refactor: ponytail audit

docs/plans/workflow-system.md

@@ -2,499 +2,114 @@
 
 Source: [`../workflow-discovery.md`](../workflow-discovery.md)
 
-Apply the global and repository-local `AGENTS.md` files and the ponytail skill
-at full intensity throughout. Preserve user work, prefer native capabilities,
-and add no abstraction without a demonstrated repeated need.
+The declarative workflow implementation is complete. This file is the living
+handoff for operational constraints and external gates; implementation history
+is available in Git.
 
-## Non-negotiable activation boundary
+## Activation boundary
 
-Only the user may switch or activate configurations. The agent must never run
-`nixos-rebuild switch`, a Home Manager activation or switch command, or any
-equivalent operation that changes the active generation. Building and
-evaluating configurations is allowed; after a successful build, give the user
-the exact activation command and wait for confirmation.
+Only the user may switch or activate configurations. Agents must not run
+`nixos-rebuild switch`, Home Manager activation, or an equivalent command that
+changes the active generation. Evaluation and builds are allowed; after a
+successful build, provide the exact activation command and wait for the user.
 
-On 2026-09-05 the agent violated this boundary by directly running a built Home
-Manager activation package. It restarted the Kitty service and closed the
-user's terminal session. Do not repeat this, including for changes described as
-user-level, harmless, temporary, or needed only for live verification.
+This boundary includes changes described as user-level, harmless, temporary, or
+necessary for live verification. A direct Home Manager activation previously
+restarted Kitty and closed the user's terminal session.
 
 ## Execution discipline
 
-Advance every safe independent lane before asking the user to act. Batch
-declarative changes behind one user-controlled activation and consolidate
-empirical, credential, hardware, and approval gates into one checklist only
-after no autonomous work remains. A single pilot reaching its user gate does
-not make it the global next step while another pilot can still progress.
-
-Never place repositories or worktrees under `~/sync`; synchronize authored
-artifacts instead. The folder's sole ignore pattern is the local `.zk` state.
+- Advance all safe independent work before asking the user to act.
+- Batch declarative changes behind user-controlled activation.
+- Consolidate empirical, credential, hardware, and approval gates only after no
+  autonomous work remains.
+- Keep repositories and worktrees outside `~/sync`; synchronize authored
+  artifacts instead.
+- Keep GitHub and other repository remotes strictly read-only.
 
 ## Current checkpoint
 
-- Tranche: autonomous consolidation across repositories, tools, and pilots
-- State: autonomous implementation exhausted; remaining gates are external or
-  explicitly deferred
-- Branch: `chore/workflow-system`
-- Baseline: `nix flake check --no-build --quiet` and no-link Zenith and Orion
-  system builds passed on 2026-09-06 after making Orion the sole transcription
-  owner; only the expected dirty-tree and unknown `modules` warnings were
-  emitted. The generated project menu finds 30 live repositories
-  without `.archive` or `.worktrees` entries, and the generated daily-note
-  configuration passes an isolated same-day idempotence test. The managed Actual
-  and WhatsApp entries are active in the current user session, Evolution's
-  source registry activates over D-Bus, and the VPN reconnects successfully.
-  The user activated the terminal root fix: `xdg-terminal-exec` now selects
-  Kitty correctly and Yazi
-  launches from Walker. After restarting the stale Elephant and Walker
-  processes, repository launch also succeeds and exiting Neovim leaves a shell
-  in the repository. The daily-note launcher and migrated notebook contents
-  also pass their live sanity check. The attempted Elephant menu restart trigger
-  stopped its dependent Walker during activation without bringing Walker back,
-  so it has been removed in favor of applying rare menu changes at login. After
-  activating that removal and relogging, Walker opens normally and repository
-  selection starts Neovim in Oil at the project root. Five fresh local clones
-  pass their flake checks, expose their tracked command catalogs, and remain
-  clean after shell entry. The dashboard contract additionally passes its full
-  check and a bounded two-process development smoke test. The dashboard and
-  traceability PostgreSQL stacks also ran concurrently while both repositories'
-  checks passed; all test processes and containers were then stopped. The
-  retired workstation tools are absent and `rclone` is live. Herdr preserves
-  its pane across detach and reattach. The data-science contract and a real
-  read-only PR review pilot pass locally. The broad GitHub credentials are gone;
-  a mode-0600 fine-grained token now passes repository, issue, pull-request,
-  Actions, and organization Project reads with no stored fallback credential.
-  The user activated its loader and confirmed a new shell can list organization
-  Projects; the skill directory and durable remote boundary are also live. The
-  activated read-only wrapper leaves `GH_TOKEN` out of cached dev shells while
-  `gh` identifies the work account and Git reads a private Cargo dependency;
-  the complete yookr-api contract passes. The replacement Context7 key is
-  mode 0600, the exposed key is revoked, and a live resolve-and-query round trip
-  passes through the activated runtime header helper. Pinta passed its real-edit
-  trial, and Outlook's installed PWA exposed stable app ID
-  `eoficlgicibekocmfdomjbfnjmehnhcd`; after activation, GIMP is absent and the
-  managed Outlook launcher is the live store-backed entry. A stopped
-  10.28-second Fossify M4A
-  transferred intact into `sync/recordings`, establishing its actual format and
-  path. The user selected Fossify's native `recordings/inbox` destination, and
-  the event-driven Orion CPU pipeline passes both an isolated transcription and
-  a live remote run of that recording without exposing its contents. Orion
-  waited for the full settlement interval, archived the byte-identical original,
-  published the expected fallback Markdown, and exited successfully. The user
-  confirmed its bilingual output, and a guarded rerun with the copied pyannote
-  model replaced that fallback with a successfully diarized transcript. A pathological
-  synchronized repository tree was removed from the Pixel. Repositories are now
-  explicitly outside the Syncthing boundary instead of relying on an expanding
-  generated-directory ignore list.
-- Final audit: the complete branch diff passes `git diff --check`; removed
-  Helix, Foot, Zed, and stable-Nixpkgs owners have no remaining Nix references,
-  and the lockfile cleanup contains no replacement inputs. The current desktop,
-  Walker, Niri, host, and transcription owners were reviewed in full without
-  finding another autonomous correction to make.
-- Next: continue independent external pilots as their real inputs arrive. No
-  configuration activation is pending.
+- State: declarative implementation and autonomous verification complete.
+- Branch: `chore/workflow-system`.
+- Validation: `nix flake check --no-build --quiet` plus no-link Zenith and Orion
+  system builds passed on 2026-09-06 after Orion became the sole transcription
+  owner. The expected dirty-tree and unknown `modules` warnings were emitted.
+- Live state: Walker project and terminal actions, daily notes, stable web apps,
+  Evolution D-Bus activation, the Zenith VPN, invocation-scoped GitHub and
+  Context7 credentials, Pinta, and Orion transcription passed their completed
+  pilots.
 
-## Progress
+## External or deferred gates
 
-| Batch | State | Evidence or blocker |
-| --- | --- | --- |
-| Bootstrap and repository ownership | Complete | Repository reconciliation, local plaintext credential cleanup, and Context7 rotation pass |
-| Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
-| Repository contracts and workbench | Waiting externally | Five clean-checkout contracts, the full yookr-api check, and read-only Kubernetes pass; API user credentials, database, report, and S3 inputs remain externally gated |
-| Desktop navigation and interaction | Waiting externally | Walker project and terminal actions plus stable Actual, WhatsApp, and Outlook launchers work; the two-output check awaits a docked session |
-| Agent workflow | Waiting externally | Herdr, read-only PR review, the corrected skill owner, durable remote boundary, invocation-scoped credentials, and organization Projects pass; a real Monday ticket remains external |
-| Notes | Complete | The daily launcher and migrated notebook pass live checks; the approved rollback copy is recoverable from Trash |
-| PIM | Deferred | Evolution 3.60.2 with Microsoft 365 support remains available beside Thunderbird; the user deferred account setup and uses Thunderbird plus Outlook meanwhile |
-| Transcription | Complete | Real Fossify transfer, settlement, bilingual CPU transcription, diarization, fallback, archive, and synchronization pass on Orion; Zenith has no transcription owner |
-| Conditional retirement and completion | Active | Superseded tools and GIMP are absent and Pinta passed; Bruno, DBeaver, and PIM clients remain behind separate gates |
+These gates do not block work on each other.
 
-## Repository checkpoints
-
-| Repository | Branch | Commit | Purpose |
-| --- | --- | --- | --- |
-| NixOS configuration | `chore/workflow-system` | `41bc61b` | Discovery, paths, Git identity, and Codex defaults |
-| NixOS configuration | `chore/workflow-system` | `69552b7` | Simplify flake inputs and declare workstation lifecycle tools |
-| NixOS configuration | `chore/workflow-system` | `0c121a6` | Declare Garden tooling and the local workbench |
-| NixOS configuration | `chore/workflow-system` | `2fb6061` | Package Garden completion declaratively |
-| NixOS configuration | `chore/workflow-system` | `ad01b9b` | Enable NetworkManager's native OpenVPN plugin |
-| NixOS configuration | `chore/workflow-system` | `c9ee688` | Advance VPN, desktop, agent, note, and PIM pilots |
-| NixOS configuration | `chore/workflow-system` | `cfa5d6d` | Correct PWA ownership and Evolution service activation |
-| NixOS configuration | `chore/workflow-system` | `c2f48df` | Restore terminal-backed Walker actions |
-| NixOS configuration | `chore/workflow-system` | `6631889` | Open Walker projects at their repository root |
-| NixOS configuration | `chore/workflow-system` | `ca65328` | Remove the unsafe Elephant restart trigger |
-| NixOS configuration | `chore/workflow-system` | `d085512` | Advance from Walker to the agent pilot |
-| NixOS configuration | `chore/workflow-system` | `ee64a7b` | Retire superseded tools and prepare the S3 pilot |
-| NixOS configuration | `chore/workflow-system` | `2ef74d4` | Expose the NixOS skill as a supported directory link |
-| NixOS configuration | `chore/workflow-system` | `1996411` | Load the machine-local read-only GitHub credential |
-| NixOS configuration | `chore/workflow-system` | `422a1ea` | Scope GitHub and Context7 credentials to their callers |
-| NixOS configuration | `chore/workflow-system` | `ec54ddd` | Own Outlook's stable launcher and select Pinta over GIMP |
-| NixOS configuration | `chore/workflow-system` | `656f144` | Prepare event-driven CPU transcription on Orion |
-| NixOS configuration | `chore/workflow-system` | `01c8855` | Make Orion the sole transcription owner after its live pass |
-| NixOS configuration | `chore/workflow-system` | `76e9d03` | Declare ADB for the Android sync recovery |
-| NixOS configuration | `chore/workflow-system` | `fa17d77` | Exclude generated devenv state from Syncthing |
-| NixOS configuration | `chore/workflow-system` | `b38fb9e` | Keep repository trees outside the Syncthing boundary |
-| NixOS configuration | `chore/workflow-system` | `5fa85c5` | Complete the bilingual and diarized transcription pilot |
-| `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |
-| `yookr-dashboard-new` | `feat/gogv2` | `8e6e4bc` | Establish its project contract and native lifecycle |
-| `yookr-dashboard-new` | `feat/gogv2` | `c99f8b6` | Move runtime configuration to its machine-local owner |
-| `rules-service` | `chore/workflow-contract` | `555d9cd` | Establish the first common repository contract |
-| `yookr-api` | `chore/workflow-contract` | `a76b2b7` | Establish the HTTP and OpenAPI contract |
-| `traceability-data-model` | `chore/workflow-contract` | `33cb7ff` | Establish the database and schema contract |
-| `traceability-data-model` | `chore/workflow-contract` | `774e710` | Remove Mathesar and simplify the local stack to PostgreSQL |
-| `yookr-data-science` | `chore/workflow-contract` | `fa410e1` | Establish its non-mutating project contract |
-| `yookr-workbench` | `main` | `badc61c` | Create the workbench and isolate its Garden session |
-
-## Deferred or externally blocked actions
-
-None of these block work on independent pilots. Surface the exact applicable
-step to the user only when it blocks the current task.
-
-- During a docked Zenith session, tell the agent the external display is
-  attached so its stable identity and the two-output `Super+A` pilot can be
-  completed. The current session exposes only `eDP-1`.
-- When the user resumes the deferred Evolution pilot, add accounts without removing any
-  existing client or changing authority: personal and old-personal through
-  their existing IMAP/SMTP service, university and work through the
-  `Microsoft 365` account type, and Radicale through native CalDAV, CardDAV,
-  and VTODO. Complete tenant consent/sign-in when prompted, then tell the agent
-  which accounts connected; the full mail/calendar/contact/task gate remains
-  a daily-use pilot rather than a one-time setup claim.
-- On Android, complete the DAVx5/Radicale and Tasks.org pilots described in the
-  discovery plan, including correct default accounts, recurrence, reminders,
-  and Microsoft To Do within its documented limits.
-- Supply one real Yookr S3 task plus a least-privileged remote and authorize one
-  bounded upload. `rclone` is prepared, but no remote or wrapper is guessed.
-- Deploy a GET image that exposes `/full-api-docs/openapi.json`, then rerun
-  `just openapi-refresh test`; the current test deployment returns 404.
-- Provide current API user credentials for the ignored private HTTP environment,
-  then perform the planned login and harmless administrator read. The recovered
-  legacy service UUID/password returned 401 from production and was not copied
-  into the user-login schema.
+- During a docked Zenith session, capture the external display's stable identity
+  and test the two-output `Super+A` exchange. The current recorded session exposed
+  only `eDP-1`.
+- Resume Evolution only when the user chooses to configure the personal,
+  old-personal, university, work, and Radicale accounts. Keep Thunderbird and
+  Outlook until the daily-use gate passes.
+- On Android, complete the DAVx5/Radicale and Tasks.org pilots, including default
+  accounts, recurrence, reminders, and Microsoft To Do within documented limits.
+- Supply one real Yookr S3 task, a least-privileged remote, and explicit permission
+  for any upload. `rclone` is installed; no remote or wrapper is preconfigured.
+- Deploy a GET image exposing `/full-api-docs/openapi.json`, then rerun
+  `just openapi-refresh test`.
+- Provide current API user credentials before the planned login and harmless
+  administrator read. The recovered legacy service credentials returned 401 and
+  were not repurposed.
+- Add workbench database connections and a Marimo-to-HTML report only when a real
+  cross-system investigation gives them durable value.
+- Keep Bruno, DBeaver, and PIM clients until their separate pilots decide them.
+- Wait for a real Monday ticket before adding anything beyond native GitHub,
+  Herdr, Git, and worktree workflows.
 
 ## Deferred Polaris replication
 
-Do not access or test Polaris during this implementation. Treat a Zenith pass
-as representative, but retain these machine-local steps for later execution on
-Polaris:
+Do not access or test Polaris unless the user resumes this deferred replication.
+Zenith's result remains representative meanwhile.
 
 1. Activate this NixOS configuration so `networkmanager-openvpn` is installed.
-2. Run `chmod 600 ~/sync/yookr-vpn.ovpn`.
-3. Run `nmcli connection import type openvpn file ~/sync/yookr-vpn.ovpn`.
-4. Rename the imported `yookr-vpn` connection to `Yookr VPN`, disable
-   autoconnect, and add the required legacy cipher:
-   `nmcli connection modify yookr-vpn connection.id "Yookr VPN" connection.autoconnect no +vpn.data data-ciphers=AES-256-CBC`.
+2. Restrict `~/sync/yookr-vpn.ovpn` to mode 0600.
+3. Import it with `nmcli connection import type openvpn file ~/sync/yookr-vpn.ovpn`.
+4. Rename the connection to `Yookr VPN`, disable autoconnect, and add
+   `data-ciphers=AES-256-CBC`.
 5. Connect with `nmcli connection up "Yookr VPN"`.
-6. Create `~/.config/yookr/github-read-only.token` without a trailing newline,
-   containing the fine-grained `yookrdev` token, and set its mode to 0600. Open
-   a new Zsh after activation and verify `gh project list --owner yookrdev`.
-7. Create `~/.config/context7/api-key` without a trailing newline, containing a
-   current Context7 key, and set its mode to 0600. Restart Codex after activation
-   and run one Context7 documentation lookup.
+6. Create mode-0600 `~/.config/yookr/github-read-only.token` without a trailing
+   newline, then verify a new shell can run
+   `gh project list --owner yookrdev`.
+7. Create mode-0600 `~/.config/context7/api-key` without a trailing newline,
+   restart Codex after activation, and run one Context7 lookup.
 
-## Decisions and discoveries
+## Durable implementation decisions
 
-- Use `/home/kiri/work/repos/yookr-dashboard-new` as the reconciliation base;
-  its `feat/gogv2` head is 17 commits newer than the sync copy and matches its
-  remote-tracking branch.
-- The user confirmed the legacy BSON migration is no longer needed and the
-  former work copy is authoritative. The sync copy was explicitly deleted;
-  its removal may propagate through Syncthing.
-- Active repositories now live under `/home/kiri/dev/work`; inactive material
-  is preserved intact under `.archive`, and the registered dashboard sensor
-  worktree is under `.worktrees`.
-- Removed the obsolete dashboard converter app and Python dependency. The
-  dashboard flake evaluates, while the pre-existing feature work remains
-  uncommitted and unstaged.
-- Pruned the absent `feat/echarts-domain` worktree metadata; its branch and
-  commit remain. The registered sensor worktree is valid at its new path.
-- Shared Codex defaults and MCP endpoints are generated at
-  `/etc/codex/config.toml`. Context7's credential is supplied at connection time
-  by Codex's native HTTP-header helper reading `~/.config/context7/api-key`; no
-  secret enters Nix or the process-wide environment. The unused generic
-  `~/.config/mcp/mcp.json` is absent.
-- Removed redundant legacy-path trust entries from the current Codex config;
-  the existing trusted home scope covers the moved repositories.
-- Bruno's transitional OpenAPI reference now follows the archived management
-  repository until the HTTP pilot retires or retains Bruno.
-- Post-move repository IDs, remotes, dirty counts, and the registered sensor
-  worktree match the pre-move inventory. The Nix flake still evaluates.
-- No-link system builds for Zenith, Polaris, and Orion pass with the migrated
-  paths and declarative Codex defaults.
-- Removed the unused stable Nixpkgs input and made Noctalia follow the root
-  package-set pin. Added `just` to the workstation tools and selected the
-  store-backed `podman-compose` provider through native `containers.conf`.
-- The resulting flake check and no-link builds for all three hosts pass.
-- The verified-empty legacy directories `~/work/.data/mongodb`, `~/work/.data`,
-  and `~/work/repos` are removed. The stale `~/.config/codex` tree was moved to
-  desktop Trash after explicit approval; the active `~/.codex` tree is intact.
-- `Sync/uni/algorithms` remained on the Pixel after its Zenith and Orion copies
-  were deleted. Android Files and MTP crashed, while recursive ADB operations
-  appeared to hang because `.devenv/state/venv` contained at least one thousand
-  generated files and deeply nested package data behind Android's FUSE layer;
-  no malformed top-level entry or filesystem failure was found. With the
-  Syncthing-Fork folder paused and explicit approval, ADB atomically renamed and
-  then permanently deleted only that exact tree. The live and temporary paths
-  are absent. A later Files hang was isolated to the remaining stale `Sync`
-  tree, which included a repository with a very large `node_modules`; that
-  1.7 GiB quarantined tree was permanently removed with explicit approval, and
-  both its visible and hidden paths are absent. The durable rule is that
-  repositories and worktrees never enter `~/sync`; the
-  shared folder therefore keeps only its intentional `**/.zk` ignore.
-- `rules-service` now has a non-mutating direnv shell, minimal Nix toolchain and
-  formatting check, native Cargo recipes, factual repository instructions,
-  one `.http` request collection, explicit test/live deployment paths, and a
-  corrected test-oriented environment example. The full locked Cargo check
-  passes; Clippy reports 18 pre-existing advisory warnings.
-- Private Cargo Git dependencies remain at their upstream HTTPS URLs and use
-  Git's existing `gh auth git-credential` integration. They are not vendored or
-  rewritten.
-- `yookr-api` now owns its reviewed OpenAPI 3.1 contract, local/test/live HTTP
-  metadata, curated login/health/admin-read requests, a non-mutating shell, and
-  one explicit snapshot-and-diff recipe. `oasdiff` 1.31.0 is pinned with source
-  and vendor hashes because Nixpkgs does not provide it.
-- The API flake evaluation, complete locked Rust test suite, and OpenAPI
-  validation pass. The fine-grained token reads the exact locked
-  `constant-store` commit and two other private Yookr crates through the
-  invocation-scoped `gh` credential helper; no dependency URL changed. The
-  validator retains two pre-existing informational example findings. The test
-  service is reachable, but its currently deployed GET image returns 404 for
-  the full OpenAPI route already present in local source and ingress
-  configuration.
-- `traceability-data-model` preserves the existing domain/schema redesign while
-  replacing automatic schema recreation with explicit `just reset`. Ordinary
-  `just dev` retains its Compose volumes, and the flake check loads fixtures in
-  text-ID mode plus a fresh schema in UUID-ID mode. Both the built check and the
-  pinned `podman-compose` configuration validation pass.
-- Mathesar is removed from `traceability-data-model`; the development stack now
-  owns only PostgreSQL plus the explicit schema-reset job. The active named
-  volume and its historical local role are preserved to avoid stranding data;
-  the obsolete `mathesar_django` database and orphaned secrets volume were
-  explicitly approved and deleted. `just reset`, `just dev`, the PostGIS
-  fixture query, Compose validation, and the flake check pass.
-- `yookr-dashboard-new` now has the same minimal project contract: a
-  non-mutating flake shell, `just dev` over its existing Process Compose graph,
-  `just check`, factual `AGENTS.md` and README guidance, a flake formatter and
-  formatting check, and a complete public environment example. Its full type,
-  lint, and format checks pass; a bounded smoke test reached ready MongoDB and
-  Vite processes and stopped cleanly. The commit contains only contract files;
-  the user's existing dashboard source work remains unstaged and untouched.
-- The active ignored `rules-service/.env` is moved unchanged to
-  `~/.config/yookr/rules-service.env`; its existing `.envrc` now loads that
-  file successfully. The dashboard environment is likewise moved unchanged to
-  `~/.config/yookr/yookr-dashboard-new.env`, and its `.envrc`, instructions,
-  and README now name that owner. Both files are mode 0600, both shells expose
-  their expected variables without recreating repository `.env` files, and the
-  dashboard commit contains only those three contract files. The unrelated
-  dashboard source work remains unstaged.
-- The unreferenced `/home/kiri/work/SECRETS` file overlapped an older
-  rules-service environment but contained different credentials, so it was not
-  merged or discarded. It is preserved byte-for-byte as the mode-0600
-  `~/.config/yookr/rules-service-legacy.env`; the original path is absent. Its
-  production Yookr service UUID/password returned 401 from `/serviceLogin`; no
-  token was retained and the credentials were not repurposed as a user login.
-- Fresh local clones of `rules-service`, `yookr-api`,
-  `traceability-data-model`, `yookr-dashboard-new`, and `yookr-data-science`
-  pass their flake and project checks, expose their tracked `just` catalogs,
-  and remain clean after shell entry. Credential-bearing and externally blocked
-  checks remain separate gates.
-- `yookr-data-science` now has a non-mutating shell and explicit `just setup`,
-  `check`, `run`, and `fetch-live` boundaries. Locked local checks and the
-  archived notebook use repository-relative paths; live Yookr access remains
-  explicit and was not invoked. Stale path-bound caches were replaced through
-  the explicit setup command, local credentials are mode 0600, and a fresh
-  clone passes the full contract without shell-created files.
-- Gardenctl 2.14.0 and Gardenlogin 0.10.0 are pinned from their official release
-  assets; the hashes match the existing binaries byte-for-byte. All three host
-  builds pass, the OIDC kubectl plugin is declarative, and Zsh consumes the
-  native `gardenctl rc zsh` output with its completion packaged declaratively.
-- The local-only `yookr-workbench` has no remote and initially owns only
-  `just k8s test`. Each invocation creates an isolated Garden session, rejects
-  every environment except test, and opens K9s read-only. Its flake check and
-  command catalog pass, and the live rejection path exits before Garden access.
-- The user activated and rebooted into the Garden tooling, then confirmed that
-  `just k8s test` opens the test shoot in read-only K9s. The initial shell error
-  came from Garden writing completion into an absent Flatpak `$fpath` entry; the
-  initial target warning came from the fresh session inheriting its parent's
-  `KUBECONFIG`. Completion is now store-owned, and the child recipe initializes
-  Garden's session-local `KUBECONFIG` before targeting instead of unsetting it.
-  The former mutable Garden binaries and generic MCP output are already absent,
-  so their stale cleanup gate is closed without further user work.
-- NetworkManager's native OpenVPN plugin is declared on Zenith and Polaris;
-  no profile is embedded in Nix or imported automatically.
-- Zenith's initial NetworkManager activation never established a tunnel:
-  OpenVPN 2.6 preserved the profile's legacy `cipher=AES-256-CBC` setting but
-  excluded it from cipher negotiation. Adding `data-ciphers=AES-256-CBC` to
-  the imported connection fixes the negotiation; NetworkManager then installs
-  the pushed tunnel address, default route, private routes, and DNS servers.
-  Company database access, disconnect/reconnect, suspend, and reboot pass on
-  Zenith, so OpenVPN 3 is retired.
-- For the entire workflow implementation, do not access or test Polaris.
-  Zenith results are accepted for both workstations; preserve exact deferred
-  Polaris replication steps instead.
-- OpenVPN 3 is removed from the configuration. A full Zenith system build
-  passes, and the first password-authorized switch removed it from the live
-  generation. NetworkManager reconnected the VPN successfully afterward.
-- Walker's native cached Lua menu scans the four identity roots and refreshes
-  when their top level changes. Its default action pipes the selected path to
-  one Nix-owned `open-project` command. Elephant supplies that path without a
-  terminating newline, so the launcher now accepts a successful partial read
-  instead of exiting under `errexit`. It opens Neovim through the configured
-  `xdg-terminal-exec` owner and leaves an interactive shell after Neovim exits.
-  Elephant reads menu actions only at startup, so rare declarative menu changes
-  take effect at the next login. The generated Walker configuration extends,
-  rather than copies or replaces, the pinned default provider list and prefixes.
-- The shared terminal-launch failure came from the Kitty package rewrite:
-  unanchored `sed` changed both `Exec=kitty` and `TryExec=kitty` to include
-  `-1`. Arguments are invalid in `TryExec`, causing `xdg-terminal-exec` to
-  reject the configured terminal. The rewrite now changes only `Exec`; live
-  resolver output selects `kitty.desktop` and retains `kitty -1`, and Yazi
-  launches successfully from Walker.
-- Restarting the pre-change Elephant and Walker processes loaded the corrected
-  project action. The user confirmed that repository launch works and exiting
-  Neovim leaves a usable shell in that repository. Passing the project root to
-  Neovim now opens the configured Oil default directory explorer immediately.
-- A custom restart trigger for Elephant proved unsafe: Walker requires Elephant,
-  so activation stopped Walker with its backend but restarted only Elephant.
-  The trigger is removed; relogging is the deliberately simple refresh path
-  unless real usage proves that inconvenient. The user activated the removal,
-  relogged, and confirmed both Walker and the project-root Oil action work.
-- Removed the decided Niri arrow/Page Up/Down/numbered duplicates, direct quit
-  and monitor-power bindings, extra screenshot modes, first/last and centering
-  actions, repeated resize families, and their four shortcut-only scripts. The
-  existing `Super+A` helper remains until a two-output session can validate its
-  bounded name-based replacement.
-- Home Manager owns the existing Vivaldi launcher filenames for Actual and
-  WhatsApp at the higher-precedence user-data location, so both invoke Vivaldi
-  8.1.4087.70 with the `Default` profile and stable app ID. Direct activation
-  replaced both generated files with managed links and retained the originals
-  as adjacent `.bak` files. The entries use native forced ownership because
-  Vivaldi may regenerate those exact paths. The installed Outlook PWA identified
-  itself as `eoficlgicibekocmfdomjbfnjmehnhcd`; its prepared managed launcher
-  preserves mailto handling and the calendar, compose, and new-event actions.
-- The first `nixos-maintainer` skill is instruction-only, Nix-owned, and passes
-  the skill-creator validator. It encodes repository-specific ownership,
-  research, formatting, no-switch, and affected-host validation behavior
-  without duplicating generic agent guidance or adding scripts.
-- Removed Zed, the inactive Helix modules and note integration, Helix's cache
-  settings and complete lock subgraph, and inactive Foot modules. Neovim and
-  Kitty remain the sole declared editor and terminal. A repository-wide search
-  found no configured npm caller, so global Node.js and Bun are also removed;
-  project shells retain language runtimes where needed.
-- Postman, HTTPie, Posting, and Resterm are removed after their valuable request
-  definitions moved to tracked HTTP owners; Bruno remains through its own
-  pilot. Rainfrog, dblab, Harlequin and its profile, Tabularis, DbGate, pgAdmin,
-  MongoDB Compass, pgModeler, tbls, global `usql`, and global MariaDB are
-  removed; Dadbod and wrapper-local clients remain, while DBeaver stays through
-  its gate. Obsidian, Planify, and Calcure are removed after note and task
-  authority was established. Pinta replaces GIMP; the Evolution-era PIM clients
-  remain independently gated.
-- `rclone` is installed as the only preparation for the selected S3 pilot. No
-  remote, wrapper, or interactive browser is added before a real task and
-  least-privileged credentials exist.
-- GitHub remote state is absolutely read-only; local files, commits, fetches,
-  clones, and worktrees remain available. The generated global agent guidance
-  records this boundary. The former broad `jellespr` credential and stale,
-  invalid `kirigar` credential are removed locally. The only working API route
-  is now a fine-grained `github_pat_` token in the mode-0600 machine-local
-  `~/.config/yookr/github-read-only.token`. The Nix-owned `gh` package wrapper
-  reads it only when `GH_TOKEN` is otherwise absent, so `gh` and its Git
-  credential helper work inside Nix dev shells without copying the secret into
-  Nix, exporting it process-wide, or adding per-repository configuration.
-- The fine-grained token passes identity, repository contents, issues, pull
-  requests, Actions, and organization Projects reads with no stored fallback.
-  The organization exposes 219 open issues, five open pull requests, and 60
-  Projects. Project 52 is a 38-issue high-level overview; Project 8 is an
-  82-item software backlog with the native ticket fields needed for the planned
-  workflow. Its only three items assigned to `jellespr` are Done, while the two
-  open issues assigned across the organization are not present there. Keep the
-  native `gh` and Git workflow and wait for the first real Monday ticket; add no
-  dashboard or wrapper before usage exposes a concrete gap.
-- The user activated the initial GitHub token loader, whole-directory skill
-  owner, and durable remote boundary. A fresh shell contained the fine-grained
-  `GH_TOKEN`, `nixos-maintainer` resolved to a store-backed directory, the
-  generated global `AGENTS.md` contained the strict remote-state policy, and
-  the user confirmed `gh project list --owner yookrdev` succeeds. A cached
-  nix-direnv shell then proved it strips inherited `GH_TOKEN`; this concrete gap
-  prompted the invocation-scoped wrapper above. After activation, a cached dev
-  shell contains no `GH_TOKEN`, while `gh api user` identifies `jellespr` and
-  Git reads the private `constant-store` remote through the wrapper-backed
-  credential helper.
-- The former Context7 declaration put a literal key in
-  `env_http_headers`, whose values Codex interprets as environment-variable
-  names; it therefore exposed the secret without supplying the documented
-  authentication. The static key is absent from the current worktree. Official
-  Codex configuration and Context7 documentation instead support the built
-  `http_headers_helper`, which emits the required `Authorization: Bearer` header.
-  The user replaced and revoked the historical key, the machine-local file is
-  mode 0600, and a restarted Codex session successfully resolves Nixpkgs and
-  queries its documentation through Context7.
-- The PR gate used `prediction-api#125`: native `gh pr view`, `checks`, and
-  `diff` reads work, while an isolated exact-base reconstruction passes patch,
-  whitespace, and Rust formatting checks and leaves no durable checkout. The PR
-  has no CI, review, linked issue, or concurrency/retry regression test for its
-  deadlock change; private dependency and MySQL requirements prevented a safe
-  full test. Native GitHub and Git tooling suffice without another review UI.
-- Five authorized ephemeral read-only Codex evaluations respected the no-switch
-  boundary and generally selected the right owners, but exposed that the live
-  `nixos-maintainer` file was absent from the model-visible skill catalog. Home
-  Manager now links the whole skill directory, the shape documented as supported
-  by Codex, rather than linking only `SKILL.md`. The flake and generated Home
-  Manager build pass, and an isolated Codex discovery probe returns
-  `DISCOVERED`; the live store-backed directory is now discoverable.
-- Herdr reports the agent lifecycle correctly and preserves its pane and output
-  across detach and reattach. Its native defaults suffice; no configuration or
-  wrapper was added.
-- In zsh, never use lowercase `path` as a loop or local variable: it is tied to
-  `PATH`. A diagnostic command temporarily hid normal executables by doing so;
-  the declarative session environment was correct and needed no patch.
-- Pinta passed the bounded real-edit trial and is selected; GIMP is absent from
-  the active workstation package set.
-- `sync/notes` is now the sole declarative notebook owner, with `daily`,
-  `meetings`, and `transcripts` directories, a native `zk daily` alias, and a
-  `Super+N` dedicated Kitty/Neovim launcher. The five unique authored work notes
-  were copied byte-for-byte, and both distinct todo lists were merged without
-  dropping an item. Syncthing returned to idle with no needed files, pull
-  errors, or new conflicts. The user confirmed the daily launcher and migrated
-  contents, then explicitly approved moving the intact `sync/work/notes`
-  rollback copy to desktop Trash. The pre-merge todo copies in `/tmp` may now
-  expire normally.
-- The Fossify pilot produced a 10.28-second, mono 48 kHz AAC/M4A named
-  `20260906_004200.m4a`. Zenith's Syncthing log records its completed transfer at
-  00:44:12, after the recording stopped, and the received file remains stable
-  and media-readable. Fossify will write future recordings directly into
-  `recordings/inbox`; this is a native one-time producer setting, not a manual
-  filing step. Orion now owns the CPU `whisper-cpp` consumer through a systemd
-  path unit. The scanner waits for five minutes of unchanged size, nanosecond
-  mtime, and inode, validates media duration, archives without clobbering, and
-  publishes an unlabeled transcript when diarization is unavailable. A copied
-  sample passed that complete CPU fallback path in an isolated sync tree. The
-  user deployed Orion with
-  `nixos-rebuild switch --target-host orion --flake ~/.config/nixos#orion`,
-  activated Zenith's desktop changes, and stopped Zenith's old timer before the
-  shared-inbox test. Moving only the observed sample into Orion's inbox triggered
-  the path unit; after the full settlement interval, roughly two minutes of CPU
-  inference produced a 563-byte fallback transcript and archived the original
-  at its unchanged 126741-byte size with no failure artifact. The results synced
-  back to Zenith, and both current generations match the simplified
-  configuration: Orion is the sole declarative transcription owner. The user
-  confirmed the sample's bilingual output. Zenith's already accepted 33 MB
-  pyannote model contained no credential files and was copied byte-for-byte to
-  Orion; a guarded isolated rerun then completed diarization and atomically
-  replaced the fallback transcript with the user's approval while preserving
-  the archived audio hash. All five temporary audio/transcript test directories
-  were removed from Zenith and Orion; the canonical synchronized archive and
-  transcript remain.
-- Evolution 3.60.2 is composed through Nixpkgs with `evolution-ews` 3.60.2,
-  whose pinned source contains the separate native Microsoft 365 mail,
-  calendar, contacts, recurrence, and OAuth backends. Live inspection caught
-  that overriding `evolutionWithPlugins.plugins` replaced its default Evolution
-  package, and that a Home Manager package alone did not register the data
-  server on D-Bus. The pilot now uses NixOS's native `programs.evolution`
-  integration with the EWS plugin beside Thunderbird. The follow-up activation
-  succeeded, its source-registry service activates through D-Bus, no account is
-  preconfigured, and no authority is changed. The user deferred account setup;
-  Thunderbird and the Outlook PWA remain the working clients meanwhile.
-- Named database connections and a Marimo-to-HTML report remain workbench
-  evaluation evidence, not scaffolding requirements. Add them only for a real
-  cross-system investigation that gives the queries and report durable value.
-- Run independent pilots in parallel, but gate every retirement separately.
+- Active work repositories live under `~/dev/work`, archives under `.archive`,
+  and worktrees under `.worktrees`. Repository trees never enter Syncthing.
+- Participating repositories expose non-mutating direnv shells, minimal flake
+  checks, native commands through `just`, concise `AGENTS.md`, and machine-local
+  credential inputs.
+- `yookr-workbench` starts with cross-system work only; isolation and additional
+  tools wait for observed needs.
+- Walker's native Elephant menu scans repository roots and calls one Nix-owned
+  `open-project` command. Rare menu changes take effect at login.
+- Kitty and Neovim are the sole declared terminal and editor. Retired duplicate
+  applications and global language runtimes stay absent unless a concrete owner
+  appears.
+- The fine-grained GitHub token and Context7 key stay in mode-0600 machine-local
+  files and are exposed only to their callers. Secrets do not enter Nix or broad
+  process environments.
+- `sync/notes` is the single notebook owner. Daily notes, meetings, and raw
+  transcripts have separate paths, and agents do not create issues or ingest
+  transcripts automatically.
+- Orion is the sole transcription owner. It waits for file settlement, validates
+  media, archives originals, and publishes an unlabeled transcript when
+  diarization fails.
+- Evolution remains a deferred presentation-layer pilot. Microsoft 365 and
+  Radicale remain the data authorities; Thunderbird and Outlook remain available.
+- GitHub and every other repository remote stay read-only. Local files, commits,
+  fetches, clones, and worktrees remain available.
+
+## Next step
+
+Continue an external pilot only when its real input arrives. Otherwise no workflow
+implementation action remains.