diff --git a/docs/plans/workflow-system.md b/docs/plans/workflow-system.md index 04e3374..7150940 100644 --- a/docs/plans/workflow-system.md +++ b/docs/plans/workflow-system.md @@ -43,36 +43,22 @@ restarted Kitty and closed the user's terminal session. Evolution D-Bus activation, the Zenith VPN, invocation-scoped GitHub and Context7 credentials, Pinta, and Orion transcription passed their completed pilots. The corrected Actual, WhatsApp, and Outlook launchers all started - successfully, and the labeled RabbitMQ test/live bookmarks are present. + successfully. The labeled RabbitMQ test/live bookmarks are present, and the + invocation-scoped test overview and queue listing passed. Test API login, + Yookr administrator read, rules read, aggregation login, and management health + passed; the Yookr token is not accepted by management's authenticated API. ## Active pilot gates These gates do not block work on each other. -- Supply approved test RabbitMQ management credentials at runtime, then verify - the Nix-provided client without installing it permanently: - - ```console - RABBITMQADMIN_BASE_URI=https://test.rabbitmq.yookr.org nix run --quiet nixpkgs#rabbitmqadmin-ng -- show overview - RABBITMQADMIN_BASE_URI=https://test.rabbitmq.yookr.org nix run --quiet nixpkgs#rabbitmqadmin-ng -- queues list - ``` - - Export `RABBITMQADMIN_USERNAME` and `RABBITMQADMIN_PASSWORD` from the approved - credential source first; do not place their values in documentation or shell - history. Keep publishing, getting, and purge visibly interactive in the - management UI. -- Supply one real Yookr S3 task, a least-privileged remote, and explicit permission - for any upload. `rclone` is installed; no remote or wrapper is preconfigured. -- The test GET image exposes `/full-api-docs/openapi.json`. The 2026-09-06 - refresh reached it successfully but validation found a dangling - `#/components/schemas/ReadParameters` reference. Have the application owner - correct and deploy the generated document, then rerun the refresh; do not - modify production source during this workflow. -- Provide current API user credentials before the planned login and harmless - administrator read. The recovered legacy service credentials returned 401 and - were not repurposed. -- Add workbench database connections and a Marimo-to-HTML report only when a real - cross-system investigation gives them durable value. +- Configure one `rclone` S3 remote per Leafcloud project, starting with the + `irristaud` project and container. Use listing and download operations only; + uploads are out of scope. Project-scoped EC2 access and secret keys remain the + missing input. +- Add the four named Dadbod connections after receiving MySQL test/live and + MongoDB test/live connection URIs. Create a Marimo-to-HTML report only when a + concrete cross-system investigation gives it durable value. - Keep Bruno, DBeaver, and PIM clients until their separate pilots decide them. - Wait for a real Monday ticket before adding anything beyond native GitHub, Herdr, Git, and worktree workflows. @@ -143,7 +129,12 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work. - `yookr-data-science` follows ordinary `nixos-unstable`, like the other companion repositories; it needs no `devenv-nixpkgs` compatibility input. - `yookr-workbench` starts with cross-system work only; isolation and additional - tools wait for observed needs. + tools wait for observed needs. Its one API environment catalogue covers the + Yookr, rules, aggregation, and management APIs; Kulala owns requests and + Dadbod's native store owns named database connections. +- The reviewed `yookr-api/openapi.yaml` remains the usable local contract. The + deployed generated document's dangling `ReadParameters` reference is accepted + for now and does not block direct API requests. - Walker's native Elephant menu scans repository roots and calls one Nix-owned `open-project` command. Rare menu changes take effect at login. - Home Manager declares the three stable Vivaldi launcher paths with forced @@ -167,11 +158,17 @@ the fresh-shell GitHub read and restarted-Codex Context7 lookup must both work. Radicale remain the data authorities; Thunderbird and Outlook remain available. - GitHub and every other repository remote stay read-only. Local files, commits, fetches, clones, and worktrees remain available. +- The provisional team chain is Project Overview project → work package → user + requirement → Software Development Backlog ticket → repository issue → one + pull request. Treat it as discovery context, not automation policy, until the + team settles the workflow; company GitHub remains read-only throughout. - Yookr production source stays read-only during workflow pilots. Changes to development tooling are allowed, and `yookr-workbench` remains the explicit source-code exception. ## Next step -Collect all inputs for the active pilots, then run them in the order RabbitMQ, -OpenAPI/API, workbench, S3, and Herdr. +Obtain the four database connection URIs, Leafcloud `irristaud` project S3 +credentials, a management API token, and one real Monday ticket. Then complete +the database/S3 access checks and the real workbench and Herdr pilots without +mutating company GitHub. diff --git a/docs/workflow-discovery.md b/docs/workflow-discovery.md index b42bd86..49a1fa4 100644 --- a/docs/workflow-discovery.md +++ b/docs/workflow-discovery.md @@ -159,15 +159,12 @@ and build configurations, then provide an activation command. ## Remaining pilots -- Verify the labeled RabbitMQ test/live bookmarks and a read-only test overview - plus queue listing through an invocation-scoped `rabbitmqadmin-ng` run. - Add workbench database connections and a Marimo report only for a real cross-system investigation. -- Configure an S3 remote only for a real task with least-privileged credentials - and explicit upload authorization. -- Rerun the Yookr OpenAPI refresh after the deployed document defines its - referenced `ReadParameters` schema; run authenticated API checks only with - current user credentials. +- Configure one read-only-use rclone S3 remote per Leafcloud project, beginning + with listing and downloading from the `irristaud` container; do not upload. +- Use the reviewed local Yookr OpenAPI contract while the accepted malformed + generated test document remains deployed. - Run the complete Herdr notification, fallback-agent, and safe worktree pilot with a real Monday ticket. - Keep Bruno, DBeaver, and existing PIM clients until their independent gates are