lux/docs/constellation-work.md

Constellation: working state

Read the design and this file to resume. Keep this file short: replace superseded state rather than appending a chronological log.

Working agreement

• Explore the philosophy through concrete use, discuss meaningful choices, then implement a small coherent change. Curiosity and alternative designs are welcome; an idea need not prove a defect before we explore it.
• Write succinctly without losing important details. Distinguish accepted choices, proposals and observations. Ask when intent would change the design; resolve routine implementation details autonomously. Infer opportunities from the user's philosophy and actual use; contribute design ideas beyond literal backlog items. Continue to the next natural step when the user could only usefully say "continue"; pause for material choices or missing authority, not routine progress.
• The main agent owns alignment, design and integration and may do small work. Use subagents for bounded independent investigations or implementation with clear ownership. Begin with at most two workers; avoid overlapping writes, duplicate investigations and mandatory delegation of trivial tasks.
• Give workers the question, relevant paths, constraints and expected result. Prefer a compact brief and fresh context when sufficient; retain relevant prior context for follow-ups. Return conclusions, uncertainty and evidence pointers, not raw logs. Astra/Sol orchestration is a candidate to learn from, not a fixed rule.
• Read only what can affect the current decision. Use quiet commands and bounded output; keep large logs in /tmp and inspect relevant failures. Do not repeatedly check settled facts. Consult current documentation for consequential or unfamiliar interfaces when needed for the task.
• No tests unless explicitly requested. Keep other verification proportional; report only what was actually checked. Avoid turning small changes into campaigns.
• Keep durable decisions in the design and current questions/next steps here. Add an area-specific document only when an active topic outgrows this arrangement. No separate backlog, scratchpad, audit ledger or agent-role files for now.

Boundaries

Repository remotes are read-only. Only the user activates system generations. Agents must not have write access to live company systems; test writes require task-specific authority and care. Do not read secret values for layout discovery. Current exploration does not authorize relocating credentials, synchronizing company content or deleting existing material. Existing local changes are preserved.

Current exploration — organization

Accepted: repositories are primarily code; general notes belong outside them. Company work is broader than repositories. Workbench has a different purpose from product projects. Structure should be intuitive without constraining future work.

Observed through shallow listings: project groups (now relocated below), ~/work, ~/sync/notes, mixed material in ~/sync, and loose work artifacts in home. Names alone do not establish ownership, contents or redundancy.

Accepted: the workbench supplies an environment at the company root. Reusable HTTP and SQL files need a home. Native tools should remain freely composable; the current custom inventory and mail commands are not the desired direction. Notes, credential placement and synchronization remain open; no relocation is approved.

Workbench .envrc still loads tools and exports test/live database, API, object-store and RabbitMQ credentials together. Neovim's global database plugin names four company connections. No services or secrets were read.

Direction: a tool/context environment at company root, maintained workbench/ tooling with http/ and databases/ material, and separate local investigation files. Human credentials are supplied through environment variables for both test/live; agent access requires separate treatment. Organize reusable requests by service and queries by database, with visible target selection. Keep setup shortcuts only where they add value; let kubectl and other clients own operations. Mail needs a searchable representation that preserves message meaning; rg over raw mailbox storage is not automatically an adequate substitute for the current helper.

API/database proposal: reusable HTTP files grouped by service, shared authentication requests, and explicit visible HTTP target selection. Start database exploration from a named connection (database + environment), creating or reopening an attached query; retain direct-file opening with explicit connection assignment. Keep reusable query text separate from target credentials. Working queries should survive restart without automatically becoming tracked workbench material.

Native evidence: Kulala imports support sharing named authentication requests across files. Dadbod UI supports connection-associated saved queries, persistent temporary-query locations and explicit assignment of independently opened buffers. Callable connection URLs resolve while populating the list, not on selection (confirmed in pinned source); they do not support the proposed per-selection credential delivery. Its save location also holds connection state, so do not put the entire directory under Git. Context7 covered Kulala; Dadbod required upstream help as fallback. The persistent-query option was also confirmed in pinned Dadbod source. HTTP import/run syntax was checked in current Kulala documentation; not exercised against company services.

Chosen root: ~/yookr. Company-wide Neovim search is explicitly deferred for lack of a concrete use case. Existing project search remains unchanged.

Created ~/yookr directly with ordinary .envrc and AGENTS.md files. Moved the actual workbench checkout from ~/dev/work/yookr-workbench to ~/yookr/workbench; the temporary link was removed. Prefer direct moves over compatibility links. Removed the earlier Home Manager workspace declarations: Nix owns tools/integration, not working directories or their authored files. Notes and credentials remain in place; workbench uncommitted work moved with the checkout. Walker's Yookr entry and Git's new work-path identity rule remain activated by the user.

Repository environments remain independent. Future relocation/composition must account for their own .envrc files (direnv provides source_up) without imposing a personal directory layout on portable repositories. The workbench's own .envrc still exports aggregate credentials; root entry uses its flake only.

Verification: checked ordinary file types and whitespace after the ownership correction. The earlier Nix configuration evaluation passed; it was not repeated for removing the workspace declarations. No builds, tests, credential reads or activation performed. The workspace files exist now; the user can authorize its environment with direnv allow ~/yookr. System activation for Walker/Git also includes pre-existing editor/AI/SharePoint changes in this checkout.

Credential decision: user wants environment-variable delivery of BOTH test and live credentials, with ordinary Neovim startup. Removed the rejected mysql-test launcher; existing workbench .envrc already supplies both and remains unchanged. Do not resume per-selection decryption or add per-connection launchers. The root environment is still tools-only; agent isolation remains separate from the chosen human workflow. No secrets were decrypted or databases contacted.

API/database organization implemented: http/ contains service-specific files, shared auth.http and the unchanged endpoint catalogue. Protected requests use native import/run to authenticate before execution in the selected environment. databases/mysql/ separates server discovery and the two existing schemas; databases/mongodb/server.js preserves MongoDB discovery. Existing request and query contents were retained, with no additional system access or credentials. Private HTTP environment files are ignored at any depth. No compatibility files.

Neovim uses db_ui_tmp_query_location under its data directory at db_ui/working; write working queries there without promoting them into Git. Dadbod's saved-query storage and connection selection remain unchanged. This one-line editor change has been activated by the user. Whitespace and Lua syntax were checked; no tests, company-service requests or decryption performed.

Target context prepared in the existing Lualine statusline: pinned Kulala 6.29.0 supplies a native kulala component for .http buffers (environment selection); Dadbod's db_ui#statusline supplies connection/schema/table in attached query buffers and timing in result buffers. No copied target state or credential URLs. These additions await the next user activation; they are indicators, not access controls. Lua syntax and whitespace checked; no company-service calls or tests.

Access isolation explicitly deferred by the user. Separate read-only credentials for agents are the eventual direction, but cannot be created now. Root remains tools-only; the workbench child supplies both human credential environments. Existing agent restrictions remain. Do not revisit isolation as a prerequisite for unrelated work or silently broaden access.

Current focus: the bigger picture, not further API/database polish. Revisited the idea inbox. Proposed areas for exploration, not a committed implementation plan: places and ownership; navigation and interaction; human/agent collaboration; system operation and maintenance. Start with places because they establish the context that launchers, editors and agents enter.

User clarification: work is mostly project-based, not organized into topics or investigations; relevant project material mostly stays in the repository. Notes are mostly meeting notes so far. Do not add investigation folders or outer project containers without a concrete need.

Approved relocation completed: ~/dev/work moved directly to ~/yookr/projects, including .archive and .worktrees; remaining ~/dev renamed ~/projects, retaining own, ext, forks. No compatibility links. Repaired the three linked worktrees in yookr-dashboard and yookr-dashboard-new with native Git repair; all three resolve at their new paths. Updated company README/AGENTS references. Walker roots, XDG projects path and Git identity rules updated in Nix. The new XDG projects path is now active. Existing shells and path-dependent development environments may need reopening/recreation; no caches or project files were rewritten.

User requested removal of Bruno collections and their Syncthing configuration. Stopped the local Syncthing service before moving ~/dev/bruno to Trash (recoverable); removed its folder entry from shared Nix configuration. Other devices' files were not touched. Syncthing was stopped for the move and has since resumed (observed active on the following turn). Only zenith's filesystem was migrated; other hosts need their own relocation before adopting the shared project-path change. Nix files formatted; worktree paths and whitespace checked. No tests or remote repository changes.

Notes entry: existing Neovim Space n f finds notes, Space n n creates one, and Space n t finds tags. Niri Mod+N opens a daily note. Added a standard Notes desktop entry, discoverable through Walker, opening ~/sync/notes in terminal Neovim. This neutral entry uses existing file/text search (Space s f, Space s g) and note commands, without creating a daily note. Pending activation. No new search provider, shortcuts, templates or note directories. Notes placement and existing daily-note behavior unchanged; agent isolation remains deferred.

Current exploration: agent-session navigation. Agent-deck 1.15.0 is already installed alongside Herdr and tmux; do not plan installation from stale notes. Its installed help provides session search, attach and Ctrl+Q detach, plus native project-path sessions and optional groups. No sessions were started, inspected, stopped or migrated. Asked the user whether they have tried it and what feels good or awkward before changing bindings or selecting it as Herdr's replacement.

Proposed division of responsibility: Walker enters a place/application, Niri navigates visible windows, the session manager finds and resumes agent work. Avoid mirroring the whole session list into another launcher or forcing a group hierarchy before actual use. Agent isolation remains deferred.

Command cleanup complete: archived the workbench justfile, custom mail reader, discovery pilot and old README in its .archive/. Removed the obsolete command catalogue check and bubblewrap/Python/just shell dependencies. The shorter README documents native Garden target/session setup followed by ordinary kubectl or K9s, fixes product-repository links after relocation, and marks mail search unresolved. No credentials, mail or remote systems were accessed. Files are recoverable in the archive; no replacement wrapper or index was introduced. Workbench nix flake check --no-build --quiet and whitespace checking passed.

Iteration setup: all five previous docs moved under docs/.archive/, retaining their relative layout. Prior editor, AI and SharePoint implementation changes remain; consult their owners when those areas become active.