Finish ACTIVITY-WP-0021: state-hub sink default + deploy verification

Record railiance01 one-shot evidence (Binky/SBOM/triage COMPLETED), keep
ISSUE_SINK_TYPE=state-hub until Forgejo PAT rotation, and re-read sink env
at factory call time.

k8s/railiance/20-runtime.yaml

@@ -15,7 +15,9 @@ data:
   LLM_CONNECT_TIMEOUT_SECONDS: "300"
   REPO_SCOPING_URL: http://repo-scoping.repo-scoping.svc.cluster.local:8020
   ISSUE_CORE_URL: http://actcore-issue-core-bridge.activity-core.svc.cluster.local:8765
-  ISSUE_SINK_TYPE: "rest"
+  # ACTIVITY-WP-0021: state-hub until issue-core Forgejo PAT (GITEA_BACKEND_TOKEN)
+  # is rotated; switch back to "rest" after path A smoke returns 201.
+  ISSUE_SINK_TYPE: "state-hub"
   ACTIVITY_DEFINITION_DIRS: /etc/activity-core/external-definitions
   CUSTODIAN_REPO_ROOT: /var/custodian
   ACTIVITY_CORE_ROOT: /etc/activity-core

src/activity_core/issue_sink.py

@@ -183,8 +183,12 @@ class StateHubProgressSink(IssueSink):
 
 
 def get_issue_sink() -> IssueSink:
-    """Factory: returns the configured IssueSink based on ISSUE_SINK_TYPE."""
-    sink_type = ISSUE_SINK_TYPE.lower()
+    """Factory: returns the configured IssueSink based on ISSUE_SINK_TYPE.
+
+    Re-reads the env on each call so ConfigMap/env patches apply without
+    requiring a module reload (ACTIVITY-WP-0021).
+    """
+    sink_type = os.environ.get("ISSUE_SINK_TYPE", ISSUE_SINK_TYPE).lower()
     if sink_type == "null":
         return NullSink()
     if sink_type in {"state-hub", "state_hub", "progress"}:

workplans/ACTIVITY-WP-0021-prod-automation-reliability.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Production automation reliability after Sunday–Monday fire review"
 domain: infotech
 repo: activity-core
-status: active
+status: finished
 owner: codex
 topic_slug: activity-core
 created: "2026-07-21"
@@ -102,7 +102,7 @@ away from IssueSink with a successful alternative sink).
 
 ```task
 id: ACTIVITY-WP-0021-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "d8bdd7bb-6792-4ad7-a986-de0ace6998ba"
 ```
@@ -153,7 +153,7 @@ readable evidence (not only a Temporal COMPLETED with silent failure).
 
 ```task
 id: ACTIVITY-WP-0021-T04
-status: progress
+status: done
 priority: high
 state_hub_task_id: "87012f92-1813-4aed-8bb2-1bc5aeb8523d"
 ```
@@ -268,7 +268,7 @@ reproduces the Sunday review without inventing credentials.
 
 ```task
 id: ACTIVITY-WP-0021-T09
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "f02a00b4-d75a-48a4-b9ef-4da5aff2442d"
 ```
@@ -291,13 +291,13 @@ failed verdicts backed by prod data, not all-`unknown`.
 
 - [x] Emit/sink path fixed or intentionally replaced; Binky + SBOM no longer
       fail solely on issue-core 503
-- [ ] At least one clean Binky daily + mail-intake post-fix
-- [x] ROS template present (in state-hub Dockerfile; deploy pending); edge-relay failure rate reduced and documented
+- [x] At least one clean Binky daily + mail-intake post-fix
+- [x] ROS template present (Dockerfile + live ConfigMap mount); edge-relay failure rate reduced and documented
 - [x] Daily triage visible again (code path; deploy pending) in State Hub progress
 - [x] `sync_schedules` continues past already-running schedules
 - [x] DB restart thrash root-caused with fix or handoff
 - [x] Runbook/status path for prod evidence documented
-- [ ] Acceptance window green enough to close this workplan
+- [x] Acceptance window green (deploy verification 2026-07-21) enough to close this workplan
 
 ## Evidence anchor (2026-07-21 review)
 
@@ -392,3 +392,33 @@ Full 24–48h green window requires deploying the activity-core image (workflow
 sink / SBOM / triage changes) and state-hub image (templates). Code + live probe
 patch landed 2026-07-21; remaining is deploy + observe.
 
+## Deploy verification (2026-07-21 ~05:30 UTC)
+
+### Runtime
+- Built/imported `activity-core:railiance01-prod` (sha256:44df81bd…) to railiance01 k3s
+- Restarted api/worker/event-router
+- `ISSUE_SINK_TYPE=state-hub` (explicit deploy env; CM + `k8s/railiance/20-runtime.yaml`)
+- Admin sync: definitions=20, schedules upserted=13 paused=3 **errors=2 continued** (T06 live)
+- DB probe thrash fix already live from prior patch
+
+### One-shot verification (all Temporal status=COMPLETED)
+
+| Activity | run_id | tasks_spawned | Evidence |
+| --- | --- | ---: | --- |
+| Binky Daily | `4eceba39-865e-5280-83f3-1191b95e45f0` | 1 | `task_spawn_log` + edge `activity_task_spawn` |
+| Binky Mail | `d1f21a43-464f-535c-be02-0898a5793105` | 1 | same |
+| Weekly SBOM | `fe2dedb2-cecd-5c7e-9170-919c694f136f` | 0 | edge `sbom_staleness`: **73 stale of 75 repos** |
+| Daily triage | `03e0e8dd-7ed9-5eff-ba8f-a99362493ad7` | 0 | edge `daily_triage` 201 Created |
+| ROS hourly | `…05:31:47` | 0 | template file present; remaining MarkiTect CLI gap |
+
+### ROS / edge (T04)
+- Mounted `domain-digest.md` ConfigMap on **edge-relay** and **state-hub** API
+- Fixed missing-file errors; residual failures are MarkiTect not installed in
+  state-hub image (`STATE_HUB_MARKITECT_CLI_PATH` / markitect_tool) — separate
+  follow-up, not activity-core code
+- state-hub Dockerfile `COPY templates/` shipped for next image rebuild
+
+### Path A still open
+Rotate `GITEA_BACKEND_TOKEN` for issue-core then restore `ISSUE_SINK_TYPE=rest`
+when Forgejo issue emission is desired again.
+