Refresh activity-core capability scope

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

SCOPE.md

@@ -1,7 +1,7 @@
 ---
 domain: capabilities
 repo: activity-core
-updated: "2026-08-18"
+updated: "2026-08-23"
 ---
 
 # SCOPE
@@ -30,14 +30,18 @@ what work or evidence to produce. When triggered, a durable Temporal workflow
 loads the definition, resolves context, evaluates the rule/instruction set, and
 emits outputs via configured sinks:
 
-- **Tasks** — via `IssueSink` (`rest` → issue-core, `state-hub` progress, or
-  `null` dry-run).
+- **Coordination outputs** — task specs through `IssueSink` (`rest` →
+  issue-core, `state-hub` progress, or `null` dry-run), plus claimable
+  `ops_runs` for automation executors when the queue is enabled.
 - **Reports** — instruction reports to working memory and/or State Hub progress.
 - **Evidence** — compact non-secret summaries from selected resolvers (ops
   inventory, package prune, legacy-meter, etc.).
 
-Everything is auditable: `activity_runs` records the activation; `task_spawn_log`
-records emissions; report sinks leave progress/working-memory artifacts.
+Everything is auditable at the orchestration boundary: `activity_runs` records
+the activation and context snapshot; `task_spawn_log` records emission facts;
+`ops_runs` records claim/lease/outcome evidence; report sinks leave
+progress/working-memory artifacts. LLM audit stores the model and prompt hash,
+not raw prompts or provider payloads.
 
 The two evaluation modes:
 
@@ -63,10 +67,10 @@ The two evaluation modes:
   trigger; one-shot schedule smoke tests for recurring definitions.
 - **Schedule reconcile**: Temporal Schedule upsert/pause with per-row error
   isolation (`sync_schedules` continues after `ScheduleAlreadyRunningError`).
-- **Context resolution adapters**: repo-scoping, State Hub (domain/workplan
-  state, SBOM status, daily triage digest, coding retro, Binky rhythm status,
-  consistency sweep, RecentlyOnScope hourly), shell queries (e.g. Forgejo
-  package prune), and ops inventory probes. Registry is extensible.
+- **Context resolution adapters**: repo-scoping, State Hub, hub-core,
+  reuse-surface, event payloads, Kaizen agent metadata, SBOM Nexus, shell
+  queries, CNPG backup, Forgejo package prune, and ops inventory probes. The
+  resolver registry is extensible.
 - **Rule evaluator**: sandboxed AST walker; `for_each` binding; no `exec()`.
 - **Instruction executor**: trusted-field rendering, llm-connect, structured
   validation, item-granular recovery, deterministic report path, report sinks.
@@ -79,17 +83,33 @@ The two evaluation modes:
   (`daily_triage`, `sbom_staleness`, `forgejo_package_prune`,
   `ops_inventory_probe`, `activity_task_spawn`, etc.).
 - **Spawn audit log**: `task_spawn_log` with rule/instruction id and sink ref.
-- **Webhook receiver**: Gitea/GitHub → EventEnvelope → NATS.
+- **Automation execution queue**: durable `ops_runs` with idempotent insertion,
+  concurrent claim (`FOR UPDATE SKIP LOCKED`), leases, heartbeat, retry/reopen,
+  terminal outcome, and operator visibility. This is machine-run delivery
+  state, not the authoritative lifecycle of a workplan task or tracker issue.
+- **Profile-driven execution contract**: structurally validate a pinned
+  `harness_profile_ref`, pass through allowlisted attribution refs, and retain
+  normalized non-secret Glas execution evidence. Glas selects the rein/model/
+  sandbox constellation; activity-core does not.
+- **Webhook receiver**: Gitea/GitHub → EventEnvelope → NATS, with HMAC
+  verification when the corresponding shared secret is configured.
 - **Worker and workflow infrastructure**: Temporal `RunActivityWorkflow`
   (load → resolve → evaluate → report → **log_run** → emit). Emit failures no
   longer skip `activity_runs` rows.
-- **REST admin API** (FastAPI): CRUD, manual trigger, admin sync, metrics.
+- **REST admin API** (FastAPI): basic ActivityDefinition row CRUD, manual
+  trigger, admin sync, event-type approval, and dependency health. Full
+  rules/instructions authoring remains markdown-and-sync driven; the row CRUD
+  schema is not a complete replacement for the file format.
 - **Operator automation console** (ACTIVITY-WP-0024): `/ops` inventory, status
   window, run history, Run now / enable / disable / pause with operator-token
   auth (fail-closed), plus thin HTML UI at `/ops/ui`.
 - **Automation status surface**: `make automation-status` and
   `make prod-automation-status` / `scripts/prod_automation_status.sh` for
   railiance01 evidence without LLM authority (same contract as `/ops/automations/status`).
+- **Review CLI**: the `activity` command merges repository commits with
+  activity/ops-run evidence across configured services, supports checkpoints,
+  and reports automation definitions and recent runs. It is an evidence review
+  client, not a task tracker.
 - **Operational runbook**: `docs/runbook.md`, emission boundary docs.
 
 ---
@@ -97,12 +117,13 @@ The two evaluation modes:
 ## Out of Scope
 
 - **Task lifecycle** — create/assign/track/close remains issue-core (or fleet
-  work-record connectors). activity-core holds a spawn audit trail only.
+  work-record connectors). activity-core holds spawn evidence and machine-run
+  delivery state, not the authoritative human/work-item record.
 - **Project and initiative management** — project-core (future).
-- **General execution workers** — scans, patches, privileged API writes that
-  are not explicitly declared as **bounded ActivityDefinition side-effects**
-  (e.g. retention prune with dry-run/apply gates) belong to per-repo workers
-  or platform tools.
+- **General execution workers** — agent loops, repository changes, arbitrary
+  scans, and privileged API writes belong to Glas/reins, per-repo workers, or
+  platform tools. The `ops_run` API dispatches and observes this work; it does
+  not perform it.
 - **General ops control plane** — Kubernetes, SSH, tunnels, secret custody,
   OpenBao policy administration.
 - **Event broker / Temporal server hosting** — consume, do not own lifecycle.
@@ -137,42 +158,54 @@ task execution. It must not expand into an unbounded ops executor.
 
 ---
 
-## Current State (2026-08-18)
+## Current State (2026-08-23)
 
 ### Status
 
-Production on **railiance01** (`activity-core` namespace). Product work through
-ACTIVITY-WP-0028 is finished. G2 (executor gap) is closed in-repo by
-**ACT-ADR-005** + **ACTIVITY-WP-0026** (ops_run claim queue).
+Production runs on **railiance01** in the `activity-core` namespace with
+PostgreSQL, Temporal Schedules, a Temporal worker, API, and NATS event router.
+The checked-in surface contains 12 ActivityDefinitions plus publisher-declared
+event types. The schema is at migration `0008`, including the ops-run queue and
+Glas profile/attribution fields.
 
-Open work (SBOM catch-up parked — CUST-WP-0062 / ACTIVITY-WP-0030):
+No open task is independently actionable on 2026-08-23:
 
-| WP | Status | Role |
+| Workplan | State | Current gate |
 | --- | --- | --- |
-| **ACTIVITY-WP-0029** | active | S5 of State Hub retirement: retarget sweeps/sinks/execution to repo-manager and hub-core |
-| ACTIVITY-WP-0030 | active (all tasks wait) | Daily SBOM catch-up; do not start — waits on CUST-WP-0062 |
+| ACTIVITY-WP-0031 | wait | OpenRouter account owner must replace the rejected provider key; external routing handoffs remain with their named owners |
+| ACTIVITY-WP-0032 | wait | `GLAS-IN-0002`: managed consumer namespace plus rein/model runtime and egress contract before a successful commit proof |
+| ACTIVITY-WP-0034 | progress | Observe the first unassisted weekday controlled-source SBOM fire; do not substitute another manual trigger |
 
 ### Live posture (railiance01)
 
-- Image: `activity-core:railiance01-prod` (locally imported).
+- Image: `activity-core:railiance01-prod` (locally built/imported deployment).
 - `ISSUE_SINK_TYPE=state-hub` (internal findings → State Hub progress, not
   Forgejo issues).
-- Edge relay: `actcore-statehub-edge-relay` → in-cluster `state-hub`.
+- The daily SBOM catch-up is enabled at weekday 09:15 Europe/Berlin, limit 3.
+  It freezes Repo Manager's full-SHA `forgejo-archive-v1` source reference,
+  reuses it across Nexus retries, and reports only allowlisted provenance.
+- The old weekly SBOM fan-out is disabled in source, DB, and Temporal.
+- `ops_runs` are claimable by rein-aharness and carry pinned Glas profile refs;
+  production has proven normalized fail-closed evidence and sandbox teardown,
+  but not yet a successful profiled commit.
 - Weekly prune: worker has `FORGEJO_TOKEN` + hostPath `/opt/railiance-platform`
   + `live_images_file` (kubectl absent in pod).
-- Proven one-shots (2026-07-21): Binky daily/mail COMPLETED with tasks_spawned=1;
-  SBOM deterministic report; daily triage progress; prune apply.
+- The deterministic status surface distinguishes schedule fires, emitted
+  tasks, ops-run states, and bounded failures.
 
 ### Definitions (repo files + prod DB)
 
 | Definition | Role |
 | --- | --- |
-| `weekly-sbom-staleness` | Deterministic SBOM report; task emit gated off |
+| `daily-sbom-catchup` | Bounded oldest-N Nexus ingestion with immutable controlled source refs |
+| `weekly-sbom-staleness` | Disabled legacy fan-out; retained as deterministic report definition |
 | `weekly-forgejo-package-prune` | Sunday 03:30 UTC apply prune + evidence |
 | `weekly-legacy-meter-review` / `legacy-meter-8h-capture` | Meter evidence |
 | `weekly-coding-retro` | Present; enablement depends on `coding_retro` feed |
 | Binky daily / mail / review-prep | Rhythm tasks via IssueSink |
-| Railiance ConfigMap bundle | Daily triage, ROS hourly, consistency sweep, etc. |
+| `daily-cnpg-option-a-backup` | Declared bounded CNPG backup plus evidence |
+| `monthly-secrets-elevation-review` | Scheduled governance review task |
+| `glas-profile-pilot` | Disabled low-risk profile-contract proof definition |
 
 ### Task emission posture
 
@@ -186,43 +219,46 @@ Open work (SBOM catch-up parked — CUST-WP-0062 / ACTIVITY-WP-0030):
 
 ## Assessment Against Intent
 
+The detailed review is preserved in
+`history/2026-08-23-scope-against-intent-assessment.md`.
+
 ### Alignment
 
 | INTENT promise | Status |
 | --- | --- |
-| Answers **when / what / where** | Met — Temporal schedules, rules/instructions, sinks |
+| Answers **when / what / where** | Met — Temporal schedules/NATS/webhooks, rules/instructions, and explicit sinks/targets |
 | Markdown definitions | Met — `activity-definitions/`, event-types, external ConfigMaps |
-| Rules before instructions | Met — SBOM/prune/Binky rules; triage uses LLM when needed |
-| Durable recurring automation | Met — railiance01 schedules fire; status surface exists |
-| Audit trail | Met — `activity_runs`, spawn log, progress/working-memory |
-| Does not own task lifecycle | Met — no completion tracking |
+| Rules before instructions | Met — deterministic rule/report paths dominate; LLM is optional |
+| Durable recurring automation | Met — Temporal schedules plus deterministic status evidence |
+| Audit trail | Partly met — activation, context, prompt hash/model, emission, queue, and normalized execution evidence exist; raw prompt text is intentionally absent |
+| Does not own task lifecycle | Met for workplan/tracker tasks; qualified by an in-repo machine `ops_run` claim/lease/outcome lifecycle |
 | Does not own project phases | Met |
 
 ### Gaps and tensions (INTENT ↔ practice)
 
 | Gap | Severity | Notes |
 | --- | --- | --- |
-| **G1. Sink default vs INTENT “emit to issue-core”** | High (policy) | INTENT names issue-core as the task landing zone. Practice and work-record canon push **State Hub / repo work records** for internal findings. WP-0022 owns policy; code already supports `state-hub` / `null` / `rest`. |
-| **G2. Executor gap** | Closed (in-repo) | **ACT-ADR-005** + **ACTIVITY-WP-0026** (ops_run claim queue). Claim loop remains **REIN-A-0002**. Do not use issue-core/Forgejo as default ops queue (WP-0022). |
-| **G3. Side-effect resolvers** | Medium | Forgejo prune `apply: true` runs platform deletes inside a context resolver. Allowed only as declared, gated side-effect; needs clearer SCOPE language (above) and operator refresh of live-images protection. |
-| **G4. Review queue** | Medium | `review_required` remains metadata-only; no downstream review queue. |
-| **G5. TaskExecutorWorkflow stub** | Low | Disabled unless `ACTIVITY_CORE_ENABLE_TASK_EXECUTOR_STUB` (WP-0023-T08). |
-| **G6. ROS digest completeness** | Medium (ops, external) | Templates mounted; **state-hub image** still lacks `markitect_tool` / MarkiTect CLI (`main-d8808bf` checked 2026-07-21). Owner: state-hub (WP-0023-T07). |
-| **G7. Credential delivery** | Low (residual) | **FORGEJO_TOKEN** via ESO `actcore-forgejo-admin` (WP-0023-T05, Ready). issue-core `GITEA_BACKEND_TOKEN` still 503 forgejo-inbox for path A rest — **issue-core owner** (WP-0023-T06). |
-| **G8. Live-images hygiene** | Medium (ops) | Multi-cluster `live-images-all.txt` must be refreshed after deploys or prune can delete live tags (incident 2026-07-21, restored). `scripts/refresh_live_images.sh` (T04). |
-| **G9. Evidence federation** | Low | Progress often lands on railiance01 edge/hub; workstation primary hub may not show the same feed without tunnel/outbox health. |
-| **G10. API external access** | Done | WP-0025 finished: Traefik + Authelia SSO for ops + Temporal UI; LLDAP `activity-core-operators` (NK-WP-0021); port-forward break-glass only. |
-| **G11. State Hub as permanent target** | Medium (T03 open) | Sweep is dual-run/repo-manager-retargetable; `/execution/semantics` is local. Progress/evidence sinks still wait on HUB-WP-0004 (`ACTIVITY-WP-0029-T03`). |
+| **G1. Operational state boundary** | High (clarity) | `ops_runs` owns open/claimed/terminal machine-run state. This is not work-item lifecycle, but INTENT's absolute wording does not state the distinction. |
+| **G2. Bounded side effects** | Medium (boundary) | SBOM ingest, package prune, and CNPG backup execute declared operations inside the orchestration workflow; INTENT says activity-core does not execute work. |
+| **G3. Live LLM execution** | High (operational, external) | The implementation is present, but production provider requests fail with a sanitized upstream 401 until the account owner replaces the key. |
+| **G4. Profiled execution proof** | Medium (operational, external) | Profile selection, failure evidence, and teardown are proven; a successful commit waits on `GLAS-IN-0002`. |
+| **G5. State Hub retirement** | Medium (integration) | hub-core adapters exist, but production task/report progress still defaults to the State Hub compatibility path. |
+| **G6. Review routing** | Medium | `review_required` remains evidence metadata; there is no downstream pending-review queue. |
+| **G7. Audit wording** | Medium (assurance) | The repo records a prompt hash, model, definition version, and context snapshot, not the literal rendered prompt promised by INTENT. |
+| **G8. Legacy surfaces** | Low | `TaskExecutorWorkflow`/`task_instances` remain disabled compatibility residue, and the basic REST CRUD schema cannot author full rules/instructions. |
 
 ### Drift risks
 
-1. **Convenience execution** — growing shell resolvers into a general ops runner.
+1. **Convenience execution** — growing the bounded side-effect allowlist into a
+   general ops runner.
 2. **Silent sink restore** — flipping `ISSUE_SINK_TYPE=rest` without policy +
    healthy Forgejo backend reintroduces issue spam / 503s.
 3. **Protection file staleness** — weekly prune with `apply: true` depends on
    fresh live-image lists.
-4. **Stub workflow attraction** — `TaskExecutorWorkflow` looks like an
-   execution home.
+4. **Queue/task conflation** — treating an `ops_run` as the authoritative human
+   task record rather than a delivery instance.
+5. **Stub workflow attraction** — `TaskExecutorWorkflow` looks like an
+   execution home despite being disabled by default.
 
 ---
 
@@ -235,14 +271,14 @@ Open work (SBOM catch-up parked — CUST-WP-0062 / ACTIVITY-WP-0030):
        ↓
 [IssueSink: rest | state-hub | null]  →  issue-core  or  hub-core progress (State Hub until cutover)
 [report/evidence sinks]               →  hub-core / working memory
-[ops_run claim queue]                 →  rein-aharness / per-repo executors
+[ops_run claim queue + Glas profile]  →  rein-aharness / other approved reins
 [bounded shell side-effects]          →  platform tools (e.g. package prune)
 ```
 
 - **Upstream**: NATS, Temporal, PostgreSQL, repo-manager / hub-core (State Hub
   until retirement), repo-scoping, llm-connect.
-- **Downstream**: issue-core (optional), hub-core progress, platform tools,
-  rein-aharness / per-repo executors claiming ops_runs.
+- **Downstream**: issue-core (optional), State Hub/hub-core progress, SBOM
+  Nexus and bounded platform tools, Glas/reins claiming `ops_runs`.
 - **Orientation (not runtime)**: info-tech-canon (task/org/governance
   vocabulary), policy-nexus (publication of ADRs/canon — not authored here).
 - **Ops**: railiance01 k3s; workstation status via SSH helper.
@@ -269,7 +305,8 @@ Open work (SBOM catch-up parked — CUST-WP-0062 / ACTIVITY-WP-0030):
 - `hub-core` — messages, progress projections, extension ports (core-hub absorbed later).
 - `state-hub` — compatibility read model until STATE-WP-0079 retirement.
 - `issue-core` — task connector / external tracker mapping (not fleet work-record origin).
-- `repo-scoping`, `llm-connect`, `rein-aharness`.
+- `repo-scoping`, `reuse-surface`, `sbom-nexus`, `llm-connect`, `glas-harness`,
+  `rein-aharness`, `sand-boxer`.
 - `railiance-platform` — Forgejo package prune tool and credential lanes.
 - `ops-warden` — credential routing (not secret vending for non-SSH).
 - `ops-bridge` tunnels.
@@ -305,8 +342,8 @@ type: data
 title: Durable event-triggered task factory
 description: >
   Org-wide Event Bridge that receives time-based and domain events, evaluates
-  declarative rules and LLM instructions against current org context, and emits
-  structured task, report, and evidence outputs with a full spawn/report audit
-  trail while leaving task lifecycle ownership downstream.
-keywords: [temporal, workflow, event-bridge, task, report, evidence, cron, event, rule, instruction, org-automation]
+  declarative rules and LLM instructions against current org context, emits
+  task/report/evidence outputs, and offers a leased ops-run delivery queue with
+  normalized execution evidence while leaving work-item lifecycle downstream.
+keywords: [temporal, workflow, event-bridge, ops-run, glas, task, report, evidence, cron, event, rule, instruction, org-automation]
 ```

history/2026-08-23-scope-against-intent-assessment.md

@@ -0,0 +1,237 @@
+---
+type: history
+title: "activity-core scope assessment against INTENT"
+date: "2026-08-23"
+author: codex
+repo: activity-core
+---
+
+# activity-core Scope Assessment Against INTENT — 2026-08-23
+
+## Purpose
+
+This assessment records what activity-core can actually do at source head and
+in its current railiance01 deployment, then compares that surface with
+`INTENT.md`. It supersedes the capability conclusions in
+`history/2026-06-16-intent-gap-analysis.md`; that earlier note remains useful
+historical evidence.
+
+Reviewed surfaces:
+
+- `INTENT.md` and `SCOPE.md`
+- `src/activity_core/`, migrations `0001` through `0008`, and the test suite
+- `activity-definitions/` and `event-types/`
+- `docs/ops-run-queue.md`, `docs/execution-queue-boundary.md`, and ADRs 001–006
+- active workplans ACTIVITY-WP-0031, ACTIVITY-WP-0032, and ACTIVITY-WP-0034
+- live evidence already captured from railiance01 during 2026-08-20 through
+  2026-08-23
+
+## Open-work decision
+
+The repo has open work, but no task that can be advanced independently at the
+time of this review:
+
+| Task | State | Gate |
+| --- | --- | --- |
+| ACTIVITY-WP-0031-T01 | wait | OpenRouter account owner must replace a key that the provider reports as `User not found` |
+| ACTIVITY-WP-0031-T05 | wait | Named external consumer/routing handoffs |
+| ACTIVITY-WP-0032-T05 | wait | `GLAS-IN-0002` managed-consumer namespace and rein/model runtime/egress contract |
+| ACTIVITY-WP-0034-T02 | progress | First unassisted weekday 09:15 controlled-source SBOM fire |
+
+Another manual Glas pilot or SBOM trigger would weaken rather than improve the
+acceptance evidence, so this review did not perform either.
+
+## Implemented capability
+
+### Trigger and definition plane
+
+- Markdown ActivityDefinitions support five-field cron schedules with timezone
+  and misfire policy, one-off scheduled datetimes, and named events.
+- Temporal Schedule reconciliation creates, updates, pauses, deletes, and
+  smoke-tests schedules with row-level error isolation.
+- NATS JetStream routes registered events. Gitea and GitHub webhook receivers
+  normalize external events into the same envelope and verify HMAC when the
+  corresponding shared secret is configured.
+- Definitions and publisher-declared event types sync from repository files.
+  The FastAPI row CRUD surface is useful for basic definitions but cannot
+  author the complete rules/instructions file contract.
+
+### Context and evaluation plane
+
+- Context adapters cover event payloads, repo-scoping, State Hub, hub-core,
+  reuse-surface, Kaizen metadata, ops inventory, SBOM Nexus, CNPG backup, and
+  controlled shell integrations.
+- Deterministic rules execute through an allowlisted AST evaluator with
+  `for_each`; they do not use Python `exec`.
+- Instructions support trusted-field rendering, llm-connect, schema validation,
+  item-granular recovery, deterministic report mode, and multiple report sinks.
+- The workflow preflights a complete governed emission batch so a malformed or
+  missing required profile cannot partially emit earlier tasks.
+
+### Output, delivery, and evidence plane
+
+- `IssueSink` can target issue-core REST, State Hub progress, or null/dry-run.
+  Production defaults internal findings to State Hub progress.
+- Report/evidence sinks write bounded working-memory, State Hub, and hub-core
+  interaction records with idempotency and queued-write awareness.
+- `ops_runs` provides idempotent machine-run delivery with concurrent claims,
+  leases, heartbeats, bounded retry/reopen, terminal outcomes, and status/UI
+  visibility without depending on Forgejo or issue-core.
+- Governed ops runs carry a structurally validated, version-pinned Glas profile
+  plus allowlisted organizational refs. Completion/failure retains a normalized
+  evidence envelope and drops prompts, tool output, provider blobs, and secret
+  fields.
+- The `activity` review CLI merges repository commits, definition fires,
+  ops-run outcomes, and artifacts across named activity-core services.
+
+### Declared bounded operations
+
+The workflow currently performs three classes of in-process side effect when a
+definition explicitly declares them: SBOM Nexus ingest for a frozen oldest-N
+selection, Forgejo package pruning with protection/dry-run controls, and CNPG
+backup invocation. These are real execution capabilities, even though they are
+not general agent or repository-work execution.
+
+## Alignment with INTENT
+
+| INTENT commitment | Assessment | Evidence |
+| --- | --- | --- |
+| Answer **when** | Met | Temporal cron/one-off schedules, NATS events, webhooks, manual trigger |
+| Answer **what** | Met | Sandboxed rules, validated instructions, deterministic reports |
+| Answer **where** | Met | Explicit target repos, configurable issue/report sinks, ops-run queue |
+| Markdown as definition | Met | `activity-definitions/`, `event-types/`, sync path |
+| Rules before instructions | Met | Rules and deterministic reports do not require an LLM |
+| Durable, auditable automation | Met in architecture | Temporal, PostgreSQL run/spawn/ops-run records, deterministic status surface |
+| Do not own project/campaign state | Met | Retired `/execution/workplan*` routes return 410 with owner pointers |
+| Do not own work-item lifecycle | Met with qualification | Workplan/tracker state stays downstream; machine delivery state is local in `ops_runs` |
+| Do not execute domain work | Partly met | General work is external, but three bounded operation classes execute here |
+| Complete instruction audit | Partly met | Model, prompt hash, validation metadata, definition version, and context are stored; literal rendered prompt is not |
+
+## Gaps and required clarifications
+
+### G1 — The ops-run state machine qualifies the “no task lifecycle” rule
+
+Severity: **high documentation/architecture clarity**.
+
+`ops_runs` stores `open`, `claimed`, `succeeded`, `failed`, and `expired`, along
+with lease owner, attempt, result, and timestamps. ADR-005 correctly distinguishes
+this machine delivery instance from a workplan task or tracker issue, but
+`INTENT.md` currently says activity-core does not track task lifecycle without
+making that distinction.
+
+Recommended closure: amend INTENT to permit bounded operational delivery state
+while explicitly prohibiting ownership of human/workplan/tracker lifecycle. If
+that distinction is rejected, the queue must move to an execution-plane owner.
+
+### G2 — Bounded side effects qualify the “does not execute work” rule
+
+Severity: **medium architecture boundary**.
+
+`RunActivityWorkflow` can invoke SBOM ingest, and context adapters can invoke
+Forgejo prune and CNPG backup. These operations are bounded, declared,
+idempotent/evidence-producing, and narrower than general task execution, but
+they are still execution.
+
+Recommended closure: codify a bounded-operation contract in INTENT/ADR with an
+explicit allowlist, fixed target selection, dry-run/apply gate where relevant,
+idempotency, credential routing, timeout/retry ceiling, and mandatory evidence.
+New operation classes should require an ADR rather than appearing as another
+generic shell resolver.
+
+### G3 — Provider-backed instruction execution is unavailable in production
+
+Severity: **high operational; external owner**.
+
+The instruction implementation and safe error surface are present, but the
+live llm-connect path returns a sanitized upstream OpenRouter 401. Deterministic
+rules/reports still operate; FI, Binky, and daily-triage judgement paths cannot
+complete until the account owner issues and provisions a valid key.
+
+Owner/evidence: ACTIVITY-WP-0031-T01 and the railiance-platform OpenBao lane.
+
+### G4 — Profile-driven execution lacks a successful end-to-end proof
+
+Severity: **medium operational; external owner**.
+
+Activity-core has proven profile/refs carriage, execution-side resolution,
+normalized failure evidence, sandbox creation, and teardown. The post-fix pilot
+fails closed at `session_start` before provider dispatch because the managed
+consumer cannot enter the namespace and the rein/model runtime/egress contract
+is absent. No profiled commit has been produced.
+
+Owner/evidence: `GLAS-IN-0002`, ACTIVITY-WP-0032-T05, and
+`docs/evidence/ACTIVITY-WP-0032-glas-profile-pilot-2026-08-23.md`.
+
+### G5 — The compatibility State Hub path remains the production default
+
+Severity: **medium integration**.
+
+INTENT describes State Hub as a compatibility read model being retired.
+hub-core context/evidence adapters and explicit retired execution semantics now
+exist, but production internal task/report progress still defaults to State
+Hub. The boundary is documented; the actual sink migration is incomplete.
+
+Recommended closure: finish the hub-core/repo-manager consumer contracts,
+switch definitions deliberately, and retain State Hub only as an explicit
+compatibility adapter until retirement.
+
+### G6 — `review_required` has no routing destination
+
+Severity: **medium product**.
+
+Instruction evaluation records `review_required` in reports and spawn audit
+metadata, but there is no pending-review queue or named downstream owner that
+turns it into an operator action.
+
+Recommended closure: either define an explicit downstream review sink/port or
+rename the field to make its evidence-only semantics unambiguous.
+
+### G7 — Audit wording promises more than the safe persistence contract
+
+Severity: **medium assurance/documentation**.
+
+INTENT says operators can see “what prompt and model produced the output.” The
+implementation intentionally stores the prompt hash, model, definition version,
+context snapshot, validation metadata, and bounded response metadata—not the
+literal rendered prompt or provider response.
+
+Recommended closure: change INTENT to promise reconstructable inputs plus a
+prompt hash, or define a separately governed encrypted prompt-evidence store.
+Do not add raw prompts to `ops_runs` or progress records.
+
+### G8 — Legacy and partial administrative surfaces remain
+
+Severity: **low drift/documentation**.
+
+- `TaskExecutorWorkflow` and `task_instances` remain as disabled compatibility
+  residue and are attractive names for future boundary drift.
+- FastAPI ActivityDefinition CRUD does not expose `rules_json` or
+  `instructions_json`; markdown sync is the authoritative complete authoring
+  path.
+- `README.md` still identifies the repository as `repo-seed`.
+
+Recommended closure: remove the disabled workflow/table in a migration when
+compatibility permits, label REST CRUD as basic/legacy or make it round-trip the
+full contract, and replace the seed README in a small documentation change.
+
+### G9 — Controlled-source SBOM promotion awaits natural-run evidence
+
+Severity: **low verification**.
+
+The implementation, deployment, attended canary, next-batch selection, and
+read-only production report probe are complete. Acceptance deliberately remains
+open until the first unassisted weekday schedule fire proves controlled-source
+provenance for the naturally selected batch.
+
+Owner/evidence: ACTIVITY-WP-0034-T02.
+
+## Overall assessment
+
+activity-core materially fulfills the Event Bridge intent: it durably decides
+when coordination fires, derives what to emit from declared context, and sends
+the result to an explicit destination. Its main drift is not project-management
+scope; it is the growth of a narrow execution-delivery plane and a few bounded
+operations around that bridge. Those additions are useful and controlled, but
+INTENT must name them precisely so future contributors can distinguish accepted
+operational state from prohibited task lifecycle and accepted bounded actions
+from a general executor.

workplans/ADHOC-2026-08-23.md

@@ -0,0 +1,27 @@
+---
+id: ADHOC-2026-08-23
+type: workplan
+title: "2026-08-23 opportunistic repository maintenance"
+domain: infotech
+repo: activity-core
+status: finished
+owner: codex
+topic_slug: activity-core
+created: "2026-08-23"
+updated: "2026-08-23"
+---
+
+# 2026-08-23 Opportunistic Repository Maintenance
+
+## Refresh implemented scope and assess it against intent
+
+```task
+id: ADHOC-2026-08-23-T01
+status: done
+priority: low
+```
+
+After confirming that every open activity-core task was externally gated or
+awaiting natural schedule evidence, update `SCOPE.md` from the implemented and
+deployed capability surface and preserve a dated gap assessment against
+`INTENT.md` under `history/`.