record rules service contract pilot

docs/plans/workflow-system.md

@@ -14,8 +14,8 @@ and add no abstraction without a demonstrated repeated need.
 - Baseline: `nix flake check --no-build --quiet` passed on 2026-09-05; only
   the existing dirty-tree and unknown `modules` output warnings were emitted.
 - Next: prove the common contract in `rules-service`, `yookr-api`, and
-  `traceability-data-model`; create the minimal workbench only after ownership
-  of the pilot artifacts is clear.
+  `traceability-data-model`; `rules-service` is complete, so reconcile the
+  API's untracked specification next.
 
 ## Progress
 
@@ -23,7 +23,7 @@ and add no abstraction without a demonstrated repeated need.
 | --- | --- | --- |
 | Bootstrap and repository ownership | Waiting for user | Repository and dashboard reconciliation complete; credential cleanup remains |
 | Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
-| Repository contracts and workbench | Active | Three repository pilots audited; implementation follows per-repository checkpoints |
+| Repository contracts and workbench | Active | `rules-service` contract passes; API and schema pilots remain |
 | Desktop, agents, notes, PIM, transcription | Pending | Independent pilots follow foundation changes |
 | Conditional retirement and completion | Pending | Requires per-pilot evidence |
 
@@ -34,6 +34,7 @@ and add no abstraction without a demonstrated repeated need.
 | NixOS configuration | `chore/workflow-system` | `41bc61b` | Discovery, paths, Git identity, and Codex defaults |
 | NixOS configuration | `chore/workflow-system` | `69552b7` | Simplify flake inputs and declare workstation lifecycle tools |
 | `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
+| `rules-service` | `chore/workflow-contract` | `555d9cd` | Establish the first common repository contract |
 
 ## Human actions
 
@@ -42,6 +43,9 @@ and add no abstraction without a demonstrated repeated need.
   the static user-config header.
 - Relocate the mode-0644 `/home/kiri/work/SECRETS` file to an approved private
   owner and restrict it; its contents have not been inspected.
+- Move the ignored `rules-service/.env` to
+  `~/.config/yookr/rules-service.env` with mode 0600; its contents have not been
+  inspected or copied.
 - Destructive cleanup, credentials, activation, and empirical pilot decisions
   will be surfaced here before use.
 
@@ -76,4 +80,11 @@ and add no abstraction without a demonstrated repeated need.
   package-set pin. Added `just` to the workstation tools and selected the
   store-backed `podman-compose` provider through native `containers.conf`.
 - The resulting flake check and no-link builds for all three hosts pass.
+- `rules-service` now has a non-mutating direnv shell, minimal Nix toolchain and
+  formatting check, native Cargo recipes, factual repository instructions,
+  one `.http` request collection, explicit test/live deployment paths, and a
+  corrected test-oriented environment example. The full locked Cargo check
+  passes; Clippy reports 18 pre-existing advisory warnings.
+- Private Cargo Git dependencies remain in the ordinary developer SSH
+  boundary. They are not vendored or bridged into sandboxed Nix builds.
 - Run independent pilots in parallel, but gate every retirement separately.