Workflow system execution

Source: ../workflow-discovery.md

Apply the global and repository-local AGENTS.md files and the ponytail skill at full intensity throughout. Preserve user work, prefer native capabilities, and add no abstraction without a demonstrated repeated need.

Current checkpoint

Tranche: repository contracts and Yookr workbench
State: active
Branch: chore/workflow-system
Baseline: nix flake check --no-build --quiet passed on 2026-09-05; only the existing dirty-tree and unknown modules output warnings were emitted.
Next: prove the common contract in rules-service, yookr-api, and traceability-data-model; the service pilots are checkpointed, so preserve and reconcile the schema repository's existing WIP next.

Progress

Batch	State	Evidence or blocker
Bootstrap and repository ownership	Waiting for user	Repository and dashboard reconciliation complete; credential cleanup remains
Declarative workstation foundation	Complete	All-host builds pass with one Nixpkgs pin, `just`, and an explicit Podman Compose provider
Repository contracts and workbench	Active	Service contracts checkpointed; API empirical gates and schema pilot remain
Desktop, agents, notes, PIM, transcription	Pending	Independent pilots follow foundation changes
Conditional retirement and completion	Pending	Requires per-pilot evidence

Repository checkpoints

Repository	Branch	Commit	Purpose
NixOS configuration	`chore/workflow-system`	`41bc61b`	Discovery, paths, Git identity, and Codex defaults
NixOS configuration	`chore/workflow-system`	`69552b7`	Simplify flake inputs and declare workstation lifecycle tools
`yookr-dashboard-new`	`feat/gogv2`	`934605d`	Remove obsolete dashboard converter
`rules-service`	`chore/workflow-contract`	`555d9cd`	Establish the first common repository contract
`yookr-api`	`chore/workflow-contract`	`a76b2b7`	Establish the HTTP and OpenAPI contract

Human actions

Rotate the exposed Context7 key and provide CONTEXT7_API_KEY through a mode-0600 machine-local environment file on each workstation before removing the static user-config header.
Relocate the mode-0644 /home/kiri/work/SECRETS file to an approved private owner and restrict it; its contents have not been inspected.
Move the ignored rules-service/.env to ~/.config/yookr/rules-service.env with mode 0600; its contents have not been inspected or copied.
Restore access to the locked yookrdev/constant-store commit or replace that retired dependency deliberately, then rerun just check in yookr-api.
Deploy a GET image that exposes /full-api-docs/openapi.json, then rerun just openapi-refresh test; the current test deployment returns 404.
Populate the ignored API HTTP credentials and perform the planned login plus harmless administrator read; no credential-bearing request has been made.
Destructive cleanup, credentials, activation, and empirical pilot decisions will be surfaced here before use.

Decisions and discoveries

Use /home/kiri/work/repos/yookr-dashboard-new as the reconciliation base; its feat/gogv2 head is 17 commits newer than the sync copy and matches its remote-tracking branch.
The user confirmed the legacy BSON migration is no longer needed and the former work copy is authoritative. The sync copy was explicitly deleted; its removal may propagate through Syncthing.
Active repositories now live under /home/kiri/dev/work; inactive material is preserved intact under .archive, and the registered dashboard sensor worktree is under .worktrees.
Removed the obsolete dashboard converter app and Python dependency. The dashboard flake evaluates, while the pre-existing feature work remains uncommitted and unstaged.
Pruned the absent feat/echarts-domain worktree metadata; its branch and commit remain. The registered sensor worktree is valid at its new path.
Shared Codex defaults and MCP endpoints are generated at /etc/codex/config.toml; Context7 reads its header from the environment. The unused generic ~/.config/mcp/mcp.json owner is removed on next activation.
Removed redundant legacy-path trust entries from the current Codex config; the existing trusted home scope covers the moved repositories.
Bruno's transitional OpenAPI reference now follows the archived management repository until the HTTP pilot retires or retains Bruno.
Post-move repository IDs, remotes, dirty counts, and the registered sensor worktree match the pre-move inventory. The Nix flake still evaluates.
No-link system builds for Zenith, Polaris, and Orion pass with the migrated paths and declarative Codex defaults.
Removed the unused stable Nixpkgs input and made Noctalia follow the root package-set pin. Added just to the workstation tools and selected the store-backed podman-compose provider through native containers.conf.
The resulting flake check and no-link builds for all three hosts pass.
rules-service now has a non-mutating direnv shell, minimal Nix toolchain and formatting check, native Cargo recipes, factual repository instructions, one .http request collection, explicit test/live deployment paths, and a corrected test-oriented environment example. The full locked Cargo check passes; Clippy reports 18 pre-existing advisory warnings.
Private Cargo Git dependencies remain in the ordinary developer SSH boundary. They are not vendored or bridged into sandboxed Nix builds.
yookr-api now owns its reviewed OpenAPI 3.1 contract, local/test/live HTTP metadata, curated login/health/admin-read requests, a non-mutating shell, and one explicit snapshot-and-diff recipe. oasdiff 1.31.0 is pinned with source and vendor hashes because Nixpkgs does not provide it.
The API flake evaluation and built OpenAPI validation pass. Cargo stops before compilation because its locked constant-store repository is unavailable through both anonymous HTTPS and the working SSH identity. The test service is reachable, but its currently deployed GET image returns 404 for the full OpenAPI route already present in local source and ingress configuration.
Run independent pilots in parallel, but gate every retirement separately.

6.3 KiB Raw Blame History