feat: advance database and Herdr pilots

docs/plans/credential-consolidation.md

@@ -71,15 +71,19 @@ indefinitely.
 - `yookr-workbench` decrypts once in memory and exports only its API login, four
   database connections, Irristaud S3 credential, and test RabbitMQ credential.
 - Central test API login and the read-only RabbitMQ overview passed.
-- MySQL test/live `SELECT 1` and MongoDB test/live `ping` passed. The MongoDB
-  endpoints publish SRV rather than direct address records and therefore use
-  `mongodb+srv` URLs.
+- MariaDB test/live example queries and MongoDB test/live example scripts passed.
+  Both MariaDB sessions negotiated TLS 1.3. The routers expose auto-generated
+  certificates from unavailable private CAs without valid host identities, so
+  only these two URLs disable certificate verification. The MongoDB endpoints
+  publish SRV rather than direct address records and therefore use `mongodb+srv`
+  URLs.
 - The ephemeral `irristaud:` rclone remote found the sole `irristaud` container
   and listed its six root entries. No object content was downloaded and no
   rclone configuration was persisted.
 
-Dadbod's four display names require activation of the pending Neovim
-configuration and explicit authorization of the changed workbench `.envrc`.
+Dadbod's four display names are active and both MongoDB connections work. The
+changed workbench `.envrc` still needs explicit re-authorization before the user
+visually confirms the MariaDB fix.
 
 ## Excluded from migration
 
@@ -105,5 +109,6 @@ credential is still active.
   the reviewed local contract and work independently.
 - Management accepts an account-issued JWT only as the raw `Authorization` value,
   contrary to its current OpenAPI Bearer declaration.
-- Herdr issue 197 is suitable for a local planning pilot, but the current Codex
-  session is not running inside Herdr and must not control it.
+- The Herdr issue 197 pilot produced local-only frontend and backend planning
+  commits without touching company GitHub. Both identify the separate account
+  service, not `yookr-dashboard`, as the implementation owner.

docs/plans/workflow-system.md

@@ -50,30 +50,38 @@ restarted Kitty and closed the user's terminal session.
   The approved user-key SOPS authority now contains active credentials and ten
   provenance-preserving archive namespaces. Its workbench exports passed a test
   API login, RabbitMQ overview, MySQL test/live `SELECT 1`, MongoDB test/live
-  `ping`, and read-only Irristaud object-storage listing.
+  `ping`, and read-only Irristaud object-storage listing. Dadbod exposes all four
+  names and the MongoDB connections work. Both MariaDB connections now use the
+  native client with narrowly scoped certificate-verification exceptions; their
+  exact example queries passed over TLS 1.3 in both environments. Direct test
+  login and authenticated reads still return HTTP 200 for Yookr, rules, and
+  management.
+- Herdr ran the issue 197 planning pilot in two predictable, non-overlapping
+  dashboard worktrees. Codex produced frontend commit `20f9d0f`; Claude produced
+  backend commit `bd965ea`. Short, long, done, fallback-agent, and genuinely
+  approval-blocked states behaved correctly, and dirty worktree removal was
+  refused. Nothing reached company GitHub. Both plans found that password reset
+  belongs to the separate account service rather than `yookr-dashboard`.
 
 ## Active pilot gates
 
 These gates do not block work on each other.
 
-- Activate the pending Neovim configuration, explicitly authorize the changed
-  workbench `.envrc`, and confirm Dadbod shows the four centralized test/live
-  connections. Create a Marimo-to-HTML report only when a concrete cross-system
-  investigation gives it durable value.
+- Explicitly authorize the changed workbench `.envrc`, restart Neovim, and
+  visually confirm the MariaDB examples and Kulala response chaining. Create a
+  Marimo-to-HTML report only when a concrete cross-system investigation gives it
+  durable value.
 - Keep Bruno, DBeaver, and PIM clients until their separate pilots decide them.
-- Wait for a real Monday ticket before adding anything beyond native GitHub,
-  Herdr, Git, and worktree workflows. Issue 197 is selected, but this Codex
-  session is outside Herdr and cannot safely control the pilot.
+- Route issue 197 to the actual account repositories before implementation;
+  leave the two local dashboard planning branches available as evidence.
 
-The Herdr pilot passes only when short, long, and approval-blocked sessions have
-accurate attention state; detach and reattach preserve output; one Claude or Pi
-fallback works; and each completed event produces exactly one notification.
-Create two independently writing, non-overlapping task worktrees under
-`~/dev/work/.worktrees/<repository>/<branch-slug>`, explicitly authorize each
-`.envrc`, and confirm paths are predictable, dirty removal is refused, and the
-branches remain for review. If a component fails, fall back independently to
-native agent sessions and Codex TUI notifications or native
-`git worktree add/list/remove`; do not add a wrapper or Worktrunk yet.
+The remaining Herdr observations are that detach and reattach preserve output,
+each completed event produces exactly one notification, and both worktree
+`.envrc` files receive explicit authorization. Short, long, approval-blocked,
+fallback-agent, predictable-path, non-overlapping-write, dirty-removal, and
+branch-retention behavior already passed. If a remaining component fails, fall
+back independently to native agent sessions and Codex TUI notifications or
+native `git worktree add/list/remove`; do not add a wrapper or Worktrunk yet.
 
 ## Deferred pilots
 
@@ -134,7 +142,10 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
   tools wait for observed needs. Its one API environment catalogue covers the
   Yookr, rules, aggregation, and management APIs; Kulala owns requests and
   Dadbod receives the four named database connections from the workbench's
-  SOPS-derived environment.
+  SOPS-derived environment. The two MariaDB routers expose auto-generated
+  private-CA certificates without a valid host identity, so only those URLs
+  disable certificate verification while retaining TLS; restore verification
+  when infrastructure provides usable CA and host certificates.
 - The reviewed `yookr-api/openapi.yaml` remains the usable local contract. The
   deployed generated document's dangling `ReadParameters` reference is accepted
   for now and does not block direct API requests.
@@ -175,7 +186,7 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
 
 ## Next step
 
-Activate the pending Neovim change, authorize the changed workbench `.envrc`,
-and confirm the four Dadbod names. Resume issue 197 from a Codex session launched
-inside Herdr, then complete one real cross-system investigation and the Herdr
-pilot without mutating company GitHub.
+Activate the pending Neovim JavaScript-query mapping, authorize the changed
+workbench and pilot-worktree `.envrc` files, and confirm the two MariaDB examples
+inside Dadbod. Then confirm Herdr notifications and detach/reattach persistence,
+and run one real cross-system investigation without mutating company GitHub.

docs/workflow-discovery.md

@@ -162,14 +162,19 @@ and build configurations, then provide an activation command.
 
 ## Remaining pilots
 
-- Activate and visually confirm the workbench's four SOPS-derived Dadbod
-  connections. Add a Marimo report only for a real cross-system investigation.
+- Authorize the changed workbench `.envrc` and visually confirm its two MariaDB
+  examples. The four SOPS-derived Dadbod connections, both MongoDB connections,
+  and all four read-only example-query runs already passed. Add a Marimo report
+  only for a real cross-system investigation.
 - Add another ephemeral read-only rclone remote only when credentials for a new
   Leafcloud project become available. Irristaud listing has passed; do not upload.
 - Use the reviewed local Yookr OpenAPI contract while the accepted malformed
   generated test document remains deployed.
-- Run the complete Herdr notification, fallback-agent, and safe worktree pilot
-  with a real Monday ticket.
+- Finish only the notification, detach/reattach, and per-worktree direnv
+  observations for the Herdr pilot. Its Codex/Claude fallback, attention states,
+  local branches, parallel non-overlapping plans, and dirty-removal guard passed
+  with issue 197; the plans show that implementation belongs outside the
+  dashboard repository.
 - Keep Bruno, DBeaver, and existing PIM clients until their independent gates are
   resolved.