Record WP0036 production rollout

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

docs/evidence/ACTIVITY-WP-0036-queue-boundary-rollout-2026-08-23.md

@@ -0,0 +1,43 @@
+# ACTIVITY-WP-0036 Queue Boundary Rollout — 2026-08-23
+
+## Source verification
+
+- Revision: `f0a897e` (`Harden ops run identity and leases`), pushed to
+  `origin/main`.
+- Tests: 468 passed, 1 skipped (the live integration-stack test).
+- Python compilation and `git diff --check`: passed.
+- Railiance manifest: all 16 YAML documents parsed; runtime ConfigMap contains
+  `ACTIVITY_CORE_WORKER_ID=rein-aharness@railiance01`.
+
+## Production rollout
+
+- Built and imported `activity-core:railiance01-prod` with OCI index digest
+  `sha256:06442e86a7d5358251554fffb799a06709b694f21431ddefa74b5f8a672dfcd9`.
+- Applied the runtime ConfigMap and restarted only `deployment/actcore-api`.
+- Ready pod `actcore-api-8799c6944-hsn74` runs config/image id
+  `sha256:e6e9f0171e36ce0f50a970435ea55f10d428f1743050d1629a94ff4fd19cec37`.
+- The worker-token Secret key was checked for non-empty presence without
+  reading or printing its value. The API reports the bound non-secret identity
+  `rein-aharness@railiance01`.
+
+## Live boundary evidence
+
+- The existing `rein-aharness-claim-loop.service` remained active. Its first
+  two polls after rollout were authenticated `POST /ops-runs/claim` responses
+  with HTTP 200 at `11:05:04Z` and `11:05:34Z`.
+- A request carrying the valid worker credential but body
+  `worker_id=spoofed-worker` was rejected with HTTP 403 and
+  `worker_id does not match authenticated worker` before queue access.
+- Authenticated status showed 0 claimed, 1 open, 23 succeeded, and 20 failed
+  rows. The sole open row is an intentionally non-automated 2026-08-17
+  retention-closeout record, so it was not claimed or changed for this proof.
+- No schedule was fired and no production `ops_run` state was manufactured.
+
+## Residual acceptance evidence
+
+The server-side missing/equal/expired lease behavior is covered deterministically
+in the passing suite, including row-lock acquisition and no mutation on
+rejection. No run was actively leased during the rollout window, so a natural
+production heartbeat plus a rejected late close remains the final T04 evidence.
+This does not weaken the deployed enforcement; it avoids changing unrelated
+production work solely to create a demonstration row.

workplans/ACTIVITY-WP-0036-queue-identity-and-lease-integrity.md

@@ -133,3 +133,14 @@ Python compilation, whitespace checks, and parsing all 16 Railiance Kubernetes
 documents passed. The manifest binds the existing production worker token to
 `rein-aharness@railiance01`. Production rollout and live rejection evidence
 remain before this task and workplan can finish.
+
+Production rollout completed on 2026-08-23 at revision `f0a897e`. The API pod
+is Ready on the new image/configuration, the existing rein-aharness claim loop
+received HTTP 200 on its first two authenticated polls, and a valid credential
+paired with a spoofed body identity was rejected HTTP 403. Bounded evidence is
+in `docs/evidence/ACTIVITY-WP-0036-queue-boundary-rollout-2026-08-23.md`.
+
+No run was claimed during the observation window, so a natural active
+heartbeat and rejected late close remain before T04 can be marked done. The
+sole open row was an intentionally non-automated retention record and was not
+modified to manufacture evidence.