Enforce bounded operation guardrails

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

SCOPE.md

@@ -132,11 +132,11 @@ The two evaluation modes:
   not task lifecycle.
 - **Coding assistant schedulers** as production authority.
 
-**Boundary note (side-effect resolvers):** A small set of shell/context
-resolvers intentionally invoke platform tools (e.g. Forgejo package prune).
-That is allowed only when the side-effect is the *declared purpose* of the
-ActivityDefinition, is credential-routed, evidence-posted, and not general
-task execution. It must not expand into an unbounded ops executor.
+**Boundary note (ACT-ADR-007):** Context resolution is read-only. A small
+code-owned registry permits explicit bounded operations (currently controlled
+SBOM ingest, Forgejo package prune, and CNPG backup) in a separate workflow
+phase. Unknown operations or incomplete mutation/evidence declarations are not
+an extension mechanism and must fail definition admission.
 
 ---
 
@@ -230,22 +230,18 @@ The detailed review is preserved in
 | Markdown definitions | Met — `activity-definitions/`, event-types, external ConfigMaps |
 | Rules before instructions | Met — deterministic rule/report paths dominate; LLM is optional |
 | Durable recurring automation | Met — Temporal schedules plus deterministic status evidence |
-| Audit trail | Partly met — activation, context, prompt hash/model, emission, queue, and normalized execution evidence exist; raw prompt text is intentionally absent |
-| Does not own task lifecycle | Met for workplan/tracker tasks; qualified by an in-repo machine `ops_run` claim/lease/outcome lifecycle |
+| Audit trail | Met as a bounded, non-secret audit projection — activation, definition/version, context projection, prompt hash/model, validation, emission, queue, and normalized execution evidence; raw prompts/provider payloads are intentionally absent |
+| Does not own task lifecycle | Met — `ops_run` claim/lease/outcome state is runtime delivery state, not work-item lifecycle |
 | Does not own project phases | Met |
 
 ### Gaps and tensions (INTENT ↔ practice)
 
 | Gap | Severity | Notes |
 | --- | --- | --- |
-| **G1. Operational state boundary** | High (clarity) | `ops_runs` owns open/claimed/terminal machine-run state. This is not work-item lifecycle, but INTENT's absolute wording does not state the distinction. |
-| **G2. Bounded side effects** | Medium (boundary) | SBOM ingest, package prune, and CNPG backup execute declared operations inside the orchestration workflow; INTENT says activity-core does not execute work. |
 | **G3. Live LLM execution** | High (operational, external) | The implementation is present, but production provider requests fail with a sanitized upstream 401 until the account owner replaces the key. |
 | **G4. Profiled execution proof** | Medium (operational, external) | Profile selection, failure evidence, and teardown are proven; a successful commit waits on `GLAS-IN-0002`. |
 | **G5. State Hub retirement** | Medium (integration) | hub-core adapters exist, but production task/report progress still defaults to the State Hub compatibility path. |
-| **G6. Review routing** | Medium | `review_required` remains evidence metadata; there is no downstream pending-review queue. |
-| **G7. Audit wording** | Medium (assurance) | The repo records a prompt hash, model, definition version, and context snapshot, not the literal rendered prompt promised by INTENT. |
-| **G8. Legacy surfaces** | Low | `TaskExecutorWorkflow`/`task_instances` remain disabled compatibility residue, and the basic REST CRUD schema cannot author full rules/instructions. |
+| **G6. Definition REST parity** | Low | Basic REST row administration intentionally cannot author or round-trip full rules/instructions; markdown source sync is authoritative. |
 
 ### Drift risks
 
@@ -257,8 +253,6 @@ The detailed review is preserved in
    fresh live-image lists.
 4. **Queue/task conflation** — treating an `ops_run` as the authoritative human
    task record rather than a delivery instance.
-5. **Stub workflow attraction** — `TaskExecutorWorkflow` looks like an
-   execution home despite being disabled by default.
 
 ---
 
@@ -272,7 +266,7 @@ The detailed review is preserved in
 [IssueSink: rest | state-hub | null]  →  issue-core  or  hub-core progress (State Hub until cutover)
 [report/evidence sinks]               →  hub-core / working memory
 [ops_run claim queue + Glas profile]  →  rein-aharness / other approved reins
-[bounded shell side-effects]          →  platform tools (e.g. package prune)
+[bounded operation stage]             →  code-registered platform tools
 ```
 
 - **Upstream**: NATS, Temporal, PostgreSQL, repo-manager / hub-core (State Hub
@@ -321,6 +315,7 @@ The detailed review is preserved in
 - `docs/adr/adr-004-producer-trust-boundary.md`
 - `docs/adr/adr-005-ops-runs-vs-dev-work-records.md`
 - `docs/adr/adr-006-glas-profile-execution.md`
+- `docs/adr/adr-007-bounded-operations.md`
 
 ---