feat: advance database and Herdr pilots

docs/plans/workflow-system.md

@@ -50,30 +50,38 @@ restarted Kitty and closed the user's terminal session.
   The approved user-key SOPS authority now contains active credentials and ten
   provenance-preserving archive namespaces. Its workbench exports passed a test
   API login, RabbitMQ overview, MySQL test/live `SELECT 1`, MongoDB test/live
-  `ping`, and read-only Irristaud object-storage listing.
+  `ping`, and read-only Irristaud object-storage listing. Dadbod exposes all four
+  names and the MongoDB connections work. Both MariaDB connections now use the
+  native client with narrowly scoped certificate-verification exceptions; their
+  exact example queries passed over TLS 1.3 in both environments. Direct test
+  login and authenticated reads still return HTTP 200 for Yookr, rules, and
+  management.
+- Herdr ran the issue 197 planning pilot in two predictable, non-overlapping
+  dashboard worktrees. Codex produced frontend commit `20f9d0f`; Claude produced
+  backend commit `bd965ea`. Short, long, done, fallback-agent, and genuinely
+  approval-blocked states behaved correctly, and dirty worktree removal was
+  refused. Nothing reached company GitHub. Both plans found that password reset
+  belongs to the separate account service rather than `yookr-dashboard`.
 
 ## Active pilot gates
 
 These gates do not block work on each other.
 
-- Activate the pending Neovim configuration, explicitly authorize the changed
-  workbench `.envrc`, and confirm Dadbod shows the four centralized test/live
-  connections. Create a Marimo-to-HTML report only when a concrete cross-system
-  investigation gives it durable value.
+- Explicitly authorize the changed workbench `.envrc`, restart Neovim, and
+  visually confirm the MariaDB examples and Kulala response chaining. Create a
+  Marimo-to-HTML report only when a concrete cross-system investigation gives it
+  durable value.
 - Keep Bruno, DBeaver, and PIM clients until their separate pilots decide them.
-- Wait for a real Monday ticket before adding anything beyond native GitHub,
-  Herdr, Git, and worktree workflows. Issue 197 is selected, but this Codex
-  session is outside Herdr and cannot safely control the pilot.
+- Route issue 197 to the actual account repositories before implementation;
+  leave the two local dashboard planning branches available as evidence.
 
-The Herdr pilot passes only when short, long, and approval-blocked sessions have
-accurate attention state; detach and reattach preserve output; one Claude or Pi
-fallback works; and each completed event produces exactly one notification.
-Create two independently writing, non-overlapping task worktrees under
-`~/dev/work/.worktrees/<repository>/<branch-slug>`, explicitly authorize each
-`.envrc`, and confirm paths are predictable, dirty removal is refused, and the
-branches remain for review. If a component fails, fall back independently to
-native agent sessions and Codex TUI notifications or native
-`git worktree add/list/remove`; do not add a wrapper or Worktrunk yet.
+The remaining Herdr observations are that detach and reattach preserve output,
+each completed event produces exactly one notification, and both worktree
+`.envrc` files receive explicit authorization. Short, long, approval-blocked,
+fallback-agent, predictable-path, non-overlapping-write, dirty-removal, and
+branch-retention behavior already passed. If a remaining component fails, fall
+back independently to native agent sessions and Codex TUI notifications or
+native `git worktree add/list/remove`; do not add a wrapper or Worktrunk yet.
 
 ## Deferred pilots
 
@@ -134,7 +142,10 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
   tools wait for observed needs. Its one API environment catalogue covers the
   Yookr, rules, aggregation, and management APIs; Kulala owns requests and
   Dadbod receives the four named database connections from the workbench's
-  SOPS-derived environment.
+  SOPS-derived environment. The two MariaDB routers expose auto-generated
+  private-CA certificates without a valid host identity, so only those URLs
+  disable certificate verification while retaining TLS; restore verification
+  when infrastructure provides usable CA and host certificates.
 - The reviewed `yookr-api/openapi.yaml` remains the usable local contract. The
   deployed generated document's dangling `ReadParameters` reference is accepted
   for now and does not block direct API requests.
@@ -175,7 +186,7 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
 
 ## Next step
 
-Activate the pending Neovim change, authorize the changed workbench `.envrc`,
-and confirm the four Dadbod names. Resume issue 197 from a Codex session launched
-inside Herdr, then complete one real cross-system investigation and the Herdr
-pilot without mutating company GitHub.
+Activate the pending Neovim JavaScript-query mapping, authorize the changed
+workbench and pilot-worktree `.envrc` files, and confirm the two MariaDB examples
+inside Dadbod. Then confirm Herdr notifications and detach/reattach persistence,
+and run one real cross-system investigation without mutating company GitHub.