chore: advance workstation workflow pilots
This commit is contained in:
kiri committed
1 parent
2c0338329b
commit
c9ee688537
18 files changed
+328
-553
No files matched your search
+120
-20
@@ -8,15 +8,19 @@ and add no abstraction without a demonstrated repeated need.
|
||||
|
||||
## Current checkpoint
|
||||
|
||||
- Tranche: repository contracts and Yookr workbench
|
||||
- State: active
|
||||
- Tranche: desktop, agents, and notes
|
||||
- State: waiting for Zenith activation
|
||||
- Branch: `chore/workflow-system`
|
||||
- Baseline: `nix flake check --no-build --quiet` passed on 2026-09-05; only
|
||||
the existing dirty-tree and unknown `modules` output warnings were emitted.
|
||||
- Next: activate the NetworkManager OpenVPN plugin on Zenith and Polaris, then
|
||||
import the existing profile as the root-owned `Yookr VPN` connection on each
|
||||
host and run its route, DNS, reconnect, suspend, and reboot gates. Keep
|
||||
OpenVPN 3 until both hosts pass.
|
||||
- Baseline: `nix flake check --no-build --quiet` and a no-link Zenith system
|
||||
build passed on 2026-09-05 after the desktop, agent, runtime, and note changes;
|
||||
only the expected dirty-tree and unknown `modules` warnings were emitted.
|
||||
The generated project menu finds 30 live repositories without `.archive` or
|
||||
`.worktrees` entries, and the generated daily-note configuration passes an
|
||||
isolated same-day idempotence test.
|
||||
- Next: the user runs
|
||||
`sudo nixos-rebuild switch --flake /home/kiri/.config/nixos#zenith` and reports
|
||||
whether it succeeds. Then the agent verifies live ownership before asking for
|
||||
one bounded interactive gate at a time.
|
||||
|
||||
## Progress
|
||||
|
||||
@@ -24,9 +28,13 @@ and add no abstraction without a demonstrated repeated need.
|
||||
| --- | --- | --- |
|
||||
| Bootstrap and repository ownership | Waiting for user | Repository and dashboard reconciliation complete; credential cleanup remains |
|
||||
| Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
|
||||
| Repository contracts and workbench | Active | Three contracts are checkpointed and the read-only test Kubernetes gate passed; API, database, and report evidence remain |
|
||||
| Desktop, agents, notes, PIM, transcription | Pending | Independent pilots follow foundation changes |
|
||||
| Conditional retirement and completion | Pending | Requires per-pilot evidence |
|
||||
| Repository contracts and workbench | Waiting externally | Three contracts and read-only Kubernetes pass; API deployment/access evidence is externally blocked, while database/report scaffolding is deferred until a real investigation |
|
||||
| Desktop navigation and interaction | Active | Project discovery, Niri vocabulary cleanup, and stable Actual/WhatsApp launchers build; activation, Outlook, and two-output checks remain |
|
||||
| Agent workflow | Active | The instruction-only `nixos-maintainer` skill validates and builds; the Herdr pilot remains |
|
||||
| Notes | Active | Authored work notes are copied and verified in the single notebook; daily-note configuration builds, while source retirement awaits one activated sanity check |
|
||||
| PIM | Active | Evolution 3.60.2 with its native Microsoft 365 backend builds beside Thunderbird; account and daily-use gates await activation and credentials |
|
||||
| Transcription | Pending | Requires a real Fossify recording-transfer pilot before implementation moves from Zenith to Orion |
|
||||
| Conditional retirement and completion | Active | OpenVPN 3, Zed, Helix, Foot, global Node.js, and global Bun are removed declaratively; other removals remain gated separately |
|
||||
|
||||
## Repository checkpoints
|
||||
|
||||
@@ -43,7 +51,38 @@ and add no abstraction without a demonstrated repeated need.
|
||||
| `traceability-data-model` | `chore/workflow-contract` | `33cb7ff` | Establish the database and schema contract |
|
||||
| `yookr-workbench` | `main` | `badc61c` | Create the workbench and isolate its Garden session |
|
||||
|
||||
## Human actions
|
||||
## Deferred or externally blocked actions
|
||||
|
||||
None of these block work on independent pilots. Surface the exact applicable
|
||||
step to the user only when it blocks the current task.
|
||||
|
||||
- Activate the verified Zenith generation with
|
||||
`sudo nixos-rebuild switch --flake /home/kiri/.config/nixos#zenith`. The agent
|
||||
attempted this non-interactively, but `sudo` requires the user's password.
|
||||
- After activation, open Walker with `Super+Space`, search for a repository,
|
||||
launch it, exit Neovim, and confirm the same Kitty window leaves a usable
|
||||
shell in that repository. Also launch Actual and WhatsApp once from Walker.
|
||||
- Press `Super+N`, confirm today's file opens under `sync/notes/daily` with the
|
||||
cursor at the append position, and briefly check the copied work notes and
|
||||
merged `sync/notes/todo.md`. Then tell the agent whether the old
|
||||
`sync/work/notes` rollback copy may be removed.
|
||||
- Run the bounded Pinta trial using a recent real edit: clipboard/open,
|
||||
selection, crop/resize/canvas, text/drawing/shapes, layers/transparency,
|
||||
basic adjustments, and PNG/JPEG export. Tell the agent whether it fully
|
||||
replaces GIMP; one of the two will then be removed.
|
||||
- Install Outlook from its signed-in page as a Vivaldi web app, then tell the
|
||||
agent so its generated desktop entry can be identified and replaced by a
|
||||
stable Home Manager owner.
|
||||
- During a docked Zenith session, tell the agent the external display is
|
||||
attached so its stable identity and the two-output `Super+A` pilot can be
|
||||
completed. The current session exposes only `eDP-1`.
|
||||
- After activation, launch Evolution and add accounts without removing any
|
||||
existing client or changing authority: personal and old-personal through
|
||||
their existing IMAP/SMTP service, university and work through the
|
||||
`Microsoft 365` account type, and Radicale through native CalDAV, CardDAV,
|
||||
and VTODO. Complete tenant consent/sign-in when prompted, then tell the agent
|
||||
which accounts connected; the full mail/calendar/contact/task gate remains
|
||||
a daily-use pilot rather than a one-time setup claim.
|
||||
|
||||
- Rotate the exposed Context7 key and provide `CONTEXT7_API_KEY` through a
|
||||
mode-0600 machine-local environment file on each workstation before removing
|
||||
@@ -59,16 +98,27 @@ and add no abstraction without a demonstrated repeated need.
|
||||
`just openapi-refresh test`; the current test deployment returns 404.
|
||||
- Populate the ignored API HTTP credentials and perform the planned login plus
|
||||
harmless administrator read; no credential-bearing request has been made.
|
||||
- Activate the follow-up Garden shell fix. The Nix-owned `gardenctl`,
|
||||
`gardenlogin`, and `kubectl-gardenlogin` are verified under
|
||||
`~/.nix-profile/bin`; afterward remove the duplicate mutable binaries
|
||||
- The next Zenith switch also activates the follow-up Garden shell fix. The
|
||||
Nix-owned `gardenctl`, `gardenlogin`, and `kubectl-gardenlogin` are verified
|
||||
under `~/.nix-profile/bin`; afterward remove the duplicate mutable binaries
|
||||
`~/.garden/gardenctl` and `~/.local/bin/{gardenctl,gardenlogin,kubectl-gardenlogin}`.
|
||||
- Restrict `~/sync/yookr-vpn.ovpn` to mode 0600, then import it separately on
|
||||
Zenith and Polaris as the root-owned NetworkManager connection `Yookr VPN`
|
||||
with autoconnect disabled. The profile contents have not been inspected.
|
||||
- Destructive cleanup, credentials, activation, and empirical pilot decisions
|
||||
will be surfaced here before use.
|
||||
|
||||
## Deferred Polaris replication
|
||||
|
||||
Do not access or test Polaris during this implementation. Treat a Zenith pass
|
||||
as representative, but retain these machine-local steps for later execution on
|
||||
Polaris:
|
||||
|
||||
1. Activate this NixOS configuration so `networkmanager-openvpn` is installed.
|
||||
2. Run `chmod 600 ~/sync/yookr-vpn.ovpn`.
|
||||
3. Run `nmcli connection import type openvpn file ~/sync/yookr-vpn.ovpn`.
|
||||
4. Rename the imported `yookr-vpn` connection to `Yookr VPN`, disable
|
||||
autoconnect, and add the required legacy cipher:
|
||||
`nmcli connection modify yookr-vpn connection.id "Yookr VPN" connection.autoconnect no +vpn.data data-ciphers=AES-256-CBC`.
|
||||
5. Connect with `nmcli connection up "Yookr VPN"`.
|
||||
|
||||
## Decisions and discoveries
|
||||
|
||||
- Use `/home/kiri/work/repos/yookr-dashboard-new` as the reconciliation base;
|
||||
@@ -136,8 +186,58 @@ and add no abstraction without a demonstrated repeated need.
|
||||
`KUBECONFIG`. Completion is now store-owned, and the child recipe initializes
|
||||
Garden's session-local `KUBECONFIG` before targeting instead of unsetting it.
|
||||
- NetworkManager's native OpenVPN plugin is declared on Zenith and Polaris;
|
||||
no profile is embedded in Nix or imported automatically. OpenVPN 3 remains
|
||||
available as the migration fallback until both hosts pass the VPN gate.
|
||||
no profile is embedded in Nix or imported automatically.
|
||||
- Zenith's initial NetworkManager activation never established a tunnel:
|
||||
OpenVPN 2.6 preserved the profile's legacy `cipher=AES-256-CBC` setting but
|
||||
excluded it from cipher negotiation. Adding `data-ciphers=AES-256-CBC` to
|
||||
the imported connection fixes the negotiation; NetworkManager then installs
|
||||
the pushed tunnel address, default route, private routes, and DNS servers.
|
||||
Company database access, disconnect/reconnect, suspend, and reboot pass on
|
||||
Zenith, so OpenVPN 3 is retired.
|
||||
- For the entire workflow implementation, do not access or test Polaris.
|
||||
Zenith results are accepted for both workstations; preserve exact deferred
|
||||
Polaris replication steps instead.
|
||||
- OpenVPN 3 is removed from the configuration. A full Zenith system build
|
||||
passes; the next password-authorized system switch removes it from the live
|
||||
generation.
|
||||
- Walker's native cached Lua menu scans the four identity roots and refreshes
|
||||
when their top level changes. Its default action pipes the selected path to
|
||||
one Nix-owned `open-project` command, which starts Neovim in a detached Kitty
|
||||
window and leaves an interactive shell after Neovim exits. The generated
|
||||
Walker configuration extends, rather than copies or replaces, the pinned
|
||||
default provider list and prefixes.
|
||||
- Removed the decided Niri arrow/Page Up/Down/numbered duplicates, direct quit
|
||||
and monitor-power bindings, extra screenshot modes, first/last and centering
|
||||
actions, repeated resize families, and their four shortcut-only scripts. The
|
||||
existing `Super+A` helper remains until a two-output session can validate its
|
||||
bounded name-based replacement.
|
||||
- Home Manager now owns the existing Vivaldi launcher filenames for Actual and
|
||||
WhatsApp, so both invoke the current package with the `Default` profile and
|
||||
stable app ID. Outlook is not installed yet, so no ID was guessed.
|
||||
- The first `nixos-maintainer` skill is instruction-only, Nix-owned, and passes
|
||||
the skill-creator validator. It encodes repository-specific ownership,
|
||||
research, formatting, no-switch, and affected-host validation behavior
|
||||
without duplicating generic agent guidance or adding scripts.
|
||||
- Removed Zed, the inactive Helix modules and note integration, Helix's cache
|
||||
settings and complete lock subgraph, and inactive Foot modules. Neovim and
|
||||
Kitty remain the sole declared editor and terminal. A repository-wide search
|
||||
found no configured npm caller, so global Node.js and Bun are also removed;
|
||||
project shells retain language runtimes where needed.
|
||||
- Pinta is added beside GIMP only for its bounded trial; neither outcome is
|
||||
preselected before real editing evidence.
|
||||
- `sync/notes` is now the sole declarative notebook owner, with `daily`,
|
||||
`meetings`, and `transcripts` directories, a native `zk daily` alias, and a
|
||||
`Super+N` dedicated Kitty/Neovim launcher. The five unique authored work notes
|
||||
were copied byte-for-byte, and both distinct todo lists were merged without
|
||||
dropping an item. Syncthing returned to idle with no needed files, pull
|
||||
errors, or new conflicts. The entire source notebook remains as rollback;
|
||||
pre-merge todo copies are also retained in `/tmp/workflow-notes-todo-before.md`
|
||||
and `/tmp/workflow-work-notes-todo-before.md` until the activated check passes.
|
||||
- Evolution 3.60.2 is composed through Nixpkgs with `evolution-ews` 3.60.2,
|
||||
whose pinned source contains the separate native Microsoft 365 mail,
|
||||
calendar, contacts, recurrence, and OAuth backends. It is installed only as
|
||||
a pilot beside Thunderbird; no account is preconfigured and no authority is
|
||||
changed.
|
||||
- Named database connections and a Marimo-to-HTML report remain workbench
|
||||
evaluation evidence, not scaffolding requirements. Add them only for a real
|
||||
cross-system investigation that gives the queries and report durable value.
|
||||
|
||||
Reference in new issue
Block a user