record API contract pilot

docs/plans/workflow-system.md

@@ -14,8 +14,8 @@ and add no abstraction without a demonstrated repeated need.
 - Baseline: `nix flake check --no-build --quiet` passed on 2026-09-05; only
   the existing dirty-tree and unknown `modules` output warnings were emitted.
 - Next: prove the common contract in `rules-service`, `yookr-api`, and
-  `traceability-data-model`; `rules-service` is complete, so reconcile the
+  `traceability-data-model`; the service pilots are checkpointed, so preserve
-  API's untracked specification next.
+  and reconcile the schema repository's existing WIP next.
 
 ## Progress
 
@@ -23,7 +23,7 @@ and add no abstraction without a demonstrated repeated need.
 | --- | --- | --- |
 | Bootstrap and repository ownership | Waiting for user | Repository and dashboard reconciliation complete; credential cleanup remains |
 | Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
-| Repository contracts and workbench | Active | `rules-service` contract passes; API and schema pilots remain |
+| Repository contracts and workbench | Active | Service contracts checkpointed; API empirical gates and schema pilot remain |
 | Desktop, agents, notes, PIM, transcription | Pending | Independent pilots follow foundation changes |
 | Conditional retirement and completion | Pending | Requires per-pilot evidence |
 
@@ -35,6 +35,7 @@ and add no abstraction without a demonstrated repeated need.
 | NixOS configuration | `chore/workflow-system` | `69552b7` | Simplify flake inputs and declare workstation lifecycle tools |
 | `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
 | `rules-service` | `chore/workflow-contract` | `555d9cd` | Establish the first common repository contract |
+| `yookr-api` | `chore/workflow-contract` | `a76b2b7` | Establish the HTTP and OpenAPI contract |
 
 ## Human actions
 
@@ -46,6 +47,12 @@ and add no abstraction without a demonstrated repeated need.
 - Move the ignored `rules-service/.env` to
   `~/.config/yookr/rules-service.env` with mode 0600; its contents have not been
   inspected or copied.
+- Restore access to the locked `yookrdev/constant-store` commit or replace that
+  retired dependency deliberately, then rerun `just check` in `yookr-api`.
+- Deploy a GET image that exposes `/full-api-docs/openapi.json`, then rerun
+  `just openapi-refresh test`; the current test deployment returns 404.
+- Populate the ignored API HTTP credentials and perform the planned login plus
+  harmless administrator read; no credential-bearing request has been made.
 - Destructive cleanup, credentials, activation, and empirical pilot decisions
   will be surfaced here before use.
 
@@ -87,4 +94,13 @@ and add no abstraction without a demonstrated repeated need.
   passes; Clippy reports 18 pre-existing advisory warnings.
 - Private Cargo Git dependencies remain in the ordinary developer SSH
   boundary. They are not vendored or bridged into sandboxed Nix builds.
+- `yookr-api` now owns its reviewed OpenAPI 3.1 contract, local/test/live HTTP
+  metadata, curated login/health/admin-read requests, a non-mutating shell, and
+  one explicit snapshot-and-diff recipe. `oasdiff` 1.31.0 is pinned with source
+  and vendor hashes because Nixpkgs does not provide it.
+- The API flake evaluation and built OpenAPI validation pass. Cargo stops before
+  compilation because its locked `constant-store` repository is unavailable
+  through both anonymous HTTPS and the working SSH identity. The test service
+  is reachable, but its currently deployed GET image returns 404 for the full
+  OpenAPI route already present in local source and ingress configuration.
 - Run independent pilots in parallel, but gate every retirement separately.