lux/modules/capabilities/workbench

Company environment

This capability owns the company-root tools, human workbench environment and persistent read-only company mounts. Garden packaging and company certificates remain in ../yookr-dev/. Requests, queries, analysis, uv.lock, content and runtime state stay in ~/yookr/workbench.

Home Manager installs devenv.nix and devenv.yaml in ~/yookr/workbench (human credentials), selecting the system's exact nixpkgs store path. The work profile also installs the tools for use at the company root without activation. The devenv CLI uses its own upstream dependency closure; this avoids rebuilding its dependencies against an unsupported pin. Its version is locked by the repository flake.

Activation and trust

After reviewing and activating the configuration on each workstation:

1. Remove the obsolete ~/yookr/.envrc and ~/yookr/workbench/.envrc. Direnv is no longer installed or hooked. Product/personal .envrc files remain yours to migrate; this pass does not convert them.
2. Run devenv allow in ~/yookr/workbench only. Open a new terminal for the native Zsh hook. Reload/file watching uses upstream defaults.
3. devenv.lock and .devenv/ are local generated state, not new configuration owners. Do not commit them into the Nix repository. Retain product locks.
4. The human workbench attempts company, live and test resolution independently. workbench-reload retries; workbench-reload --tools-only clears the variables owned by this loader. Existing processes/editors keep their original environment.

For a clean, credential-free check use the flake's tools-only #workbench shell from a clean parent environment. For native devenv without credential loading, set WORKBENCH_TOOLS_ONLY=1 before devenv shell. Neither method removes arbitrary credentials already inherited from its parent; they are not isolation mechanisms.

The company root intentionally has no generated devenv environment pending review: upstream's hook does nothing while another devenv shell is active, so an ancestor shell would prevent automatic workbench entry and interfere with project environments. The recommendation is installed tools at the company root, native activation at the workbench, and product-owned environments below projects/.

Credential provisioning (user-run only)

The encrypted company document belongs at modules/secrets/company.yaml in this repository. It is deliberately absent until you migrate it. Reuse the existing machine age identities; never copy private keys into Git. On each workstation, obtain its public recipient with age-keygen -y /var/lib/sops/keys.txt.

On the machine holding the old credentials, run from this repository:

SOPS_AGE_KEY_FILE="$HOME/.config/sops/age/keys.txt" python3 modules/capabilities/workbench/migrate-credentials.py \
  "$HOME/.config/yookr/credentials.yaml" modules/secrets/company.yaml \
  --age 'POLARIS_PUBLIC_AGE_RECIPIENT,ZENITH_PUBLIC_AGE_RECIPIENT'

The helper decrypts only in memory, preserves the old file, and refuses to overwrite an existing destination. The new document contains root-level company login and live database URLs for SecretSpec, plus the existing leafcloud map for mounts. MySQL certificate verification behavior is preserved. Test credentials are not copied into the new document. Review the encrypted result before a local commit; pushing remains a separate decision. Other machines receive ciphertext through the existing repository. Edit it with sops edit modules/secrets/company.yaml using the machine's normal SOPS_AGE_KEY_FILE=/var/lib/sops/keys.txt.

Test cluster: mapping and login still pending

No cluster query is needed to build this repository. Before enabling test loading, settle the explicit test context and existing application Secret/namespace/key mappings. The loader expects a ~/.config/workbench/test-secrets.toml manifest with profile test, using only explicit k8s+secret://SECRET@NAMESPACE providers and ref.item for existing keys. Required exports are:

• YOOKR_MYSQL_TEST_DATABASE_URL, YOOKR_MONGODB_TEST_DATABASE_URL
• RABBITMQADMIN_USERNAME, RABBITMQADMIN_PASSWORD

If applications store URL components separately, the manifest/composition must be adapted after confirming their keys; do not invent field names or change URL escaping. This manifest is a provisioning boundary pending review, not a second global secret store.

Test loading also requires an explicitly prepared, noninteractive kubeconfig at $XDG_RUNTIME_DIR/workbench/test-kubeconfig. No generic login helper is provided: the actual context and exec plugin must be inspected first, then its native or provider-specific cached login flow selected. Do not reimplement Kubernetes' exec credential protocol for an unknown plugin. Until both runtime files exist, test reports unavailable. Shell entry never invokes authentication or opens a login popup.

SecretSpec exports are captured in memory with stdin closed and a timeout. Errors report only the unavailable source, not provider output or secret values. Sources load independently; unavailable sources clear their old variables. Test never falls back to SOPS, and live never depends on Kubernetes. Native devenv's all-at-once secret resolution is intentionally not used: it would couple their failure behavior.

Mounts

company-obs.service and company-sharepoint.service are user services on both workstations. Mounts live at ~/yookr/workbench/{obs,sharepoint}. They are read-only, use --vfs-cache-mode off, and retry failures every minute. No background content mirror remains. The existing local SharePoint mirror is preserved, not deleted. Small memory buffers and filesystem metadata are still used.

OBS uses the company's encrypted leafcloud map and machine age key. SharePoint uses the existing native rclone remotes company-sharepoint and company-sharepoint-projecten in ~/.config/rclone/rclone.conf; configure/login to these on each workstation with rclone. Tokens remain application-owned outside Git. Before first activation, unmount any old workbench-entry OBS mount. Do not empty or replace nonempty mount directories: move any authored content deliberately first.

systemctl --user restart company-obs company-sharepoint
systemctl --user status company-obs company-sharepoint

Do not invoke the old workspace just mount-obs helper once systemd owns the mount. The old helper/recipes can be removed after the new mounts are accepted in use. Shell exit does not unmount company files. All processes running as your user can read the mounts; these services do not isolate agents.