ACTIVITY-WP-0042: propose platform backup/restore evidence scheduling role (decision pending)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 459908@bnt-lap001
Assistant-Session: 8b6f63e5-8763-4d5f-bce5-e91e6eed8fe9

workplans/ACTIVITY-WP-0042-platform-backup-restore-evidence-scheduling.md

@@ -0,0 +1,73 @@
+---
+id: ACTIVITY-WP-0042
+type: workplan
+title: "Scheduling role for recurring platform backup/restore evidence runs"
+domain: infotech
+repo: activity-core
+status: proposed
+owner: codex
+topic_slug: activity-core
+created: "2026-10-03"
+updated: "2026-10-03"
+---
+
+Origin: State Hub message e3668cd9 from railiance-platform (RPF-WP-0036-T03,
+RPF-WP-0038-T04) proposing activity-core as execution owner for recurring
+backup/restore evidence runs. This plan is a proposal. Acceptance of the role
+is a founder/owner decision and is NOT recorded here.
+
+Facts from the repo (2026-10-03):
+
+- `daily-cnpg-option-a-backup` already runs a cron-scheduled bounded operation
+  (`cnpg_option_a_backup`, ACT-ADR-007) with state-hub-progress evidence. Its
+  definition targets the Nextcloud lane and covers forgejo-db, net-kingdom-pg,
+  state-hub-db; it does not cover apps-pg/platform-pg/platform-pg-2 or the
+  Scaleway primary, and it never performs restores.
+- ACT-ADR-007 allowlist is closed. A restore-evidence or Scaleway-backup run
+  needs a new code-registered operation plus an ADR successor, tests, a
+  credential route and an evidence contract. A definition string cannot add one.
+- The `actcore-backup-offsite` lane depends on ClusterSecretStore
+  `openbao-activity-core`, reported failing since 2026-09-19 (expired token).
+
+## Decide whether activity-core accepts the scheduling role
+
+```task
+id: ACTIVITY-WP-0042-T01
+status: wait
+priority: high
+```
+
+Founder decision. Options: accept scheduling only (when/what/where; S3 keeps
+validators, cadence, expiry and evidence), accept scheduling plus a bounded
+operation, or decline. Needs: restore execution stays with an S3-owned tool
+invoked as a fixed bounded operation; approval-engine authority supplied per
+run; no general executor behaviour.
+
+## Admit a bounded operation and credential lane
+
+```task
+id: ACTIVITY-WP-0042-T02
+status: wait
+priority: medium
+```
+
+Blocked on T01. Successor to ACT-ADR-007, registry entry (target bounds,
+timeout, idempotency, dry_run explicit), tests, credential route via OpenBao
+(owner railiance-platform) with a repaired `openbao-activity-core` store, and
+non-secret evidence mode. Scheduled caller satisfies RPF-WP-0038-T04 only
+once recurring tiered scheduling and retention are accepted by their owners.
+
+## Answer ops-warden on atm-backup-daily
+
+```task
+id: ACTIVITY-WP-0042-T03
+status: wait
+priority: low
+```
+
+WARDEN-WP-0040 asks which owner declares workload resolution `backup-daily`
+for `atm-backup-daily`. activity-core has no `atm-*` identity of its own in
+this repo and no evidence that the actor was minted for its worker. Declare
+only if the founder confirms activity-core's backup worker is that unit;
+otherwise the declaring owner is whoever holds the actor's issuance
+(railiance-platform was also asked). Never infer membership.