quality_dor_note: "The 2026-08-23 implementation audit identified locally actionable boundary gaps. Existing provider, Glas, State Hub retirement, and natural SBOM-run work remain with their current workplans and are not duplicated here."
related:
- ACT-ADR-003
- ACT-ADR-005
- ACT-ADR-006
- ACTIVITY-WP-0023
- ACTIVITY-WP-0029
- ACTIVITY-WP-0031
- ACTIVITY-WP-0032
- ACTIVITY-WP-0034
---
# Make the Execution Boundary Enforceable and the Review Contract Truthful
## Origin
The 2026-08-23 assessment in
`history/2026-08-23-scope-against-intent-assessment.md` found that the product
still fulfills its Event Bridge purpose, but two implemented capabilities are
described only as exceptions:
1.`ops_runs` has a machine delivery lifecycle even though `INTENT.md` says
activity-core does not track task lifecycle.
2. SBOM ingest, Forgejo package prune, and CNPG backup perform real bounded
operations even though `INTENT.md` says activity-core does not execute work.
The audit also found two truthfulness gaps: the promised instruction audit is
stronger than the safe persisted evidence, and `review_required` sounds like a
hold/release mechanism even though it is metadata only.
These are more important than cosmetic cleanup because they determine which
future features are admissible. If the boundary remains implicit, a generic
shell executor or a second task database can arrive one reasonable-looking
change at a time.
## Goal
Make the accepted execution-delivery boundary explicit in governing documents
and enforce it in definition admission and workflow structure. At completion:
- an `ops_run` is unambiguously runtime delivery state, never a work-item record;
- a small, reviewable registry is the only way activity-core may perform a
bounded operation;
- context resolution is read-only in semantics and mutating work has an
explicit workflow stage;
- instruction audit promises match the non-secret data actually retained; and
- review-worthy output has either a real downstream hold/release contract or a
name that truthfully communicates advisory-only metadata.
## Non-goals and existing owners
- Do not rotate the OpenRouter key or duplicate ACTIVITY-WP-0031.
- Do not repair the Glas/sand-boxer runtime or duplicate ACTIVITY-WP-0032.
- Do not manually fire the controlled-source SBOM schedule or duplicate
ACTIVITY-WP-0034.
- Do not reopen the completed ACTIVITY-WP-0029 hub-port work. Remaining general
State Hub progress migration belongs to the State Hub retirement program.
- Do not add workplan/task lifecycle, a project model, a general agent loop, a
credential store, or a local mirror of Glas profiles.
- Do not persist raw prompts, provider responses, tool output, or secrets merely
to satisfy an audit wording mismatch.
## Decision rules
1. Existing safe behavior wins over stale prose; reconcile prose without
weakening the safety boundary.
2. A bounded operation must be named and statically admissible. “Shell command
from definition data” is never an acceptable extension mechanism.
3. Every mutating operation needs fixed target selection, an idempotency model,
a timeout/retry ceiling, credential ownership, and non-secret evidence.
4.`review_required` must not imply that output was held unless a downstream
owner actually acknowledges and releases it.
5. Compatibility fields may be deprecated gradually, but new definitions must
use the final semantics once selected.
## Align INTENT with the accepted runtime-delivery plane
