docs: enforce read-only remote workflow

docs/plans/workflow-system.md

@@ -30,11 +30,11 @@ not make it the global next step while another pilot can still progress.
 ## Current checkpoint
 
 - Tranche: autonomous consolidation across repositories, tools, and pilots
-- State: autonomous implementation exhausted; consolidated gates await the user
+- State: autonomous implementation exhausted; one activation and external gates await the user
 - Branch: `chore/workflow-system`
 - Baseline: `nix flake check --no-build --quiet` and a no-link Zenith system
-  build passed on 2026-09-05 after the consolidated workstation retirement and
-  `rclone` preparation; only the expected dirty-tree and unknown `modules`
+  build passed on 2026-09-05 after the skill-discovery and durable remote-state
+  boundary changes; only the expected dirty-tree and unknown `modules`
   warnings were emitted. The generated project menu finds 30 live repositories
   without `.archive` or `.worktrees` entries, and the generated daily-note
   configuration passes an isolated same-day idempotence test. The managed Actual
@@ -49,14 +49,17 @@ not make it the global next step while another pilot can still progress.
   stopped its dependent Walker during activation without bringing Walker back,
   so it has been removed in favor of applying rare menu changes at login. After
   activating that removal and relogging, Walker opens normally and repository
-  selection starts Neovim in Oil at the project root. Four fresh local clones
+  selection starts Neovim in Oil at the project root. Five fresh local clones
   pass their flake checks, expose their tracked command catalogs, and remain
   clean after shell entry. The dashboard contract additionally passes its full
   check and a bounded two-process development smoke test. The dashboard and
   traceability PostgreSQL stacks also ran concurrently while both repositories'
-  checks passed; all test processes and containers were then stopped.
-- Next: present one consolidated user batch covering the built activation and
-  the independent empirical, credential, hardware, and approval gates below.
+  checks passed; all test processes and containers were then stopped. The
+  retired workstation tools are absent and `rclone` is live. Herdr preserves
+  its pane across detach and reattach. The data-science contract and a real
+  read-only PR review pilot pass locally.
+- Next: activate the skill-directory and remote-boundary fix, then continue the
+  independent empirical, credential, hardware, and real-task gates below.
 
 ## Progress
 
@@ -64,9 +67,9 @@ not make it the global next step while another pilot can still progress.
 | --- | --- | --- |
 | Bootstrap and repository ownership | Waiting for user | Repository and dashboard reconciliation complete; credential cleanup remains |
 | Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
-| Repository contracts and workbench | Waiting externally | Four clean-checkout contracts and read-only Kubernetes pass; data-science overlaps uncommitted work, while API, database, report, and secret inputs remain externally gated |
+| Repository contracts and workbench | Waiting externally | Five clean-checkout contracts and read-only Kubernetes pass; API, database, report, S3, and secret inputs remain externally gated |
 | Desktop navigation and interaction | Active | Walker project and terminal actions plus stable Actual/WhatsApp launchers work; Outlook and two-output checks remain |
-| Agent workflow | Waiting for user | The `nixos-maintainer` skill validates and matches its live owner; external policy blocks nested Codex evaluation without approval, and Herdr awaits its first live check |
+| Agent workflow | Waiting for user | Herdr and read-only PR review pass; the corrected skill owner is built and awaits user activation, while a real Monday ticket and Project read credential remain external |
 | Notes | Complete | The daily launcher and migrated notebook pass live checks; the approved rollback copy is recoverable from Trash |
 | PIM | Active | Native NixOS Evolution 3.60.2 plus Microsoft 365 integration is live beside Thunderbird; account and daily-use gates await credentials |
 | Transcription | Pending | Requires a real Fossify recording-transfer pilot before implementation moves from Zenith to Orion |
@@ -88,12 +91,14 @@ not make it the global next step while another pilot can still progress.
 | NixOS configuration | `chore/workflow-system` | `ca65328` | Remove the unsafe Elephant restart trigger |
 | NixOS configuration | `chore/workflow-system` | `d085512` | Advance from Walker to the agent pilot |
 | NixOS configuration | `chore/workflow-system` | `ee64a7b` | Retire superseded tools and prepare the S3 pilot |
+| NixOS configuration | `chore/workflow-system` | `2ef74d4` | Expose the NixOS skill as a supported directory link |
 | `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
 | `yookr-dashboard-new` | `feat/gogv2` | `8e6e4bc` | Establish its project contract and native lifecycle |
 | `rules-service` | `chore/workflow-contract` | `555d9cd` | Establish the first common repository contract |
 | `yookr-api` | `chore/workflow-contract` | `a76b2b7` | Establish the HTTP and OpenAPI contract |
 | `traceability-data-model` | `chore/workflow-contract` | `33cb7ff` | Establish the database and schema contract |
 | `traceability-data-model` | `chore/workflow-contract` | `774e710` | Remove Mathesar and simplify the local stack to PostgreSQL |
+| `yookr-data-science` | `chore/workflow-contract` | `fa410e1` | Establish its non-mutating project contract |
 | `yookr-workbench` | `main` | `badc61c` | Create the workbench and isolate its Garden session |
 
 ## Deferred or externally blocked actions
@@ -101,14 +106,9 @@ not make it the global next step while another pilot can still progress.
 None of these block work on independent pilots. Surface the exact applicable
 step to the user only when it blocks the current task.
 
-- Activate the consolidated Zenith build with `cd ~/.config/nixos && nh os
-  switch`. This removes the retired tools and installs `rclone`; only the user
-  may run it.
-- In a separate terminal, enter this repository and run `herdr`, start `codex`,
-  and ask it to read `docs/plans/workflow-system.md` without editing and report
-  the exact next implementation step. Confirm Herdr shows the agent's working
-  and waiting/done states, detach with `Ctrl+B` then `q`, reattach with `herdr`,
-  and confirm the pane survived with its output intact.
+- Activate the latest Zenith build with `cd ~/.config/nixos && nh os switch`.
+  This changes `nixos-maintainer` to a supported directory link and installs the
+  durable remote-read-only agent instruction; only the user may run it.
 - Run the bounded Pinta trial using a recent real edit: clipboard/open,
   selection, crop/resize/canvas, text/drawing/shapes, layers/transparency,
   basic adjustments, and PNG/JPEG export. Tell the agent whether it fully
@@ -132,13 +132,10 @@ step to the user only when it blocks the current task.
 - Make one Fossify recording on the Pixel and let Syncthing transfer it. Do not
   rename or move it manually; the agent must first observe the real write and
   settlement behavior before implementing Orion automation.
-- Reauthenticate the GitHub CLI with `gh auth login -h github.com`; its current
-  `kirigar` token is invalid. The agent can then complete the read-only PR and
-  isolated review-worktree gate without more direction.
-- Explicitly authorize the five ephemeral, read-only `codex exec` skill-scope
-  checks if sending this private repository to another authenticated Codex
-  session is acceptable. External policy correctly rejected them without that
-  approval; static skill validation already passes.
+- Before inspecting organization Project boards, replace the broad classic
+  GitHub token with a fine-grained token limited to required repository reads
+  and organization Projects read. The current credential can write and lacks
+  Project access; do not widen it with `gh auth refresh`.
 - Rotate the exposed Context7 key and provide `CONTEXT7_API_KEY` through a
   mode-0600 machine-local environment file on each workstation before removing
   the static user-config header.
@@ -150,15 +147,6 @@ step to the user only when it blocks the current task.
 - Move the ignored `yookr-dashboard-new/.env` to its approved machine-local
   mode-0600 owner, then update `.envrc`; the non-secret repository contract is
   already complete.
-- Commit or otherwise hand off the extensive dirty `yookr-data-science` work
-  before its flake, live-fetch defaults, local credentials, and missing project
-  contract are changed. Those files overlap the active work directly.
-- Explicitly approve moving the stale `~/.config/codex` tree to Trash if its old
-  authentication, conversations, databases, and plugins are no longer needed.
-- Explicitly approve removing the orphaned Podman volume
-  `traceability-data-model_mathesar-secrets` and the old `mathesar_django`
-  database if no Mathesar rollback is wanted. They are disconnected from the
-  repository but preserved because deletion would be irreversible.
 - Supply one real Yookr S3 task plus a least-privileged remote and authorize one
   bounded upload. `rclone` is prepared, but no remote or wrapper is guessed.
 - Restore access to the locked `yookrdev/constant-store` commit or replace that
@@ -214,9 +202,8 @@ Polaris:
   store-backed `podman-compose` provider through native `containers.conf`.
 - The resulting flake check and no-link builds for all three hosts pass.
 - The verified-empty legacy directories `~/work/.data/mongodb`, `~/work/.data`,
-  and `~/work/repos` are removed. The stale `~/.config/codex` tree is preserved
-  because it contains old authentication and conversation state; moving that
-  recoverably requires explicit user approval.
+  and `~/work/repos` are removed. The stale `~/.config/codex` tree was moved to
+  desktop Trash after explicit approval; the active `~/.codex` tree is intact.
 - `rules-service` now has a non-mutating direnv shell, minimal Nix toolchain and
   formatting check, native Cargo recipes, factual repository instructions,
   one `.http` request collection, explicit test/live deployment paths, and a
@@ -239,10 +226,11 @@ Polaris:
   text-ID mode plus a fresh schema in UUID-ID mode. Both the built check and the
   pinned `podman-compose` configuration validation pass.
 - Mathesar is removed from `traceability-data-model`; the development stack now
-  owns only PostgreSQL plus the explicit schema-reset job. The existing named
-  volume and its historical local role are preserved to avoid stranding data.
-  `just reset`, `just dev`, the PostGIS fixture query, Compose validation, and
-  the flake check pass after the simplification.
+  owns only PostgreSQL plus the explicit schema-reset job. The active named
+  volume and its historical local role are preserved to avoid stranding data;
+  the obsolete `mathesar_django` database and orphaned secrets volume were
+  explicitly approved and deleted. `just reset`, `just dev`, the PostGIS
+  fixture query, Compose validation, and the flake check pass.
 - `yookr-dashboard-new` now has the same minimal project contract: a
   non-mutating flake shell, `just dev` over its existing Process Compose graph,
   `just check`, factual `AGENTS.md` and README guidance, a flake formatter and
@@ -251,15 +239,16 @@ Polaris:
   Vite processes and stopped cleanly. The commit contains only contract files;
   the user's existing dashboard source work remains unstaged and untouched.
 - Fresh local clones of `rules-service`, `yookr-api`,
-  `traceability-data-model`, and `yookr-dashboard-new` all pass `nix flake
-  check`, expose their tracked `just` catalogs, and remain clean after entering
-  their development shells. Credential-bearing and externally blocked checks
-  remain separate gates.
-- `yookr-data-science` still lacks a committed project contract, its untracked
-  flake mutates the checkout during shell entry, and its explicit fetch pipeline
-  still targets live services. Those exact files overlap extensive uncommitted
-  user work, so a partial agent edit would be unsafe and misleading; wait for a
-  commit or deliberate handoff before changing them coherently.
+  `traceability-data-model`, `yookr-dashboard-new`, and `yookr-data-science`
+  pass their flake and project checks, expose their tracked `just` catalogs,
+  and remain clean after shell entry. Credential-bearing and externally blocked
+  checks remain separate gates.
+- `yookr-data-science` now has a non-mutating shell and explicit `just setup`,
+  `check`, `run`, and `fetch-live` boundaries. Locked local checks and the
+  archived notebook use repository-relative paths; live Yookr access remains
+  explicit and was not invoked. Stale path-bound caches were replaced through
+  the explicit setup command, local credentials are mode 0600, and a fresh
+  clone passes the full contract without shell-created files.
 - Gardenctl 2.14.0 and Gardenlogin 0.10.0 are pinned from their official release
   assets; the hashes match the existing binaries byte-for-byte. All three host
   builds pass, the OIDC kubectl plugin is declarative, and Zsh consumes the
@@ -347,13 +336,32 @@ Polaris:
 - `rclone` is installed as the only preparation for the selected S3 pilot. No
   remote, wrapper, or interactive browser is added before a real task and
   least-privileged credentials exist.
-- GitHub PR review is blocked by the invalid `kirigar` CLI token, not repository
-  state. The agent can complete the read-only review and isolated worktree gate
-  autonomously after reauthentication.
-- The live `nixos-maintainer` skill matches its Nix source and passes static
-  validation. Five ephemeral read-only behavioral checks were deliberately not
-  run because external policy requires explicit approval before another
-  authenticated Codex session receives this private repository.
+- GitHub remote state is absolutely read-only; local files, commits, fetches,
+  clones, and worktrees remain available. The generated global agent guidance
+  records this boundary. The active `jellespr` credential has broad classic
+  `repo` scope and the sampled repositories report admin access, so the boundary
+  is behavioral until it is replaced by a fine-grained read-only token.
+- The organization exposes 219 open issues and five open pull requests. Recent
+  dashboard user stories and an existing Project-to-issue-to-cross-repository-PR
+  chain show that the intended ticket workflow already has useful raw material;
+  organization Projects remain unreadable because the token lacks
+  `read:project`. Add no dashboard or wrapper before Monday usage exposes a gap.
+- The PR gate used `prediction-api#125`: native `gh pr view`, `checks`, and
+  `diff` reads work, while an isolated exact-base reconstruction passes patch,
+  whitespace, and Rust formatting checks and leaves no durable checkout. The PR
+  has no CI, review, linked issue, or concurrency/retry regression test for its
+  deadlock change; private dependency and MySQL requirements prevented a safe
+  full test. Native GitHub and Git tooling suffice without another review UI.
+- Five authorized ephemeral read-only Codex evaluations respected the no-switch
+  boundary and generally selected the right owners, but exposed that the live
+  `nixos-maintainer` file was absent from the model-visible skill catalog. Home
+  Manager now links the whole skill directory, the shape documented as supported
+  by Codex, rather than linking only `SKILL.md`. The flake and generated Home
+  Manager build pass, and an isolated Codex discovery probe returns
+  `DISCOVERED`; live confirmation awaits user activation.
+- Herdr reports the agent lifecycle correctly and preserves its pane and output
+  across detach and reattach. Its native defaults suffice; no configuration or
+  wrapper was added.
 - In zsh, never use lowercase `path` as a loop or local variable: it is tied to
   `PATH`. A diagnostic command temporarily hid normal executables by doing so;
   the declarative session environment was correct and needed no patch.

modules/capabilities/ai.nix

@@ -131,6 +131,15 @@ in
         # Context
 
         Every action must justify its context. Minimize tools and skills; prefer targeted queries and bounded output. Ask for readily available large output instead of retrieving it.
+
+        # Remote state
+
+        GitHub and all other repository remotes are strictly read-only. Fetching,
+        cloning, and reading metadata, issues, pull requests, checks, and diffs are
+        allowed. Never push or mutate remote repositories, issues, pull requests,
+        reviews, comments, labels, assignments, projects, workflows, releases,
+        settings, keys, secrets, or variables. Local files and local Git state may
+        be modified as authorized.
       '';
 
       home.file.".codex/skills/nixos-maintainer".source = ./skills/nixos-maintainer;