carve walkthrough: behold demo carve — the recordable peel-advise → carve experience (#230 M1.5)

[lex00]

M1.5 of #230 — the recordable carve walkthrough. Goal: one command → a video-grade guided flow showing peel-advise → carve, honest about the human steps. Builds on #252's carve lens (report → graph, bands, predicted diff).

behold demo carve: a bundled Terraform mini-estate in the demo catalog (sample-estate shape: VPC, subnets, bucket, lambda, log group, a random_pet scoring 0 — all text, plus a synthetic .tfstate). Demo boot installs @cdktf/hcl2json in the demo copy and runs chant carve advise --json via a project-local chant. No cloud, no Docker.

The stepper (palette tab or inspect-pane flow), with behold running the SAFE steps as local actions with dial progress — precedent: /api/apply's step runs, substrate bring-up, local CI dispatch:

1. Advise — the scored graph, one-line band explanations.
2. Pick — click a green leaf; score arithmetic + the predicted diff (cut edges + survivors needing patches) light up (carve lens M1: behold carve <report.json> — render the peelability report (#230) #252's machinery).
3. Emit — button runs carve emit --state (writes only the output dir); emitted chant source appears; chant lint gate shown green.
4. Bridge — button runs carve bridge (NO --apply-rewrites); the proposed TF patch renders as a reconcile-style change set.
5. Handoff — the runbook rendered with copy buttons (terraform state rm, terraform plan, apply rewrites). Deliberately NOT a button: the destructive middle stays human, and the UI says why.
6. Morph — post-handoff (user clicks "I ran it" / behold detects the emitted project), the resource's box transitions from the TF boundary into the chant project box at observe position. Pinhole's frame-sequence morph is the mechanism.

End card: "chant-owned, observe position — terraform import reverses everything."

Boundaries: behold gains local-only carve action endpoints (advise/emit/bridge) — no cloud writes, no TF mutation, same delegated-local-run contract as the existing action endpoints; document in AGENTS.md. The walkthrough state (current step, picked resource) is client-side only.

Acceptance

• behold demo carve → browser → complete the six steps on camera without touching a terminal except the handoff step's two copy-pasted commands.
• Every step's UI state is reachable by test: route tests for the action endpoints (emit/bridge run against the demo fixture in a temp copy), smoke assertions for the stepper states, a morph-frame test.
• Nothing mutates the demo source in place; re-running the demo resets clean.

[lex00]

The demo estate, designed for the peel (not chant's test fixture)

Make it a mixed estate from the first frame — the video opens on a migration already half-done, not an empty chant side. Two members:

• app/ — a small chant project that reads as "the pieces already carved": the CloudWatch log group and an SSM parameter, chant-owned at observe, with a source comment saying they came out of the TF last month. The estate view shows a real chant box beside the TF box from the start, and the morph moment has somewhere to land.
• legacy-tf/ — the Terraform half, authored so the advisor's bands tell the story at a glance (~10 nodes, readable on camera):

resource	designed score/band	narrative role
aws_s3_bucket.assets (+ inlined versioning/PAB sub-resources)	~88, carve-now	the star — one inbound (lambda reads it), clean tier-1 map; the resource we carve on camera
aws_cloudwatch_log_group.worker	100, carve-now	the "trivial one" — mentioned, not carved, proves there's always a free first move
aws_lambda_function.api	~65, boundary work	the "next month" candidate — tier 2, outbound refs into the VPC; shows the yellow band honestly
aws_iam_role.api	~70, boundary work	attached to the lambda; shows inbound counting
aws_vpc.main + 2 subnets + SG	~30s and low, leave	the grey anchor — many inbound; the "this stays, and that's fine" line
module.cdn	mid	one module entry so module scoring appears
random_pet.suffix	0, unmappable	the "long tail stays in Terraform indefinitely" punchline

• terraform.tfstate — synthetic but complete for the starred resources (bucket + log group attributes present), so carve emit --state works offline; fake account ids, clearly-fake ARNs, a header comment saying so.
• The bucket's single inbound edge (lambda's s3_bucket env ref) is what lights up in the Pick step — one clean cut, one data-source patch, visible.

Script beats the estate is tuned for: green star → arithmetic → cut-edge highlight → emit (lint green) → bridge (one small patch) → handoff (two pasted commands) → the box slides into app/. Total ~2 minutes.

Authoring note: keep every value boring-realistic (no foo/bar), because the video pauses on the inspect pane.

[lex00]

Floci tier (per Alex): behold demo carve --live

Two tiers. Offline (synthetic tfstate, zero deps beyond the demo copy) stays the default — guaranteed first 30 seconds. The Floci tier is the full video: it turns 'the resource stays live through the carve' from a caption into footage.

• Scratch Floci in Docker (never touch existing floci* containers — boot our own, delete after; behold demo k8s's scratch pattern). chant's just carve-emit-e2e is the prior art for carve-against-Floci.
• terraform apply the legacy-tf INTO Floci first (AWS provider endpoints override in a floci tfvars/override file, kept out of the offline story) — so the tfstate is real, written by terraform.
• The walkthrough's observe beats go live: after Emit, chant's lifecycle diff --live reads the bucket from Floci — live, clean — while Terraform still owns it. Handoff runs a REAL terraform plan on camera showing no destroy. After handoff, behold's overlay flips the bucket chant-owned green.
• Requires: docker + terraform on PATH; demo entry declares both. Resource set stays inside Floci's emulated coverage (S3, CloudWatch Logs safe; the carve-emit-e2e covered types are the guide).
• The narration line the tier exists for: 'Terraform forgot it, chant adopted it, and it never blinked.'