docs: advance credential and API gates

docs/plans/workflow-system.md

@@ -30,11 +30,12 @@ not make it the global next step while another pilot can still progress.
 ## Current checkpoint
 
 - Tranche: autonomous consolidation across repositories, tools, and pilots
-- State: autonomous implementation exhausted; one activation and external gates await the user
+- State: autonomous implementation exhausted; one activation and external or
+  real-use gates await the user
 - Branch: `chore/workflow-system`
 - Baseline: `nix flake check --no-build --quiet` and a no-link Zenith system
-  build passed on 2026-09-05 after the skill-discovery and durable remote-state
+  build passed on 2026-09-06 after the invocation-scoped credential changes;
-  boundary changes; only the expected dirty-tree and unknown `modules`
+  only the expected dirty-tree and unknown `modules`
   warnings were emitted. The generated project menu finds 30 live repositories
   without `.archive` or `.worktrees` entries, and the generated daily-note
   configuration passes an isolated same-day idempotence test. The managed Actual
@@ -60,19 +61,24 @@ not make it the global next step while another pilot can still progress.
   read-only PR review pilot pass locally. The broad GitHub credentials are gone;
   a mode-0600 fine-grained token now passes repository, issue, pull-request,
   Actions, and organization Project reads with no stored fallback credential.
-- Next: activate the skill-directory, remote-boundary, and GitHub-token loader
+  The user activated its loader and confirmed a new shell can list organization
-  changes, then use the first real Monday ticket to test the native
+  Projects; the skill directory and durable remote boundary are also live. The
-  Project-to-issue-to-local-branch workflow.
+  new read-only wrapper fetches all private Cargo dependencies from inside a
+  cached dev shell, and the complete yookr-api contract passes.
+- Next: rotate the exposed Context7 key, create its machine-local file, and
+  activate the invocation-scoped GitHub and Context7 owners once. Then use the
+  first real Monday ticket to test the native Project-to-issue-to-local-branch
+  workflow and continue the remaining external pilots as inputs arrive.
 
 ## Progress
 
 | Batch | State | Evidence or blocker |
 | --- | --- | --- |
-| Bootstrap and repository ownership | Waiting for user | Repository and dashboard reconciliation complete; credential cleanup remains |
+| Bootstrap and repository ownership | Waiting for user | Repository reconciliation and local plaintext credential cleanup are complete; Context7 rotation remains |
 | Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
-| Repository contracts and workbench | Waiting externally | Five clean-checkout contracts and read-only Kubernetes pass; API, database, report, S3, and secret inputs remain externally gated |
+| Repository contracts and workbench | Waiting externally | Five clean-checkout contracts, the full yookr-api check, and read-only Kubernetes pass; API user credentials, database, report, and S3 inputs remain externally gated |
 | Desktop navigation and interaction | Active | Walker project and terminal actions plus stable Actual/WhatsApp launchers work; Outlook and two-output checks remain |
-| Agent workflow | Waiting for user | Herdr, read-only PR review, the fine-grained credential, and organization Projects pass; the corrected skill owner and token loader await user activation, while a real Monday ticket remains external |
+| Agent workflow | Waiting for user | Herdr, read-only PR review, the corrected skill owner, durable remote boundary, fine-grained credential, and organization Projects pass; the invocation-scoped owners await one activation and a real Monday ticket remains external |
 | Notes | Complete | The daily launcher and migrated notebook pass live checks; the approved rollback copy is recoverable from Trash |
 | PIM | Active | Native NixOS Evolution 3.60.2 plus Microsoft 365 integration is live beside Thunderbird; account and daily-use gates await credentials |
 | Transcription | Pending | Requires a real Fossify recording-transfer pilot before implementation moves from Zenith to Orion |
@@ -96,8 +102,10 @@ not make it the global next step while another pilot can still progress.
 | NixOS configuration | `chore/workflow-system` | `ee64a7b` | Retire superseded tools and prepare the S3 pilot |
 | NixOS configuration | `chore/workflow-system` | `2ef74d4` | Expose the NixOS skill as a supported directory link |
 | NixOS configuration | `chore/workflow-system` | `1996411` | Load the machine-local read-only GitHub credential |
+| NixOS configuration | `chore/workflow-system` | `422a1ea` | Scope GitHub and Context7 credentials to their callers |
 | `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
 | `yookr-dashboard-new` | `feat/gogv2` | `8e6e4bc` | Establish its project contract and native lifecycle |
+| `yookr-dashboard-new` | `feat/gogv2` | `c99f8b6` | Move runtime configuration to its machine-local owner |
 | `rules-service` | `chore/workflow-contract` | `555d9cd` | Establish the first common repository contract |
 | `yookr-api` | `chore/workflow-contract` | `a76b2b7` | Establish the HTTP and OpenAPI contract |
 | `traceability-data-model` | `chore/workflow-contract` | `33cb7ff` | Establish the database and schema contract |
@@ -110,10 +118,6 @@ not make it the global next step while another pilot can still progress.
 None of these block work on independent pilots. Surface the exact applicable
 step to the user only when it blocks the current task.
 
-- Activate the latest Zenith build with `cd ~/.config/nixos && nh os switch`.
-  This changes `nixos-maintainer` to a supported directory link and installs the
-  durable remote-read-only agent instruction plus the runtime GitHub token
-  loader; only the user may run it.
 - Run the bounded Pinta trial using a recent real edit: clipboard/open,
   selection, crop/resize/canvas, text/drawing/shapes, layers/transparency,
   basic adjustments, and PNG/JPEG export. Tell the agent whether it fully
@@ -137,25 +141,19 @@ step to the user only when it blocks the current task.
 - Make one Fossify recording on the Pixel and let Syncthing transfer it. Do not
   rename or move it manually; the agent must first observe the real write and
   settlement behavior before implementing Orion automation.
-- Rotate the exposed Context7 key and provide `CONTEXT7_API_KEY` through a
+- Generate a replacement Context7 API key, save it without a trailing newline
-  mode-0600 machine-local environment file on each workstation before removing
+  as `~/.config/context7/api-key` with mode 0600, and revoke the old exposed
-  the static user-config header.
+  key. Then activate the latest Zenith build with
-- Relocate the mode-0644 `/home/kiri/work/SECRETS` file to an approved private
+  `cd ~/.config/nixos && nh os switch` and restart Codex. Only the user may
-  owner and restrict it; its contents have not been inspected.
+  perform the activation.
-- Move the ignored `rules-service/.env` to
-  `~/.config/yookr/rules-service.env` with mode 0600; its contents have not been
-  inspected or copied.
-- Move the ignored `yookr-dashboard-new/.env` to its approved machine-local
-  mode-0600 owner, then update `.envrc`; the non-secret repository contract is
-  already complete.
 - Supply one real Yookr S3 task plus a least-privileged remote and authorize one
   bounded upload. `rclone` is prepared, but no remote or wrapper is guessed.
-- Restore access to the locked `yookrdev/constant-store` commit or replace that
-  retired dependency deliberately, then rerun `just check` in `yookr-api`.
 - Deploy a GET image that exposes `/full-api-docs/openapi.json`, then rerun
   `just openapi-refresh test`; the current test deployment returns 404.
-- Populate the ignored API HTTP credentials and perform the planned login plus
+- Provide current API user credentials for the ignored private HTTP environment,
-  harmless administrator read; no credential-bearing request has been made.
+  then perform the planned login and harmless administrator read. The recovered
+  legacy service UUID/password returned 401 from production and was not copied
+  into the user-login schema.
 
 ## Deferred Polaris replication
 
@@ -173,6 +171,9 @@ Polaris:
 6. Create `~/.config/yookr/github-read-only.token` without a trailing newline,
    containing the fine-grained `yookrdev` token, and set its mode to 0600. Open
    a new Zsh after activation and verify `gh project list --owner yookrdev`.
+7. Create `~/.config/context7/api-key` without a trailing newline, containing a
+   current Context7 key, and set its mode to 0600. Restart Codex after activation
+   and run one Context7 documentation lookup.
 
 ## Decisions and discoveries
 
@@ -191,8 +192,10 @@ Polaris:
 - Pruned the absent `feat/echarts-domain` worktree metadata; its branch and
   commit remain. The registered sensor worktree is valid at its new path.
 - Shared Codex defaults and MCP endpoints are generated at
-  `/etc/codex/config.toml`; Context7 reads its header from the environment. The
+  `/etc/codex/config.toml`. Context7's credential is supplied at connection time
-  unused generic `~/.config/mcp/mcp.json` is absent.
+  by Codex's native HTTP-header helper reading `~/.config/context7/api-key`; no
+  secret enters Nix or the process-wide environment. The unused generic
+  `~/.config/mcp/mcp.json` is absent.
 - Removed redundant legacy-path trust entries from the current Codex config;
   the existing trusted home scope covers the moved repositories.
 - Bruno's transitional OpenAPI reference now follows the archived management
@@ -213,17 +216,21 @@ Polaris:
   one `.http` request collection, explicit test/live deployment paths, and a
   corrected test-oriented environment example. The full locked Cargo check
   passes; Clippy reports 18 pre-existing advisory warnings.
-- Private Cargo Git dependencies remain in the ordinary developer SSH
+- Private Cargo Git dependencies remain at their upstream HTTPS URLs and use
-  boundary. They are not vendored or bridged into sandboxed Nix builds.
+  Git's existing `gh auth git-credential` integration. They are not vendored or
+  rewritten.
 - `yookr-api` now owns its reviewed OpenAPI 3.1 contract, local/test/live HTTP
   metadata, curated login/health/admin-read requests, a non-mutating shell, and
   one explicit snapshot-and-diff recipe. `oasdiff` 1.31.0 is pinned with source
   and vendor hashes because Nixpkgs does not provide it.
-- The API flake evaluation and built OpenAPI validation pass. Cargo stops before
+- The API flake evaluation, complete locked Rust test suite, and OpenAPI
-  compilation because its locked `constant-store` repository is unavailable
+  validation pass. The fine-grained token reads the exact locked
-  through both anonymous HTTPS and the working SSH identity. The test service
+  `constant-store` commit and two other private Yookr crates through the
-  is reachable, but its currently deployed GET image returns 404 for the full
+  invocation-scoped `gh` credential helper; no dependency URL changed. The
-  OpenAPI route already present in local source and ingress configuration.
+  validator retains two pre-existing informational example findings. The test
+  service is reachable, but its currently deployed GET image returns 404 for
+  the full OpenAPI route already present in local source and ingress
+  configuration.
 - `traceability-data-model` preserves the existing domain/schema redesign while
   replacing automatic schema recreation with explicit `just reset`. Ordinary
   `just dev` retains its Compose volumes, and the flake check loads fixtures in
@@ -242,6 +249,20 @@ Polaris:
   lint, and format checks pass; a bounded smoke test reached ready MongoDB and
   Vite processes and stopped cleanly. The commit contains only contract files;
   the user's existing dashboard source work remains unstaged and untouched.
+- The active ignored `rules-service/.env` is moved unchanged to
+  `~/.config/yookr/rules-service.env`; its existing `.envrc` now loads that
+  file successfully. The dashboard environment is likewise moved unchanged to
+  `~/.config/yookr/yookr-dashboard-new.env`, and its `.envrc`, instructions,
+  and README now name that owner. Both files are mode 0600, both shells expose
+  their expected variables without recreating repository `.env` files, and the
+  dashboard commit contains only those three contract files. The unrelated
+  dashboard source work remains unstaged.
+- The unreferenced `/home/kiri/work/SECRETS` file overlapped an older
+  rules-service environment but contained different credentials, so it was not
+  merged or discarded. It is preserved byte-for-byte as the mode-0600
+  `~/.config/yookr/rules-service-legacy.env`; the original path is absent. Its
+  production Yookr service UUID/password returned 401 from `/serviceLogin`; no
+  token was retained and the credentials were not repurposed as a user login.
 - Fresh local clones of `rules-service`, `yookr-api`,
   `traceability-data-model`, `yookr-dashboard-new`, and `yookr-data-science`
   pass their flake and project checks, expose their tracked `just` catalogs,
@@ -345,9 +366,10 @@ Polaris:
   records this boundary. The former broad `jellespr` credential and stale,
   invalid `kirigar` credential are removed locally. The only working API route
   is now a fine-grained `github_pat_` token in the mode-0600 machine-local
-  `~/.config/yookr/github-read-only.token`; Zsh loads it as the documented
+  `~/.config/yookr/github-read-only.token`. The Nix-owned `gh` package wrapper
-  `GH_TOKEN` interface without copying the secret into Nix or a password-manager
+  reads it only when `GH_TOKEN` is otherwise absent, so `gh` and its Git
-  adapter.
+  credential helper work inside Nix dev shells without copying the secret into
+  Nix, exporting it process-wide, or adding per-repository configuration.
 - The fine-grained token passes identity, repository contents, issues, pull
   requests, Actions, and organization Projects reads with no stored fallback.
   The organization exposes 219 open issues, five open pull requests, and 60
@@ -357,6 +379,22 @@ Polaris:
   open issues assigned across the organization are not present there. Keep the
   native `gh` and Git workflow and wait for the first real Monday ticket; add no
   dashboard or wrapper before usage exposes a concrete gap.
+- The user activated the initial GitHub token loader, whole-directory skill
+  owner, and durable remote boundary. A fresh shell contained the fine-grained
+  `GH_TOKEN`, `nixos-maintainer` resolved to a store-backed directory, the
+  generated global `AGENTS.md` contained the strict remote-state policy, and
+  the user confirmed `gh project list --owner yookrdev` succeeds. A cached
+  nix-direnv shell then proved it strips inherited `GH_TOKEN`; this concrete gap
+  prompted the invocation-scoped wrapper above, which passes an isolated dev
+  shell API query and the full private-dependency build before activation.
+- The former Context7 declaration put a literal key in
+  `env_http_headers`, whose values Codex interprets as environment-variable
+  names; it therefore exposed the secret without supplying the documented
+  authentication. The static key is absent from the current worktree. Official
+  Codex configuration and Context7 documentation instead support the built
+  `http_headers_helper`, which emits the required `Authorization: Bearer` header
+  and passes an isolated fake-key JSON test. The historical key still requires
+  revocation.
 - The PR gate used `prediction-api#125`: native `gh pr view`, `checks`, and
   `diff` reads work, while an isolated exact-base reconstruction passes patch,
   whitespace, and Rust formatting checks and leaves no durable checkout. The PR
@@ -369,7 +407,7 @@ Polaris:
   Manager now links the whole skill directory, the shape documented as supported
   by Codex, rather than linking only `SKILL.md`. The flake and generated Home
   Manager build pass, and an isolated Codex discovery probe returns
-  `DISCOVERED`; live confirmation awaits user activation.
+  `DISCOVERED`; the live store-backed directory is now discoverable.
 - Herdr reports the agent lifecycle correctly and preserves its pane and output
   across detach and reattach. Its native defaults suffice; no configuration or
   wrapper was added.