**Chat log** from Bead: Egp Missions · [canonical source](https://redfish.acequia.io/guerin/.agents/35e928bc-200c-4eb7-8248-e7bca9b07859/2026-06-21/chats/2026-06-21-start-bead-egp-missions.md) · session 2026-06-21 · discussion: Talk: Egp Missions *Verbatim chat log: immutable provenance. The bead's copy is ground truth; wiki edits here are a fork, never the record.*
Verbatim user prompts; assistant turns summarized with pointers to durable artifacts. Continuation of the wildcad / wildfire-forager session.
## Turn (verbatim) > a bead that generated the bookmarklet EGP missions may already exist > javascript:(function(){var s=document.getElementById('egp-mb-script');if(!s){s=document.createElement('script');s.id='egp-mb-script';s.src='https://simtable.acequia.io/apps/mission-browser/mission-browser-app.js';s.onerror=function(){alert('Failed to load mission browser')};document.head.appendChild(s)}else{s.remove();var ns=document.createElement('script');ns.id='egp-mb-script';ns.src='https://simtable.acequia.io/apps/mission-browser/mission-browser-app.js?t=%27+Date.now();document.head.appendChild(ns)}})(); > if not start-bead egp-missions > this scrapes EGP login and downloads egp data to an incident folder ### Assistant actions (summary) - Searched the commons (Explore subagent). **Conclusion: no bead owns/generated the mission-browser bookmarklet+app.** Only `b3461c66` documents its *output* (`mission-browser-as-catalog.md`); `c38c1239` references it as a catalog surface. The app code lives standalone at `simtable.acequia.io/apps/mission-browser/` with `_v0.._v3` backups and no bead provenance. - Read `mission-browser-README.md` and `b3461c66`'s producer note to capture accurate behavior: EGP API `egpapi.wildfire.gov /v1/sa/missionscombined/{id}` (array per aircraft, merged), dual save destinations (File System Access API local / WebDAV+Bearer), on-disk shape `<root>/<missionName>/{mission.json,*.mp4,*.json KLV,IR/HS,*.kml}`, backend-agnostic `storagePut/...` abstraction. - Verified a **path bug**: install page points the loader at `…/incidents/mission-browser/…` → **404**; working path (Stephen's bookmarklet) is `…/apps/mission-browser/…` → **200**. - Opened **`egp-missions`** (`35e928bc-…`): about.md, `notes/00-egp-mission-browser-orientation.md`, `artifacts/bookmarklet.js` (verbatim loader), uploads/README. Mounted into `5b518c35` wildfire-forager as the EGP airborne-FMV source-forager; related to `b3461c66`/`c38c1239`/`97559992`/`90f902e0`.
## Turn (verbatim) > do grep on .claude chats that created it and link to it > take advantage of the date of mission-browser creation date ### Assistant actions (summary) - Grepped all 359 `.claude` transcripts under `…/projects/c--Users-steph-Documents-sites/` for `mission-browser`. Creator session = **`1beb95e0-f44f-475b-81cd-dc7ce78d8b8f`** (wrote `mission-browser-app.js`, README, and `b3461c66`'s catalog note; first app write `2026-06-09T02:27:43Z`). Session `13aa2b80` (2026-06-08) only referenced it. - Pinned the artifact **creation date = 2026-06-09** and recorded it as provenance in about.md (Identity + Session Log) and note 00 (new Provenance subsection), linking the off-namespace creator transcript. This bead is the in-namespace anchor for that `.claude` origin.
## Turn (verbatim) > currently, we have to login into egp in the browser and then run the bookmarklet. is there a more direct API to EGP with tokens. Or is there a way you can login in with puppeteer and do the same and maintain a cookie or token. every so often i might have to use authenticator. is there any way I can give an .mjs a limited authenticator? basically I'm exploring all ways to do this. > > This should be documented in egp-missions bead ### Assistant actions (summary) - Researched EGP auth: **FAMAuth** OAuth2 SSO (federates **Login.gov** + USDA **eAuth/PIV**); access token 30 min, **refresh token 12 h**; FedRAMP/USDA compliant; 2FA mandated. The bookmarklet rides live session cookies to `egpapi.wildfire.gov`. - Wrote [`notes/01-headless-auth-options.md`](https://redfish.acequia.io/guerin/.agents/35e928bc-200c-4eb7-8248-e7bca9b07859/2026-06-21/notes/01-headless-auth-options.md): Option A (sanctioned API/service token — pursue first), Option B (Playwright login + persist `storageState`/refresh token), Option C (TOTP seed in `.mjs` via `otplib` = the "limited authenticator"; isolate as a dedicated, revocable factor; keep in a node not the commons). Refresh-token-centric hybrid recommendation, decision matrix, compliance caveat (federal Rules of Behavior), 5 open Qs.
## References (bead cross-links) - Bead 1beb95e0 · [canonical](https://redfish.acequia.io/guerin/.agents/1beb95e0-f44f-475b-81cd-dc7ce78d8b8f/) (no page yet)