diff --git a/docs/plans/workflow-system.md b/docs/plans/workflow-system.md index 7874b33..feaa0ca 100644 --- a/docs/plans/workflow-system.md +++ b/docs/plans/workflow-system.md @@ -57,9 +57,12 @@ not make it the global next step while another pilot can still progress. checks passed; all test processes and containers were then stopped. The retired workstation tools are absent and `rclone` is live. Herdr preserves its pane across detach and reattach. The data-science contract and a real - read-only PR review pilot pass locally. -- Next: activate the skill-directory and remote-boundary fix, then continue the - independent empirical, credential, hardware, and real-task gates below. + read-only PR review pilot pass locally. The broad GitHub credentials are gone; + a mode-0600 fine-grained token now passes repository, issue, pull-request, + Actions, and organization Project reads with no stored fallback credential. +- Next: activate the skill-directory, remote-boundary, and GitHub-token loader + changes, then use the first real Monday ticket to test the native + Project-to-issue-to-local-branch workflow. ## Progress @@ -69,7 +72,7 @@ not make it the global next step while another pilot can still progress. | Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider | | Repository contracts and workbench | Waiting externally | Five clean-checkout contracts and read-only Kubernetes pass; API, database, report, S3, and secret inputs remain externally gated | | Desktop navigation and interaction | Active | Walker project and terminal actions plus stable Actual/WhatsApp launchers work; Outlook and two-output checks remain | -| Agent workflow | Waiting for user | Herdr and read-only PR review pass; the corrected skill owner is built and awaits user activation, while a real Monday ticket and Project read credential remain external | +| Agent workflow | Waiting for user | Herdr, read-only PR review, the fine-grained credential, and organization Projects pass; the corrected skill owner and token loader await user activation, while a real Monday ticket remains external | | Notes | Complete | The daily launcher and migrated notebook pass live checks; the approved rollback copy is recoverable from Trash | | PIM | Active | Native NixOS Evolution 3.60.2 plus Microsoft 365 integration is live beside Thunderbird; account and daily-use gates await credentials | | Transcription | Pending | Requires a real Fossify recording-transfer pilot before implementation moves from Zenith to Orion | @@ -92,6 +95,7 @@ not make it the global next step while another pilot can still progress. | NixOS configuration | `chore/workflow-system` | `d085512` | Advance from Walker to the agent pilot | | NixOS configuration | `chore/workflow-system` | `ee64a7b` | Retire superseded tools and prepare the S3 pilot | | NixOS configuration | `chore/workflow-system` | `2ef74d4` | Expose the NixOS skill as a supported directory link | +| NixOS configuration | `chore/workflow-system` | `1996411` | Load the machine-local read-only GitHub credential | | `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter | | `yookr-dashboard-new` | `feat/gogv2` | `8e6e4bc` | Establish its project contract and native lifecycle | | `rules-service` | `chore/workflow-contract` | `555d9cd` | Establish the first common repository contract | @@ -108,7 +112,8 @@ step to the user only when it blocks the current task. - Activate the latest Zenith build with `cd ~/.config/nixos && nh os switch`. This changes `nixos-maintainer` to a supported directory link and installs the - durable remote-read-only agent instruction; only the user may run it. + durable remote-read-only agent instruction plus the runtime GitHub token + loader; only the user may run it. - Run the bounded Pinta trial using a recent real edit: clipboard/open, selection, crop/resize/canvas, text/drawing/shapes, layers/transparency, basic adjustments, and PNG/JPEG export. Tell the agent whether it fully @@ -132,10 +137,6 @@ step to the user only when it blocks the current task. - Make one Fossify recording on the Pixel and let Syncthing transfer it. Do not rename or move it manually; the agent must first observe the real write and settlement behavior before implementing Orion automation. -- Before inspecting organization Project boards, replace the broad classic - GitHub token with a fine-grained token limited to required repository reads - and organization Projects read. The current credential can write and lacks - Project access; do not widen it with `gh auth refresh`. - Rotate the exposed Context7 key and provide `CONTEXT7_API_KEY` through a mode-0600 machine-local environment file on each workstation before removing the static user-config header. @@ -169,6 +170,9 @@ Polaris: autoconnect, and add the required legacy cipher: `nmcli connection modify yookr-vpn connection.id "Yookr VPN" connection.autoconnect no +vpn.data data-ciphers=AES-256-CBC`. 5. Connect with `nmcli connection up "Yookr VPN"`. +6. Create `~/.config/yookr/github-read-only.token` without a trailing newline, + containing the fine-grained `yookrdev` token, and set its mode to 0600. Open + a new Zsh after activation and verify `gh project list --owner yookrdev`. ## Decisions and discoveries @@ -338,14 +342,21 @@ Polaris: least-privileged credentials exist. - GitHub remote state is absolutely read-only; local files, commits, fetches, clones, and worktrees remain available. The generated global agent guidance - records this boundary. The active `jellespr` credential has broad classic - `repo` scope and the sampled repositories report admin access, so the boundary - is behavioral until it is replaced by a fine-grained read-only token. -- The organization exposes 219 open issues and five open pull requests. Recent - dashboard user stories and an existing Project-to-issue-to-cross-repository-PR - chain show that the intended ticket workflow already has useful raw material; - organization Projects remain unreadable because the token lacks - `read:project`. Add no dashboard or wrapper before Monday usage exposes a gap. + records this boundary. The former broad `jellespr` credential and stale, + invalid `kirigar` credential are removed locally. The only working API route + is now a fine-grained `github_pat_` token in the mode-0600 machine-local + `~/.config/yookr/github-read-only.token`; Zsh loads it as the documented + `GH_TOKEN` interface without copying the secret into Nix or a password-manager + adapter. +- The fine-grained token passes identity, repository contents, issues, pull + requests, Actions, and organization Projects reads with no stored fallback. + The organization exposes 219 open issues, five open pull requests, and 60 + Projects. Project 52 is a 38-issue high-level overview; Project 8 is an + 82-item software backlog with the native ticket fields needed for the planned + workflow. Its only three items assigned to `jellespr` are Done, while the two + open issues assigned across the organization are not present there. Keep the + native `gh` and Git workflow and wait for the first real Monday ticket; add no + dashboard or wrapper before usage exposes a concrete gap. - The PR gate used `prediction-api#125`: native `gh pr view`, `checks`, and `diff` reads work, while an isolated exact-base reconstruction passes patch, whitespace, and Rust formatting checks and leaves no durable checkout. The PR