lux/docs/constellation-work.md

# Constellation: working state

Read [the design](constellation.md) and this file to resume. Keep this file short:
replace superseded state rather than appending a chronological log.

## Working agreement

- Explore the philosophy through concrete use, discuss meaningful choices, then
  implement a small coherent change. Curiosity and alternative designs are welcome;
  an idea need not prove a defect before we explore it.
- Write succinctly without losing important details. Distinguish accepted choices,
  proposals and observations. Ask when intent would change the design; resolve
  routine implementation details autonomously. Infer opportunities from the user's
  philosophy and actual use; contribute design ideas beyond literal backlog items.
  Continue to the next natural step when the user could only usefully say "continue";
  pause for material choices or missing authority, not routine progress.
- The main agent owns alignment, design and integration and may do small work.
  Use subagents for bounded independent investigations or implementation with clear
  ownership. Begin with at most two workers; avoid overlapping writes, duplicate
  investigations and mandatory delegation of trivial tasks.
- Give workers the question, relevant paths, constraints and expected result.
  Prefer a compact brief and fresh context when sufficient; retain relevant prior
  context for follow-ups. Return conclusions, uncertainty and evidence pointers,
  not raw logs. Astra/Sol orchestration is a candidate to learn from, not a fixed rule.
- Read only what can affect the current decision. Use quiet commands and bounded
  output; keep large logs in `/tmp` and inspect relevant failures. Do not repeatedly
  check settled facts. Consult current documentation for consequential or unfamiliar
  interfaces when needed for the task.
- No tests unless explicitly requested. Keep other verification proportional;
  report only what was actually checked. Avoid turning small changes into campaigns.
- Keep durable decisions in the design and current questions/next steps here.
  Add an area-specific document only when an active topic outgrows this arrangement.
  No separate backlog, scratchpad, audit ledger or agent-role files for now.

## Boundaries

Repository remotes are read-only. Only the user activates system generations.
Agents must not have write access to live company systems; test writes require
task-specific authority and care. Do not read secret values for layout discovery.
Current exploration does not authorize relocating credentials, synchronizing
company content or deleting existing material. Existing local changes are preserved.

## Current exploration — organization

Accepted: repositories are primarily code; general notes belong outside them.
Company work is broader than repositories. Workbench has a different purpose from
product projects. Structure should be intuitive without constraining future work.

Observed through shallow listings: project groups (now relocated below), `~/work`,
`~/sync/notes`, mixed material in `~/sync`, and loose work artifacts in home.
Names alone do not establish ownership, contents or redundancy.

Accepted: the workbench supplies an environment at the company root. Reusable HTTP
and SQL files need a home. Native tools should remain freely composable; the current
custom inventory and mail commands are not the desired direction. Notes, credential
placement and synchronization remain open; no relocation is approved.

Workbench `.envrc` still loads tools and exports test/live database, API,
object-store and RabbitMQ credentials together. Neovim's global database plugin
names four company connections. No services or secrets were read.

Direction: a tool/context environment at company root, maintained `workbench/`
tooling with `http/` and `databases/` material, and separate local investigation files.
Human credentials are supplied through environment variables for both test/live;
agent access requires separate treatment.
Organize reusable requests by service and queries by database, with visible target
selection. Keep setup
shortcuts only where they add value; let kubectl and other clients own operations.
Mail needs a searchable representation that preserves message meaning; rg over raw
mailbox storage is not automatically an adequate substitute for the current helper.

API/database proposal: reusable HTTP files grouped by service, shared authentication
requests, and explicit visible HTTP target selection. Start database exploration
from a named connection (database + environment), creating or reopening an attached
query; retain direct-file opening with explicit connection assignment. Keep reusable
query text separate from target credentials. Working queries should survive restart
without automatically becoming tracked workbench material.

Native evidence: [Kulala imports](https://github.com/mistweaverco/kulala.nvim/blob/main/doc/kulala.import-and-run-http.txt)
support sharing named authentication requests across files.
[Dadbod UI](https://github.com/kristijanhusak/vim-dadbod-ui/blob/master/doc/dadbod-ui.txt)
supports connection-associated saved queries, persistent temporary-query locations
and explicit assignment of independently opened buffers. Callable connection URLs
resolve while populating the list, not on selection (confirmed in pinned source);
they do not support the proposed per-selection credential delivery.
Its save location also holds connection state, so do not put the entire directory
under Git. Context7 covered Kulala; Dadbod required upstream help as fallback.
The persistent-query option was also confirmed in pinned Dadbod source. HTTP
import/run syntax was checked in current Kulala documentation; not exercised
against company services.

Chosen root: `~/yookr`. Company-wide Neovim search is explicitly deferred for lack
of a concrete use case. Existing project search remains unchanged.

Created `~/yookr` directly with ordinary `.envrc` and `AGENTS.md` files. Moved the
actual workbench checkout from `~/dev/work/yookr-workbench` to `~/yookr/workbench`;
the temporary link was removed. Prefer direct moves over compatibility links.
Removed the earlier Home Manager
workspace declarations: Nix owns tools/integration, not working directories or
their authored files. Notes and credentials remain in place;
workbench uncommitted work moved with the checkout. Walker's Yookr entry and Git's new work-path identity rule remain
activated by the user.

Repository environments remain independent. Future relocation/composition must
account for their own `.envrc` files (direnv provides `source_up`) without imposing
a personal directory layout on portable repositories. The workbench's own `.envrc`
still exports aggregate credentials; root entry uses its flake only.

Verification: checked ordinary file types and whitespace
after the ownership correction. The earlier Nix configuration evaluation passed;
it was not repeated for removing the workspace declarations. No builds, tests,
credential reads or activation performed. The workspace files exist now; the user
can authorize its environment with `direnv allow ~/yookr`. System activation for
Walker/Git also includes pre-existing editor/AI/SharePoint changes in this checkout.

Credential decision: user wants environment-variable delivery of BOTH test and
live credentials, with ordinary Neovim startup. Removed the rejected `mysql-test`
launcher; existing workbench `.envrc` already supplies both and remains unchanged.
Do not resume per-selection decryption or add per-connection launchers. The root
environment is still tools-only; agent isolation remains separate from the chosen
human workflow. No secrets were decrypted or databases contacted.

API/database organization implemented: `http/` contains service-specific files,
shared `auth.http` and the unchanged endpoint catalogue. Protected requests use
native `import`/`run` to authenticate before execution in the selected environment.
`databases/mysql/` separates server discovery and the two existing schemas;
`databases/mongodb/server.js` preserves MongoDB discovery. Existing request and
query contents were retained, with no additional system access or credentials.
Private HTTP environment files are ignored at any depth. No compatibility files.

Neovim uses `db_ui_tmp_query_location` under its data directory at
`db_ui/working`; write working queries there without promoting them into Git.
Dadbod's saved-query storage and connection selection remain unchanged. This
one-line editor change has been activated by the user. Whitespace and Lua syntax
were checked; no tests, company-service requests or decryption performed.

Target context prepared in the existing Lualine statusline: pinned Kulala 6.29.0
supplies a native `kulala` component for `.http` buffers (environment selection);
Dadbod's `db_ui#statusline` supplies connection/schema/table in attached query
buffers and timing in result buffers. No copied target state or credential URLs.
These additions await the next user activation; they are indicators, not access
controls. Lua syntax and whitespace checked; no company-service calls or tests.

Access isolation explicitly deferred by the user. Separate read-only credentials
for agents are the eventual direction, but cannot be created now. Root remains
tools-only; the workbench child supplies both human credential environments.
Existing agent restrictions remain. Do not revisit isolation as a prerequisite
for unrelated work or silently broaden access.

Current focus: the bigger picture, not further API/database polish. Revisited the
idea inbox. Proposed areas for exploration, not a committed implementation plan:
places and ownership; navigation and interaction; human/agent collaboration;
system operation and maintenance. Start with places because they establish the
context that launchers, editors and agents enter.

User clarification: work is mostly project-based, not organized into topics or
investigations; relevant project material mostly stays in the repository. Notes
are mostly meeting notes so far. Do not add investigation folders or outer project
containers without a concrete need.

Approved relocation completed: `~/dev/work` moved directly to `~/yookr/projects`,
including `.archive` and `.worktrees`; remaining `~/dev` renamed `~/projects`,
retaining `own`, `ext`, `forks`. No compatibility links. Repaired the three linked
worktrees in yookr-dashboard and yookr-dashboard-new with native Git repair;
all three resolve at their new paths. Updated company README/AGENTS references.
Walker roots, XDG projects path and Git identity rules updated in Nix. The new
XDG projects path is now active. Existing shells and path-dependent development environments
may need reopening/recreation; no caches or project files were rewritten.

User requested removal of Bruno collections and their Syncthing configuration.
Stopped the local Syncthing service before moving `~/dev/bruno` to Trash
(recoverable); removed its folder entry from shared Nix configuration. Other
devices' files were not touched. Syncthing was stopped for the move and has since
resumed (observed active on the following turn).
Only zenith's filesystem was migrated; other hosts need their own relocation
before adopting the shared project-path change. Nix files formatted; worktree
paths and whitespace checked. No tests or remote repository changes.

Notes entry: existing Neovim `Space n f` finds notes, `Space n n` creates one,
and `Space n t` finds tags. Niri `Mod+N` opens a daily note. Added a standard
Notes desktop entry, discoverable through Walker, opening `~/sync/notes` in
terminal Neovim. This neutral entry uses existing file/text search (`Space s f`,
`Space s g`) and note commands, without creating a daily note. Pending activation.
No new search provider, shortcuts, templates or note directories. Notes placement
and existing daily-note behavior unchanged; agent isolation remains deferred.

Current exploration: agent-session navigation. Agent-deck 1.15.0 is already
installed alongside Herdr and tmux; do not plan installation from stale notes.
Its installed help provides session search, attach and Ctrl+Q detach, plus native
project-path sessions and optional groups. No sessions were started, inspected,
stopped or migrated. Asked the user whether they have tried it and what feels good
or awkward before changing bindings or selecting it as Herdr's replacement.

Proposed division of responsibility: Walker enters a place/application, Niri
navigates visible windows, the session manager finds and resumes agent work.
Avoid mirroring the whole session list into another launcher or forcing a group
hierarchy before actual use. Agent isolation remains deferred.

Command cleanup complete: archived the workbench justfile, custom mail reader,
discovery pilot and old README in its `.archive/`. Removed the obsolete command
catalogue check and bubblewrap/Python/just shell dependencies. The shorter README
documents native Garden target/session setup followed by ordinary kubectl or K9s,
fixes product-repository links after relocation, and marks mail search unresolved.
No credentials, mail or remote systems were accessed. Files are recoverable in the
archive; no replacement wrapper or index was introduced.
Workbench `nix flake check --no-build --quiet` and whitespace checking passed.

Iteration setup: all five previous docs moved under `docs/.archive/`, retaining
their relative layout. Prior editor, AI and SharePoint implementation changes
remain; consult their owners when those areas become active.