Refresh activity-core capability scope

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

SCOPE.md

@@ -1,7 +1,7 @@
 ---
 domain: capabilities
 repo: activity-core
-updated: "2026-08-18"
+updated: "2026-08-23"
 ---
 
 # SCOPE
@@ -30,14 +30,18 @@ what work or evidence to produce. When triggered, a durable Temporal workflow
 loads the definition, resolves context, evaluates the rule/instruction set, and
 emits outputs via configured sinks:
 
-- **Tasks** — via `IssueSink` (`rest` → issue-core, `state-hub` progress, or
-  `null` dry-run).
+- **Coordination outputs** — task specs through `IssueSink` (`rest` →
+  issue-core, `state-hub` progress, or `null` dry-run), plus claimable
+  `ops_runs` for automation executors when the queue is enabled.
 - **Reports** — instruction reports to working memory and/or State Hub progress.
 - **Evidence** — compact non-secret summaries from selected resolvers (ops
   inventory, package prune, legacy-meter, etc.).
 
-Everything is auditable: `activity_runs` records the activation; `task_spawn_log`
-records emissions; report sinks leave progress/working-memory artifacts.
+Everything is auditable at the orchestration boundary: `activity_runs` records
+the activation and context snapshot; `task_spawn_log` records emission facts;
+`ops_runs` records claim/lease/outcome evidence; report sinks leave
+progress/working-memory artifacts. LLM audit stores the model and prompt hash,
+not raw prompts or provider payloads.
 
 The two evaluation modes:
 
@@ -63,10 +67,10 @@ The two evaluation modes:
   trigger; one-shot schedule smoke tests for recurring definitions.
 - **Schedule reconcile**: Temporal Schedule upsert/pause with per-row error
   isolation (`sync_schedules` continues after `ScheduleAlreadyRunningError`).
-- **Context resolution adapters**: repo-scoping, State Hub (domain/workplan
-  state, SBOM status, daily triage digest, coding retro, Binky rhythm status,
-  consistency sweep, RecentlyOnScope hourly), shell queries (e.g. Forgejo
-  package prune), and ops inventory probes. Registry is extensible.
+- **Context resolution adapters**: repo-scoping, State Hub, hub-core,
+  reuse-surface, event payloads, Kaizen agent metadata, SBOM Nexus, shell
+  queries, CNPG backup, Forgejo package prune, and ops inventory probes. The
+  resolver registry is extensible.
 - **Rule evaluator**: sandboxed AST walker; `for_each` binding; no `exec()`.
 - **Instruction executor**: trusted-field rendering, llm-connect, structured
   validation, item-granular recovery, deterministic report path, report sinks.
@@ -79,17 +83,33 @@ The two evaluation modes:
   (`daily_triage`, `sbom_staleness`, `forgejo_package_prune`,
   `ops_inventory_probe`, `activity_task_spawn`, etc.).
 - **Spawn audit log**: `task_spawn_log` with rule/instruction id and sink ref.
-- **Webhook receiver**: Gitea/GitHub → EventEnvelope → NATS.
+- **Automation execution queue**: durable `ops_runs` with idempotent insertion,
+  concurrent claim (`FOR UPDATE SKIP LOCKED`), leases, heartbeat, retry/reopen,
+  terminal outcome, and operator visibility. This is machine-run delivery
+  state, not the authoritative lifecycle of a workplan task or tracker issue.
+- **Profile-driven execution contract**: structurally validate a pinned
+  `harness_profile_ref`, pass through allowlisted attribution refs, and retain
+  normalized non-secret Glas execution evidence. Glas selects the rein/model/
+  sandbox constellation; activity-core does not.
+- **Webhook receiver**: Gitea/GitHub → EventEnvelope → NATS, with HMAC
+  verification when the corresponding shared secret is configured.
 - **Worker and workflow infrastructure**: Temporal `RunActivityWorkflow`
   (load → resolve → evaluate → report → **log_run** → emit). Emit failures no
   longer skip `activity_runs` rows.
-- **REST admin API** (FastAPI): CRUD, manual trigger, admin sync, metrics.
+- **REST admin API** (FastAPI): basic ActivityDefinition row CRUD, manual
+  trigger, admin sync, event-type approval, and dependency health. Full
+  rules/instructions authoring remains markdown-and-sync driven; the row CRUD
+  schema is not a complete replacement for the file format.
 - **Operator automation console** (ACTIVITY-WP-0024): `/ops` inventory, status
   window, run history, Run now / enable / disable / pause with operator-token
   auth (fail-closed), plus thin HTML UI at `/ops/ui`.
 - **Automation status surface**: `make automation-status` and
   `make prod-automation-status` / `scripts/prod_automation_status.sh` for
   railiance01 evidence without LLM authority (same contract as `/ops/automations/status`).
+- **Review CLI**: the `activity` command merges repository commits with
+  activity/ops-run evidence across configured services, supports checkpoints,
+  and reports automation definitions and recent runs. It is an evidence review
+  client, not a task tracker.
 - **Operational runbook**: `docs/runbook.md`, emission boundary docs.
 
 ---
@@ -97,12 +117,13 @@ The two evaluation modes:
 ## Out of Scope
 
 - **Task lifecycle** — create/assign/track/close remains issue-core (or fleet
-  work-record connectors). activity-core holds a spawn audit trail only.
+  work-record connectors). activity-core holds spawn evidence and machine-run
+  delivery state, not the authoritative human/work-item record.
 - **Project and initiative management** — project-core (future).
-- **General execution workers** — scans, patches, privileged API writes that
-  are not explicitly declared as **bounded ActivityDefinition side-effects**
-  (e.g. retention prune with dry-run/apply gates) belong to per-repo workers
-  or platform tools.
+- **General execution workers** — agent loops, repository changes, arbitrary
+  scans, and privileged API writes belong to Glas/reins, per-repo workers, or
+  platform tools. The `ops_run` API dispatches and observes this work; it does
+  not perform it.
 - **General ops control plane** — Kubernetes, SSH, tunnels, secret custody,
   OpenBao policy administration.
 - **Event broker / Temporal server hosting** — consume, do not own lifecycle.
@@ -137,42 +158,54 @@ task execution. It must not expand into an unbounded ops executor.
 
 ---
 
-## Current State (2026-08-18)
+## Current State (2026-08-23)
 
 ### Status
 
-Production on **railiance01** (`activity-core` namespace). Product work through
-ACTIVITY-WP-0028 is finished. G2 (executor gap) is closed in-repo by
-**ACT-ADR-005** + **ACTIVITY-WP-0026** (ops_run claim queue).
+Production runs on **railiance01** in the `activity-core` namespace with
+PostgreSQL, Temporal Schedules, a Temporal worker, API, and NATS event router.
+The checked-in surface contains 12 ActivityDefinitions plus publisher-declared
+event types. The schema is at migration `0008`, including the ops-run queue and
+Glas profile/attribution fields.
 
-Open work (SBOM catch-up parked — CUST-WP-0062 / ACTIVITY-WP-0030):
+No open task is independently actionable on 2026-08-23:
 
-| WP | Status | Role |
+| Workplan | State | Current gate |
 | --- | --- | --- |
-| **ACTIVITY-WP-0029** | active | S5 of State Hub retirement: retarget sweeps/sinks/execution to repo-manager and hub-core |
-| ACTIVITY-WP-0030 | active (all tasks wait) | Daily SBOM catch-up; do not start — waits on CUST-WP-0062 |
+| ACTIVITY-WP-0031 | wait | OpenRouter account owner must replace the rejected provider key; external routing handoffs remain with their named owners |
+| ACTIVITY-WP-0032 | wait | `GLAS-IN-0002`: managed consumer namespace plus rein/model runtime and egress contract before a successful commit proof |
+| ACTIVITY-WP-0034 | progress | Observe the first unassisted weekday controlled-source SBOM fire; do not substitute another manual trigger |
 
 ### Live posture (railiance01)
 
-- Image: `activity-core:railiance01-prod` (locally imported).
+- Image: `activity-core:railiance01-prod` (locally built/imported deployment).
 - `ISSUE_SINK_TYPE=state-hub` (internal findings → State Hub progress, not
   Forgejo issues).
-- Edge relay: `actcore-statehub-edge-relay` → in-cluster `state-hub`.
+- The daily SBOM catch-up is enabled at weekday 09:15 Europe/Berlin, limit 3.
+  It freezes Repo Manager's full-SHA `forgejo-archive-v1` source reference,
+  reuses it across Nexus retries, and reports only allowlisted provenance.
+- The old weekly SBOM fan-out is disabled in source, DB, and Temporal.
+- `ops_runs` are claimable by rein-aharness and carry pinned Glas profile refs;
+  production has proven normalized fail-closed evidence and sandbox teardown,
+  but not yet a successful profiled commit.
 - Weekly prune: worker has `FORGEJO_TOKEN` + hostPath `/opt/railiance-platform`
   + `live_images_file` (kubectl absent in pod).
-- Proven one-shots (2026-07-21): Binky daily/mail COMPLETED with tasks_spawned=1;
-  SBOM deterministic report; daily triage progress; prune apply.
+- The deterministic status surface distinguishes schedule fires, emitted
+  tasks, ops-run states, and bounded failures.
 
 ### Definitions (repo files + prod DB)
 
 | Definition | Role |
 | --- | --- |
-| `weekly-sbom-staleness` | Deterministic SBOM report; task emit gated off |
+| `daily-sbom-catchup` | Bounded oldest-N Nexus ingestion with immutable controlled source refs |
+| `weekly-sbom-staleness` | Disabled legacy fan-out; retained as deterministic report definition |
 | `weekly-forgejo-package-prune` | Sunday 03:30 UTC apply prune + evidence |
 | `weekly-legacy-meter-review` / `legacy-meter-8h-capture` | Meter evidence |
 | `weekly-coding-retro` | Present; enablement depends on `coding_retro` feed |
 | Binky daily / mail / review-prep | Rhythm tasks via IssueSink |
-| Railiance ConfigMap bundle | Daily triage, ROS hourly, consistency sweep, etc. |
+| `daily-cnpg-option-a-backup` | Declared bounded CNPG backup plus evidence |
+| `monthly-secrets-elevation-review` | Scheduled governance review task |
+| `glas-profile-pilot` | Disabled low-risk profile-contract proof definition |
 
 ### Task emission posture
 
@@ -186,43 +219,46 @@ Open work (SBOM catch-up parked — CUST-WP-0062 / ACTIVITY-WP-0030):
 
 ## Assessment Against Intent
 
+The detailed review is preserved in
+`history/2026-08-23-scope-against-intent-assessment.md`.
+
 ### Alignment
 
 | INTENT promise | Status |
 | --- | --- |
-| Answers **when / what / where** | Met — Temporal schedules, rules/instructions, sinks |
+| Answers **when / what / where** | Met — Temporal schedules/NATS/webhooks, rules/instructions, and explicit sinks/targets |
 | Markdown definitions | Met — `activity-definitions/`, event-types, external ConfigMaps |
-| Rules before instructions | Met — SBOM/prune/Binky rules; triage uses LLM when needed |
-| Durable recurring automation | Met — railiance01 schedules fire; status surface exists |
-| Audit trail | Met — `activity_runs`, spawn log, progress/working-memory |
-| Does not own task lifecycle | Met — no completion tracking |
+| Rules before instructions | Met — deterministic rule/report paths dominate; LLM is optional |
+| Durable recurring automation | Met — Temporal schedules plus deterministic status evidence |
+| Audit trail | Partly met — activation, context, prompt hash/model, emission, queue, and normalized execution evidence exist; raw prompt text is intentionally absent |
+| Does not own task lifecycle | Met for workplan/tracker tasks; qualified by an in-repo machine `ops_run` claim/lease/outcome lifecycle |
 | Does not own project phases | Met |
 
 ### Gaps and tensions (INTENT ↔ practice)
 
 | Gap | Severity | Notes |
 | --- | --- | --- |
-| **G1. Sink default vs INTENT “emit to issue-core”** | High (policy) | INTENT names issue-core as the task landing zone. Practice and work-record canon push **State Hub / repo work records** for internal findings. WP-0022 owns policy; code already supports `state-hub` / `null` / `rest`. |
-| **G2. Executor gap** | Closed (in-repo) | **ACT-ADR-005** + **ACTIVITY-WP-0026** (ops_run claim queue). Claim loop remains **REIN-A-0002**. Do not use issue-core/Forgejo as default ops queue (WP-0022). |
-| **G3. Side-effect resolvers** | Medium | Forgejo prune `apply: true` runs platform deletes inside a context resolver. Allowed only as declared, gated side-effect; needs clearer SCOPE language (above) and operator refresh of live-images protection. |
-| **G4. Review queue** | Medium | `review_required` remains metadata-only; no downstream review queue. |
-| **G5. TaskExecutorWorkflow stub** | Low | Disabled unless `ACTIVITY_CORE_ENABLE_TASK_EXECUTOR_STUB` (WP-0023-T08). |
-| **G6. ROS digest completeness** | Medium (ops, external) | Templates mounted; **state-hub image** still lacks `markitect_tool` / MarkiTect CLI (`main-d8808bf` checked 2026-07-21). Owner: state-hub (WP-0023-T07). |
-| **G7. Credential delivery** | Low (residual) | **FORGEJO_TOKEN** via ESO `actcore-forgejo-admin` (WP-0023-T05, Ready). issue-core `GITEA_BACKEND_TOKEN` still 503 forgejo-inbox for path A rest — **issue-core owner** (WP-0023-T06). |
-| **G8. Live-images hygiene** | Medium (ops) | Multi-cluster `live-images-all.txt` must be refreshed after deploys or prune can delete live tags (incident 2026-07-21, restored). `scripts/refresh_live_images.sh` (T04). |
-| **G9. Evidence federation** | Low | Progress often lands on railiance01 edge/hub; workstation primary hub may not show the same feed without tunnel/outbox health. |
-| **G10. API external access** | Done | WP-0025 finished: Traefik + Authelia SSO for ops + Temporal UI; LLDAP `activity-core-operators` (NK-WP-0021); port-forward break-glass only. |
-| **G11. State Hub as permanent target** | Medium (T03 open) | Sweep is dual-run/repo-manager-retargetable; `/execution/semantics` is local. Progress/evidence sinks still wait on HUB-WP-0004 (`ACTIVITY-WP-0029-T03`). |
+| **G1. Operational state boundary** | High (clarity) | `ops_runs` owns open/claimed/terminal machine-run state. This is not work-item lifecycle, but INTENT's absolute wording does not state the distinction. |
+| **G2. Bounded side effects** | Medium (boundary) | SBOM ingest, package prune, and CNPG backup execute declared operations inside the orchestration workflow; INTENT says activity-core does not execute work. |
+| **G3. Live LLM execution** | High (operational, external) | The implementation is present, but production provider requests fail with a sanitized upstream 401 until the account owner replaces the key. |
+| **G4. Profiled execution proof** | Medium (operational, external) | Profile selection, failure evidence, and teardown are proven; a successful commit waits on `GLAS-IN-0002`. |
+| **G5. State Hub retirement** | Medium (integration) | hub-core adapters exist, but production task/report progress still defaults to the State Hub compatibility path. |
+| **G6. Review routing** | Medium | `review_required` remains evidence metadata; there is no downstream pending-review queue. |
+| **G7. Audit wording** | Medium (assurance) | The repo records a prompt hash, model, definition version, and context snapshot, not the literal rendered prompt promised by INTENT. |
+| **G8. Legacy surfaces** | Low | `TaskExecutorWorkflow`/`task_instances` remain disabled compatibility residue, and the basic REST CRUD schema cannot author full rules/instructions. |
 
 ### Drift risks
 
-1. **Convenience execution** — growing shell resolvers into a general ops runner.
+1. **Convenience execution** — growing the bounded side-effect allowlist into a
+   general ops runner.
 2. **Silent sink restore** — flipping `ISSUE_SINK_TYPE=rest` without policy +
    healthy Forgejo backend reintroduces issue spam / 503s.
 3. **Protection file staleness** — weekly prune with `apply: true` depends on
    fresh live-image lists.
-4. **Stub workflow attraction** — `TaskExecutorWorkflow` looks like an
-   execution home.
+4. **Queue/task conflation** — treating an `ops_run` as the authoritative human
+   task record rather than a delivery instance.
+5. **Stub workflow attraction** — `TaskExecutorWorkflow` looks like an
+   execution home despite being disabled by default.
 
 ---
 
@@ -235,14 +271,14 @@ Open work (SBOM catch-up parked — CUST-WP-0062 / ACTIVITY-WP-0030):
        ↓
 [IssueSink: rest | state-hub | null]  →  issue-core  or  hub-core progress (State Hub until cutover)
 [report/evidence sinks]               →  hub-core / working memory
-[ops_run claim queue]                 →  rein-aharness / per-repo executors
+[ops_run claim queue + Glas profile]  →  rein-aharness / other approved reins
 [bounded shell side-effects]          →  platform tools (e.g. package prune)
 ```
 
 - **Upstream**: NATS, Temporal, PostgreSQL, repo-manager / hub-core (State Hub
   until retirement), repo-scoping, llm-connect.
-- **Downstream**: issue-core (optional), hub-core progress, platform tools,
-  rein-aharness / per-repo executors claiming ops_runs.
+- **Downstream**: issue-core (optional), State Hub/hub-core progress, SBOM
+  Nexus and bounded platform tools, Glas/reins claiming `ops_runs`.
 - **Orientation (not runtime)**: info-tech-canon (task/org/governance
   vocabulary), policy-nexus (publication of ADRs/canon — not authored here).
 - **Ops**: railiance01 k3s; workstation status via SSH helper.
@@ -269,7 +305,8 @@ Open work (SBOM catch-up parked — CUST-WP-0062 / ACTIVITY-WP-0030):
 - `hub-core` — messages, progress projections, extension ports (core-hub absorbed later).
 - `state-hub` — compatibility read model until STATE-WP-0079 retirement.
 - `issue-core` — task connector / external tracker mapping (not fleet work-record origin).
-- `repo-scoping`, `llm-connect`, `rein-aharness`.
+- `repo-scoping`, `reuse-surface`, `sbom-nexus`, `llm-connect`, `glas-harness`,
+  `rein-aharness`, `sand-boxer`.
 - `railiance-platform` — Forgejo package prune tool and credential lanes.
 - `ops-warden` — credential routing (not secret vending for non-SSH).
 - `ops-bridge` tunnels.
@@ -305,8 +342,8 @@ type: data
 title: Durable event-triggered task factory
 description: >
   Org-wide Event Bridge that receives time-based and domain events, evaluates
-  declarative rules and LLM instructions against current org context, and emits
-  structured task, report, and evidence outputs with a full spawn/report audit
-  trail while leaving task lifecycle ownership downstream.
-keywords: [temporal, workflow, event-bridge, task, report, evidence, cron, event, rule, instruction, org-automation]
+  declarative rules and LLM instructions against current org context, emits
+  task/report/evidence outputs, and offers a leased ops-run delivery queue with
+  normalized execution evidence while leaving work-item lifecycle downstream.
+keywords: [temporal, workflow, event-bridge, ops-run, glas, task, report, evidence, cron, event, rule, instruction, org-automation]
 ```