docs: close invocation credential gate
This commit is contained in:
kiri committed
1 parent
89675c5f16
commit
bd2648a8d3
1 file changed
+20
-20
@@ -30,8 +30,8 @@ not make it the global next step while another pilot can still progress.
|
||||
## Current checkpoint
|
||||
|
||||
- Tranche: autonomous consolidation across repositories, tools, and pilots
|
||||
- State: autonomous implementation exhausted; one activation and external or
|
||||
real-use gates await the user
|
||||
- State: autonomous implementation exhausted; external and real-use gates await
|
||||
their inputs
|
||||
- Branch: `chore/workflow-system`
|
||||
- Baseline: `nix flake check --no-build --quiet` and a no-link Zenith system
|
||||
build passed on 2026-09-06 after the invocation-scoped credential changes;
|
||||
@@ -63,22 +63,24 @@ not make it the global next step while another pilot can still progress.
|
||||
Actions, and organization Project reads with no stored fallback credential.
|
||||
The user activated its loader and confirmed a new shell can list organization
|
||||
Projects; the skill directory and durable remote boundary are also live. The
|
||||
new read-only wrapper fetches all private Cargo dependencies from inside a
|
||||
cached dev shell, and the complete yookr-api contract passes.
|
||||
- Next: rotate the exposed Context7 key, create its machine-local file, and
|
||||
activate the invocation-scoped GitHub and Context7 owners once. Then use the
|
||||
first real Monday ticket to test the native Project-to-issue-to-local-branch
|
||||
workflow and continue the remaining external pilots as inputs arrive.
|
||||
activated read-only wrapper leaves `GH_TOKEN` out of cached dev shells while
|
||||
`gh` identifies the work account and Git reads a private Cargo dependency;
|
||||
the complete yookr-api contract passes. The replacement Context7 key is
|
||||
mode 0600, the exposed key is revoked, and a live resolve-and-query round trip
|
||||
passes through the activated runtime header helper.
|
||||
- Next: use the first real Monday ticket to test the native
|
||||
Project-to-issue-to-local-branch workflow and continue the remaining external
|
||||
pilots as inputs arrive.
|
||||
|
||||
## Progress
|
||||
|
||||
| Batch | State | Evidence or blocker |
|
||||
| --- | --- | --- |
|
||||
| Bootstrap and repository ownership | Waiting for user | Repository reconciliation and local plaintext credential cleanup are complete; Context7 rotation remains |
|
||||
| Bootstrap and repository ownership | Complete | Repository reconciliation, local plaintext credential cleanup, and Context7 rotation pass |
|
||||
| Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
|
||||
| Repository contracts and workbench | Waiting externally | Five clean-checkout contracts, the full yookr-api check, and read-only Kubernetes pass; API user credentials, database, report, and S3 inputs remain externally gated |
|
||||
| Desktop navigation and interaction | Active | Walker project and terminal actions plus stable Actual/WhatsApp launchers work; Outlook and two-output checks remain |
|
||||
| Agent workflow | Waiting for user | Herdr, read-only PR review, the corrected skill owner, durable remote boundary, fine-grained credential, and organization Projects pass; the invocation-scoped owners await one activation and a real Monday ticket remains external |
|
||||
| Agent workflow | Waiting externally | Herdr, read-only PR review, the corrected skill owner, durable remote boundary, invocation-scoped credentials, and organization Projects pass; a real Monday ticket remains external |
|
||||
| Notes | Complete | The daily launcher and migrated notebook pass live checks; the approved rollback copy is recoverable from Trash |
|
||||
| PIM | Active | Native NixOS Evolution 3.60.2 plus Microsoft 365 integration is live beside Thunderbird; account and daily-use gates await credentials |
|
||||
| Transcription | Pending | Requires a real Fossify recording-transfer pilot before implementation moves from Zenith to Orion |
|
||||
@@ -141,11 +143,6 @@ step to the user only when it blocks the current task.
|
||||
- Make one Fossify recording on the Pixel and let Syncthing transfer it. Do not
|
||||
rename or move it manually; the agent must first observe the real write and
|
||||
settlement behavior before implementing Orion automation.
|
||||
- Generate a replacement Context7 API key, save it without a trailing newline
|
||||
as `~/.config/context7/api-key` with mode 0600, and revoke the old exposed
|
||||
key. Then activate the latest Zenith build with
|
||||
`cd ~/.config/nixos && nh os switch` and restart Codex. Only the user may
|
||||
perform the activation.
|
||||
- Supply one real Yookr S3 task plus a least-privileged remote and authorize one
|
||||
bounded upload. `rclone` is prepared, but no remote or wrapper is guessed.
|
||||
- Deploy a GET image that exposes `/full-api-docs/openapi.json`, then rerun
|
||||
@@ -385,16 +382,19 @@ Polaris:
|
||||
generated global `AGENTS.md` contained the strict remote-state policy, and
|
||||
the user confirmed `gh project list --owner yookrdev` succeeds. A cached
|
||||
nix-direnv shell then proved it strips inherited `GH_TOKEN`; this concrete gap
|
||||
prompted the invocation-scoped wrapper above, which passes an isolated dev
|
||||
shell API query and the full private-dependency build before activation.
|
||||
prompted the invocation-scoped wrapper above. After activation, a cached dev
|
||||
shell contains no `GH_TOKEN`, while `gh api user` identifies `jellespr` and
|
||||
Git reads the private `constant-store` remote through the wrapper-backed
|
||||
credential helper.
|
||||
- The former Context7 declaration put a literal key in
|
||||
`env_http_headers`, whose values Codex interprets as environment-variable
|
||||
names; it therefore exposed the secret without supplying the documented
|
||||
authentication. The static key is absent from the current worktree. Official
|
||||
Codex configuration and Context7 documentation instead support the built
|
||||
`http_headers_helper`, which emits the required `Authorization: Bearer` header
|
||||
and passes an isolated fake-key JSON test. The historical key still requires
|
||||
revocation.
|
||||
`http_headers_helper`, which emits the required `Authorization: Bearer` header.
|
||||
The user replaced and revoked the historical key, the machine-local file is
|
||||
mode 0600, and a restarted Codex session successfully resolves Nixpkgs and
|
||||
queries its documentation through Context7.
|
||||
- The PR gate used `prediction-api#125`: native `gh pr view`, `checks`, and
|
||||
`diff` reads work, while an isolated exact-base reconstruction passes patch,
|
||||
whitespace, and Rust formatting checks and leaves no durable checkout. The PR
|
||||
|
||||
Reference in new issue
Block a user