# Current work

## Scope and accepted decisions

Foundation pass started 2026-09-19. Improve existing capabilities through discussion
and coherent implementation batches; completion requires the user's agreement.

Accepted: retain host/profile/capability/facts composition and explicit ownership;
Polaris and Zenith have identical intended use; use the four-file harness. Validation
uses a Git-ignore-aware snapshot without index changes, prioritizing low token cost.
The work profile is explicitly provisional. Consolidate the workbench environment
only, using the shared NixOS nixpkgs pin; authored material and the Python lock stay
in the writable workbench. See [design](design.md) for durable boundaries.

## Completed and evidence

- Replaced Constellation with the four-file harness after preserving useful knowledge;
  older archives remain historical sources. Survey began from clean `3c022ad` on Polaris.
- Implemented `just validate` with optional host arguments. Full runs format, evaluate,
  build all hosts, and now build the workbench shell. Logs are brief; details remain
  in `/tmp`. The index is untouched by validation. Both prerequisites were already
  declared on workstations.
- Added provisional `modules/profiles/work.nix`, imported by both workstations.
  It selects existing VPN/development integration, Garden tools, and work Git settings.
  Generic development/editor tools remain shared; SharePoint remains Zenith-only.
- Garden definitions now have one owner in `yookr-dev/_packages.nix`, used by both
  installed tools and `devShells.x86_64-linux.workbench`. Preserved the workbench's
  tools and Python variables; its nixpkgs pin now follows the system as agreed.
- Updated `~/yookr/.envrc` and `~/yookr/workbench/.envrc` to select the shared
  environment; updated workbench README/instructions and removed its redundant
  flake/lock. Its credential/mount body is unchanged. Requests, queries, analysis,
  Python lock, existing changes, and generated data remain in place. Pre-change
  migration files: `/tmp/workbench-environment-before-6k4dwzuo`.
- Full validation passed formatting, evaluation, Orion/Polaris/Zenith builds, and
  workbench shell build on 2026-09-19. Logs: `/tmp/nixos-validate-4ojjb2q7`.
  The existing unknown `modules` output warning remains. Whitespace review passed
  in both repositories; loader changes were compared against pre-change copies.
  No tests, activation, credential loading, mounts, or remote changes.

## Next step and user-owned actions

User reviews and re-allows the two changed `.envrc` files with direnv, and activates
NixOS when ready. Do not run those loaders as an agent. The workbench retains
unrelated uncommitted analysis, documentation, and mount-helper work; do not commit
that work as part of this pass. Replicate the two loader changes and removal of the
old environment definition on Zenith; only Polaris's workspace was changed here.

Evaluate the provisional work boundary in practice, then discuss secret delivery.
Current constraints: human workbench entry exposes both test/live credentials and
starts read-only object-storage mounts; the tools-only environment does neither
but does not erase inherited credentials. SOPS is already used, with different
key locations for system and company material. No credential values were read.
Clarify encrypted-file/key distribution across machines before proposing changes.
Devenv and secretspec remain candidates, not dependencies. No new live authority
or per-connection launchers are authorized.

## Questions to carry into relevant areas

- Desktop integration: terminal/launcher interfaces have inconsistent consumers;
  Mailspring coexists with Thunderbird account declarations; Herdr coexists with
  agent-deck notifications and multiple session tools. Determine purpose before
  removing anything. The disabled nixos-maintainer skill's source remains.
- Cross-host behavior: earlier workspace migration was reported only on Zenith.
  Verify Polaris paths before assuming equivalent filesystem state. TeamViewer and
  SharePoint currently exist only on Zenith despite identical intended use.
- Runtime evidence: earlier theme/greeter, expanded Herdr shortcuts, Handy
  hold/release/paste, and SharePoint activation checks were incomplete. Old build
  results do not establish current behavior. Ask in the relevant area.
- Handy hang investigation remains parked unless requested: a prior debugger
  capture found the recorder waiting for an audio chunk before handling stop;
  Bluetooth failures coincided, and disconnecting Sony WH-1000XM6 helped. The user
  wants that microphone. Persistent HFP was proposed but never applied or verified;
  inference-backend changes were not an established fix.
- Agent evaluation, new mail ingestion, and company credential isolation were
  deferred. Secret-management discussion reopens design, not live access.

The inbox is not a backlog. Detailed old handoffs remain in Git before this batch;
consult them only when their evidence affects a current choice.