Set up only what the task needs. Most orientation, planning, documentation, isolated interface work, route checks, type checks, and unit tests can begin without production access.
Use this order:
- choose or create a bounded Wildbase Work task;
- read this handbook and the repository’s
README, and contribution notes; - clone only the repositories involved;
- run the checks that do not require secrets;
- create local development credentials or an isolated local service when the task needs them; and
- request a protected permission only when the remaining work cannot be done without it.
What is self-service
| Work | What you need |
|---|---|
| Read the public handbook and instincts | Nothing beyond a browser or local checkout. |
| Edit this site | Node.js 22.12 or newer, pnpm, and the wildhq-site checkout. |
| Inspect or change Packbase code | GitHub organisation access, MFA, and the relevant checkout. |
| Run Packbase server static checks | Node.js 24, pnpm 11, and installed dependencies; route checks do not require real service credentials. |
| Build isolated Packbase UI components | The web checkout and its local toolchain; Storybook mocks can cover many components without a live account. |
| Run the full Packbase web application | A development Clerk publishable key and an explicitly selected API. |
| Run the full Packbase server | An isolated PostgreSQL database plus development credentials for the services exercised by the task. |
| Merge, deploy, inspect production data, or moderate real content | Explicit task-scoped authority and the corresponding account permission. |
Do not use production merely because local setup is inconvenient. The Packbase web client defaults to the production API unless you deliberately override it. A local interface attached to production is still production.
When setup cannot be self-service
Wild HQ has no secure channel for sending shared secrets. Prefer credentials you create for a development environment. If a task genuinely depends on a shared secret or production permission, record the exact missing capability on the task and stop that part of the work until safe access exists.
That is a real blocker, not an invitation to paste a token into Discord, email, a pull request, or an AI tool.