# Workflow system execution

Source: [`../workflow-discovery.md`](../workflow-discovery.md)

Apply the global and repository-local `AGENTS.md` files and the ponytail skill
at full intensity throughout. Preserve user work, prefer native capabilities,
and add no abstraction without a demonstrated repeated need.

## Current checkpoint

- Tranche: bootstrap and repository ownership reconciliation
- State: waiting for user credential handling
- Branch: `chore/workflow-system`
- Baseline: `nix flake check --no-build --quiet` passed on 2026-09-05; only
  the existing dirty-tree and unknown `modules` output warnings were emitted.
- Next: relocate the legacy secret, rotate the Context7 key, remove the
  resulting empty legacy directories, and close the ownership tranche.

## Progress

| Batch | State | Evidence or blocker |
| --- | --- | --- |
| Bootstrap and repository ownership | Waiting for user | Repository and dashboard reconciliation complete; credential cleanup remains |
| Declarative workstation foundation | Pending | Depends on canonical paths |
| Repository contracts and workbench | Pending | Depends on repository reconciliation |
| Desktop, agents, notes, PIM, transcription | Pending | Independent pilots follow foundation changes |
| Conditional retirement and completion | Pending | Requires per-pilot evidence |

## Repository checkpoints

| Repository | Branch | Commit | Purpose |
| --- | --- | --- | --- |
| NixOS configuration | `chore/workflow-system` | `41bc61b` | Discovery, paths, Git identity, and Codex defaults |
| `yookr-dashboard-new` | `feat/gogv2` | `934605d` | Remove obsolete dashboard converter |

## Human actions

- Rotate the exposed Context7 key and provide `CONTEXT7_API_KEY` through a
  mode-0600 machine-local environment file on each workstation before removing
  the static user-config header.
- Relocate the mode-0644 `/home/kiri/work/SECRETS` file to an approved private
  owner and restrict it; its contents have not been inspected.
- Destructive cleanup, credentials, activation, and empirical pilot decisions
  will be surfaced here before use.

## Decisions and discoveries

- Use `/home/kiri/work/repos/yookr-dashboard-new` as the reconciliation base;
  its `feat/gogv2` head is 17 commits newer than the sync copy and matches its
  remote-tracking branch.
- The user confirmed the legacy BSON migration is no longer needed and the
  former work copy is authoritative. The sync copy was explicitly deleted;
  its removal may propagate through Syncthing.
- Active repositories now live under `/home/kiri/dev/work`; inactive material
  is preserved intact under `.archive`, and the registered dashboard sensor
  worktree is under `.worktrees`.
- Removed the obsolete dashboard converter app and Python dependency. The
  dashboard flake evaluates, while the pre-existing feature work remains
  uncommitted and unstaged.
- Pruned the absent `feat/echarts-domain` worktree metadata; its branch and
  commit remain. The registered sensor worktree is valid at its new path.
- Shared Codex defaults and MCP endpoints are generated at
  `/etc/codex/config.toml`; Context7 reads its header from the environment. The
  unused generic `~/.config/mcp/mcp.json` owner is removed on next activation.
- Removed redundant legacy-path trust entries from the current Codex config;
  the existing trusted home scope covers the moved repositories.
- Bruno's transitional OpenAPI reference now follows the archived management
  repository until the HTTP pilot retires or retains Bruno.
- Post-move repository IDs, remotes, dirty counts, and the registered sensor
  worktree match the pre-move inventory. The Nix flake still evaluates.
- No-link system builds for Zenith, Polaris, and Orion pass with the migrated
  paths and declarative Codex defaults.
- Run independent pilots in parallel, but gate every retirement separately.