135 lines
8.8 KiB
Markdown
135 lines
8.8 KiB
Markdown
# Current work
|
||
|
||
## Phase and working method
|
||
|
||
Implementation is authorized and underway. Do not restart the broad design pass or
|
||
reconfirm accepted choices. `docs/design.md` owns the model, decisions and coding
|
||
conventions; README owns navigation/maintenance; operational details live with owners.
|
||
|
||
Complete independent agreed work and obvious fixes autonomously. Leave consequential
|
||
unknowns pending and collect recommendations/alternatives into one substantial review
|
||
batch. Ask earlier only to prevent broad rework/blockage. The old 2–4-question quota
|
||
is superseded. Keep effort focused; no speculative systems or peripheral research.
|
||
Do not write or run tests or perform extensive validation unless explicitly requested.
|
||
Do not activate, push, decrypt for discovery or access company systems with write
|
||
authority. No subagents unless explicitly authorized by current instructions.
|
||
|
||
Keep this record current by replacing superseded state. Pass-specific procedures
|
||
stay here, not in AGENTS. The user must agree before the overall pass is complete.
|
||
The unedited `~/sync/notes/setup-todo.md` remains an idea inbox, not authorization.
|
||
|
||
## Implemented, reviewed and validated; awaiting user checkpoint
|
||
|
||
- Flat capability owners; service category flattened. AI, theme, Handy and
|
||
transcription support colocated. Imported Nix helpers moved under `_support/`.
|
||
File management owns Nautilus/GVfs/udisks; keyring remains separate.
|
||
- Removed Walker project discovery, agent-deck/notify, tmux, Zellij, TeamViewer and
|
||
direnv. Removed the uninstalled nixos-maintainer skill source. Retained Herdr,
|
||
Ollama/grounded-docs and their data, mail/calendar tools, dictation/transcription.
|
||
- Shared notes launcher uses Kitty's explicit directory and native zk note picker;
|
||
the picker already supports Ctrl+E creation. Oil's mini.icons provider loads
|
||
before initial directory buffers. Manual workspace naming/clearing and visible
|
||
Noctalia labels; shell titles include directory/command. Garden shell initialization
|
||
now belongs to company integration instead of every host's generic shell.
|
||
- Kanagawa declares Adwaita/hicolor icon fallback; modest Limine branding/layout.
|
||
Walker uses upstream Elephant without a local vault patch. It may query `rbw` at startup.
|
||
- GitHub devenv 2.3.2 installed with native Zsh hook and upstream reload defaults.
|
||
CLI dependencies keep upstream pins/cache; workbench tools use this repository's
|
||
exact nixpkgs pin. Company tools are also installed through the work profile. Product and
|
||
personal environments are untouched. No external loader was sourced or changed.
|
||
- Workbench runtime SecretSpec export helper resolves company/live/test independently,
|
||
clears stale owned variables, reports value-free status, and supports tools-only
|
||
entry/retry. Source mappings/provisioning remain pending below.
|
||
- User-run encrypted company migration helper prepared, never run. Company document
|
||
absent until user provisioning. Test mapping and login remain deliberately
|
||
unimplemented until the concrete context and plugin are known; the loader accepts
|
||
only an explicit noninteractive runtime snapshot. No company credential values
|
||
have been read.
|
||
- Both workstations select persistent read-only OBS/SharePoint user mounts, no content
|
||
cache; replaced Zenith-only hourly mirror. Existing data is preserved. Credentials,
|
||
old OBS mount handover and runtime acceptance remain user-owned.
|
||
- Tailscale enabled on all hosts; ordinary SSH keys retained. Zenith SSH is tailnet-only,
|
||
Polaris LAN SSH unchanged, Orion public SSH unchanged pending verification.
|
||
- Documentation consolidated; coding conventions in design, short AGENTS retained.
|
||
Validation prepares upstream devenv's import-from-derivation dependencies before
|
||
read-only flake checking, accepts the repository's declared official cache, and
|
||
reports interruption concisely. Full builds still include the tools-only shell.
|
||
|
||
## Decisions/provisioning still needed
|
||
|
||
1. **Company-root activation.** Native devenv suppresses its hook inside an active
|
||
devenv shell, including nested projects. No root environment is generated now;
|
||
recommend globally installed company tools at root and autoactivation only in
|
||
workbench. This avoids custom activation machinery; confirm at the user checkpoint.
|
||
2. **Test SecretSpec mapping.** Need the explicit test context and existing application
|
||
Secret/namespace/key coordinates (metadata only, no values). Confirm whether
|
||
database Secrets hold complete URLs or separate components. Do not invent keys,
|
||
silently use the current context or fall back to live/SOPS test credentials.
|
||
Test loading reports unavailable until its runtime manifest and login snapshot exist.
|
||
3. **Explicit-login mechanism.** Final review removed the generic ExecCredential
|
||
interpreter: it duplicated a security-sensitive Kubernetes client protocol before
|
||
the actual company plugin was known. Inspect the selected context's exec stanza,
|
||
then choose its native/provider-specific cached login flow and prepare a mode-0600
|
||
runtime snapshot. Shell entry must not launch authentication.
|
||
4. **Live MariaDB certificate verification.** The migration helper preserves the
|
||
old `ssl-verify-server-cert=0` behavior. Before running it, either explicitly accept
|
||
that legacy risk or identify the correct CA/hostname settings and enable verification.
|
||
5. **Manual provisioning/acceptance.** Company SOPS recipients/migration, rclone
|
||
OAuth on both hosts, old OBS mount handover, devenv trust/responsiveness, Noctalia
|
||
Radicale password and private Outlook ICS URL, tailnet enrollment/private SSH.
|
||
See workbench README and root README. Do not close public Orion SSH yet.
|
||
6. **Guidelines review.** Design now spells out owner naming, module selection,
|
||
helper placement, package reuse/pinning, runtime boundaries and validation. No new
|
||
test policy, automation framework or pass-specific repo-wide rules were added.
|
||
|
||
## Validation state
|
||
|
||
Final full validation passed before the final review deletions:
|
||
`/tmp/nixos-validate-t7zv1zux` (session 88912,
|
||
completed exit 0). Formatting, devenv preparation, flake check, all three host
|
||
builds (Orion, Polaris, Zenith), and the tools-only workbench build passed.
|
||
This includes the final notes startup ordering, FUSE wrapper paths, native Zsh retry
|
||
function and SecretSpec package collision fix. The vault patch was removed afterward.
|
||
No systems were activated.
|
||
|
||
Native devenv tools-only startup also passed in an isolated temporary home:
|
||
`/tmp/foundation-native/startup.log`. Company/live/test loading was disabled;
|
||
SecretSpec 0.20.0 and Python 3.14.7 were available. No company credentials loaded.
|
||
|
||
Clean-home manual editor checks passed: direct directory startup renders a Lua-file
|
||
icon in Oil; opening the note picker after VimEnter reaches TelescopePrompt.
|
||
Evidence: `/tmp/foundation-editor-check/{startup,notes}.log`. No real notebook or
|
||
credentials loaded. Built Kanagawa index declares `Inherits=Adwaita,hicolor`.
|
||
Python source syntax and local documentation links checked; no automated tests added.
|
||
|
||
The earlier final review removed the unaccepted Kubernetes login wrapper and the
|
||
machine-wide devenv cache setting; the flake-scoped cache remains. Full builds were
|
||
not repeated for those deletions. The later Walker patch removal has not been built.
|
||
|
||
Builds do not establish interactive acceptance. The user checkpoint remains; do not
|
||
repeat full builds for documentation-only handoff edits.
|
||
|
||
## Review checkpoint
|
||
|
||
The final diff was reviewed for correctness, integration and Ponytail complexity.
|
||
Desktop/capability moves and repository wiring had no material findings. The review
|
||
removed the speculative Kubernetes login interpreter and kept the devenv cache at
|
||
flake scope instead of granting it machine-wide trust. The remaining Python has a
|
||
concrete role: in-memory concurrent secret loading with completeness checks, one-time
|
||
encrypted credential reshaping, dynamic OBS rclone configuration, or pre-existing
|
||
dictation/transcription behavior.
|
||
|
||
The user checkpoint is still required before this pass is complete. The implementation
|
||
was committed as `5748b34` after the initial foundation commit `f164d8b`. Later
|
||
cleanup removed the Walker patch, Handy test and AI capability README.
|
||
No activation was recorded during that pass. External workbench analysis/content
|
||
changes are unrelated and must not be committed here. Previous external loader
|
||
copies remain at `/tmp/workbench-environment-before-6k4dwzuo`; only root/workbench environment documentation and ignore entries were updated.
|
||
Backups: `/tmp/foundation-workbench-docs-bvrs1hu9`. Old external loaders remain
|
||
until user activation, so the currently running system is not broken. Constellation documents were already
|
||
superseded and removed in the prior foundation commit.
|
||
|
||
Deliberate deferrals remain in design: backups declined, dashboard scrapped,
|
||
Zenith Plymouth and extra Noctalia keyboard controls deferred, stronger credential
|
||
isolation/new agent workflows/indexing and unrelated editor redesign out of scope.
|