docs: consolidate remaining workflow gates

docs/plans/workflow-system.md

@@ -19,20 +19,29 @@ Manager activation package. It restarted the Kitty service and closed the
 user's terminal session. Do not repeat this, including for changes described as
 user-level, harmless, temporary, or needed only for live verification.
 
+## Execution discipline
+
+Advance every safe independent lane before asking the user to act. Batch
+declarative changes behind one user-controlled activation and consolidate
+empirical, credential, hardware, and approval gates into one checklist only
+after no autonomous work remains. A single pilot reaching its user gate does
+not make it the global next step while another pilot can still progress.
+
 ## Current checkpoint
 
-- Tranche: desktop, agents, and notes
-- State: Walker and notes verified; ready for the first bounded Herdr pilot
+- Tranche: autonomous consolidation across repositories, tools, and pilots
+- State: autonomous implementation exhausted; consolidated gates await the user
 - Branch: `chore/workflow-system`
 - Baseline: `nix flake check --no-build --quiet` and a no-link Zenith system
-  build passed on 2026-09-05 with the project-root launcher change and restart
-  trigger removal; only the expected dirty-tree and unknown `modules` warnings
-  were emitted. The generated project menu finds 30 live repositories without
-  `.archive` or `.worktrees` entries, and the generated daily-note configuration
-  passes an isolated same-day idempotence test. The managed Actual and WhatsApp
-  entries are active in the current user session, Evolution's source registry
-  activates over D-Bus, and the VPN reconnects successfully. The user activated the
-  terminal root fix: `xdg-terminal-exec` now selects Kitty correctly and Yazi
+  build passed on 2026-09-05 after the consolidated workstation retirement and
+  `rclone` preparation; only the expected dirty-tree and unknown `modules`
+  warnings were emitted. The generated project menu finds 30 live repositories
+  without `.archive` or `.worktrees` entries, and the generated daily-note
+  configuration passes an isolated same-day idempotence test. The managed Actual
+  and WhatsApp entries are active in the current user session, Evolution's
+  source registry activates over D-Bus, and the VPN reconnects successfully.
+  The user activated the terminal root fix: `xdg-terminal-exec` now selects
+  Kitty correctly and Yazi
   launches from Walker. After restarting the stale Elephant and Walker
   processes, repository launch also succeeds and exiting Neovim leaves a shell
   in the repository. The daily-note launcher and migrated notebook contents
@@ -40,9 +49,14 @@ user-level, harmless, temporary, or needed only for live verification.
   stopped its dependent Walker during activation without bringing Walker back,
   so it has been removed in favor of applying rare menu changes at login. After
   activating that removal and relogging, Walker opens normally and repository
-  selection starts Neovim in Oil at the project root.
-- Next: use Herdr for one read-only fresh-session resume check, including agent
-  state detection and detach/reattach, before adding any Herdr configuration.
+  selection starts Neovim in Oil at the project root. Four fresh local clones
+  pass their flake checks, expose their tracked command catalogs, and remain
+  clean after shell entry. The dashboard contract additionally passes its full
+  check and a bounded two-process development smoke test. The dashboard and
+  traceability PostgreSQL stacks also ran concurrently while both repositories'
+  checks passed; all test processes and containers were then stopped.
+- Next: present one consolidated user batch covering the built activation and
+  the independent empirical, credential, hardware, and approval gates below.
 
 ## Progress
 
@@ -50,13 +64,13 @@ user-level, harmless, temporary, or needed only for live verification.
 | --- | --- | --- |
 | Bootstrap and repository ownership | Waiting for user | Repository and dashboard reconciliation complete; credential cleanup remains |
 | Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
-| Repository contracts and workbench | Waiting externally | Three contracts and read-only Kubernetes pass; API deployment/access evidence is externally blocked, while database/report scaffolding is deferred until a real investigation |
+| Repository contracts and workbench | Waiting externally | Four clean-checkout contracts and read-only Kubernetes pass; data-science overlaps uncommitted work, while API, database, report, and secret inputs remain externally gated |
 | Desktop navigation and interaction | Active | Walker project and terminal actions plus stable Actual/WhatsApp launchers work; Outlook and two-output checks remain |
-| Agent workflow | Active | The `nixos-maintainer` skill validates and builds; Herdr 0.8.2 is installed with only native state and awaits its first bounded live check |
+| Agent workflow | Waiting for user | The `nixos-maintainer` skill validates and matches its live owner; external policy blocks nested Codex evaluation without approval, and Herdr awaits its first live check |
 | Notes | Complete | The daily launcher and migrated notebook pass live checks; the approved rollback copy is recoverable from Trash |
 | PIM | Active | Native NixOS Evolution 3.60.2 plus Microsoft 365 integration is live beside Thunderbird; account and daily-use gates await credentials |
 | Transcription | Pending | Requires a real Fossify recording-transfer pilot before implementation moves from Zenith to Orion |
-| Conditional retirement and completion | Active | OpenVPN 3, Zed, Helix, Foot, global Node.js, and global Bun are removed declaratively; other removals remain gated separately |
+| Conditional retirement and completion | Active | Superseded HTTP/database/note tools are removed with earlier retirements; Bruno, DBeaver, image editors, and PIM clients remain behind separate gates |
 
 ## Repository checkpoints
 
@@ -72,10 +86,14 @@ user-level, harmless, temporary, or needed only for live verification.
 | NixOS configuration | `chore/workflow-system` | `c2f48df` | Restore terminal-backed Walker actions |
 | NixOS configuration | `chore/workflow-system` | `6631889` | Open Walker projects at their repository root |
 | NixOS configuration | `chore/workflow-system` | `ca65328` | Remove the unsafe Elephant restart trigger |
+| NixOS configuration | `chore/workflow-system` | `d085512` | Advance from Walker to the agent pilot |
+| NixOS configuration | `chore/workflow-system` | `ee64a7b` | Retire superseded tools and prepare the S3 pilot |
 | `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
+| `yookr-dashboard-new` | `feat/gogv2` | `8e6e4bc` | Establish its project contract and native lifecycle |
 | `rules-service` | `chore/workflow-contract` | `555d9cd` | Establish the first common repository contract |
 | `yookr-api` | `chore/workflow-contract` | `a76b2b7` | Establish the HTTP and OpenAPI contract |
 | `traceability-data-model` | `chore/workflow-contract` | `33cb7ff` | Establish the database and schema contract |
+| `traceability-data-model` | `chore/workflow-contract` | `774e710` | Remove Mathesar and simplify the local stack to PostgreSQL |
 | `yookr-workbench` | `main` | `badc61c` | Create the workbench and isolate its Garden session |
 
 ## Deferred or externally blocked actions
@@ -83,6 +101,9 @@ user-level, harmless, temporary, or needed only for live verification.
 None of these block work on independent pilots. Surface the exact applicable
 step to the user only when it blocks the current task.
 
+- Activate the consolidated Zenith build with `cd ~/.config/nixos && nh os
+  switch`. This removes the retired tools and installs `rclone`; only the user
+  may run it.
 - In a separate terminal, enter this repository and run `herdr`, start `codex`,
   and ask it to read `docs/plans/workflow-system.md` without editing and report
   the exact next implementation step. Confirm Herdr shows the agent's working
@@ -105,7 +126,19 @@ step to the user only when it blocks the current task.
   and VTODO. Complete tenant consent/sign-in when prompted, then tell the agent
   which accounts connected; the full mail/calendar/contact/task gate remains
   a daily-use pilot rather than a one-time setup claim.
-
+- On Android, complete the DAVx5/Radicale and Tasks.org pilots described in the
+  discovery plan, including correct default accounts, recurrence, reminders,
+  and Microsoft To Do within its documented limits.
+- Make one Fossify recording on the Pixel and let Syncthing transfer it. Do not
+  rename or move it manually; the agent must first observe the real write and
+  settlement behavior before implementing Orion automation.
+- Reauthenticate the GitHub CLI with `gh auth login -h github.com`; its current
+  `kirigar` token is invalid. The agent can then complete the read-only PR and
+  isolated review-worktree gate without more direction.
+- Explicitly authorize the five ephemeral, read-only `codex exec` skill-scope
+  checks if sending this private repository to another authenticated Codex
+  session is acceptable. External policy correctly rejected them without that
+  approval; static skill validation already passes.
 - Rotate the exposed Context7 key and provide `CONTEXT7_API_KEY` through a
   mode-0600 machine-local environment file on each workstation before removing
   the static user-config header.
@@ -114,18 +147,26 @@ step to the user only when it blocks the current task.
 - Move the ignored `rules-service/.env` to
   `~/.config/yookr/rules-service.env` with mode 0600; its contents have not been
   inspected or copied.
+- Move the ignored `yookr-dashboard-new/.env` to its approved machine-local
+  mode-0600 owner, then update `.envrc`; the non-secret repository contract is
+  already complete.
+- Commit or otherwise hand off the extensive dirty `yookr-data-science` work
+  before its flake, live-fetch defaults, local credentials, and missing project
+  contract are changed. Those files overlap the active work directly.
+- Explicitly approve moving the stale `~/.config/codex` tree to Trash if its old
+  authentication, conversations, databases, and plugins are no longer needed.
+- Explicitly approve removing the orphaned Podman volume
+  `traceability-data-model_mathesar-secrets` and the old `mathesar_django`
+  database if no Mathesar rollback is wanted. They are disconnected from the
+  repository but preserved because deletion would be irreversible.
+- Supply one real Yookr S3 task plus a least-privileged remote and authorize one
+  bounded upload. `rclone` is prepared, but no remote or wrapper is guessed.
 - Restore access to the locked `yookrdev/constant-store` commit or replace that
   retired dependency deliberately, then rerun `just check` in `yookr-api`.
 - Deploy a GET image that exposes `/full-api-docs/openapi.json`, then rerun
   `just openapi-refresh test`; the current test deployment returns 404.
 - Populate the ignored API HTTP credentials and perform the planned login plus
   harmless administrator read; no credential-bearing request has been made.
-- The next Zenith switch also activates the follow-up Garden shell fix. The
-  Nix-owned `gardenctl`, `gardenlogin`, and `kubectl-gardenlogin` are verified
-  under `~/.nix-profile/bin`; afterward remove the duplicate mutable binaries
-  `~/.garden/gardenctl` and `~/.local/bin/{gardenctl,gardenlogin,kubectl-gardenlogin}`.
-- Destructive cleanup, credentials, activation, and empirical pilot decisions
-  will be surfaced here before use.
 
 ## Deferred Polaris replication
 
@@ -159,7 +200,7 @@ Polaris:
   commit remain. The registered sensor worktree is valid at its new path.
 - Shared Codex defaults and MCP endpoints are generated at
   `/etc/codex/config.toml`; Context7 reads its header from the environment. The
-  unused generic `~/.config/mcp/mcp.json` owner is removed on next activation.
+  unused generic `~/.config/mcp/mcp.json` is absent.
 - Removed redundant legacy-path trust entries from the current Codex config;
   the existing trusted home scope covers the moved repositories.
 - Bruno's transitional OpenAPI reference now follows the archived management
@@ -172,6 +213,10 @@ Polaris:
   package-set pin. Added `just` to the workstation tools and selected the
   store-backed `podman-compose` provider through native `containers.conf`.
 - The resulting flake check and no-link builds for all three hosts pass.
+- The verified-empty legacy directories `~/work/.data/mongodb`, `~/work/.data`,
+  and `~/work/repos` are removed. The stale `~/.config/codex` tree is preserved
+  because it contains old authentication and conversation state; moving that
+  recoverably requires explicit user approval.
 - `rules-service` now has a non-mutating direnv shell, minimal Nix toolchain and
   formatting check, native Cargo recipes, factual repository instructions,
   one `.http` request collection, explicit test/live deployment paths, and a
@@ -193,6 +238,28 @@ Polaris:
   `just dev` retains its Compose volumes, and the flake check loads fixtures in
   text-ID mode plus a fresh schema in UUID-ID mode. Both the built check and the
   pinned `podman-compose` configuration validation pass.
+- Mathesar is removed from `traceability-data-model`; the development stack now
+  owns only PostgreSQL plus the explicit schema-reset job. The existing named
+  volume and its historical local role are preserved to avoid stranding data.
+  `just reset`, `just dev`, the PostGIS fixture query, Compose validation, and
+  the flake check pass after the simplification.
+- `yookr-dashboard-new` now has the same minimal project contract: a
+  non-mutating flake shell, `just dev` over its existing Process Compose graph,
+  `just check`, factual `AGENTS.md` and README guidance, a flake formatter and
+  formatting check, and a complete public environment example. Its full type,
+  lint, and format checks pass; a bounded smoke test reached ready MongoDB and
+  Vite processes and stopped cleanly. The commit contains only contract files;
+  the user's existing dashboard source work remains unstaged and untouched.
+- Fresh local clones of `rules-service`, `yookr-api`,
+  `traceability-data-model`, and `yookr-dashboard-new` all pass `nix flake
+  check`, expose their tracked `just` catalogs, and remain clean after entering
+  their development shells. Credential-bearing and externally blocked checks
+  remain separate gates.
+- `yookr-data-science` still lacks a committed project contract, its untracked
+  flake mutates the checkout during shell entry, and its explicit fetch pipeline
+  still targets live services. Those exact files overlap extensive uncommitted
+  user work, so a partial agent edit would be unsafe and misleading; wait for a
+  commit or deliberate handoff before changing them coherently.
 - Gardenctl 2.14.0 and Gardenlogin 0.10.0 are pinned from their official release
   assets; the hashes match the existing binaries byte-for-byte. All three host
   builds pass, the OIDC kubectl plugin is declarative, and Zsh consumes the
@@ -207,6 +274,8 @@ Polaris:
   initial target warning came from the fresh session inheriting its parent's
   `KUBECONFIG`. Completion is now store-owned, and the child recipe initializes
   Garden's session-local `KUBECONFIG` before targeting instead of unsetting it.
+  The former mutable Garden binaries and generic MCP output are already absent,
+  so their stale cleanup gate is closed without further user work.
 - NetworkManager's native OpenVPN plugin is declared on Zenith and Polaris;
   no profile is embedded in Nix or imported automatically.
 - Zenith's initial NetworkManager activation never established a tunnel:
@@ -267,6 +336,27 @@ Polaris:
   Kitty remain the sole declared editor and terminal. A repository-wide search
   found no configured npm caller, so global Node.js and Bun are also removed;
   project shells retain language runtimes where needed.
+- Postman, HTTPie, Posting, and Resterm are removed after their valuable request
+  definitions moved to tracked HTTP owners; Bruno remains through its own
+  pilot. Rainfrog, dblab, Harlequin and its profile, Tabularis, DbGate, pgAdmin,
+  MongoDB Compass, pgModeler, tbls, global `usql`, and global MariaDB are
+  removed; Dadbod and wrapper-local clients remain, while DBeaver stays through
+  its gate. Obsidian, Planify, and Calcure are removed after note and task
+  authority was established. Pinta/GIMP and the Evolution-era PIM clients remain
+  independently gated.
+- `rclone` is installed as the only preparation for the selected S3 pilot. No
+  remote, wrapper, or interactive browser is added before a real task and
+  least-privileged credentials exist.
+- GitHub PR review is blocked by the invalid `kirigar` CLI token, not repository
+  state. The agent can complete the read-only review and isolated worktree gate
+  autonomously after reauthentication.
+- The live `nixos-maintainer` skill matches its Nix source and passes static
+  validation. Five ephemeral read-only behavioral checks were deliberately not
+  run because external policy requires explicit approval before another
+  authenticated Codex session receives this private repository.
+- In zsh, never use lowercase `path` as a loop or local variable: it is tied to
+  `PATH`. A diagnostic command temporarily hid normal executables by doing so;
+  the declarative session environment was correct and needed no patch.
 - Pinta is added beside GIMP only for its bounded trial; neither outcome is
   preselected before real editing evidence.
 - `sync/notes` is now the sole declarative notebook owner, with `daily`,