# Workflow system execution

Source: [`../workflow-discovery.md`](../workflow-discovery.md)

Apply the global and repository-local `AGENTS.md` files and the ponytail skill
at full intensity throughout. Preserve user work, prefer native capabilities,
and add no abstraction without a demonstrated repeated need.

## Current checkpoint

- Tranche: repository contracts and Yookr workbench
- State: active
- Branch: `chore/workflow-system`
- Baseline: `nix flake check --no-build --quiet` passed on 2026-09-05; only
  the existing dirty-tree and unknown `modules` output warnings were emitted.
- Next: prove the common contract in `rules-service`, `yookr-api`, and
  `traceability-data-model`; create the minimal workbench only after ownership
  of the pilot artifacts is clear.

## Progress

| Batch | State | Evidence or blocker |
| --- | --- | --- |
| Bootstrap and repository ownership | Waiting for user | Repository and dashboard reconciliation complete; credential cleanup remains |
| Declarative workstation foundation | Complete | All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider |
| Repository contracts and workbench | Active | Three repository pilots audited; implementation follows per-repository checkpoints |
| Desktop, agents, notes, PIM, transcription | Pending | Independent pilots follow foundation changes |
| Conditional retirement and completion | Pending | Requires per-pilot evidence |

## Repository checkpoints

| Repository | Branch | Commit | Purpose |
| --- | --- | --- | --- |
| NixOS configuration | `chore/workflow-system` | `41bc61b` | Discovery, paths, Git identity, and Codex defaults |
| NixOS configuration | `chore/workflow-system` | `69552b7` | Simplify flake inputs and declare workstation lifecycle tools |
| `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |

## Human actions

- Rotate the exposed Context7 key and provide `CONTEXT7_API_KEY` through a
  mode-0600 machine-local environment file on each workstation before removing
  the static user-config header.
- Relocate the mode-0644 `/home/kiri/work/SECRETS` file to an approved private
  owner and restrict it; its contents have not been inspected.
- Destructive cleanup, credentials, activation, and empirical pilot decisions
  will be surfaced here before use.

## Decisions and discoveries

- Use `/home/kiri/work/repos/yookr-dashboard-new` as the reconciliation base;
  its `feat/gogv2` head is 17 commits newer than the sync copy and matches its
  remote-tracking branch.
- The user confirmed the legacy BSON migration is no longer needed and the
  former work copy is authoritative. The sync copy was explicitly deleted;
  its removal may propagate through Syncthing.
- Active repositories now live under `/home/kiri/dev/work`; inactive material
  is preserved intact under `.archive`, and the registered dashboard sensor
  worktree is under `.worktrees`.
- Removed the obsolete dashboard converter app and Python dependency. The
  dashboard flake evaluates, while the pre-existing feature work remains
  uncommitted and unstaged.
- Pruned the absent `feat/echarts-domain` worktree metadata; its branch and
  commit remain. The registered sensor worktree is valid at its new path.
- Shared Codex defaults and MCP endpoints are generated at
  `/etc/codex/config.toml`; Context7 reads its header from the environment. The
  unused generic `~/.config/mcp/mcp.json` owner is removed on next activation.
- Removed redundant legacy-path trust entries from the current Codex config;
  the existing trusted home scope covers the moved repositories.
- Bruno's transitional OpenAPI reference now follows the archived management
  repository until the HTTP pilot retires or retains Bruno.
- Post-move repository IDs, remotes, dirty counts, and the registered sensor
  worktree match the pre-move inventory. The Nix flake still evaluates.
- No-link system builds for Zenith, Polaris, and Orion pass with the migrated
  paths and declarative Codex defaults.
- Removed the unused stable Nixpkgs input and made Noctalia follow the root
  package-set pin. Added `just` to the workstation tools and selected the
  store-backed `podman-compose` provider through native `containers.conf`.
- The resulting flake check and no-link builds for all three hosts pass.
- Run independent pilots in parallel, but gate every retirement separately.