docs: inventory workflow credentials

docs/plans/workflow-system.md

@@ -46,7 +46,7 @@ restarted Kitty and closed the user's terminal session.
   successfully. The labeled RabbitMQ test/live bookmarks are present, and the
   invocation-scoped test overview and queue listing passed. Test API login,
   Yookr administrator read, rules read, aggregation login, and management health
-  passed; the Yookr token is not accepted by management's authenticated API.
+  passed. Account login plus a raw-token management user read also passed.
 
 ## Active pilot gates
 
@@ -61,7 +61,8 @@ These gates do not block work on each other.
   concrete cross-system investigation gives it durable value.
 - Keep Bruno, DBeaver, and PIM clients until their separate pilots decide them.
 - Wait for a real Monday ticket before adding anything beyond native GitHub,
-  Herdr, Git, and worktree workflows.
+  Herdr, Git, and worktree workflows. Issue 197 is selected, but this Codex
+  session is outside Herdr and cannot safely control the pilot.
 
 The Herdr pilot passes only when short, long, and approval-blocked sessions have
 accurate attention state; detach and reattach preserve output; one Claude or Pi
@@ -148,6 +149,9 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
 - The fine-grained GitHub token and Context7 key stay in mode-0600 machine-local
   files and are exposed only to their callers. Secrets do not enter Nix or broad
   process environments.
+- The value-free credential audit and proposed central SOPS authority are in
+  [`credential-consolidation.md`](credential-consolidation.md). Do not migrate
+  plaintext sources until the user accepts the authority and migration order.
 - `sync/notes` is the single notebook owner. Daily notes, meetings, and raw
   transcripts have separate paths, and agents do not create issues or ingest
   transcripts automatically.
@@ -168,7 +172,7 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work.
 
 ## Next step
 
-Obtain the four database connection URIs, Leafcloud `irristaud` project S3
-credentials, a management API token, and one real Monday ticket. Then complete
-the database/S3 access checks and the real workbench and Herdr pilots without
-mutating company GitHub.
+Agree on the proposed central SOPS credential authority, obtain Leafcloud S3
+credentials from the `irristaud` project, and resume issue 197 from a Codex
+session launched inside Herdr. Then complete database/S3 access checks and the
+real workbench and Herdr pilots without mutating company GitHub.