diff --git a/docs/plans/credential-consolidation.md b/docs/plans/credential-consolidation.md index 6eccf18..e67ddcd 100644 --- a/docs/plans/credential-consolidation.md +++ b/docs/plans/credential-consolidation.md @@ -71,15 +71,19 @@ indefinitely. - `yookr-workbench` decrypts once in memory and exports only its API login, four database connections, Irristaud S3 credential, and test RabbitMQ credential. - Central test API login and the read-only RabbitMQ overview passed. -- MySQL test/live `SELECT 1` and MongoDB test/live `ping` passed. The MongoDB - endpoints publish SRV rather than direct address records and therefore use - `mongodb+srv` URLs. +- MariaDB test/live example queries and MongoDB test/live example scripts passed. + Both MariaDB sessions negotiated TLS 1.3. The routers expose auto-generated + certificates from unavailable private CAs without valid host identities, so + only these two URLs disable certificate verification. The MongoDB endpoints + publish SRV rather than direct address records and therefore use `mongodb+srv` + URLs. - The ephemeral `irristaud:` rclone remote found the sole `irristaud` container and listed its six root entries. No object content was downloaded and no rclone configuration was persisted. -Dadbod's four display names require activation of the pending Neovim -configuration and explicit authorization of the changed workbench `.envrc`. +Dadbod's four display names are active and both MongoDB connections work. The +changed workbench `.envrc` still needs explicit re-authorization before the user +visually confirms the MariaDB fix. ## Excluded from migration @@ -105,5 +109,6 @@ credential is still active. the reviewed local contract and work independently. - Management accepts an account-issued JWT only as the raw `Authorization` value, contrary to its current OpenAPI Bearer declaration. -- Herdr issue 197 is suitable for a local planning pilot, but the current Codex - session is not running inside Herdr and must not control it. +- The Herdr issue 197 pilot produced local-only frontend and backend planning + commits without touching company GitHub. Both identify the separate account + service, not `yookr-dashboard`, as the implementation owner. diff --git a/docs/plans/workflow-system.md b/docs/plans/workflow-system.md index a577627..5a26b42 100644 --- a/docs/plans/workflow-system.md +++ b/docs/plans/workflow-system.md @@ -50,30 +50,38 @@ restarted Kitty and closed the user's terminal session. The approved user-key SOPS authority now contains active credentials and ten provenance-preserving archive namespaces. Its workbench exports passed a test API login, RabbitMQ overview, MySQL test/live `SELECT 1`, MongoDB test/live - `ping`, and read-only Irristaud object-storage listing. + `ping`, and read-only Irristaud object-storage listing. Dadbod exposes all four + names and the MongoDB connections work. Both MariaDB connections now use the + native client with narrowly scoped certificate-verification exceptions; their + exact example queries passed over TLS 1.3 in both environments. Direct test + login and authenticated reads still return HTTP 200 for Yookr, rules, and + management. +- Herdr ran the issue 197 planning pilot in two predictable, non-overlapping + dashboard worktrees. Codex produced frontend commit `20f9d0f`; Claude produced + backend commit `bd965ea`. Short, long, done, fallback-agent, and genuinely + approval-blocked states behaved correctly, and dirty worktree removal was + refused. Nothing reached company GitHub. Both plans found that password reset + belongs to the separate account service rather than `yookr-dashboard`. ## Active pilot gates These gates do not block work on each other. -- Activate the pending Neovim configuration, explicitly authorize the changed - workbench `.envrc`, and confirm Dadbod shows the four centralized test/live - connections. Create a Marimo-to-HTML report only when a concrete cross-system - investigation gives it durable value. +- Explicitly authorize the changed workbench `.envrc`, restart Neovim, and + visually confirm the MariaDB examples and Kulala response chaining. Create a + Marimo-to-HTML report only when a concrete cross-system investigation gives it + durable value. - Keep Bruno, DBeaver, and PIM clients until their separate pilots decide them. -- Wait for a real Monday ticket before adding anything beyond native GitHub, - Herdr, Git, and worktree workflows. Issue 197 is selected, but this Codex - session is outside Herdr and cannot safely control the pilot. +- Route issue 197 to the actual account repositories before implementation; + leave the two local dashboard planning branches available as evidence. -The Herdr pilot passes only when short, long, and approval-blocked sessions have -accurate attention state; detach and reattach preserve output; one Claude or Pi -fallback works; and each completed event produces exactly one notification. -Create two independently writing, non-overlapping task worktrees under -`~/dev/work/.worktrees//`, explicitly authorize each -`.envrc`, and confirm paths are predictable, dirty removal is refused, and the -branches remain for review. If a component fails, fall back independently to -native agent sessions and Codex TUI notifications or native -`git worktree add/list/remove`; do not add a wrapper or Worktrunk yet. +The remaining Herdr observations are that detach and reattach preserve output, +each completed event produces exactly one notification, and both worktree +`.envrc` files receive explicit authorization. Short, long, approval-blocked, +fallback-agent, predictable-path, non-overlapping-write, dirty-removal, and +branch-retention behavior already passed. If a remaining component fails, fall +back independently to native agent sessions and Codex TUI notifications or +native `git worktree add/list/remove`; do not add a wrapper or Worktrunk yet. ## Deferred pilots @@ -134,7 +142,10 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work. tools wait for observed needs. Its one API environment catalogue covers the Yookr, rules, aggregation, and management APIs; Kulala owns requests and Dadbod receives the four named database connections from the workbench's - SOPS-derived environment. + SOPS-derived environment. The two MariaDB routers expose auto-generated + private-CA certificates without a valid host identity, so only those URLs + disable certificate verification while retaining TLS; restore verification + when infrastructure provides usable CA and host certificates. - The reviewed `yookr-api/openapi.yaml` remains the usable local contract. The deployed generated document's dangling `ReadParameters` reference is accepted for now and does not block direct API requests. @@ -175,7 +186,7 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work. ## Next step -Activate the pending Neovim change, authorize the changed workbench `.envrc`, -and confirm the four Dadbod names. Resume issue 197 from a Codex session launched -inside Herdr, then complete one real cross-system investigation and the Herdr -pilot without mutating company GitHub. +Activate the pending Neovim JavaScript-query mapping, authorize the changed +workbench and pilot-worktree `.envrc` files, and confirm the two MariaDB examples +inside Dadbod. Then confirm Herdr notifications and detach/reattach persistence, +and run one real cross-system investigation without mutating company GitHub. diff --git a/docs/workflow-discovery.md b/docs/workflow-discovery.md index fd75cf3..1674286 100644 --- a/docs/workflow-discovery.md +++ b/docs/workflow-discovery.md @@ -162,14 +162,19 @@ and build configurations, then provide an activation command. ## Remaining pilots -- Activate and visually confirm the workbench's four SOPS-derived Dadbod - connections. Add a Marimo report only for a real cross-system investigation. +- Authorize the changed workbench `.envrc` and visually confirm its two MariaDB + examples. The four SOPS-derived Dadbod connections, both MongoDB connections, + and all four read-only example-query runs already passed. Add a Marimo report + only for a real cross-system investigation. - Add another ephemeral read-only rclone remote only when credentials for a new Leafcloud project become available. Irristaud listing has passed; do not upload. - Use the reviewed local Yookr OpenAPI contract while the accepted malformed generated test document remains deployed. -- Run the complete Herdr notification, fallback-agent, and safe worktree pilot - with a real Monday ticket. +- Finish only the notification, detach/reattach, and per-worktree direnv + observations for the Herdr pilot. Its Codex/Claude fallback, attention states, + local branches, parallel non-overlapping plans, and dirty-removal guard passed + with issue 197; the plans show that implementation belongs outside the + dashboard repository. - Keep Bruno, DBeaver, and existing PIM clients until their independent gates are resolved. diff --git a/modules/capabilities/neovim/lua-config/lua/plugins/database.lua b/modules/capabilities/neovim/lua-config/lua/plugins/database.lua index 5cf4c29..a0939cd 100644 --- a/modules/capabilities/neovim/lua-config/lua/plugins/database.lua +++ b/modules/capabilities/neovim/lua-config/lua/plugins/database.lua @@ -6,36 +6,37 @@ local commands = { "DBUIRenameBuffer", "DBUILastQueryInfo", } -local filetypes = { "sql", "mysql", "plsql" } +local sql_filetypes = { "sql", "mysql", "plsql" } +local query_filetypes = { "sql", "mysql", "plsql", "javascript" } require("lz.n").load({ { "vim-dadbod" }, - { "vim-dadbod-completion", ft = filetypes }, + { "vim-dadbod-completion", ft = sql_filetypes }, { "vim-dadbod-ui", cmd = commands, - ft = filetypes, + ft = query_filetypes, keys = { { "qo", "DBUIToggle", desc = "Toggle database workspace" }, { "r", "(DBUI_ExecuteQuery)", mode = { "n", "x" }, - ft = filetypes, + ft = query_filetypes, remap = true, desc = "Execute database query", }, { "s", "(DBUI_SaveQuery)", - ft = filetypes, + ft = query_filetypes, remap = true, desc = "Save database query", }, { "p", "(DBUI_EditBindParameters)", - ft = filetypes, + ft = query_filetypes, remap = true, desc = "Edit query parameters", },