advance workflow implementation ledger

docs/plans/workflow-system.md

@@ -8,21 +8,22 @@ and add no abstraction without a demonstrated repeated need.
 
 ## Current checkpoint
 
-- Tranche: bootstrap and repository ownership reconciliation
-- State: waiting for user credential handling
+- Tranche: repository contracts and Yookr workbench
+- State: active
 - Branch: `chore/workflow-system`
 - Baseline: `nix flake check --no-build --quiet` passed on 2026-09-05; only
   the existing dirty-tree and unknown `modules` output warnings were emitted.
-- Next: relocate the legacy secret, rotate the Context7 key, remove the
-  resulting empty legacy directories, and close the ownership tranche.
+- Next: prove the common contract in `rules-service`, `yookr-api`, and
+  `traceability-data-model`; create the minimal workbench only after ownership
+  of the pilot artifacts is clear.
 
 ## Progress
 
 | Batch | State | Evidence or blocker |
 | --- | --- | --- |
 | Bootstrap and repository ownership | Waiting for user | Repository and dashboard reconciliation complete; credential cleanup remains |
-| Declarative workstation foundation | Pending | Depends on canonical paths |
-| Repository contracts and workbench | Pending | Depends on repository reconciliation |
+| Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
+| Repository contracts and workbench | Active | Three repository pilots audited; implementation follows per-repository checkpoints |
 | Desktop, agents, notes, PIM, transcription | Pending | Independent pilots follow foundation changes |
 | Conditional retirement and completion | Pending | Requires per-pilot evidence |
 
@@ -31,6 +32,7 @@ and add no abstraction without a demonstrated repeated need.
 | Repository | Branch | Commit | Purpose |
 | --- | --- | --- | --- |
 | NixOS configuration | `chore/workflow-system` | `41bc61b` | Discovery, paths, Git identity, and Codex defaults |
+| NixOS configuration | `chore/workflow-system` | `69552b7` | Simplify flake inputs and declare workstation lifecycle tools |
 | `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
 
 ## Human actions
@@ -70,4 +72,8 @@ and add no abstraction without a demonstrated repeated need.
   worktree match the pre-move inventory. The Nix flake still evaluates.
 - No-link system builds for Zenith, Polaris, and Orion pass with the migrated
   paths and declarative Codex defaults.
+- Removed the unused stable Nixpkgs input and made Noctalia follow the root
+  package-set pin. Added `just` to the workstation tools and selected the
+  store-backed `podman-compose` provider through native `containers.conf`.
+- The resulting flake check and no-link builds for all three hosts pass.
 - Run independent pilots in parallel, but gate every retirement separately.