kiri/lux
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: advance credential and API gates

Browse Source
This commit is contained in:
kiri committed 2026-09-06 00:25:13 +02:00
1 parent 422a1eacc3
commit 89675c5f16
1 file changed
+79 -41
Download Patch File Download Diff File Expand all files Collapse all files
docs/plans/workflow-system.md
+79 -41
View File
@@ -30,11 +30,12 @@ not make it the global next step while another pilot can still progress.
## Current checkpoint
- Tranche: autonomous consolidation across repositories, tools, and pilots
- State: autonomous implementation exhausted; one activation and external gates await the user
- State: autonomous implementation exhausted; one activation and external or
real-use gates await the user
- Branch: `chore/workflow-system`
- Baseline: `nix flake check --no-build --quiet` and a no-link Zenith system
build passed on 2026-09-05 after the skill-discovery and durable remote-state
boundary changes; only the expected dirty-tree and unknown `modules`
build passed on 2026-09-06 after the invocation-scoped credential changes;
only the expected dirty-tree and unknown `modules`
warnings were emitted. The generated project menu finds 30 live repositories
without `.archive` or `.worktrees` entries, and the generated daily-note
configuration passes an isolated same-day idempotence test. The managed Actual
@@ -60,19 +61,24 @@ not make it the global next step while another pilot can still progress.
read-only PR review pilot pass locally. The broad GitHub credentials are gone;
a mode-0600 fine-grained token now passes repository, issue, pull-request,
Actions, and organization Project reads with no stored fallback credential.
- Next: activate the skill-directory, remote-boundary, and GitHub-token loader
changes, then use the first real Monday ticket to test the native
Project-to-issue-to-local-branch workflow.
The user activated its loader and confirmed a new shell can list organization
Projects; the skill directory and durable remote boundary are also live. The
new read-only wrapper fetches all private Cargo dependencies from inside a
cached dev shell, and the complete yookr-api contract passes.
- Next: rotate the exposed Context7 key, create its machine-local file, and
activate the invocation-scoped GitHub and Context7 owners once. Then use the
first real Monday ticket to test the native Project-to-issue-to-local-branch
workflow and continue the remaining external pilots as inputs arrive.
## Progress
| Batch | State | Evidence or blocker |
| --- | --- | --- |
| Bootstrap and repository ownership | Waiting for user | Repository and dashboard reconciliation complete; credential cleanup remains |
| Bootstrap and repository ownership | Waiting for user | Repository reconciliation and local plaintext credential cleanup are complete; Context7 rotation remains |
| Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
| Repository contracts and workbench | Waiting externally | Five clean-checkout contracts and read-only Kubernetes pass; API, database, report, S3, and secret inputs remain externally gated |
| Repository contracts and workbench | Waiting externally | Five clean-checkout contracts, the full yookr-api check, and read-only Kubernetes pass; API user credentials, database, report, and S3 inputs remain externally gated |
| Desktop navigation and interaction | Active | Walker project and terminal actions plus stable Actual/WhatsApp launchers work; Outlook and two-output checks remain |
| Agent workflow | Waiting for user | Herdr, read-only PR review, the fine-grained credential, and organization Projects pass; the corrected skill owner and token loader await user activation, while a real Monday ticket remains external |
| Agent workflow | Waiting for user | Herdr, read-only PR review, the corrected skill owner, durable remote boundary, fine-grained credential, and organization Projects pass; the invocation-scoped owners await one activation and a real Monday ticket remains external |
| Notes | Complete | The daily launcher and migrated notebook pass live checks; the approved rollback copy is recoverable from Trash |
| PIM | Active | Native NixOS Evolution 3.60.2 plus Microsoft 365 integration is live beside Thunderbird; account and daily-use gates await credentials |
| Transcription | Pending | Requires a real Fossify recording-transfer pilot before implementation moves from Zenith to Orion |
@@ -96,8 +102,10 @@ not make it the global next step while another pilot can still progress.
| NixOS configuration | `chore/workflow-system` | `ee64a7b` | Retire superseded tools and prepare the S3 pilot |
| NixOS configuration | `chore/workflow-system` | `2ef74d4` | Expose the NixOS skill as a supported directory link |
| NixOS configuration | `chore/workflow-system` | `1996411` | Load the machine-local read-only GitHub credential |
| NixOS configuration | `chore/workflow-system` | `422a1ea` | Scope GitHub and Context7 credentials to their callers |
| `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
| `yookr-dashboard-new` | `feat/gogv2` | `8e6e4bc` | Establish its project contract and native lifecycle |
| `yookr-dashboard-new` | `feat/gogv2` | `c99f8b6` | Move runtime configuration to its machine-local owner |
| `rules-service` | `chore/workflow-contract` | `555d9cd` | Establish the first common repository contract |
| `yookr-api` | `chore/workflow-contract` | `a76b2b7` | Establish the HTTP and OpenAPI contract |
| `traceability-data-model` | `chore/workflow-contract` | `33cb7ff` | Establish the database and schema contract |
@@ -110,10 +118,6 @@ not make it the global next step while another pilot can still progress.
None of these block work on independent pilots. Surface the exact applicable
step to the user only when it blocks the current task.
- Activate the latest Zenith build with `cd ~/.config/nixos && nh os switch`.
This changes `nixos-maintainer` to a supported directory link and installs the
durable remote-read-only agent instruction plus the runtime GitHub token
loader; only the user may run it.
- Run the bounded Pinta trial using a recent real edit: clipboard/open,
selection, crop/resize/canvas, text/drawing/shapes, layers/transparency,
basic adjustments, and PNG/JPEG export. Tell the agent whether it fully
@@ -137,25 +141,19 @@ step to the user only when it blocks the current task.
- Make one Fossify recording on the Pixel and let Syncthing transfer it. Do not
rename or move it manually; the agent must first observe the real write and
settlement behavior before implementing Orion automation.
- Rotate the exposed Context7 key and provide `CONTEXT7_API_KEY` through a
mode-0600 machine-local environment file on each workstation before removing
the static user-config header.
- Relocate the mode-0644 `/home/kiri/work/SECRETS` file to an approved private
owner and restrict it; its contents have not been inspected.
- Move the ignored `rules-service/.env` to
`~/.config/yookr/rules-service.env` with mode 0600; its contents have not been
inspected or copied.
- Move the ignored `yookr-dashboard-new/.env` to its approved machine-local
mode-0600 owner, then update `.envrc`; the non-secret repository contract is
already complete.
- Generate a replacement Context7 API key, save it without a trailing newline
as `~/.config/context7/api-key` with mode 0600, and revoke the old exposed
key. Then activate the latest Zenith build with
`cd ~/.config/nixos && nh os switch` and restart Codex. Only the user may
perform the activation.
- Supply one real Yookr S3 task plus a least-privileged remote and authorize one
bounded upload. `rclone` is prepared, but no remote or wrapper is guessed.
- Restore access to the locked `yookrdev/constant-store` commit or replace that
retired dependency deliberately, then rerun `just check` in `yookr-api`.
- Deploy a GET image that exposes `/full-api-docs/openapi.json`, then rerun
`just openapi-refresh test`; the current test deployment returns 404.
- Populate the ignored API HTTP credentials and perform the planned login plus
harmless administrator read; no credential-bearing request has been made.
- Provide current API user credentials for the ignored private HTTP environment,
then perform the planned login and harmless administrator read. The recovered
legacy service UUID/password returned 401 from production and was not copied
into the user-login schema.
## Deferred Polaris replication
@@ -173,6 +171,9 @@ Polaris:
6. Create `~/.config/yookr/github-read-only.token` without a trailing newline,
containing the fine-grained `yookrdev` token, and set its mode to 0600. Open
a new Zsh after activation and verify `gh project list --owner yookrdev`.
7. Create `~/.config/context7/api-key` without a trailing newline, containing a
current Context7 key, and set its mode to 0600. Restart Codex after activation
and run one Context7 documentation lookup.
## Decisions and discoveries
@@ -191,8 +192,10 @@ Polaris:
- Pruned the absent `feat/echarts-domain` worktree metadata; its branch and
commit remain. The registered sensor worktree is valid at its new path.
- Shared Codex defaults and MCP endpoints are generated at
`/etc/codex/config.toml`; Context7 reads its header from the environment. The
unused generic `~/.config/mcp/mcp.json` is absent.
`/etc/codex/config.toml`. Context7's credential is supplied at connection time
by Codex's native HTTP-header helper reading `~/.config/context7/api-key`; no
secret enters Nix or the process-wide environment. The unused generic
`~/.config/mcp/mcp.json` is absent.
- Removed redundant legacy-path trust entries from the current Codex config;
the existing trusted home scope covers the moved repositories.
- Bruno's transitional OpenAPI reference now follows the archived management
@@ -213,17 +216,21 @@ Polaris:
one `.http` request collection, explicit test/live deployment paths, and a
corrected test-oriented environment example. The full locked Cargo check
passes; Clippy reports 18 pre-existing advisory warnings.
- Private Cargo Git dependencies remain in the ordinary developer SSH
boundary. They are not vendored or bridged into sandboxed Nix builds.
- Private Cargo Git dependencies remain at their upstream HTTPS URLs and use
Git's existing `gh auth git-credential` integration. They are not vendored or
rewritten.
- `yookr-api` now owns its reviewed OpenAPI 3.1 contract, local/test/live HTTP
metadata, curated login/health/admin-read requests, a non-mutating shell, and
one explicit snapshot-and-diff recipe. `oasdiff` 1.31.0 is pinned with source
and vendor hashes because Nixpkgs does not provide it.
- The API flake evaluation and built OpenAPI validation pass. Cargo stops before
compilation because its locked `constant-store` repository is unavailable
through both anonymous HTTPS and the working SSH identity. The test service
is reachable, but its currently deployed GET image returns 404 for the full
OpenAPI route already present in local source and ingress configuration.
- The API flake evaluation, complete locked Rust test suite, and OpenAPI
validation pass. The fine-grained token reads the exact locked
`constant-store` commit and two other private Yookr crates through the
invocation-scoped `gh` credential helper; no dependency URL changed. The
validator retains two pre-existing informational example findings. The test
service is reachable, but its currently deployed GET image returns 404 for
the full OpenAPI route already present in local source and ingress
configuration.
- `traceability-data-model` preserves the existing domain/schema redesign while
replacing automatic schema recreation with explicit `just reset`. Ordinary
`just dev` retains its Compose volumes, and the flake check loads fixtures in
@@ -242,6 +249,20 @@ Polaris:
lint, and format checks pass; a bounded smoke test reached ready MongoDB and
Vite processes and stopped cleanly. The commit contains only contract files;
the user's existing dashboard source work remains unstaged and untouched.
- The active ignored `rules-service/.env` is moved unchanged to
`~/.config/yookr/rules-service.env`; its existing `.envrc` now loads that
file successfully. The dashboard environment is likewise moved unchanged to
`~/.config/yookr/yookr-dashboard-new.env`, and its `.envrc`, instructions,
and README now name that owner. Both files are mode 0600, both shells expose
their expected variables without recreating repository `.env` files, and the
dashboard commit contains only those three contract files. The unrelated
dashboard source work remains unstaged.
- The unreferenced `/home/kiri/work/SECRETS` file overlapped an older
rules-service environment but contained different credentials, so it was not
merged or discarded. It is preserved byte-for-byte as the mode-0600
`~/.config/yookr/rules-service-legacy.env`; the original path is absent. Its
production Yookr service UUID/password returned 401 from `/serviceLogin`; no
token was retained and the credentials were not repurposed as a user login.
- Fresh local clones of `rules-service`, `yookr-api`,
`traceability-data-model`, `yookr-dashboard-new`, and `yookr-data-science`
pass their flake and project checks, expose their tracked `just` catalogs,
@@ -345,9 +366,10 @@ Polaris:
records this boundary. The former broad `jellespr` credential and stale,
invalid `kirigar` credential are removed locally. The only working API route
is now a fine-grained `github_pat_` token in the mode-0600 machine-local
`~/.config/yookr/github-read-only.token`; Zsh loads it as the documented
`GH_TOKEN` interface without copying the secret into Nix or a password-manager
adapter.
`~/.config/yookr/github-read-only.token`. The Nix-owned `gh` package wrapper
reads it only when `GH_TOKEN` is otherwise absent, so `gh` and its Git
credential helper work inside Nix dev shells without copying the secret into
Nix, exporting it process-wide, or adding per-repository configuration.
- The fine-grained token passes identity, repository contents, issues, pull
requests, Actions, and organization Projects reads with no stored fallback.
The organization exposes 219 open issues, five open pull requests, and 60
@@ -357,6 +379,22 @@ Polaris:
open issues assigned across the organization are not present there. Keep the
native `gh` and Git workflow and wait for the first real Monday ticket; add no
dashboard or wrapper before usage exposes a concrete gap.
- The user activated the initial GitHub token loader, whole-directory skill
owner, and durable remote boundary. A fresh shell contained the fine-grained
`GH_TOKEN`, `nixos-maintainer` resolved to a store-backed directory, the
generated global `AGENTS.md` contained the strict remote-state policy, and
the user confirmed `gh project list --owner yookrdev` succeeds. A cached
nix-direnv shell then proved it strips inherited `GH_TOKEN`; this concrete gap
prompted the invocation-scoped wrapper above, which passes an isolated dev
shell API query and the full private-dependency build before activation.
- The former Context7 declaration put a literal key in
`env_http_headers`, whose values Codex interprets as environment-variable
names; it therefore exposed the secret without supplying the documented
authentication. The static key is absent from the current worktree. Official
Codex configuration and Context7 documentation instead support the built
`http_headers_helper`, which emits the required `Authorization: Bearer` header
and passes an isolated fake-key JSON test. The historical key still requires
revocation.
- The PR gate used `prediction-api#125`: native `gh pr view`, `checks`, and
`diff` reads work, while an isolated exact-base reconstruction passes patch,
whitespace, and Rust formatting checks and leaves no durable checkout. The PR
@@ -369,7 +407,7 @@ Polaris:
Manager now links the whole skill directory, the shape documented as supported
by Codex, rather than linking only `SKILL.md`. The flake and generated Home
Manager build pass, and an isolated Codex discovery probe returns
`DISCOVERED`; live confirmation awaits user activation.
`DISCOVERED`; the live store-backed directory is now discoverable.
- Herdr reports the agent lifecycle correctly and preserves its pane and output
across detach and reattach. Its native defaults suffice; no configuration or
wrapper was added.