coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement ACTIVITY-WP-0022/0023: safe sink default and gap closures
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
Build and Publish Container Image / build-and-push (push) Successful in 28s
Details

Browse source 
Default ISSUE_SINK_TYPE to state-hub (no silent Forgejo issues), hard-fail
prune apply without live-images protection, refresh-live-images script,
disable TaskExecutor stub by default, and document consumer/sink contracts.
This commit is contained in:
tegwick 2026-07-21 21:40:08 +02:00
parent 5c7a90ce7c
commit 4f5399df84
19 changed files with 525 additions and 155 deletions
Download patch file Download diff file Expand all files Collapse all files

58
docs/runbook.md
View file

@ -238,6 +238,43 @@ kubectl -n activity-core exec deploy/actcore-worker -- /app/.venv/bin/python3 -c
'
```
### Where progress evidence lives (edge vs workstation)
Prod activations post to **`http://actcore-statehub-edge-relay:8000`** on
railiance01 (upstream in-cluster `state-hub`). That feed is **not always** the
same history as workstation `http://127.0.0.1:8000` (local primary vs tunnel).
After a fire, query the edge from the worker:
```bash
ssh railiance01 'export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
kubectl -n activity-core exec deploy/actcore-worker -- /app/.venv/bin/python3 -c "
import urllib.request, json
for et in [\"daily_triage\",\"forgejo_package_prune\",\"activity_task_spawn\",\"sbom_staleness\"]:
d=json.loads(urllib.request.urlopen(
f\"http://actcore-statehub-edge-relay:8000/progress/?event_type={et}&limit=3\").read())
print(et, d[0][\"created_at\"] if d else None, (d[0].get(\"summary\") or \"\")[:80] if d else \"\")
"'
```
## IssueSink / task emission
Default: **`ISSUE_SINK_TYPE=state-hub`** (ACTIVITY-WP-0022). See
`docs/issue-core-emission-boundary.md` and
`docs/task-emission-consumer-contract.md`.
| Mode | Use |
| --- | --- |
| `state-hub` | Internal findings (default) |
| `null` | Dry-run |
| `rest` | Intentional issue-core / external tracker only |
`TaskExecutorWorkflow` is **disabled** unless
`ACTIVITY_CORE_ENABLE_TASK_EXECUTOR_STUB=true` (legacy tests only).
`review_required` on instructions is **metadata only** until a downstream
review queue exists (issue-core / work-record lane) — see ACTIVITY-WP-0023-T09.
Example distinction from the June 2026 daily triage evidence:
```text
@ -332,14 +369,31 @@ mount of `~/railiance-platform` on the worker) with `apply: true` and posts
**Enabled 2026-07-21** after dry-run + first apply evidence
(`railiance-platform/docs/evidence/forgejo-package-prune-apply-20260721.json`:
38 deleted, 0 errors). Manual apply:
38 deleted, 0 errors).
**Apply safety (ACTIVITY-WP-0023-T03):** `apply: true` **refuses** to run without
a non-empty `live_images_file` (or `FORGEJO_LIVE_IMAGES_FILE`). Allowed
side-effect shell query with apply today: **`forgejo_package_prune` only**.
Refresh protection list after cluster image rollouts:
```bash
# From workstation with both contexts, or merge scp'd exports on railiance01:
./scripts/refresh_live_images.sh
# railiance01 worker hostPath target:
OUT=~/railiance-platform/docs/evidence/live-images-all.txt \
EXTRA_LIVE_FILES=/path/to/coulombcore-export.txt \
./scripts/refresh_live_images.sh
```
Manual apply:
```bash
cd ~/railiance-platform
export VAULT_ADDR=https://bao.coulomb.social
# OIDC or platform token — never paste PAT into chat
export FORGEJO_TOKEN=$(bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin)
./tools/cmd/forgejo-package-prune --apply --live-images-file /path/to/live-images.txt
./tools/cmd/forgejo-package-prune --apply --live-images-file docs/evidence/live-images-all.txt
```
`weekly-sbom-staleness` is the canonical rule-only weekly maintenance schedule.