docs: archive workflow plans and introduce constellation

Preserve the accumulated phase-two record and introduce the constellation design and working agreement. Archived approvals and plans are historical, not current authority.

docs/constellation-work.md

@@ -0,0 +1,210 @@
+# Constellation: working state
+
+Read [the design](constellation.md) and this file to resume. Keep this file short:
+replace superseded state rather than appending a chronological log.
+
+## Working agreement
+
+- Explore the philosophy through concrete use, discuss meaningful choices, then
+  implement a small coherent change. Curiosity and alternative designs are welcome;
+  an idea need not prove a defect before we explore it.
+- Write succinctly without losing important details. Distinguish accepted choices,
+  proposals and observations. Ask when intent would change the design; resolve
+  routine implementation details autonomously. Infer opportunities from the user's
+  philosophy and actual use; contribute design ideas beyond literal backlog items.
+  Continue to the next natural step when the user could only usefully say "continue";
+  pause for material choices or missing authority, not routine progress.
+- The main agent owns alignment, design and integration and may do small work.
+  Use subagents for bounded independent investigations or implementation with clear
+  ownership. Begin with at most two workers; avoid overlapping writes, duplicate
+  investigations and mandatory delegation of trivial tasks.
+- Give workers the question, relevant paths, constraints and expected result.
+  Prefer a compact brief and fresh context when sufficient; retain relevant prior
+  context for follow-ups. Return conclusions, uncertainty and evidence pointers,
+  not raw logs. Astra/Sol orchestration is a candidate to learn from, not a fixed rule.
+- Read only what can affect the current decision. Use quiet commands and bounded
+  output; keep large logs in `/tmp` and inspect relevant failures. Do not repeatedly
+  check settled facts. Consult current documentation for consequential or unfamiliar
+  interfaces when needed for the task.
+- No tests unless explicitly requested. Keep other verification proportional;
+  report only what was actually checked. Avoid turning small changes into campaigns.
+- Keep durable decisions in the design and current questions/next steps here.
+  Add an area-specific document only when an active topic outgrows this arrangement.
+  No separate backlog, scratchpad, audit ledger or agent-role files for now.
+
+## Boundaries
+
+Repository remotes are read-only. Only the user activates system generations.
+Agents must not have write access to live company systems; test writes require
+task-specific authority and care. Do not read secret values for layout discovery.
+Current exploration does not authorize relocating credentials, synchronizing
+company content or deleting existing material. Existing local changes are preserved.
+
+## Current exploration — organization
+
+Accepted: repositories are primarily code; general notes belong outside them.
+Company work is broader than repositories. Workbench has a different purpose from
+product projects. Structure should be intuitive without constraining future work.
+
+Observed through shallow listings: project groups (now relocated below), `~/work`,
+`~/sync/notes`, mixed material in `~/sync`, and loose work artifacts in home.
+Names alone do not establish ownership, contents or redundancy.
+
+Accepted: the workbench supplies an environment at the company root. Reusable HTTP
+and SQL files need a home. Native tools should remain freely composable; the current
+custom inventory and mail commands are not the desired direction. Notes, credential
+placement and synchronization remain open; no relocation is approved.
+
+Workbench `.envrc` still loads tools and exports test/live database, API,
+object-store and RabbitMQ credentials together. Neovim's global database plugin
+names four company connections. No services or secrets were read.
+
+Direction: a tool/context environment at company root, maintained `workbench/`
+tooling with `http/` and `databases/` material, and separate local investigation files.
+Human credentials are supplied through environment variables for both test/live;
+agent access requires separate treatment.
+Organize reusable requests by service and queries by database, with visible target
+selection. Keep setup
+shortcuts only where they add value; let kubectl and other clients own operations.
+Mail needs a searchable representation that preserves message meaning; rg over raw
+mailbox storage is not automatically an adequate substitute for the current helper.
+
+API/database proposal: reusable HTTP files grouped by service, shared authentication
+requests, and explicit visible HTTP target selection. Start database exploration
+from a named connection (database + environment), creating or reopening an attached
+query; retain direct-file opening with explicit connection assignment. Keep reusable
+query text separate from target credentials. Working queries should survive restart
+without automatically becoming tracked workbench material.
+
+Native evidence: [Kulala imports](https://github.com/mistweaverco/kulala.nvim/blob/main/doc/kulala.import-and-run-http.txt)
+support sharing named authentication requests across files.
+[Dadbod UI](https://github.com/kristijanhusak/vim-dadbod-ui/blob/master/doc/dadbod-ui.txt)
+supports connection-associated saved queries, persistent temporary-query locations
+and explicit assignment of independently opened buffers. Callable connection URLs
+resolve while populating the list, not on selection (confirmed in pinned source);
+they do not support the proposed per-selection credential delivery.
+Its save location also holds connection state, so do not put the entire directory
+under Git. Context7 covered Kulala; Dadbod required upstream help as fallback.
+The persistent-query option was also confirmed in pinned Dadbod source. HTTP
+import/run syntax was checked in current Kulala documentation; not exercised
+against company services.
+
+Chosen root: `~/yookr`. Company-wide Neovim search is explicitly deferred for lack
+of a concrete use case. Existing project search remains unchanged.
+
+Created `~/yookr` directly with ordinary `.envrc` and `AGENTS.md` files. Moved the
+actual workbench checkout from `~/dev/work/yookr-workbench` to `~/yookr/workbench`;
+the temporary link was removed. Prefer direct moves over compatibility links.
+Removed the earlier Home Manager
+workspace declarations: Nix owns tools/integration, not working directories or
+their authored files. Notes and credentials remain in place;
+workbench uncommitted work moved with the checkout. Walker's Yookr entry and Git's new work-path identity rule remain
+activated by the user.
+
+Repository environments remain independent. Future relocation/composition must
+account for their own `.envrc` files (direnv provides `source_up`) without imposing
+a personal directory layout on portable repositories. The workbench's own `.envrc`
+still exports aggregate credentials; root entry uses its flake only.
+
+Verification: checked ordinary file types and whitespace
+after the ownership correction. The earlier Nix configuration evaluation passed;
+it was not repeated for removing the workspace declarations. No builds, tests,
+credential reads or activation performed. The workspace files exist now; the user
+can authorize its environment with `direnv allow ~/yookr`. System activation for
+Walker/Git also includes pre-existing editor/AI/SharePoint changes in this checkout.
+
+Credential decision: user wants environment-variable delivery of BOTH test and
+live credentials, with ordinary Neovim startup. Removed the rejected `mysql-test`
+launcher; existing workbench `.envrc` already supplies both and remains unchanged.
+Do not resume per-selection decryption or add per-connection launchers. The root
+environment is still tools-only; agent isolation remains separate from the chosen
+human workflow. No secrets were decrypted or databases contacted.
+
+API/database organization implemented: `http/` contains service-specific files,
+shared `auth.http` and the unchanged endpoint catalogue. Protected requests use
+native `import`/`run` to authenticate before execution in the selected environment.
+`databases/mysql/` separates server discovery and the two existing schemas;
+`databases/mongodb/server.js` preserves MongoDB discovery. Existing request and
+query contents were retained, with no additional system access or credentials.
+Private HTTP environment files are ignored at any depth. No compatibility files.
+
+Neovim uses `db_ui_tmp_query_location` under its data directory at
+`db_ui/working`; write working queries there without promoting them into Git.
+Dadbod's saved-query storage and connection selection remain unchanged. This
+one-line editor change has been activated by the user. Whitespace and Lua syntax
+were checked; no tests, company-service requests or decryption performed.
+
+Target context prepared in the existing Lualine statusline: pinned Kulala 6.29.0
+supplies a native `kulala` component for `.http` buffers (environment selection);
+Dadbod's `db_ui#statusline` supplies connection/schema/table in attached query
+buffers and timing in result buffers. No copied target state or credential URLs.
+These additions await the next user activation; they are indicators, not access
+controls. Lua syntax and whitespace checked; no company-service calls or tests.
+
+Access isolation explicitly deferred by the user. Separate read-only credentials
+for agents are the eventual direction, but cannot be created now. Root remains
+tools-only; the workbench child supplies both human credential environments.
+Existing agent restrictions remain. Do not revisit isolation as a prerequisite
+for unrelated work or silently broaden access.
+
+Current focus: the bigger picture, not further API/database polish. Revisited the
+idea inbox. Proposed areas for exploration, not a committed implementation plan:
+places and ownership; navigation and interaction; human/agent collaboration;
+system operation and maintenance. Start with places because they establish the
+context that launchers, editors and agents enter.
+
+User clarification: work is mostly project-based, not organized into topics or
+investigations; relevant project material mostly stays in the repository. Notes
+are mostly meeting notes so far. Do not add investigation folders or outer project
+containers without a concrete need.
+
+Approved relocation completed: `~/dev/work` moved directly to `~/yookr/projects`,
+including `.archive` and `.worktrees`; remaining `~/dev` renamed `~/projects`,
+retaining `own`, `ext`, `forks`. No compatibility links. Repaired the three linked
+worktrees in yookr-dashboard and yookr-dashboard-new with native Git repair;
+all three resolve at their new paths. Updated company README/AGENTS references.
+Walker roots, XDG projects path and Git identity rules updated in Nix. The new
+XDG projects path is now active. Existing shells and path-dependent development environments
+may need reopening/recreation; no caches or project files were rewritten.
+
+User requested removal of Bruno collections and their Syncthing configuration.
+Stopped the local Syncthing service before moving `~/dev/bruno` to Trash
+(recoverable); removed its folder entry from shared Nix configuration. Other
+devices' files were not touched. Syncthing was stopped for the move and has since
+resumed (observed active on the following turn).
+Only zenith's filesystem was migrated; other hosts need their own relocation
+before adopting the shared project-path change. Nix files formatted; worktree
+paths and whitespace checked. No tests or remote repository changes.
+
+Notes entry: existing Neovim `Space n f` finds notes, `Space n n` creates one,
+and `Space n t` finds tags. Niri `Mod+N` opens a daily note. Added a standard
+Notes desktop entry, discoverable through Walker, opening `~/sync/notes` in
+terminal Neovim. This neutral entry uses existing file/text search (`Space s f`,
+`Space s g`) and note commands, without creating a daily note. Pending activation.
+No new search provider, shortcuts, templates or note directories. Notes placement
+and existing daily-note behavior unchanged; agent isolation remains deferred.
+
+Current exploration: agent-session navigation. Agent-deck 1.15.0 is already
+installed alongside Herdr and tmux; do not plan installation from stale notes.
+Its installed help provides session search, attach and Ctrl+Q detach, plus native
+project-path sessions and optional groups. No sessions were started, inspected,
+stopped or migrated. Asked the user whether they have tried it and what feels good
+or awkward before changing bindings or selecting it as Herdr's replacement.
+
+Proposed division of responsibility: Walker enters a place/application, Niri
+navigates visible windows, the session manager finds and resumes agent work.
+Avoid mirroring the whole session list into another launcher or forcing a group
+hierarchy before actual use. Agent isolation remains deferred.
+
+Command cleanup complete: archived the workbench justfile, custom mail reader,
+discovery pilot and old README in its `.archive/`. Removed the obsolete command
+catalogue check and bubblewrap/Python/just shell dependencies. The shorter README
+documents native Garden target/session setup followed by ordinary kubectl or K9s,
+fixes product-repository links after relocation, and marks mail search unresolved.
+No credentials, mail or remote systems were accessed. Files are recoverable in the
+archive; no replacement wrapper or index was introduced.
+Workbench `nix flake check --no-build --quiet` and whitespace checking passed.
+
+Iteration setup: all five previous docs moved under `docs/.archive/`, retaining
+their relative layout. Prior editor, AI and SharePoint implementation changes
+remain; consult their owners when those areas become active.