Workflow system execution

Source: ../workflow-discovery.md

Apply the global and repository-local AGENTS.md files and the ponytail skill at full intensity throughout. Preserve user work, prefer native capabilities, and add no abstraction without a demonstrated repeated need.

Current checkpoint

Tranche: desktop, agents, and notes
State: waiting for Zenith activation
Branch: chore/workflow-system
Baseline: nix flake check --no-build --quiet and a no-link Zenith system build passed on 2026-09-05 after the desktop, agent, runtime, and note changes; only the expected dirty-tree and unknown modules warnings were emitted. The generated project menu finds 30 live repositories without .archive or .worktrees entries, and the generated daily-note configuration passes an isolated same-day idempotence test.
Next: the user runs sudo nixos-rebuild switch --flake /home/kiri/.config/nixos#zenith and reports whether it succeeds. Then the agent verifies live ownership before asking for one bounded interactive gate at a time.

Progress

Batch	State	Evidence or blocker
Bootstrap and repository ownership	Waiting for user	Repository and dashboard reconciliation complete; credential cleanup remains
Declarative workstation foundation	Complete	All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider
Repository contracts and workbench	Waiting externally	Three contracts and read-only Kubernetes pass; API deployment/access evidence is externally blocked, while database/report scaffolding is deferred until a real investigation
Desktop navigation and interaction	Active	Project discovery, Niri vocabulary cleanup, and stable Actual/WhatsApp launchers build; activation, Outlook, and two-output checks remain
Agent workflow	Active	The instruction-only `nixos-maintainer` skill validates and builds; the Herdr pilot remains
Notes	Active	Authored work notes are copied and verified in the single notebook; daily-note configuration builds, while source retirement awaits one activated sanity check
PIM	Active	Evolution 3.60.2 with its native Microsoft 365 backend builds beside Thunderbird; account and daily-use gates await activation and credentials
Transcription	Pending	Requires a real Fossify recording-transfer pilot before implementation moves from Zenith to Orion
Conditional retirement and completion	Active	OpenVPN 3, Zed, Helix, Foot, global Node.js, and global Bun are removed declaratively; other removals remain gated separately

Repository checkpoints

Repository	Branch	Commit	Purpose
NixOS configuration	`chore/workflow-system`	`41bc61b`	Discovery, paths, Git identity, and Codex defaults
NixOS configuration	`chore/workflow-system`	`69552b7`	Simplify flake inputs and declare workstation lifecycle tools
NixOS configuration	`chore/workflow-system`	`0c121a6`	Declare Garden tooling and the local workbench
NixOS configuration	`chore/workflow-system`	`2fb6061`	Package Garden completion declaratively
NixOS configuration	`chore/workflow-system`	`ad01b9b`	Enable NetworkManager's native OpenVPN plugin
`yookr-dashboard-new`	`feat/gogv2`	`934605d`	Remove obsolete dashboard converter
`rules-service`	`chore/workflow-contract`	`555d9cd`	Establish the first common repository contract
`yookr-api`	`chore/workflow-contract`	`a76b2b7`	Establish the HTTP and OpenAPI contract
`traceability-data-model`	`chore/workflow-contract`	`33cb7ff`	Establish the database and schema contract
`yookr-workbench`	`main`	`badc61c`	Create the workbench and isolate its Garden session

Deferred or externally blocked actions

None of these block work on independent pilots. Surface the exact applicable step to the user only when it blocks the current task.

Activate the verified Zenith generation with sudo nixos-rebuild switch --flake /home/kiri/.config/nixos#zenith. The agent attempted this non-interactively, but sudo requires the user's password.
After activation, open Walker with Super+Space, search for a repository, launch it, exit Neovim, and confirm the same Kitty window leaves a usable shell in that repository. Also launch Actual and WhatsApp once from Walker.
Press Super+N, confirm today's file opens under sync/notes/daily with the cursor at the append position, and briefly check the copied work notes and merged sync/notes/todo.md. Then tell the agent whether the old sync/work/notes rollback copy may be removed.
Run the bounded Pinta trial using a recent real edit: clipboard/open, selection, crop/resize/canvas, text/drawing/shapes, layers/transparency, basic adjustments, and PNG/JPEG export. Tell the agent whether it fully replaces GIMP; one of the two will then be removed.
Install Outlook from its signed-in page as a Vivaldi web app, then tell the agent so its generated desktop entry can be identified and replaced by a stable Home Manager owner.
During a docked Zenith session, tell the agent the external display is attached so its stable identity and the two-output Super+A pilot can be completed. The current session exposes only eDP-1.
After activation, launch Evolution and add accounts without removing any existing client or changing authority: personal and old-personal through their existing IMAP/SMTP service, university and work through the Microsoft 365 account type, and Radicale through native CalDAV, CardDAV, and VTODO. Complete tenant consent/sign-in when prompted, then tell the agent which accounts connected; the full mail/calendar/contact/task gate remains a daily-use pilot rather than a one-time setup claim.
Rotate the exposed Context7 key and provide CONTEXT7_API_KEY through a mode-0600 machine-local environment file on each workstation before removing the static user-config header.
Relocate the mode-0644 /home/kiri/work/SECRETS file to an approved private owner and restrict it; its contents have not been inspected.
Move the ignored rules-service/.env to ~/.config/yookr/rules-service.env with mode 0600; its contents have not been inspected or copied.
Restore access to the locked yookrdev/constant-store commit or replace that retired dependency deliberately, then rerun just check in yookr-api.
Deploy a GET image that exposes /full-api-docs/openapi.json, then rerun just openapi-refresh test; the current test deployment returns 404.
Populate the ignored API HTTP credentials and perform the planned login plus harmless administrator read; no credential-bearing request has been made.
The next Zenith switch also activates the follow-up Garden shell fix. The Nix-owned gardenctl, gardenlogin, and kubectl-gardenlogin are verified under ~/.nix-profile/bin; afterward remove the duplicate mutable binaries ~/.garden/gardenctl and ~/.local/bin/{gardenctl,gardenlogin,kubectl-gardenlogin}.
Destructive cleanup, credentials, activation, and empirical pilot decisions will be surfaced here before use.

Deferred Polaris replication

Do not access or test Polaris during this implementation. Treat a Zenith pass as representative, but retain these machine-local steps for later execution on Polaris:

Activate this NixOS configuration so networkmanager-openvpn is installed.
Run chmod 600 ~/sync/yookr-vpn.ovpn.
Run nmcli connection import type openvpn file ~/sync/yookr-vpn.ovpn.
Rename the imported yookr-vpn connection to Yookr VPN, disable autoconnect, and add the required legacy cipher: nmcli connection modify yookr-vpn connection.id "Yookr VPN" connection.autoconnect no +vpn.data data-ciphers=AES-256-CBC.
Connect with nmcli connection up "Yookr VPN".

Decisions and discoveries

Use /home/kiri/work/repos/yookr-dashboard-new as the reconciliation base; its feat/gogv2 head is 17 commits newer than the sync copy and matches its remote-tracking branch.
The user confirmed the legacy BSON migration is no longer needed and the former work copy is authoritative. The sync copy was explicitly deleted; its removal may propagate through Syncthing.
Active repositories now live under /home/kiri/dev/work; inactive material is preserved intact under .archive, and the registered dashboard sensor worktree is under .worktrees.
Removed the obsolete dashboard converter app and Python dependency. The dashboard flake evaluates, while the pre-existing feature work remains uncommitted and unstaged.
Pruned the absent feat/echarts-domain worktree metadata; its branch and commit remain. The registered sensor worktree is valid at its new path.
Shared Codex defaults and MCP endpoints are generated at /etc/codex/config.toml; Context7 reads its header from the environment. The unused generic ~/.config/mcp/mcp.json owner is removed on next activation.
Removed redundant legacy-path trust entries from the current Codex config; the existing trusted home scope covers the moved repositories.
Bruno's transitional OpenAPI reference now follows the archived management repository until the HTTP pilot retires or retains Bruno.
Post-move repository IDs, remotes, dirty counts, and the registered sensor worktree match the pre-move inventory. The Nix flake still evaluates.
No-link system builds for Zenith, Polaris, and Orion pass with the migrated paths and declarative Codex defaults.
Removed the unused stable Nixpkgs input and made Noctalia follow the root package-set pin. Added just to the workstation tools and selected the store-backed podman-compose provider through native containers.conf.
The resulting flake check and no-link builds for all three hosts pass.
rules-service now has a non-mutating direnv shell, minimal Nix toolchain and formatting check, native Cargo recipes, factual repository instructions, one .http request collection, explicit test/live deployment paths, and a corrected test-oriented environment example. The full locked Cargo check passes; Clippy reports 18 pre-existing advisory warnings.
Private Cargo Git dependencies remain in the ordinary developer SSH boundary. They are not vendored or bridged into sandboxed Nix builds.
yookr-api now owns its reviewed OpenAPI 3.1 contract, local/test/live HTTP metadata, curated login/health/admin-read requests, a non-mutating shell, and one explicit snapshot-and-diff recipe. oasdiff 1.31.0 is pinned with source and vendor hashes because Nixpkgs does not provide it.
The API flake evaluation and built OpenAPI validation pass. Cargo stops before compilation because its locked constant-store repository is unavailable through both anonymous HTTPS and the working SSH identity. The test service is reachable, but its currently deployed GET image returns 404 for the full OpenAPI route already present in local source and ingress configuration.
traceability-data-model preserves the existing domain/schema redesign while replacing automatic schema recreation with explicit just reset. Ordinary just dev retains its Compose volumes, and the flake check loads fixtures in text-ID mode plus a fresh schema in UUID-ID mode. Both the built check and the pinned podman-compose configuration validation pass.
Gardenctl 2.14.0 and Gardenlogin 0.10.0 are pinned from their official release assets; the hashes match the existing binaries byte-for-byte. All three host builds pass, the OIDC kubectl plugin is declarative, and Zsh consumes the native gardenctl rc zsh output with its completion packaged declaratively.
The local-only yookr-workbench has no remote and initially owns only just k8s test. Each invocation creates an isolated Garden session, rejects every environment except test, and opens K9s read-only. Its flake check and command catalog pass, and the live rejection path exits before Garden access.
The user activated and rebooted into the Garden tooling, then confirmed that just k8s test opens the test shoot in read-only K9s. The initial shell error came from Garden writing completion into an absent Flatpak $fpath entry; the initial target warning came from the fresh session inheriting its parent's KUBECONFIG. Completion is now store-owned, and the child recipe initializes Garden's session-local KUBECONFIG before targeting instead of unsetting it.
NetworkManager's native OpenVPN plugin is declared on Zenith and Polaris; no profile is embedded in Nix or imported automatically.
Zenith's initial NetworkManager activation never established a tunnel: OpenVPN 2.6 preserved the profile's legacy cipher=AES-256-CBC setting but excluded it from cipher negotiation. Adding data-ciphers=AES-256-CBC to the imported connection fixes the negotiation; NetworkManager then installs the pushed tunnel address, default route, private routes, and DNS servers. Company database access, disconnect/reconnect, suspend, and reboot pass on Zenith, so OpenVPN 3 is retired.
For the entire workflow implementation, do not access or test Polaris. Zenith results are accepted for both workstations; preserve exact deferred Polaris replication steps instead.
OpenVPN 3 is removed from the configuration. A full Zenith system build passes; the next password-authorized system switch removes it from the live generation.
Walker's native cached Lua menu scans the four identity roots and refreshes when their top level changes. Its default action pipes the selected path to one Nix-owned open-project command, which starts Neovim in a detached Kitty window and leaves an interactive shell after Neovim exits. The generated Walker configuration extends, rather than copies or replaces, the pinned default provider list and prefixes.
Removed the decided Niri arrow/Page Up/Down/numbered duplicates, direct quit and monitor-power bindings, extra screenshot modes, first/last and centering actions, repeated resize families, and their four shortcut-only scripts. The existing Super+A helper remains until a two-output session can validate its bounded name-based replacement.
Home Manager now owns the existing Vivaldi launcher filenames for Actual and WhatsApp, so both invoke the current package with the Default profile and stable app ID. Outlook is not installed yet, so no ID was guessed.
The first nixos-maintainer skill is instruction-only, Nix-owned, and passes the skill-creator validator. It encodes repository-specific ownership, research, formatting, no-switch, and affected-host validation behavior without duplicating generic agent guidance or adding scripts.
Removed Zed, the inactive Helix modules and note integration, Helix's cache settings and complete lock subgraph, and inactive Foot modules. Neovim and Kitty remain the sole declared editor and terminal. A repository-wide search found no configured npm caller, so global Node.js and Bun are also removed; project shells retain language runtimes where needed.
Pinta is added beside GIMP only for its bounded trial; neither outcome is preselected before real editing evidence.
sync/notes is now the sole declarative notebook owner, with daily, meetings, and transcripts directories, a native zk daily alias, and a Super+N dedicated Kitty/Neovim launcher. The five unique authored work notes were copied byte-for-byte, and both distinct todo lists were merged without dropping an item. Syncthing returned to idle with no needed files, pull errors, or new conflicts. The entire source notebook remains as rollback; pre-merge todo copies are also retained in /tmp/workflow-notes-todo-before.md and /tmp/workflow-work-notes-todo-before.md until the activated check passes.
Evolution 3.60.2 is composed through Nixpkgs with evolution-ews 3.60.2, whose pinned source contains the separate native Microsoft 365 mail, calendar, contacts, recurrence, and OAuth backends. It is installed only as a pilot beside Thunderbird; no account is preconfigured and no authority is changed.
Named database connections and a Marimo-to-HTML report remain workbench evaluation evidence, not scaffolding requirements. Add them only for a real cross-system investigation that gives the queries and report durable value.
Run independent pilots in parallel, but gate every retirement separately.

16 KiB Raw Blame History