lux/docs/current-work.md

Current work

Scope and accepted decisions

Foundation pass started 2026-09-19. Improve existing capabilities through discussion and coherent implementation batches; completion requires the user's agreement.

Accepted: retain host/profile/capability/facts composition and explicit ownership; Polaris and Zenith have identical intended use; use the four-file harness. Validation uses a Git-ignore-aware snapshot without index changes, prioritizing low token cost. The work profile is explicitly provisional. Consolidate the workbench environment only, using the shared NixOS nixpkgs pin; authored material and the Python lock stay in the writable workbench. See design for durable boundaries.

Completed and evidence

• Replaced Constellation with the four-file harness after preserving useful knowledge; older archives remain historical sources. Survey began from clean 3c022ad on Polaris.
• Implemented just validate with optional host arguments. Full runs format, evaluate, build all hosts, and now build the workbench shell. Logs are brief; details remain in /tmp. The index is untouched by validation. Both prerequisites were already declared on workstations.
• Added provisional modules/profiles/work.nix, imported by both workstations. It selects existing VPN/development integration, Garden tools, and work Git settings. Generic development/editor tools remain shared; SharePoint remains Zenith-only.
• Garden definitions now have one owner in yookr-dev/_packages.nix, used by both installed tools and devShells.x86_64-linux.workbench. Preserved the workbench's tools and Python variables; its nixpkgs pin now follows the system as agreed.
• Updated ~/yookr/.envrc and ~/yookr/workbench/.envrc to select the shared environment; updated workbench README/instructions and removed its redundant flake/lock. Its credential/mount body is unchanged. Requests, queries, analysis, Python lock, existing changes, and generated data remain in place. Pre-change migration files: /tmp/workbench-environment-before-6k4dwzuo.
• Full validation passed formatting, evaluation, Orion/Polaris/Zenith builds, and workbench shell build on 2026-09-19. Logs: /tmp/nixos-validate-4ojjb2q7. The existing unknown modules output warning remains. Whitespace review passed in both repositories; loader changes were compared against pre-change copies. No tests, activation, credential loading, mounts, or remote changes.

Next step and user-owned actions

User reviews and re-allows the two changed .envrc files with direnv, and activates NixOS when ready. Do not run those loaders as an agent. The workbench retains unrelated uncommitted analysis, documentation, and mount-helper work; do not commit that work as part of this pass. Replicate the two loader changes and removal of the old environment definition on Zenith; only Polaris's workspace was changed here.

Evaluate the provisional work boundary in practice, then discuss secret delivery. Current constraints: human workbench entry exposes both test/live credentials and starts read-only object-storage mounts; the tools-only environment does neither but does not erase inherited credentials. SOPS is already used, with different key locations for system and company material. No credential values were read. Clarify encrypted-file/key distribution across machines before proposing changes. Devenv and secretspec remain candidates, not dependencies. No new live authority or per-connection launchers are authorized.

Questions to carry into relevant areas

• Desktop integration: terminal/launcher interfaces have inconsistent consumers; Mailspring coexists with Thunderbird account declarations; Herdr coexists with agent-deck notifications and multiple session tools. Determine purpose before removing anything. The disabled nixos-maintainer skill's source remains.
• Cross-host behavior: earlier workspace migration was reported only on Zenith. Verify Polaris paths before assuming equivalent filesystem state. TeamViewer and SharePoint currently exist only on Zenith despite identical intended use.
• Runtime evidence: earlier theme/greeter, expanded Herdr shortcuts, Handy hold/release/paste, and SharePoint activation checks were incomplete. Old build results do not establish current behavior. Ask in the relevant area.
• Handy hang investigation remains parked unless requested: a prior debugger capture found the recorder waiting for an audio chunk before handling stop; Bluetooth failures coincided, and disconnecting Sony WH-1000XM6 helped. The user wants that microphone. Persistent HFP was proposed but never applied or verified; inference-backend changes were not an established fix.
• Agent evaluation, new mail ingestion, and company credential isolation were deferred. Secret-management discussion reopens design, not live access.

The inbox is not a backlog. Detailed old handoffs remain in Git before this batch; consult them only when their evidence affects a current choice.