From 7a6f51ce09d79f58937e8d8030cabcc61a8a175c Mon Sep 17 00:00:00 2001 From: Jelle Spreeuwenberg Date: Sun, 6 Sep 2026 15:11:27 +0200 Subject: [PATCH] docs: record pilot boundaries and OpenAPI blocker --- docs/plans/workflow-system.md | 13 +++++++++++-- docs/workflow-discovery.md | 9 ++++++--- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/docs/plans/workflow-system.md b/docs/plans/workflow-system.md index c26273f..04e3374 100644 --- a/docs/plans/workflow-system.md +++ b/docs/plans/workflow-system.md @@ -26,6 +26,9 @@ restarted Kitty and closed the user's terminal session. - Keep repositories and worktrees outside `~/sync`; synchronize authored artifacts instead. - Keep GitHub and other repository remotes strictly read-only. +- Treat Yookr production source as read-only. Dev-tooling changes are allowed; + `yookr-workbench` is the only repository whose own source may be changed for + these pilots. ## Current checkpoint @@ -60,8 +63,11 @@ These gates do not block work on each other. management UI. - Supply one real Yookr S3 task, a least-privileged remote, and explicit permission for any upload. `rclone` is installed; no remote or wrapper is preconfigured. -- Deploy a GET image exposing `/full-api-docs/openapi.json`, then rerun - `just openapi-refresh test`. +- The test GET image exposes `/full-api-docs/openapi.json`. The 2026-09-06 + refresh reached it successfully but validation found a dangling + `#/components/schemas/ReadParameters` reference. Have the application owner + correct and deploy the generated document, then rerun the refresh; do not + modify production source during this workflow. - Provide current API user credentials before the planned login and harmless administrator read. The recovered legacy service credentials returned 401 and were not repurposed. @@ -161,6 +167,9 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work. Radicale remain the data authorities; Thunderbird and Outlook remain available. - GitHub and every other repository remote stay read-only. Local files, commits, fetches, clones, and worktrees remain available. +- Yookr production source stays read-only during workflow pilots. Changes to + development tooling are allowed, and `yookr-workbench` remains the explicit + source-code exception. ## Next step diff --git a/docs/workflow-discovery.md b/docs/workflow-discovery.md index bb86fde..b42bd86 100644 --- a/docs/workflow-discovery.md +++ b/docs/workflow-discovery.md @@ -140,6 +140,9 @@ copied application state. GitHub and all other remotes are read-only. Local commits, clones, fetches, and worktrees are allowed; remote mutation requires a separate change to policy. +Yookr production source is also read-only during these pilots. Development +tooling may be changed, and `yookr-workbench` is the explicit source-code +exception. Credentials and `.env` files normally stay outside Git, the Nix store, and broad synchronization. The accepted `yookr-vpn.ovpn` is a narrow exception for Zenith @@ -162,9 +165,9 @@ and build configurations, then provide an activation command. cross-system investigation. - Configure an S3 remote only for a real task with least-privileged credentials and explicit upload authorization. -- Rerun the Yookr OpenAPI refresh after the deployed image exposes - `/full-api-docs/openapi.json`; run authenticated API checks only with current - user credentials. +- Rerun the Yookr OpenAPI refresh after the deployed document defines its + referenced `ReadParameters` schema; run authenticated API checks only with + current user credentials. - Run the complete Herdr notification, fallback-agent, and safe worktree pilot with a real Monday ticket. - Keep Bruno, DBeaver, and existing PIM clients until their independent gates are