lux/docs/current-work.md

Current work

Phase and working method

Implementation is authorized and underway. Do not restart the broad design pass or reconfirm accepted choices. docs/design.md owns the model, decisions and coding conventions; README owns navigation/maintenance; operational details live with owners.

Complete independent agreed work and obvious fixes autonomously. Leave consequential unknowns pending and collect recommendations/alternatives into one substantial review batch. Ask earlier only to prevent broad rework/blockage. The old 2–4-question quota is superseded. Keep effort focused; no speculative systems or peripheral research. Do not write or run tests or perform extensive validation unless explicitly requested. Do not activate, push, decrypt for discovery or access company systems with write authority. No subagents unless explicitly authorized by current instructions.

Keep this record current by replacing superseded state. Pass-specific procedures stay here, not in AGENTS. The user must agree before the overall pass is complete. The unedited ~/sync/notes/setup-todo.md remains an idea inbox, not authorization.

Implemented, reviewed and validated; awaiting user checkpoint

• Flat capability owners; service category flattened. AI, theme, Handy and transcription support colocated. Imported Nix helpers moved under _support/. File management owns Nautilus/GVfs/udisks; keyring remains separate.
• Removed Walker project discovery, agent-deck/notify, tmux, Zellij, TeamViewer and direnv. Removed the uninstalled nixos-maintainer skill source. Retained Herdr, Ollama/grounded-docs and their data, mail/calendar tools, dictation/transcription.
• Shared notes launcher uses Kitty's explicit directory and native zk note picker; the picker already supports Ctrl+E creation. Oil's mini.icons provider loads before initial directory buffers. Manual workspace naming/clearing and visible Noctalia labels; shell titles include directory/command. Garden shell initialization now belongs to company integration instead of every host's generic shell.
• Kanagawa declares Adwaita/hicolor icon fallback; modest Limine branding/layout. Walker uses upstream Elephant without a local vault patch. It may query rbw at startup.
• GitHub devenv 2.3.2 installed with native Zsh hook and upstream reload defaults. CLI dependencies keep upstream pins/cache; workbench tools use this repository's exact nixpkgs pin. Company tools are also installed through the work profile. Product and personal environments are untouched. No external loader was sourced or changed.
• Workbench runtime SecretSpec export helper resolves company/live/test independently, clears stale owned variables, reports value-free status, and supports tools-only entry/retry. Source mappings/provisioning remain pending below.
• User-run encrypted company migration helper prepared, never run. Company document absent until user provisioning. Test mapping and login remain deliberately unimplemented until the concrete context and plugin are known; the loader accepts only an explicit noninteractive runtime snapshot. No company credential values have been read.
• Both workstations select persistent read-only OBS/SharePoint user mounts, no content cache; replaced Zenith-only hourly mirror. Existing data is preserved. Credentials, old OBS mount handover and runtime acceptance remain user-owned.
• Tailscale enabled on all hosts; ordinary SSH keys retained. Zenith SSH is tailnet-only, Polaris LAN SSH unchanged, Orion public SSH unchanged pending verification.
• Documentation consolidated; coding conventions in design, short AGENTS retained. Validation prepares upstream devenv's import-from-derivation dependencies before read-only flake checking, accepts the repository's declared official cache, and reports interruption concisely. Full builds still include the tools-only shell. The devenv cache is now in persistent NixOS Nix settings; the flake cache hint was removed.
• Noctalia tracks upstream's cachix branch with its own nixpkgs pin; persistent Nix settings include the official cache and signing key. The existing 5.2.1 commit is unchanged. Its resulting x86_64 package has a matching signed cache entry; the previous package with our nixpkgs pin returned 404. No build or activation was run. For the first activation, pass the cache URL and key from modules/capabilities/nix.nix as extra-substituters and extra-trusted-public-keys options to nh os switch; afterward Nix uses the persistent settings.

Decisions/provisioning still needed

1. Company-root activation. Native devenv suppresses its hook inside an active devenv shell, including nested projects. No root environment is generated now; recommend globally installed company tools at root and autoactivation only in workbench. This avoids custom activation machinery; confirm at the user checkpoint.
2. Test SecretSpec mapping. Need the explicit test context and existing application Secret/namespace/key coordinates (metadata only, no values). Confirm whether database Secrets hold complete URLs or separate components. Do not invent keys, silently use the current context or fall back to live/SOPS test credentials. Test loading reports unavailable until its runtime manifest and login snapshot exist.
3. Explicit-login mechanism. Final review removed the generic ExecCredential interpreter: it duplicated a security-sensitive Kubernetes client protocol before the actual company plugin was known. Inspect the selected context's exec stanza, then choose its native/provider-specific cached login flow and prepare a mode-0600 runtime snapshot. Shell entry must not launch authentication.
4. Live MariaDB certificate verification. The migration helper preserves the old ssl-verify-server-cert=0 behavior. Before running it, either explicitly accept that legacy risk or identify the correct CA/hostname settings and enable verification.
5. Manual provisioning/acceptance. Company SOPS recipients/migration, rclone OAuth on both hosts, old OBS mount handover, devenv trust/responsiveness, Noctalia Radicale password and private Outlook ICS URL, tailnet enrollment/private SSH. See workbench README and root README. Do not close public Orion SSH yet.
6. Guidelines review. Design now spells out owner naming, module selection, helper placement, package reuse/pinning, runtime boundaries and validation. No new test policy, automation framework or pass-specific repo-wide rules were added.

Validation state

Final full validation passed before the final review deletions: /tmp/nixos-validate-t7zv1zux (session 88912, completed exit 0). Formatting, devenv preparation, flake check, all three host builds (Orion, Polaris, Zenith), and the tools-only workbench build passed. This includes the final notes startup ordering, FUSE wrapper paths, native Zsh retry function and SecretSpec package collision fix. The vault patch was removed afterward. No systems were activated.

Native devenv tools-only startup also passed in an isolated temporary home: /tmp/foundation-native/startup.log. Company/live/test loading was disabled; SecretSpec 0.20.0 and Python 3.14.7 were available. No company credentials loaded.

Clean-home manual editor checks passed: direct directory startup renders a Lua-file icon in Oil; opening the note picker after VimEnter reaches TelescopePrompt. Evidence: /tmp/foundation-editor-check/{startup,notes}.log. No real notebook or credentials loaded. Built Kanagawa index declares Inherits=Adwaita,hicolor. Python source syntax and local documentation links checked; no automated tests added.

The earlier final review removed the unaccepted Kubernetes login wrapper and the machine-wide devenv cache setting; the flake-scoped cache remains. Full builds were not repeated for those deletions. The later Walker patch removal has not been built.

Builds do not establish interactive acceptance. The user checkpoint remains; do not repeat full builds for documentation-only handoff edits.

Review checkpoint

The final diff was reviewed for correctness, integration and Ponytail complexity. Desktop/capability moves and repository wiring had no material findings. The review removed the speculative Kubernetes login interpreter. The devenv cache was later moved from flake scope to machine-wide Nix settings at the user's request. The remaining Python has a concrete role: in-memory concurrent secret loading with completeness checks, one-time encrypted credential reshaping, dynamic OBS rclone configuration, or pre-existing dictation/transcription behavior.

The user checkpoint is still required before this pass is complete. The implementation was committed as 5748b34 after the initial foundation commit f164d8b. Later cleanup removed the Walker patch, Handy test and AI capability README. No activation was recorded during that pass. External workbench analysis/content changes are unrelated and must not be committed here. Previous external loader copies remain at /tmp/workbench-environment-before-6k4dwzuo; only root/workbench environment documentation and ignore entries were updated. Backups: /tmp/foundation-workbench-docs-bvrs1hu9. Old external loaders remain until user activation, so the currently running system is not broken. Constellation documents were already superseded and removed in the prior foundation commit.

Deliberate deferrals remain in design: backups declined, dashboard scrapped, Zenith Plymouth and extra Noctalia keyboard controls deferred, stronger credential isolation/new agent workflows/indexing and unrelated editor redesign out of scope.