feat: centralize workflow credentials

docs/plans/credential-consolidation.md

@@ -3,11 +3,14 @@
 This inventory contains names and provenance only. It intentionally contains no
 credential values or value hashes.
 
-## Proposed authority
+## Authority
 
 Use one SOPS-encrypted `~/.config/yookr/credentials.yaml`, backed by the existing
 mode-0600 user age identity. SOPS 3.13.3 and the identity are already present,
-and an encrypt/decrypt round trip passed on 2026-09-06.
+and an exact encrypt/decrypt comparison passed on 2026-09-06. The user approved
+this authority and an active-credentials-first migration. The directory is mode
+0700 and the encrypted file is mode 0600; it remains outside Git and the Nix
+store.
 
 Keep the document hierarchical so operators can inspect and edit everything in
 one place while callers extract only their own scalar values or subtree. Do not
@@ -15,20 +18,19 @@ load the complete document into every repository environment. Public endpoints,
 queue names, bucket names, and other non-secret configuration remain with their
 normal owners.
 
-Candidate top-level groups:
+Top-level groups:
 
-- `company-login`
+- `company_login`
 - `databases`
 - `leafcloud`
 - `rabbitmq`
-- `service-accounts`
-- `third-party`
+- `applications`
 - `archive`
 
-Do not migrate or remove source values until the user approves this authority.
-After approval, migrate active credentials first, verify each consumer, then
-handle archived credentials and delete redundant plaintext only with explicit
-approval.
+Active credentials and ten archived credential sources have been migrated.
+Archive membership does not imply inactivity, so their source namespaces are
+preserved. Delete redundant plaintext only with explicit approval after each
+original consumer is verified.
 
 ## Active sources
 
@@ -38,12 +40,17 @@ approval.
   frontend source and is therefore client-visible, not a protectable secret.
 - `~/dev/work/yookr-data-science/.env`: WeatherAPI key.
 - `~/rabbitmq-creds-test`: test RabbitMQ username and password.
+- `~/irristaud-openstack-creds`: Irristaud project EC2 credentials.
 - `~/db-creds`: MySQL test/live and MongoDB test/live material.
 - `~/dev/work/yookr-api/http-client.private.env.json`: company email and
   password used for API logins.
 - `~/.local/share/db_ui/connections.json`: existing `traceability` connection.
 
 All credential-bearing active files above are mode 0600 after the audit.
+They remain in place pending consumer-by-consumer removal approval. The dashboard
+backend's MySQL and MongoDB credentials do not match either named test/live pair,
+so they are preserved separately instead of being assigned an environment by
+assumption.
 
 ## Archived credential sources
 
@@ -54,9 +61,25 @@ All credential-bearing active files above are mode 0600 after the audit.
 - Legacy data science and soil-moisture tools: company login credentials.
 - `salemans`: CMI credentials.
 
-These files are now mode 0600. Preserve their provenance under `archive` until
-the user decides whether each credential is still valid; stale credentials
-should be revoked instead of retained indefinitely.
+These files are now mode 0600 and their selected credentials are preserved under
+`archive`. The user is still cleaning the filesystem, so stale status must be
+decided per source; stale credentials should be revoked instead of retained
+indefinitely.
+
+## Verified consumers
+
+- `yookr-workbench` decrypts once in memory and exports only its API login, four
+  database connections, Irristaud S3 credential, and test RabbitMQ credential.
+- Central test API login and the read-only RabbitMQ overview passed.
+- MySQL test/live `SELECT 1` and MongoDB test/live `ping` passed. The MongoDB
+  endpoints publish SRV rather than direct address records and therefore use
+  `mongodb+srv` URLs.
+- The ephemeral `irristaud:` rclone remote found the sole `irristaud` container
+  and listed its six root entries. No object content was downloaded and no
+  rclone configuration was persisted.
+
+Dadbod's four display names require activation of the pending Neovim
+configuration and explicit authorization of the changed workbench `.envrc`.
 
 ## Excluded from migration
 
@@ -76,8 +99,8 @@ credential is still active.
 
 ## Immediate findings
 
-- The discovered dashboard S3 credential can list eight Leafcloud containers but
-  cannot see `irristaud`; a credential from the `irristaud` project is required.
+- The dashboard S3 credential and the Irristaud project credential are distinct;
+  the latter is now centralized and its read-only pilot passed.
 - The generated Yookr OpenAPI document remains malformed, but direct requests use
   the reviewed local contract and work independently.
 - Management accepts an account-issued JWT only as the raw `Authorization` value,

docs/plans/workflow-system.md

@@ -47,18 +47,19 @@ restarted Kitty and closed the user's terminal session.
   invocation-scoped test overview and queue listing passed. Test API login,
   Yookr administrator read, rules read, aggregation login, and management health
   passed. Account login plus a raw-token management user read also passed.
+  The approved user-key SOPS authority now contains active credentials and ten
+  provenance-preserving archive namespaces. Its workbench exports passed a test
+  API login, RabbitMQ overview, MySQL test/live `SELECT 1`, MongoDB test/live
+  `ping`, and read-only Irristaud object-storage listing.
 
 ## Active pilot gates
 
 These gates do not block work on each other.
 
-- Configure one `rclone` S3 remote per Leafcloud project, starting with the
-  `irristaud` project and container. Use listing and download operations only;
-  uploads are out of scope. Project-scoped EC2 access and secret keys remain the
-  missing input.
-- Add the four named Dadbod connections after receiving MySQL test/live and
-  MongoDB test/live connection URIs. Create a Marimo-to-HTML report only when a
-  concrete cross-system investigation gives it durable value.
+- Activate the pending Neovim configuration, explicitly authorize the changed
+  workbench `.envrc`, and confirm Dadbod shows the four centralized test/live
+  connections. Create a Marimo-to-HTML report only when a concrete cross-system
+  investigation gives it durable value.
 - Keep Bruno, DBeaver, and PIM clients until their separate pilots decide them.
 - Wait for a real Monday ticket before adding anything beyond native GitHub,
   Herdr, Git, and worktree workflows. Issue 197 is selected, but this Codex
@@ -132,7 +133,8 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
 - `yookr-workbench` starts with cross-system work only; isolation and additional
   tools wait for observed needs. Its one API environment catalogue covers the
   Yookr, rules, aggregation, and management APIs; Kulala owns requests and
-  Dadbod's native store owns named database connections.
+  Dadbod receives the four named database connections from the workbench's
+  SOPS-derived environment.
 - The reviewed `yookr-api/openapi.yaml` remains the usable local contract. The
   deployed generated document's dangling `ReadParameters` reference is accepted
   for now and does not block direct API requests.
@@ -149,9 +151,10 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
 - The fine-grained GitHub token and Context7 key stay in mode-0600 machine-local
   files and are exposed only to their callers. Secrets do not enter Nix or broad
   process environments.
-- The value-free credential audit and proposed central SOPS authority are in
-  [`credential-consolidation.md`](credential-consolidation.md). Do not migrate
-  plaintext sources until the user accepts the authority and migration order.
+- The credential audit and approved central SOPS authority are in
+  [`credential-consolidation.md`](credential-consolidation.md). The authority is
+  active, while original plaintext sources remain pending consumer-specific
+  verification and explicit removal approval.
 - `sync/notes` is the single notebook owner. Daily notes, meetings, and raw
   transcripts have separate paths, and agents do not create issues or ingest
   transcripts automatically.
@@ -172,7 +175,7 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
 
 ## Next step
 
-Agree on the proposed central SOPS credential authority, obtain Leafcloud S3
-credentials from the `irristaud` project, and resume issue 197 from a Codex
-session launched inside Herdr. Then complete database/S3 access checks and the
-real workbench and Herdr pilots without mutating company GitHub.
+Activate the pending Neovim change, authorize the changed workbench `.envrc`,
+and confirm the four Dadbod names. Resume issue 197 from a Codex session launched
+inside Herdr, then complete one real cross-system investigation and the Herdr
+pilot without mutating company GitHub.

docs/workflow-discovery.md

@@ -145,9 +145,12 @@ tooling may be changed, and `yookr-workbench` is the explicit source-code
 exception.
 
 Credentials and `.env` files normally stay outside Git, the Nix store, and broad
-synchronization. The accepted `yookr-vpn.ovpn` is a narrow exception for Zenith
-and Polaris: keep it user-restricted and import it into NetworkManager without
-printing or committing its contents.
+synchronization. Machine-local Yookr credentials use the approved user-key SOPS
+authority at `~/.config/yookr/credentials.yaml`; callers expose only the fields
+they need. Original plaintext sources remain until their consumers are verified
+and removal is explicitly approved. The accepted `yookr-vpn.ovpn` is a narrow
+exception for Zenith and Polaris: keep it user-restricted and import it into
+NetworkManager without printing or committing its contents.
 
 `yookr-data-science/conf/local/credentials.yml` is a separate application-owned
 exception: Kedro resolves its named credential dataset through the conventional
@@ -159,10 +162,10 @@ and build configurations, then provide an activation command.
 
 ## Remaining pilots
 
-- Add workbench database connections and a Marimo report only for a real
-  cross-system investigation.
-- Configure one read-only-use rclone S3 remote per Leafcloud project, beginning
-  with listing and downloading from the `irristaud` container; do not upload.
+- Activate and visually confirm the workbench's four SOPS-derived Dadbod
+  connections. Add a Marimo report only for a real cross-system investigation.
+- Add another ephemeral read-only rclone remote only when credentials for a new
+  Leafcloud project become available. Irristaud listing has passed; do not upload.
 - Use the reviewed local Yookr OpenAPI contract while the accepted malformed
   generated test document remains deployed.
 - Run the complete Herdr notification, fallback-agent, and safe worktree pilot