record dashboard reconciliation

docs/plans/workflow-system.md

@@ -9,18 +9,18 @@ and add no abstraction without a demonstrated repeated need.
 ## Current checkpoint
 
 - Tranche: bootstrap and repository ownership reconciliation
-- State: active
+- State: waiting for user credential handling
 - Branch: `chore/workflow-system`
 - Baseline: `nix flake check --no-build --quiet` passed on 2026-09-05; only
   the existing dirty-tree and unknown `modules` output warnings were emitted.
-- Next: resolve the dashboard converter and private-state decisions, then
-  finish machine-local cleanup and close the ownership tranche.
+- Next: relocate the legacy secret, rotate the Context7 key, remove the
+  resulting empty legacy directories, and close the ownership tranche.
 
 ## Progress
 
 | Batch | State | Evidence or blocker |
 | --- | --- | --- |
-| Bootstrap and repository ownership | Active | Repositories moved intact; dashboard and machine-local cleanup decisions remain |
+| Bootstrap and repository ownership | Waiting for user | Repository and dashboard reconciliation complete; credential cleanup remains |
 | Declarative workstation foundation | Pending | Depends on canonical paths |
 | Repository contracts and workbench | Pending | Depends on repository reconciliation |
 | Desktop, agents, notes, PIM, transcription | Pending | Independent pilots follow foundation changes |
@@ -31,12 +31,10 @@ and add no abstraction without a demonstrated repeated need.
 | Repository | Branch | Commit | Purpose |
 | --- | --- | --- | --- |
 | NixOS configuration | `chore/workflow-system` | `41bc61b` | Discovery, paths, Git identity, and Codex defaults |
+| `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
 
 ## Human actions
 
-- Decide whether the one-time legacy dashboard BSON migration is still needed.
-- Confirm whether the authoritative dashboard copy's `.env` and `.data` should
-  supersede the divergent private state in the sync copy.
 - Rotate the exposed Context7 key and provide `CONTEXT7_API_KEY` through a
   mode-0600 machine-local environment file on each workstation before removing
   the static user-config header.
@@ -50,16 +48,17 @@ and add no abstraction without a demonstrated repeated need.
 - Use `/home/kiri/work/repos/yookr-dashboard-new` as the reconciliation base;
   its `feat/gogv2` head is 17 commits newer than the sync copy and matches its
   remote-tracking branch.
-- Preserve the sync copy until authored changes and raw/generated data have
-  been classified. Do not commit its database dump.
+- The user confirmed the legacy BSON migration is no longer needed and the
+  former work copy is authoritative. The sync copy was explicitly deleted;
+  its removal may propagate through Syncthing.
 - Active repositories now live under `/home/kiri/dev/work`; inactive material
   is preserved intact under `.archive`, and the registered dashboard sensor
   worktree is under `.worktrees`.
-- The sync dashboard's staged application changes are superseded. Its unique
-  `convert_dashboards.py` is still referenced, but absent, in the authoritative
-  flake. Its exports, `.env`, and MongoDB state remain untouched and private.
-- The obsolete `feat/echarts-domain` worktree path is absent; its branch remains
-  and its prunable metadata has not been removed.
+- Removed the obsolete dashboard converter app and Python dependency. The
+  dashboard flake evaluates, while the pre-existing feature work remains
+  uncommitted and unstaged.
+- Pruned the absent `feat/echarts-domain` worktree metadata; its branch and
+  commit remain. The registered sensor worktree is valid at its new path.
 - Shared Codex defaults and MCP endpoints are generated at
   `/etc/codex/config.toml`; Context7 reads its header from the environment. The
   unused generic `~/.config/mcp/mcp.json` owner is removed on next activation.