST_URL>` placeholders in README.md and `app/guides/claude-code/page.js`"
    - "The screencast is verified publicly accessible (no captcha, no workspace-only gate) before this plan closes"
    - "Every code snippet on `/guides/claude-code` ran as-is during the walkthrough with no mid-recording edits — evidence the guide is accurate"
  artifacts:
    - path: ".planning/phases/02-claude-code-beachhead/cci-01-walkthrough.mp4"
      provides: "Evidence recording of the ≤5-minute Windows/WSL walkthrough (may be stored as a Loom link in the SUMMARY instead of committing the binary — Claude's discretion)"
    - path: "README.md"
      provides: "README with the `<SCREENCAST_URL>` placeholder replaced by the real public video URL"
    - path: "app/guides/claude-code/page.js"
      provides: "Guide with the `<SCREENCAST_URL>` placeholder replaced by the real public video URL"
  key_links:
    - from: ".planning/phases/02-claude-code-beachhead/02-01-SUMMARY.md"
      to: "cci-01-walkthrough.mp4 (or Loom URL)"
      via: "SUMMARY file records the recording artifact path or external URL"
      pattern: "cci-01-walkthrough"
    - from: "README.md (first 50 lines)"
      to: "Screencast URL"
      via: "`<SCREENCAST_URL>` token replaced with the real URL"
      pattern: "loom\\.com|youtube\\.com"
    - from: "app/guides/claude-code/page.js"
      to: "Screencast URL"
      via: "`<SCREENCAST_URL>` token replaced with the real URL"
      pattern: "loom\\.com|youtube\\.com"
---

<objective>
Close CCI-01 and CCI-02: produce the human-verifiable evidence that Phase 2 works end-to-end, and hold the line on CCI-02 no-regression.

- CCI-02 is a **gate**: the `claude-code-starter` policy pack shipped 2026-04-21 and must not regress. Task 1 enforces this with a final full-suite `npm test` run after plans 02-02 and 02-03 have landed.
- CCI-01 is an **artifact**: a ≤5-minute screen recording from fresh clone through first Discord approval on Wes's Windows/WSL machine. Cannot be automated — Claude cannot literally hold a phone and tap Approve. Task 2 is a `checkpoint:human-action` gate that surfaces the record-and-publish step to the operator.
- The screencast (CCI-05 artifact, scope-lives-here-operationally) is recorded alongside or extracted from the CCI-01 walkthrough. Task 3 backfills the real public URL into the README + guide placeholders that plan 02-03 left.

This plan is **Wave 2** and depends on plans 02-02 (Discord approval) and 02-03 (UI + docs) being complete — Discord must actually work before the walkthrough can be recorded, and the guide + README must already contain the `<SCREENCAST_URL>` placeholders before the backfill task can find them.

Purpose: Without this evidence, Phase 2 has no proof. Tests passing is not the same as "Wes recorded it on Windows/WSL in ≤5:00." The walkthrough IS the product claim.

Output:
- A ≤5:00 recording demonstrating the full Windows/WSL install-to-first-approval path (stored as `cci-01-walkthrough.mp4` in the phase directory OR an external Loom/YouTube link captured in the SUMMARY — storage choice is Claude's discretion per D-20 and the operator's preference)
- A ≤3:00 public screencast (may be trimmed from the walkthrough or recorded separately) for CCI-05, published on Loom unlisted-but-public OR YouTube Unlisted
- README.md + guides page with `<SCREENCAST_URL>` placeholders replaced by the real URL
- Confirmed full `npm test` suite green with Phase 2's full diff in place (no regressions to CCI-02's test coverage)
- Final plan summary capturing measured wall-clock time, phone-to-resolution timing, and any walkthrough footguns surfaced

Non-goals:
- Polished public demo video (DOG-02) — that's Phase 3
- Homepage hero publish (DOG-03) — Phase 3
- Launch content (Show HN, tweet thread, blog) — Phase 3
- Mac / Linux walkthrough — deferred
</objective>

<execution_context>
@$HOME/.claude/get-shit-done/workflows/execute-plan.md
@$HOME/.claude/get-shit-done/templates/summary.md
</execution_context>

<context>
@.planning/PROJECT.md
@.planning/STATE.md
@.planning/phases/02-claude-code-beachhead/02-SPEC.md
@.planning/phases/02-claude-code-beachhead/02-CONTEXT.md
@.planning/phases/02-claude-code-beachhead/02-RESEARCH.md
@.planning/phases/02-claude-code-beachhead/02-VALIDATION.md
@.planning/phases/02-claude-code-beachhead/02-02-PLAN.md
@.planning/phases/02-claude-code-beachhead/02-03-PLAN.md

# The tests to not-break (CCI-02 gate)
@__tests__/unit/claude-code-starter-pack.test.js

# The surfaces under test during the walkthrough
@README.md
@app/guides/claude-code/page.js
@hooks/dashclaw_pretool.py
@mcp-server/lib/tools.js

<interfaces>
<!-- The walkthrough exercises these as-shipped. No code changes in this plan except the URL backfill. -->

CCI-01 SPEC acceptance:
- Recording stored at `.planning/phases/02-claude-code-beachhead/cci-01-walkthrough.mp4` (or equivalent Loom/YouTube link captured in SUMMARY)
- ≤ 5:00 wall-clock from `git clone` to "Claude Code proceeds after Discord approval"
- Windows/WSL (Wes's actual dogfood environment)

CCI-05 screencast acceptance:
- Public video ≤ 3:00
- URL resolves without captcha or auth wall
- Linked from both README.md (first 50 lines) and `app/guides/claude-code/page.js`

CCI-03 manual verification piggybacked on this walkthrough:
- Phone tap → DB resolution ≤ 10s median, logged with timestamps in the SUMMARY

Regression baseline (CCI-02):
- `__tests__/unit/claude-code-starter-pack.test.js` — 9 tests, all passed per plan 02-01 ship on 2026-04-21
- Full `npm test` ~ 1648 tests, must all pass at the end of Phase 2
</interfaces>
</context>

<tasks>

<task type="auto" tdd="false">
  <name>Task 1: CCI-02 no-regression gate — full suite after 02-02 + 02-03 land</name>
  <files>See files_modified frontmatter for the full list; task-specific subset is documented in the action block.</files>
  <read_first>
    - __tests__/unit/claude-code-starter-pack.test.js (9 tests — the exact behavior locked 2026-04-21)
    - .planning/phases/02-claude-code-beachhead/02-VALIDATION.md §Test Infrastructure
    - .planning/phases/02-claude-code-beachhead/02-SPEC.md §CCI-02 Acceptance
    - app/lib/guardrails/packs/claude-code-starter/policies.yml (the policy pack itself — read only if CCI-02 tests fail and root cause diagnosis is needed)
  </read_first>
  <action>
    1. Confirm prerequisite plans are complete:
       ```bash
       ls .planning/phases/02-claude-code-beachhead/02-02-SUMMARY.md  # must exist
       ls .planning/phases/02-claude-code-beachhead/02-03-SUMMARY.md  # must exist
       ```
       If either is missing, STOP and surface to the operator — this plan cannot proceed.

    2. Run the full test suite from a clean git state:
       ```bash
       git status                        # should be clean
       npm ci                            # deterministic install
       npm test                          # all 1648+ tests
       ```
       Expected: exit 0. Including specifically `__tests__/unit/claude-code-starter-pack.test.js` (9/9).

    3. Run the static guardrails suite — MUST all pass:
       ```bash
       npm run lint
       npm run route-sql:check
       npm run openapi:check
       npm run api:inventory:check
       npm run docs:check
       node scripts/check-readme-lead.mjs   # added in 02-03
       ```

    4. If any test fails that was not failing before Phase 2 (compare to the pre-Phase-2 baseline in `.planning/STATE.md` — "all 6 Phase 1.5 plans completed"):
       - Diagnose the regression with `git bisect` if ambiguous between 02-02 and 02-03
       - File a gap entry in a follow-up `02-VERIFICATION.md` with a reproduction + root cause
       - Do NOT fix the regression in this plan's scope — loop back via `/gsd-plan-phase 02 --gaps`
       - STOP this plan at Task 1

    5. If all tests pass, commit a lightweight "Phase 2 regression gate passed" record to the SUMMARY at the end of the plan (no code commit here — Task 1 is read-only verification).
  </action>
  <verify>
    <automated>npm ci &amp;&amp; npm test &amp;&amp; npm run lint &amp;&amp; npm run route-sql:check &amp;&amp; npm run openapi:check &amp;&amp; npm run api:inventory:check &amp;&amp; npm run docs:check &amp;&amp; node scripts/check-readme-lead.mjs</automated>
  </verify>
  <done>
    - Prerequisite plans 02-02 and 02-03 have SUMMARY files present
    - `npm ci && npm test` exits 0 (CCI-02 gate held — full suite green)
    - `claude-code-starter-pack.test.js` all 9 tests pass
    - All static guardrails pass
    - `git status` clean (no uncommitted drift)
    - If any failure occurred, a gap file exists and this plan is halted in STOP state — not silently closed
  </done>
</task>

<task type="checkpoint:human-action" gate="blocking">
  <name>Task 2: CCI-01 recorded walkthrough on Windows/WSL (≤5:00)</name>
  <files>.planning/phases/02-claude-code-beachhead/cci-01-walkthrough.mp4 (new — recording artifact, may alternatively live as an external Loom/YouTube URL captured in 02-01-SUMMARY.md)</files>
  <what-built>
    Plan 02-02 shipped the Discord approval flow. Plan 02-03 shipped `/my-agent`, the `/activity` day-grouping, the Discord section in `/guides/claude-code`, the Claude Code-first README lead, and the homepage draft. Task 1 above confirmed the regression gate is green. The product is now in a state where a fresh `git clone` on Windows/WSL should take ≤5 minutes to first Discord approval. The only thing Claude cannot do is record the screen while a human holds a phone.

    **Before kicking this to the human**, Claude MUST pre-flight everything that CAN be automated:

    - [ ] Pre-flight 1: Verify the latest `main` branch deploys cleanly on Vercel (or is reproducible on localhost via `npm run dev`). Run `gh run list --workflow=ci --limit=1` or equivalent and check the latest CI run is green for main after Phase 2 commits.
    - [ ] Pre-flight 2: Verify the Discord bot app + bot token + public key + approver user ID are all set in the walkthrough environment. Check `.env.local` on Wes's Windows/WSL machine via an earlier prep message or a readme note — do NOT read secrets back; just confirm the five `DISCORD_*` names are present in `.env.example` AND the operator has already completed the Developer Portal setup steps in `app/guides/claude-code/page.js`.
    - [ ] Pre-flight 3: Confirm the throwaway workspace is prepared. The walkthrough MUST NOT record a workspace containing:
      - Real production API keys (use rotatable test tokens only)
      - Personal email/account info (Discord user ID is fine; email addresses are not)
      - Git history visible in the terminal with unrelated commits
      - Other applications with credentials visible (password managers, secret env files open in another pane)
    - [ ] Pre-flight 4: Write the walkthrough script — the exact copy-paste commands, in order, the operator will run on camera. Script must be ≤5:00 wall-clock at an unhurried pace. Suggested script structure:
      ```
      [0:00] Clone and cd into repo
             git clone https://github.com/ucsandman/DashClaw.git
             cd DashClaw

      [0:15] Install
             npm install

      [1:00] Configure DashClaw API key (env)
             cp .env.example .env.local
             # fill DATABASE_URL, DASHCLAW_API_KEY, and DISCORD_* block

      [2:00] Install the hook in a Claude Code project
             npm run hooks:install -- /path/to/your-claude-code-project

      [2:30] Start the dev server (or rely on deployed instance)
             npm run dev

      [3:00] Trigger a Claude Code action that hits the starter policy pack
             (switch to Claude Code, ask it to run `rm -rf dist` or `npm install some-package`)

      [3:30] Phone lights up with Discord DM. Tap Approve.

      [3:45] DM edits in place to APPROVED — HH:MM:SS

      [4:00] Claude Code unblocks; check /activity shows the event under today's group
             Check /my-agent narrative: "Today your agent ran N commands. 1 required approval. 0 were denied."

      [4:45] Stop recording.
      ```

    - [ ] Pre-flight 5: Verify the recording tool is ready (OBS, Windows Game Bar, Loom desktop, or equivalent). Confirm audio on. Confirm phone screen can be captured alongside (either via Scrcpy mirror into the Windows capture, or a separate phone-held camera angle).
    - [ ] Pre-flight 6: Trigger a last-mile sanity smoke — from the exact `git clone` state, does `npm install && npm run dev` boot the app cleanly? If not, loop back to a gap plan. The walkthrough can't record a build failure.
  </what-built>
  <how-to-verify>
    Human (Wes) performs:

    1. Open OBS (or chosen recording tool) and start the timer visible on-screen.
    2. Open a fresh terminal on Windows/WSL. Confirm no DashClaw clone exists yet.
    3. Run the walkthrough script in one continuous take. No edits, no retakes within the recording.
    4. Phone is in frame (or Scrcpy mirror is visible) when the Discord DM arrives.
    5. Tap Approve. Note the wall-clock timestamp.
    6. Continue the recording until Claude Code unblocks AND the `/activity` page (refreshed after the event) shows the event grouped under today.
    7. Stop recording at ≤5:00 total wall clock.
    8. **Review** the recording for:
       - ≤5:00 duration (hard cap — SPEC)
       - No visible secrets (scrub frame by frame for `.env*` contents, API keys, auth tokens, passwords)
       - Phone-to-resolution time observable on camera — note the timestamp delta (phone tap timestamp vs. terminal-unblock timestamp) — must be ≤10s for CCI-03 manual verification
       - Every code snippet from `/guides/claude-code` and README ran without mid-take correction
    9. If any of the above fails, re-record. Do NOT post a recording that shows secrets or exceeds 5:00.
    10. Save the final recording to `.planning/phases/02-claude-code-beachhead/cci-01-walkthrough.mp4` OR upload to Loom/YouTube Unlisted and capture the URL.

    **Post-recording:**
    - Measure and note in the SUMMARY:
      - Total wall-clock time
      - Phone-to-resolution time (from Discord tap to Claude Code unblock)
      - Any moments where the operator had to pause, deviate from the script, or manually fix something (these are future-plan inputs)
    - If recording lives locally (.mp4), note filesize. If it's large (>50 MB), prefer uploading to Loom Unlisted or YouTube Unlisted and recording the URL in SUMMARY instead of committing the binary. `.gitignore` does not exclude the `.planning/phases/*/*.mp4` path by default — Claude's discretion to commit or link.

    **Security post-review (T-02-03-02 carryforward):**
    - Scrub the entire recording for secret exposure. A single frame of a visible API key in a scroll buffer or terminal history fails this task.
    - If the operator's Discord app is configured to show message previews in the phone's lock-screen push notification, those previews (including approval embed content) may leak action goal text to any bystander during the recording. For this walkthrough it's not a leak (you're showing it on purpose), but verify no OTHER pushes from unrelated apps are visible.
  </how-to-verify>
  <resume-signal>
    Reply with one of:
    - `approved — walkthrough at <path or URL>, wall-clock <MM:SS>, phone-to-resolution <N>s` → proceed to Task 3 (URL backfill).
    - `walkthrough failed — <reason>` → this plan pauses; operator re-records. Describe the reason so Claude can propose a gap plan if a codebase fix is implicated (e.g., "Discord DM never arrived — bot isn't in a mutual server").
    - `skip recording for now, ship placeholder` → explicitly defer CCI-01 to a follow-up plan. The orchestrator surfaces this as an open gap and Phase 2 closes with "CCI-01 walkthrough deferred to <next plan>."
  </resume-signal>
  <action>
    This task is a human-gated checkpoint (type: checkpoint:human-action). All mechanical steps are captured in the pre-flight checklist inside `<what-built>` above; the recording itself is performed by the operator per the script in `<how-to-verify>` above.

    Claude's role in this task:
    1. Run all six pre-flight items listed in `<what-built>` (CI green check, env var presence check, throwaway workspace prep, walkthrough script draft, recording-tool readiness confirmation, last-mile `npm install && npm run dev` smoke).
    2. Present the walkthrough script and pre-flight completion to the operator, along with the prompt in `<resume-signal>`.
    3. Pause until the operator returns one of the three resume-signal responses.
    4. On `approved`: parse the walkthrough path/URL, wall-clock time, and phone-to-resolution time from the operator's message. Record them in `02-01-SUMMARY.md`. Then proceed to Task 3 (URL backfill).
    5. On `walkthrough failed`: propose a gap plan if the failure implicates a codebase bug (e.g., "Discord DM never arrived" suggests bot configuration or the route is broken). Do NOT auto-advance to Task 3.
    6. On `skip recording for now`: mark CCI-01 as explicitly deferred in the SUMMARY; Phase 2 closes with an open gap and Task 3 is skipped.
  </action>
  <verify>
    <automated>test -f .planning/phases/02-claude-code-beachhead/02-01-SUMMARY.md &amp;&amp; (grep -qE "walkthrough.*\.mp4|loom\.com|youtube\.com" .planning/phases/02-claude-code-beachhead/02-01-SUMMARY.md || grep -q "CCI-01 deferred" .planning/phases/02-claude-code-beachhead/02-01-SUMMARY.md)</automated>
  </verify>
  <done>
    - All 6 pre-flight items in `<what-built>` completed and their outputs recorded in the SUMMARY
    - Operator has returned one of the three resume-signal responses
    - On `approved`: recording artifact (file or URL) recorded in SUMMARY with measured wall-clock time ≤5:00 and phone-to-resolution time ≤10s
    - On `walkthrough failed`: gap plan proposed; this task halted; Task 3 NOT executed
    - On `skip recording for now`: SUMMARY explicitly states "CCI-01 walkthrough deferred" with the operator's reason; Phase 2 closes with an open gap
    - No secrets appear in any published recording (operator confirms frame-by-frame post-review in the resume-signal message)
  </done>
</task>

<task type="auto" tdd="false">
  <name>Task 3: Backfill the real screencast URL into README and guide</name>
  <files>See files_modified frontmatter for the full list; task-specific subset is documented in the action block.</files>
  <read_first>
    - README.md (find the `<SCREENCAST_URL>` placeholder)
    - app/guides/claude-code/page.js (find the `<SCREENCAST_URL>` placeholder)
    - The SUMMARY file from Task 2 above (records the real URL)
  </read_first>
  <action>
    After the walkthrough is recorded and published (Task 2), the real public video URL is known. Replace both `<SCREENCAST_URL>` placeholders:

    1. Grep for all occurrences:
       ```bash
       grep -rn "<SCREENCAST_URL>" README.md app/guides/claude-code/page.js
       ```
       Expected: at least 1 match in each file. If more than one per file, replace them all.

    2. Replace each occurrence with the real URL (operator provides in the Task 2 resume-signal):
       - Loom example: `https://www.loom.com/share/XXXXXXXXXXXXXXXX`
       - YouTube Unlisted example: `https://www.youtube.com/watch?v=XXXXXXXXXXX`

    3. Verify the replacement:
       ```bash
       grep -rn "<SCREENCAST_URL>" README.md app/guides/claude-code/page.js  # expect ZERO matches
       grep -rnE "loom\.com|youtube\.com" README.md app/guides/claude-code/page.js  # expect ≥ 2 matches
       ```

    4. Verify the URL resolves publicly:
       ```bash
       curl -sI "$SCREENCAST_URL" | head -1  # expect HTTP/2 200 (Loom) or 200 (YouTube)
       ```
       Open the URL in an incognito browser window (or through a VPN) to confirm no workspace-only auth wall (per RESEARCH §Pitfall 8).

    5. Re-run the README-lead gate:
       ```bash
       node scripts/check-readme-lead.mjs
       ```
       Still green — URL backfill doesn't move the "Claude Code" text around.

    6. Final check — full suite still green after the two-file edit:
       ```bash
       npm test
       npm run lint
       ```

    7. Commit the backfill as a single commit:
       ```
       docs(02): backfill CCI-05 screencast URL after walkthrough recording
       ```
  </action>
  <verify>
    <automated>grep -rn "&lt;SCREENCAST_URL&gt;" README.md app/guides/claude-code/page.js; test $? -eq 1 &amp;&amp; echo OK_NO_PLACEHOLDERS &amp;&amp; node scripts/check-readme-lead.mjs &amp;&amp; npm test &amp;&amp; npm run lint</automated>
  </verify>
  <done>
    - `grep -n "<SCREENCAST_URL>" README.md` returns ZERO matches
    - `grep -n "<SCREENCAST_URL>" app/guides/claude-code/page.js` returns ZERO matches
    - `grep -E "loom\.com|youtube\.com" README.md` returns ≥ 1 match (the real URL)
    - `grep -E "loom\.com|youtube\.com" app/guides/claude-code/page.js` returns ≥ 1 match
    - `curl -sI <real_url>` resolves to HTTP 200 (or 302 → 200)
    - `scripts/check-readme-lead.mjs` exits 0 (Claude Code lead still intact)
    - `npm test` exits 0 (no regression from the content edit)
    - Final commit lands on main with message starting `docs(02): backfill CCI-05 screencast`
  </done>
</task>

</tasks>

<threat_model>
## Trust Boundaries

| Boundary | Description |
|----------|-------------|
| Recording session → published public URL | The recording captures developer-machine state (terminal, browser, phone) and publishes it. Anyone with the URL can watch. Secret exposure via video is irreversible once the URL is public. |
| Walkthrough operator's phone → bystander visibility | If the recording includes phone lock-screen previews of OTHER apps (SMS, email, 2FA codes, other Discord servers), those leak alongside the intended content. |

## STRIDE Threat Register

| Threat ID | Category | Component | Disposition | Mitigation Plan |
|-----------|----------|-----------|-------------|-----------------|
| T-02-01-01 | Information Disclosure | Screencast leaks secrets via on-screen content (env files, API keys, tokens, passwords visible in terminal scrollback or auxiliary windows) | mitigate | Task 2 Pre-flight 3 requires a throwaway workspace with rotatable test tokens only. Task 2 post-review requires a frame-by-frame scrub for visible secrets. Failing this check → re-record. Irreversibility: once the video is public, a token glimpse is game-over; rotate any such token immediately. |
| T-02-01-02 | Information Disclosure | Phone lock-screen previews from unrelated apps (2FA SMS, email subject lines, etc.) appear during the phone-tap moment | mitigate | Before recording, enable Do Not Disturb on the phone with only Discord allowed to show previews. Disable lock-screen preview text for all other apps. Verify in a 10-second pre-roll before starting the main recording. |
| T-02-01-03 | Information Disclosure | Loom "anyone with link" default gates the URL behind a captcha or regional check for unauthenticated viewers | mitigate | Task 3 step 4 verifies the URL resolves in an incognito browser from a different IP. If Loom default fails, switch to Loom "public" setting or re-upload to YouTube Unlisted. Per RESEARCH Pitfall 8. |
| T-02-01-04 | Spoofing / Tampering | Someone publishes a modified "DashClaw walkthrough" fake under a squatted domain | accept | Phase 2 is too early for brand-squatting concerns. The authoritative link lives in the README on the canonical GitHub repo. Mitigation would be code-signing video metadata — out of scope for a beachhead milestone. |
| T-02-01-05 | Information Disclosure | Walkthrough inadvertently reveals internal policy names, org IDs, or dogfood data that a competitor could exploit | accept | DashClaw is OSS; the policy pack + repository structure are already public. Wes's org_id in a throwaway workspace has no privileged information attached. No new exposure beyond what's already on GitHub. |
</threat_model>

<verification>

### Task-level
- Task 1: full suite + static guardrails all green — prerequisite for the walkthrough to even make sense
- Task 2 (human): artifact exists (file or URL), ≤5:00, no secrets in frame, phone-to-resolution ≤10s recorded
- Task 3: placeholders gone, real URL in both files, URL resolves publicly, full suite still green after edit

### Plan-level
```bash
# Regression line (still green at plan close)
npm test
npm run lint

# Placeholder is fully replaced
! grep -rn "<SCREENCAST_URL>" README.md app/guides/claude-code/page.js

# README lead still intact
node scripts/check-readme-lead.mjs

# Video evidence exists
test -f .planning/phases/02-claude-code-beachhead/cci-01-walkthrough.mp4 \
  || grep -E "loom\.com|youtube\.com" .planning/phases/02-claude-code-beachhead/02-01-SUMMARY.md
```

### Manual sign-off items captured in SUMMARY
- Measured wall-clock time ≤ 5:00
- Measured phone-to-resolution ≤ 10s
- Screencast URL verified incognito
- No secrets visible in any frame
- All guide code snippets ran as-is (CCI-05 acceptance criterion)

</verification>

<success_criteria>

The plan is complete when:

1. **CCI-02 gate held**: `npm test` exits 0 with Phase 2's full diff in place; `claude-code-starter-pack.test.js` all 9 tests pass; all static guardrails clean.
2. **CCI-01 artifact exists**: `cci-01-walkthrough.mp4` at the phase directory OR a Loom/YouTube URL captured in `02-01-SUMMARY.md`; recording is ≤5:00 Windows/WSL wall-clock from `git clone` to "Claude Code proceeds after Discord approval."
3. **CCI-03 manual sub-criterion met**: phone tap → Claude Code unblock observed in the recording is ≤10s, value noted in SUMMARY.
4. **CCI-05 screencast artifact exists**: a ≤3-minute publicly accessible video (may be a trim of the walkthrough or a separate recording); URL resolves in an incognito session.
5. **URL backfilled**: `<SCREENCAST_URL>` placeholders replaced in `README.md` and `app/guides/claude-code/page.js`.
6. **Post-recording secret hygiene**: operator confirms no secrets visible in the published video; any accidental exposure triggered a re-record (and token rotation if applicable).
7. **README lead intact**: `scripts/check-readme-lead.mjs` still passes after the URL edit.
8. **No regressions introduced by this plan**: final `npm test` + `npm run lint` clean after Task 3's commit.
9. **T-02-01-01..03** mitigated; T-02-01-04/05 accepted with rationale in the threat model.

If CCI-01 cannot be recorded for any operational reason (phone unavailable, dev machine broken, etc.), this plan halts in a `CHECKPOINT REACHED` state with the failure reason — the orchestrator re-plans. Do NOT close the plan silently without the recording.

</success_criteria>

<output>
After completion, create `.planning/phases/02-claude-code-beachhead/02-01-SUMMARY.md` capturing:

- Final test suite result (`npm test` output summary, timestamp, git SHA at time of run)
- Walkthrough recording location (file path or public URL)
- Measured wall-clock time (e.g., "4:32 — well under 5:00")
- Measured phone-to-resolution time for the Approve tap (e.g., "3.1s — well under 10s")
- Any mid-walkthrough friction points observed (e.g., "had to re-source .env.local mid-recording because NEXTAUTH_URL was stale — log as todo-004 for future polish")
- Screencast URL + the two filepaths where it was backfilled
- Verification that no secrets appear in the recording (frame-by-frame spot-check log)
- CCI-01, CCI-02, CCI-03-manual, CCI-05 coverage confirmation
- Phase 2 close-out statement: all 5 CCI requirements satisfied
</output>
