feat(event-bridge): WP-0003a — domain model, rules module, event type registry

Implements phases 7–8 of the Event Bridge architecture (custodian-WP-0003a).

Domain model (T34, T40):
- Added RuleDef, InstructionDef, ActionDef to models.py
- Updated ActivityDefinition with rules/instructions fields (task_templates deprecated)
- Formalized EventEnvelope: id, type, version, timestamp, publisher, attributes
- Added from_nats_message() and from_webhook_payload() classmethods

Rules module (T35, T36, T37):
- src/activity_core/rules/ skeleton with boundary enforcement
- evaluate_condition() — sandboxed AST walker, whitelisted nodes only, never exec()
- execute_instruction() — LLM task generation with trusted_fields injection guard
- tests/rules/test_boundary.py verifies no cross-boundary imports

Infrastructure (T38, T39):
- Alembic migrations 0004 (task_spawn_log) and 0005 (event_types)
- IssueSink ABC + IssueCoreRestSink (REST) + NullSink (testing)
- TaskSpawnLog and EventType ORM models

Event type registry (T41, T42, T43):
- event_type_registry.py: file scanner, parser, DB sync, in-process lookup
- ACTIVITY_CURATOR_GATE env var (disabled|required) + approve endpoint
- Three org event type definitions: org.repo.registered, org.workstream.completed,
  org.activity.run.completed

All 10 tests pass. Boundary test confirms rules/ isolation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/activity_core/issue_sink.py

@@ -0,0 +1,75 @@
+"""
+IssueSink adapter interface and implementations.
+
+IssueSink is the outbound boundary between activity-core and task backends
+(issue-core, etc.). It receives TaskSpec objects and returns TaskRef objects.
+
+Active sink is selected by ISSUE_SINK_TYPE env var: "rest" (default) | "null".
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import uuid
+from abc import ABC, abstractmethod
+
+import httpx
+
+from activity_core.rules.models import TaskRef, TaskSpec
+
+logger = logging.getLogger(__name__)
+
+ISSUE_CORE_URL = os.environ.get("ISSUE_CORE_URL", "http://127.0.0.1:8010")
+ISSUE_SINK_TYPE = os.environ.get("ISSUE_SINK_TYPE", "rest")
+
+
+class IssueSink(ABC):
+    @abstractmethod
+    def emit(self, task_spec: TaskSpec) -> TaskRef: ...
+
+
+class IssueCoreRestSink(IssueSink):
+    """POSTs to issue-core REST API. Config: ISSUE_CORE_URL env var."""
+
+    def __init__(self, base_url: str = ISSUE_CORE_URL) -> None:
+        self._base_url = base_url.rstrip("/")
+
+    def emit(self, task_spec: TaskSpec) -> TaskRef:
+        payload = {
+            "title": task_spec.title,
+            "description": task_spec.description,
+            "target_repo": task_spec.target_repo,
+            "priority": task_spec.priority,
+            "labels": task_spec.labels,
+            "due_in_days": task_spec.due_in_days,
+            "source_type": task_spec.source_type,
+            "source_id": task_spec.source_id,
+            "triggering_event_id": task_spec.triggering_event_id,
+            "activity_definition_id": task_spec.activity_definition_id,
+        }
+        resp = httpx.post(f"{self._base_url}/issues/", json=payload, timeout=10.0)
+        resp.raise_for_status()
+        data = resp.json()
+        return TaskRef(
+            external_id=data["issue_id"],
+            backend_url=data.get("issue_url"),
+            backend=data.get("backend", ""),
+        )
+
+
+class NullSink(IssueSink):
+    """Discards tasks and returns synthetic TaskRefs. For testing."""
+
+    def emit(self, task_spec: TaskSpec) -> TaskRef:
+        synthetic_id = f"null-{uuid.uuid4()}"
+        logger.debug("NullSink: discarding task %r → %s", task_spec.title, synthetic_id)
+        return TaskRef(external_id=synthetic_id, backend="null")
+
+
+def get_issue_sink() -> IssueSink:
+    """Factory: returns the configured IssueSink based on ISSUE_SINK_TYPE."""
+    sink_type = ISSUE_SINK_TYPE.lower()
+    if sink_type == "null":
+        return NullSink()
+    return IssueCoreRestSink()