install wardrowbe on orion

docs/current-work.md

@@ -18,6 +18,25 @@ Keep this record current by replacing superseded state. Pass-specific procedures
 stay here, not in AGENTS. The user must agree before the overall pass is complete.
 The unedited `~/sync/notes/setup-todo.md` remains an idea inbox, not authorization.
 
+## Wardrowbe on Orion: implemented, awaiting provisioning and activation
+
+- Orion selects the Wardrowbe capability at `wardrobe.jelles.net`, with Tinyauth
+  password access at `wardrobe-auth.jelles.net`. Trusted household members select
+  their profile through Wardrowbe's development login after the gateway; profile
+  identity is not independently verified.
+- Podman containers use immutable image digests, a dedicated network and persistent
+  named volumes. Database/queue health gates migrations and API startup; frontend
+  and workers wait for the API. Caddy protects all application routes; published
+  container ports are localhost-only. Internal AI is disabled everywhere. No
+  Codex bridge, Ollama or paid provider is configured.
+- Four new system SOPS keys and both DNS records remain user-provisioned. Missing
+  SOPS keys must be supplied before Orion builds or activates. See
+  [Wardrowbe setup](../modules/capabilities/wardrowbe/README.md) for provisioning,
+  activation, operations, upgrade limits and manual acceptance.
+- Focused source/configuration review only. No tests, host evaluation/build,
+  `just validate`, activation or remote changes. No existing secrets were decrypted
+  or read for discovery.
+
 ## Implemented, reviewed and validated; awaiting user checkpoint
 
 - Flat capability owners; service category flattened. AI, theme, Handy and