docs: inventory workflow credentials

docs/plans/credential-consolidation.md

@@ -0,0 +1,86 @@
+# Yookr credential consolidation
+
+This inventory contains names and provenance only. It intentionally contains no
+credential values or value hashes.
+
+## Proposed authority
+
+Use one SOPS-encrypted `~/.config/yookr/credentials.yaml`, backed by the existing
+mode-0600 user age identity. SOPS 3.13.3 and the identity are already present,
+and an encrypt/decrypt round trip passed on 2026-09-06.
+
+Keep the document hierarchical so operators can inspect and edit everything in
+one place while callers extract only their own scalar values or subtree. Do not
+load the complete document into every repository environment. Public endpoints,
+queue names, bucket names, and other non-secret configuration remain with their
+normal owners.
+
+Candidate top-level groups:
+
+- `company-login`
+- `databases`
+- `leafcloud`
+- `rabbitmq`
+- `service-accounts`
+- `third-party`
+- `archive`
+
+Do not migrate or remove source values until the user approves this authority.
+After approval, migrate active credentials first, verify each consumer, then
+handle archived credentials and delete redundant plaintext only with explicit
+approval.
+
+## Active sources
+
+- `~/dev/work/yookr-dashboard/backend/.env`: MySQL, MongoDB, Leafcloud S3, and
+  logger credentials.
+- `~/dev/work/yookr-dashboard/front-end/.env`: `VITE_BASE_TOKEN` is referenced by
+  frontend source and is therefore client-visible, not a protectable secret.
+- `~/dev/work/yookr-data-science/.env`: WeatherAPI key.
+- `~/rabbitmq-creds-test`: test RabbitMQ username and password.
+- `~/db-creds`: MySQL test/live and MongoDB test/live material.
+- `~/dev/work/yookr-api/http-client.private.env.json`: company email and
+  password used for API logins.
+- `~/.local/share/db_ui/connections.json`: existing `traceability` connection.
+
+All credential-bearing active files above are mode 0600 after the audit.
+
+## Archived credential sources
+
+- Service login: `inteerlijn`, `water-need`, `temperature-relay-dendron`, and
+  `prediction_mildew_rust`.
+- Rules service: RabbitMQ and database credentials in `rules-service-hex`.
+- Legacy management: database, logger, and local-login credentials.
+- Legacy data science and soil-moisture tools: company login credentials.
+- `salemans`: CMI credentials.
+
+These files are now mode 0600. Preserve their provenance under `archive` until
+the user decides whether each credential is still valid; stale credentials
+should be revoked instead of retained indefinitely.
+
+## Excluded from migration
+
+- Tracked `.env.example` files and public URL-only frontend environments.
+- Tracked Apache Superset/Hive development defaults.
+- Empty placeholders, queue names, ports, bucket names, and service URLs.
+- NixOS SOPS secrets and personal Vaultwarden entries, which already have their
+  own authorities.
+
+## Observed services
+
+The scan identified Yookr measurement, authentication, management, aggregation,
+rules, prediction, dashboard, and data-science workflows plus MySQL, MongoDB,
+RabbitMQ, Leafcloud S3, logger, SMTP, Vonage, TTN, WeatherAPI, CMI, Superset, and
+Hive integrations. Presence in an archive does not establish that a service or
+credential is still active.
+
+## Immediate findings
+
+- The discovered dashboard S3 credential can list eight Leafcloud containers but
+  cannot see `irristaud`; a credential from the `irristaud` project is required.
+- The generated Yookr OpenAPI document remains malformed, but direct requests use
+  the reviewed local contract and work independently.
+- Management accepts an account-issued JWT only as the raw `Authorization` value,
+  contrary to its current OpenAPI Bearer declaration.
+- Herdr issue 197 is suitable for a local planning pilot, but the current Codex
+  session is not running inside Herdr and must not control it.

docs/plans/workflow-system.md

@@ -46,7 +46,7 @@ restarted Kitty and closed the user's terminal session.
   successfully. The labeled RabbitMQ test/live bookmarks are present, and the
   invocation-scoped test overview and queue listing passed. Test API login,
   Yookr administrator read, rules read, aggregation login, and management health
-  passed; the Yookr token is not accepted by management's authenticated API.
+  passed. Account login plus a raw-token management user read also passed.
 
 ## Active pilot gates
 
@@ -61,7 +61,8 @@ These gates do not block work on each other.
   concrete cross-system investigation gives it durable value.
 - Keep Bruno, DBeaver, and PIM clients until their separate pilots decide them.
 - Wait for a real Monday ticket before adding anything beyond native GitHub,
-  Herdr, Git, and worktree workflows.
+  Herdr, Git, and worktree workflows. Issue 197 is selected, but this Codex
+  session is outside Herdr and cannot safely control the pilot.
 
 The Herdr pilot passes only when short, long, and approval-blocked sessions have
 accurate attention state; detach and reattach preserve output; one Claude or Pi
@@ -148,6 +149,9 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
 - The fine-grained GitHub token and Context7 key stay in mode-0600 machine-local
   files and are exposed only to their callers. Secrets do not enter Nix or broad
   process environments.
+- The value-free credential audit and proposed central SOPS authority are in
+  [`credential-consolidation.md`](credential-consolidation.md). Do not migrate
+  plaintext sources until the user accepts the authority and migration order.
 - `sync/notes` is the single notebook owner. Daily notes, meetings, and raw
   transcripts have separate paths, and agents do not create issues or ingest
   transcripts automatically.
@@ -168,7 +172,7 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
 
 ## Next step
 
-Obtain the four database connection URIs, Leafcloud `irristaud` project S3
-credentials, a management API token, and one real Monday ticket. Then complete
-the database/S3 access checks and the real workbench and Herdr pilots without
-mutating company GitHub.
+Agree on the proposed central SOPS credential authority, obtain Leafcloud S3
+credentials from the `irristaud` project, and resume issue 197 from a Codex
+session launched inside Herdr. Then complete database/S3 access checks and the
+real workbench and Herdr pilots without mutating company GitHub.