cd /Users/Ali/PKM/scratch/pkm-deepdive
# extract the new key from the file (value never typed/echoed by me), base64-pipe to the VDS secret store
KEY=$(grep -oE 'AQ\.[A-Za-z0-9_.-]+' "/Users/Ali/Downloads/Google Agent Platform .txt" | head -1)
printf '%s' "$KEY" | base64 | ./vds-exec.sh runl '
  NK=$(base64 -d)
  S=/srv/aina-hq/.secrets
  mkdir -p "$S"
  # 1. BACK UP the existing key file(s) so the old key is preserved as backup
  for f in vertex-express.env gemini.env gemini-interactions.env; do
    [ -f "$S/$f" ] && cp "$S/$f" "$S/$f.bak-$(date +%Y%m%dT%H%M%S)" && echo "backed up $f";
  done
  # 2. write the NEW key to a dedicated secret file (value NOT echoed)
  umask 077
  printf "GEMINI_API_KEY=%s\nGEMINI_INTERACTIONS_API_KEY=%s\nGOOGLE_API_KEY=%s\nGOOGLE_GENAI_API_KEY=%s\n" "$NK" "$NK" "$NK" "$NK" > "$S/gemini-interactions.env"
  chmod 600 "$S/gemini-interactions.env"
  echo "wrote gemini-interactions.env (new key length: ${#NK}, prefix: ${NK:0:3}...)"
  echo "== existing key VAR NAMES in vertex-express.env (redacted, for backup awareness) =="
  grep -oE "^[A-Z_]*(KEY|TOKEN)[A-Z_]*=" "$S/vertex-express.env" 2>/dev/null | sort -u
'

cd /Users/Ali/PKM/scratch/pkm-deepdive
cat > lane-gemini-newkey.md <<'EOF'
# Lane: Test Gemini Interactions API with the NEW key (Ali-provided 2026-06-29)
## AUTONOMY: proceed without asking; test + honest report; gpt-5.5. NEVER echo/print the key value anywhere (logs, report, commits).
## Context: Ali provided a NEW key (file was "Google Agent Platform" = Gemini Enterprise Agent Platform). Stored at `/srv/aina-hq/.secrets/gemini-interactions.env` (GEMINI_API_KEY / GEMINI_INTERACTIONS_API_KEY / GOOGLE_API_KEY / GOOGLE_GENAI_API_KEY, prefix AQ.). Old key backed up (vertex-express.env.bak). 
## Prior findings (to beat): AI Studio Developer API Interactions WORKS but the OLD key had "prepayment credits depleted"; the Vertex Interactions endpoint rejected the Gemini models (400 unsupported_model_interaction) AND rejected API keys (401). This new AQ. key may be the key that unlocks it — TEST it.
## Do
1. `set -a; source /srv/aina-hq/.secrets/gemini-interactions.env; set +a`. Test the Interactions API with this key across the plausible surfaces, capturing status/latency/tokens/error for each:
   - **AI Studio Developer API**: `POST https://generativelanguage.googleapis.com/v1beta/interactions` with header `x-goog-api-key: $GEMINI_API_KEY`, body {model:"gemini-3.5-flash", input:"Explain how AI works in a few words"} (also try gemini-2.5-flash, and v1beta2 if v1beta 404s).
   - **Gemini Enterprise Agent Platform / Vertex Express**: if the AQ. key is an Express key, try the Express interactions endpoint (check VERTEX_EXPRESS_ENDPOINT pattern + the Gemini Enterprise Agent Platform interactions reference). 
   - Use the existing probe harness (scripts/spikes/ or scripts/probes/gemini-vertex-interactions-probe.mjs) if it can be pointed at the key path; else a minimal probe.
2. If ANY surface WORKS (200 + an interactionId): prove `previous_interaction_id` chaining (2nd turn); run a concurrency probe (ramps 5,25,50, turns 2) → latency p50/p95, 429s, real concurrent ceiling, go/no-go. Then plan the Cloudflare-Workers runtime — a KEY-based path (header) works directly from Workers (no ADC needed), which is a big win; confirm.
3. If it still fails: capture the EXACT error per surface + the precise blocker; compare to prior (depleted-prepay vs model-allowlisting vs key-type). State what (if anything) Ali still needs.
## Deliver: branch ali/gemini-newkey-test-2026-06-29, report `/srv/aina/ops/gemini-newkey-report.md` (WORKS? which surface/model + concurrency + Workers plan, OR exact blocker). Keep flag-off until proven. NEVER expose the key. Honest. gpt-5.5.
EOF
base64 < lane-gemini-newkey.md | ./vds-exec.sh runl '
  base64 -d > /srv/aina/ops/lanes/lane-gemini-newkey.md
  export PATH=$PATH:/usr/local/bin
  C5="exec --json --dangerously-bypass-approvals-and-sandbox --model gpt-5.5 -c model_reasoning_effort=high --skip-git-repo-check -"
  WT=/home/ali/agent-workspaces/aina-academy-gemini-spike-20260629
  [ -d "$WT" ] && cd "$WT" || cd /srv/repos/aina-academy
  nohup bash -c "cat /srv/aina/ops/lanes/lane-gemini-newkey.md | codex $C5" > /srv/aina/ops/codex-gemini-newkey.log 2>&1 &
  echo "gemini-newkey-test lane pid=$!"'

cd /Users/Ali/ui-lesson-previews-ali-recovered-2026-05-18
echo "== file sizes =="; wc -l lessons/*.html assets/*.css
echo; echo "== assets/lesson-shell.css (full) =="; cat assets/lesson-shell.css
echo; echo "== assets/tokens.css (full) =="; cat assets/tokens.css

cd /Users/Ali/ui-lesson-previews-ali-recovered-2026-05-18
tar czf - lessons assets | base64 | /Users/Ali/PKM/scratch/pkm-deepdive/vds-exec.sh runl '
  mkdir -p /srv/aina/ops/reference/recovered-lesson-shell
  base64 -d | tar xzf - -C /srv/aina/ops/reference/recovered-lesson-shell
  echo "STAGED recovered shell:"; ls -R /srv/aina/ops/reference/recovered-lesson-shell | head -20'

cd /Users/Ali/PKM/scratch/pkm-deepdive
cat > lane-lesson-shell-port.md <<'EOF'
# Lane: Port the RECOVERED card-based chat shell to the live lesson page (Ali UI/UX direction)
## AUTONOMY: proceed without asking; build, screenshot-verify, honest report; gpt-5.5. Repo /srv/repos/aina-academy.
## Founder direction (Ali 2026-06-29): the live lesson page (https://aina-academy-staging.img-playground.workers.dev/lesson/) is NOT what he had in mind. Use the RECOVERED chat shell at `/srv/aina/ops/reference/recovered-lesson-shell/` — it has the cards + the 3-column chat shell he wants. "Tweak it a bit" to fit, but MATCH this design.
## The target design (recovered shell):
- **3-column layout**: 260px LEFT (steps + nav) | center (chat stream) | 300px RIGHT (trajectory + hints). Sticky top bars per column. Mobile breakpoints included.
- **Card components**: ExplainerCard, AnnotatedPromptCard, RubricCard, HintStack, callouts (workplace / vague / do-don't), composer. Token-driven (assets/tokens.css + assets/lesson-shell.css, 411 lines — NO literal colors, all via token vars).
- Reference lessons (the look + card usage): `lessons/structured-intent-spec.html`, `context-provision-and-briefing.html`, `universal-path.html`.
## Do
1. Study the recovered shell (the 3 HTML lessons + lesson-shell.css + tokens.css) — the 3-col card-based chat shell is the target look.
2. Find the CURRENT live lesson surface in aina-academy (the React component behind `/lesson/`) + its lesson-data shape. Diff it against the recovered shell.
3. Port the recovered design onto the live lesson page: the 3-column layout + the card components (Explainer / AnnotatedPrompt / Rubric / HintStack) + callouts + composer + chat stream, wired to the REAL lesson data (don't hardcode the sample content). Bring in the recovered lesson-shell.css/tokens.css, reconciled with the aina-design tokens (token-driven). Preserve the live tutor/practice API flow + feature flag. Tweak to fit, but match the recovered card-based chat shell.
4. **Screenshot** the result (desktop + mobile) AND the recovered reference; verify the live page now matches the recovered design (cards + 3-col chat shell). Iterate until it does.
## Deliver: branch ali/lesson-shell-port-2026-06-29, commit+push+PR with the before/after + recovered-vs-new screenshots; report `/srv/aina/ops/lesson-shell-port-report.md`. Behind the lesson flag if it changes the live route. gpt-5.5. Honest if anything can't match. Address Codex bot comments. The review harness + Éowyn visual-QA vet before it surfaces to Ali.
EOF
base64 < lane-lesson-shell-port.md | ./vds-exec.sh runl '
  base64 -d > /srv/aina/ops/lanes/lane-lesson-shell-port.md
  export PATH=$PATH:/usr/local/bin
  C5="exec --json --dangerously-bypass-approvals-and-sandbox --model gpt-5.5 -c model_reasoning_effort=high --skip-git-repo-check -"
  cd /srv/repos/aina-academy
  nohup bash -c "cat /srv/aina/ops/lanes/lane-lesson-shell-port.md | codex $C5" > /srv/aina/ops/codex-lesson-shell-port.log 2>&1 &
  echo "lesson-shell-port lane pid=$!"'

cd /Users/Ali/PKM/scratch/pkm-deepdive
./vds-exec.sh run 'set +e
export PATH=$PATH:/usr/local/bin
echo "== codex procs =="; pgrep -af "codex exec" | grep -v pgrep | wc -l
echo "== gemini-newkey report? =="; ls -la --time-style=+%H:%M /srv/aina/ops/gemini-newkey-report.md 2>/dev/null
echo "== newkey lane final =="; tail -1 /srv/aina/ops/codex-gemini-newkey.log 2>/dev/null | tr -d "\000" | python3 -c "import sys,json
try:
 o=json.loads(sys.stdin.read());t=o.get(\"type\")
 if t==\"turn.completed\":print(\"COMPLETED\")
 elif t==\"turn.failed\":print(\"FAILED:\",o.get(\"error\",{}).get(\"message\",\"\")[:120])
 elif o.get(\"item\",{}).get(\"type\")==\"agent_message\":print(\"MSG:\",o[\"item\"][\"text\"][:400])
 else:print(\"(running)\",t)
except:print(\"(running)\")"
echo "== COO-dispatched builds → PRs? open PRs (academy) =="; gh pr list --repo ainative-academy/aina-academy --state open --json number,headRefName --jq ".[]|\"\(.number) \(.headRefName)\"" 2>/dev/null | head -15
echo "== backlog movement (was 89 todo/2 inprog/2 done) =="; paperclipai issue list --json 2>/dev/null | python3 -c "import sys,json;from collections import Counter;d=json.load(sys.stdin);i=d if isinstance(d,list) else d.get(\"issues\",d.get(\"data\",[]));n=[x for x in i if \"council-2026-06-29\" in (x.get(\"description\") or \"\")];print(\"93-backlog:\",dict(Counter(x.get(\"status\") for x in n)))"
echo "== lesson-shell-port running? =="; tail -1 /srv/aina/ops/codex-lesson-shell-port.log 2>/dev/null | tr -d "\000" | head -c 80; echo

cd /Users/Ali/PKM/scratch/pkm-deepdive
./vds-exec.sh run 'set +e
export PATH=$PATH:/usr/local/bin
echo "PROCS:"; pgrep -af "codex exec" | grep -v pgrep | wc -l
echo "NEWKEY-REPORT:"; ls -la --time-style=+%H:%M /srv/aina/ops/gemini-newkey-report.md 2>/dev/null || echo none
echo "NEWKEY-LANE-LASTTYPE:"; tail -1 /srv/aina/ops/codex-gemini-newkey.log 2>/dev/null | tr -d "\000" | grep -oE "\"type\":\"[a-z.]+\"" | tail -1
echo "OPEN-PRS:"; gh pr list --repo ainative-academy/aina-academy --state open --json number,headRefName --jq ".[]|\"#\(.number) \(.headRefName)\"" 2>/dev/null
echo "PORT-LANE:"; tail -1 /srv/aina/ops/codex-lesson-shell-port.log 2>/dev/null | tr -d "\000" | grep -oE "\"type\":\"[a-z.]+\"" | tail -1' 
echo "---BACKLOG---"
./vds-exec.sh run 'export PATH=$PATH:/usr/local/bin; paperclipai issue list --json 2>/dev/null > /tmp/il.json; python3 -c "import json;from collections import Counter;i=json.load(open(\"/tmp/il.json\"));i=i if isinstance(i,list) else i.get(\"issues\",i.get(\"data\",[]));n=[x for x in i if \"council-2026-06-29\" in (x.get(\"description\") or \"\")];print(\"93-backlog:\",dict(Counter(x.get(\"status\") for x in n)))"'

cd /Users/Ali/PKM/scratch/pkm-deepdive
./vds-exec.sh run 'sed -n "1,60p" /srv/aina/ops/gemini-newkey-report.md 2>/dev/null'

cd /Users/Ali/PKM/scratch/pkm-deepdive
./vds-exec.sh run 'export PATH=$PATH:/usr/local/bin
python3 - <<"PY"
import subprocess,json
def pc(*a): return subprocess.run(["paperclipai",*a],capture_output=True,text=True)
iss=json.loads(pc("issue","list","--json").stdout); iss=iss if isinstance(iss,list) else iss.get("issues",iss.get("data",[]))
ids={x.get("identifier"):x.get("id") for x in iss}
v=("NEW-KEY Interactions test (Ali key, 2026-06-29): the new AQ. key does NOT unlock Interactions (no surface returned 200+interactionId; ceiling 0). BUT it WORKS for key-based Vertex Express generateContent on both models — confirms a direct KEY-HEADER path from Cloudflare Workers WITHOUT ADC for standard Gemini generation (good for the launch tutor). Interactions still blocked: this is a valid GENERATION key but cannot call the Interactions METHOD. To get Interactions, Ali needs a BILLING-ACTIVE Developer API credential, OR Google to enable Interactions models on Vertex project aina-495702. DECISION UNCHANGED: launch tutor on standard Vertex generateContent (key-based, Workers-ready); Interactions = optional post-launch. Old key backed up. PR #119.")
for ident in ("AIN-174","AIN-133"):
    i=ids.get(ident)
    if i: print(ident, pc("issue","comment",i,"--body",v).returncode==0)
PY'

cd /Users/Ali/PKM/scratch/pkm-deepdive
cat > learner-flow-doctrine.txt <<'EOF'

---
## LEARNER FLOW + INTERFACE DOCTRINE (Ali 2026-06-29) — "everything flows through here only"
- **THE card-based chat shell (recovered, 3-col) is the SINGLE PRIMARY INTERFACE.** NO separate media/video/audio pages or routes. ALL content — lessons, media, video, audio — flows INLINE through this one shell (cards + stream). One interface; everything through it.
- **LESSONS ARE DETERMINISTIC — no live LLM, no tutor agent.** The lesson flow is a SELECTOR over pre-authored content + cards (the deterministic tier = "selector by default"). It works FULLY WITHOUT a live LLM. The tutor / Gemini-Interactions API is NOT needed for lessons.
- **PROGRESSION / UNLOCK:** lesson (deterministic) → learner CLEARS it → unlocks **MISSIONS + PRACTICE ARENA** → learner chooses: advance to the next lesson, OR do the practice arena (can return to the arena later). Practice arena unlocks after lesson completion / after a few lessons.
- **LIVE LLM = OFF by default everywhere; toggled ON ONLY in the PRACTICE ARENA for MISSIONS** (the "gated generation by exception" tier). Lessons never call the LLM; only arena missions do — and even there the pure-sim / no-LLM mode exists (see ARENA-DOCTRINE).
- **REPRIORITIZE: the Gemini-tutor / Interactions API is NOT on the lesson critical path** (lessons are deterministic). It only matters for arena missions (optional, behind the LLM toggle). Drop its urgency. Priority = the deterministic lesson flow (the chat shell) + the unlock progression + the arena LLM-toggle. This IS the two-tier engine: deterministic lessons (selector) + gated-LLM arena missions.
- Supersedes the "separate video-lesson page" framing (AIN-91): video flows INLINE through the shell, not a separate route. "We had discussed this" — aligns with the two-tier engine + ARENA-DOCTRINE (with/without LLM).
EOF
base64 < learner-flow-doctrine.txt | ./vds-exec.sh runl '
  T=$(base64 -d)
  echo "$T" >> /srv/aina/ops/FACTORY-GUARDRAILS.md
  for f in lane-lesson-shell-port.md lane-practice-arena-v2.md; do [ -f /srv/aina/ops/lanes/$f ] && echo "$T" >> /srv/aina/ops/lanes/$f; done
  echo FLOW_DOCTRINE_LOGGED'

cd /Users/Ali/PKM/scratch/pkm-deepdive
./vds-exec.sh run 'export PATH=$PATH:/usr/local/bin
python3 - <<"PY"
import subprocess,json
def pc(*a): return subprocess.run(["paperclipai",*a],capture_output=True,text=True)
iss=json.loads(pc("issue","list","--json").stdout); iss=iss if isinstance(iss,list) else iss.get("issues",iss.get("data",[]))
ids={x.get("identifier"):x.get("id") for x in iss}
notes={
 "AIN-91":"RE-SCOPED (Ali flow doctrine 2026-06-29): video is NOT a separate page/route — it flows INLINE through the single card-based chat shell (the one primary interface). Build video as an inline card in the shell, not a standalone video-lesson page.",
 "AIN-133":"DE-PRIORITIZED (Ali flow doctrine 2026-06-29): lessons are DETERMINISTIC (selector + cards, NO live LLM, no tutor agent) — the Gemini tutor/Interactions API is NOT on the lesson critical path. Live LLM is toggled ON only in the PRACTICE ARENA for missions. Move any LLM-tutor work to the arena-missions toggle; not needed for the lesson flow.",
 "AIN-92":"Per flow doctrine 2026-06-29: audio flows INLINE through the chat shell (no separate audio page); audio remains founder-owned (Ali) + off the agent critical path.",
}
for ident,n in notes.items():
    i=ids.get(ident)
    if i: print(ident, pc("issue","comment",i,"--body",n).returncode==0)
    else: print(ident,"not found")
PY'

cd /Users/Ali/PKM/scratch/pkm-deepdive
cat > arena-sim-primary.txt <<'EOF'

---
## ARENA SIMULATION IS PRIMARY (Ali 2026-06-29 confirm — "always been the plan")
- The Practice Arena's PRIMARY / DEFAULT mode = **SIMULATE LLM behavior** (the flight simulator): deterministically program LLM behavior — errors, mistakes, context-window limits, drift, hallucination, refusal, latency — sourced from OUR OWN learnings (the "15 things" + PKM gotchas). This IS the point, NOT a fallback. Privacy-safe, no data egress, reproducible.
- **Live LLM = OPTIONAL toggle in the arena, "if needed" — NOT the default.** (Client-side LLM / Gemma-Chrome is the other privacy-safe option.)
- THEREFORE **the WHOLE PLATFORM runs WITHOUT any live LLM by default**: lessons = deterministic (selector + cards); arena = simulated LLM behavior. Live LLM is optional, arena-only, behind a toggle.
- This de-prioritizes live-LLM / Gemini-Interactions EVEN FURTHER: the platform is fully functional + launch-ready with ZERO live LLM. Gemini/live-LLM = a later optional enhancement, NEVER a launch blocker. Build the arena SIM-FIRST (the simulation engine + the failure-mode catalog), with live-LLM as an optional behind-flag mode.
EOF
base64 < arena-sim-primary.txt | ./vds-exec.sh runl '
  T=$(base64 -d)
  echo "$T" >> /srv/aina/ops/FACTORY-GUARDRAILS.md
  echo "$T" >> /srv/aina/ops/reference/ARENA-DOCTRINE.md
  [ -f /srv/aina/ops/lanes/lane-practice-arena-v2.md ] && echo "$T" >> /srv/aina/ops/lanes/lane-practice-arena-v2.md
  echo SIM_PRIMARY_LOGGED'