Establish repository foundation and shared work environment

docs/current-work.md

@@ -0,0 +1,78 @@
+# Current work
+
+## Scope and accepted decisions
+
+Foundation pass started 2026-09-19. Improve existing capabilities through discussion
+and coherent implementation batches; completion requires the user's agreement.
+
+Accepted: retain host/profile/capability/facts composition and explicit ownership;
+Polaris and Zenith have identical intended use; use the four-file harness. Validation
+uses a Git-ignore-aware snapshot without index changes, prioritizing low token cost.
+The work profile is explicitly provisional. Consolidate the workbench environment
+only, using the shared NixOS nixpkgs pin; authored material and the Python lock stay
+in the writable workbench. See [design](design.md) for durable boundaries.
+
+## Completed and evidence
+
+- Replaced Constellation with the four-file harness after preserving useful knowledge;
+  older archives remain historical sources. Survey began from clean `3c022ad` on Polaris.
+- Implemented `just validate` with optional host arguments. Full runs format, evaluate,
+  build all hosts, and now build the workbench shell. Logs are brief; details remain
+  in `/tmp`. The index is untouched by validation. Both prerequisites were already
+  declared on workstations.
+- Added provisional `modules/profiles/work.nix`, imported by both workstations.
+  It selects existing VPN/development integration, Garden tools, and work Git settings.
+  Generic development/editor tools remain shared; SharePoint remains Zenith-only.
+- Garden definitions now have one owner in `yookr-dev/_packages.nix`, used by both
+  installed tools and `devShells.x86_64-linux.workbench`. Preserved the workbench's
+  tools and Python variables; its nixpkgs pin now follows the system as agreed.
+- Updated `~/yookr/.envrc` and `~/yookr/workbench/.envrc` to select the shared
+  environment; updated workbench README/instructions and removed its redundant
+  flake/lock. Its credential/mount body is unchanged. Requests, queries, analysis,
+  Python lock, existing changes, and generated data remain in place. Pre-change
+  migration files: `/tmp/workbench-environment-before-6k4dwzuo`.
+- Full validation passed formatting, evaluation, Orion/Polaris/Zenith builds, and
+  workbench shell build on 2026-09-19. Logs: `/tmp/nixos-validate-4ojjb2q7`.
+  The existing unknown `modules` output warning remains. Whitespace review passed
+  in both repositories; loader changes were compared against pre-change copies.
+  No tests, activation, credential loading, mounts, or remote changes.
+
+## Next step and user-owned actions
+
+User reviews and re-allows the two changed `.envrc` files with direnv, and activates
+NixOS when ready. Do not run those loaders as an agent. The workbench retains
+unrelated uncommitted analysis, documentation, and mount-helper work; do not commit
+that work as part of this pass. Replicate the two loader changes and removal of the
+old environment definition on Zenith; only Polaris's workspace was changed here.
+
+Evaluate the provisional work boundary in practice, then discuss secret delivery.
+Current constraints: human workbench entry exposes both test/live credentials and
+starts read-only object-storage mounts; the tools-only environment does neither
+but does not erase inherited credentials. SOPS is already used, with different
+key locations for system and company material. No credential values were read.
+Clarify encrypted-file/key distribution across machines before proposing changes.
+Devenv and secretspec remain candidates, not dependencies. No new live authority
+or per-connection launchers are authorized.
+
+## Questions to carry into relevant areas
+
+- Desktop integration: terminal/launcher interfaces have inconsistent consumers;
+  Mailspring coexists with Thunderbird account declarations; Herdr coexists with
+  agent-deck notifications and multiple session tools. Determine purpose before
+  removing anything. The disabled nixos-maintainer skill's source remains.
+- Cross-host behavior: earlier workspace migration was reported only on Zenith.
+  Verify Polaris paths before assuming equivalent filesystem state. TeamViewer and
+  SharePoint currently exist only on Zenith despite identical intended use.
+- Runtime evidence: earlier theme/greeter, expanded Herdr shortcuts, Handy
+  hold/release/paste, and SharePoint activation checks were incomplete. Old build
+  results do not establish current behavior. Ask in the relevant area.
+- Handy hang investigation remains parked unless requested: a prior debugger
+  capture found the recorder waiting for an audio chunk before handling stop;
+  Bluetooth failures coincided, and disconnecting Sony WH-1000XM6 helped. The user
+  wants that microphone. Persistent HFP was proposed but never applied or verified;
+  inference-backend changes were not an established fix.
+- Agent evaluation, new mail ingestion, and company credential isolation were
+  deferred. Secret-management discussion reopens design, not live access.
+
+The inbox is not a backlog. Detailed old handoffs remain in Git before this batch;
+consult them only when their evidence affects a current choice.