Refresh SCOPE.md intent gap analysis; add ACTIVITY-WP-0023
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
CI Smoke / container-smoke (push) Successful in 4s

Document production posture after WP-0020/0021, list INTENT↔practice gaps
G1–G10, and open a workplan for gap closure plus operational follow-ups.
This commit is contained in:
tegwick 2026-07-21 21:19:47 +02:00
parent bb7842dcdc
commit e73575dcd6
2 changed files with 436 additions and 258 deletions

View file

@ -0,0 +1,254 @@
---
id: ACTIVITY-WP-0023
type: workplan
title: "Intentscope gap closure and WP-0020/0021 operational follow-ups"
domain: infotech
repo: activity-core
status: proposed
owner: codex
topic_slug: activity-core
created: "2026-07-21"
updated: "2026-07-21"
---
# Intentscope gap closure and WP-0020/0021 operational follow-ups
## Origin
2026-07-21 gap analysis of `INTENT.md` against production practice and the
refreshed `SCOPE.md` (same day). Captures:
1. **Product/architecture gaps** vs the governing when/what/where principle.
2. **Non-blocking operational follow-ups** from ACTIVITY-WP-0020 (Forgejo prune)
and ACTIVITY-WP-0021 (prod reliability).
Does **not** re-implement ACTIVITY-WP-0022 (IssueSink default policy) — that
workplan owns G1 policy decisions; this workplan **consumes** its outcomes and
covers adjacent gaps.
## Gap summary (from SCOPE)
| ID | Gap | Intent tension |
| --- | --- | --- |
| G1 | Sink default vs “emit to issue-core” | Policy — **ACTIVITY-WP-0022** |
| G2 | Executor gap (tasks emit, work not executed) | INTENT assigns execution to per-repo workers |
| G3 | Side-effect resolvers (prune apply) | Must stay bounded/declared |
| G4 | `review_required` has no queue | Downstream contract missing |
| G5 | `TaskExecutorWorkflow` stub attraction | Execution boundary residue |
| G6 | ROS digests need MarkiTect | Ops completeness |
| G7 | Credential delivery (FORGEJO_TOKEN ESO; issue-core Gitea PAT) | Path A / weekly prune durability |
| G8 | `live-images-all.txt` hygiene | Prune safety after deploys |
| G9 | Evidence federation workstation vs edge hub | Operator visibility |
| G10 | ClusterIP-only API | Deferred auth |
## Goal
Close or explicitly disposition each gap with either shipped code/docs,
operator-owned policy (WP-0022), or a deliberate “wontfix / external owner”
note — so SCOPE stays truthful and INTENTs three questions remain load-bearing.
## Out of scope
- Implementing fleet work-record promotion (state-hub / the-custodian).
- Full agent-harness product roadmap (only the activity-core emission contract).
- OpenBao policy authorship for unrelated workloads.
- Re-opening finished WP-0006/0008 calibration narratives unless evidence is
still broken after WP-0021 triage fixes.
## Tasks
## Task: Align sink matrix with INTENT and WP-0022
```task
id: ACTIVITY-WP-0023-T01
status: wait
priority: high
```
**Depends on ACTIVITY-WP-0022-T01** (default sink policy decision).
1. After WP-0022 decides defaults, update `INTENT.md` wording if the fleet no
longer treats issue-core as the **default** landing zone (keep issue-core as
optional external connector).
2. Ensure `docs/issue-core-emission-boundary.md` + runbook sink matrix match:
`null` / `state-hub` / `rest` + per-definition opt-in.
3. Confirm railiance01 env and ConfigMap defaults match the decision (today:
`state-hub`).
**Done when:** INTENT + emission docs + prod defaults tell one story; WP-0022
tasks for docs/defaults are cross-linked as done.
## Task: Executor contract for emitted tasks (Binky first)
```task
id: ACTIVITY-WP-0023-T02
status: todo
priority: high
```
INTENT: execution lives in per-repo workers / harness — not activity-core.
1. Document the **consumer contract** for `activity_task_spawn` (state-hub) and
issue-core REST refs: required fields, idempotency, target_repo.
2. Prove one end-to-end path for **Binky daily brief**: emit → consumer
(agent-harness or documented human lane) → `binky_daily_brief` progress /
brief artifact.
3. File or link harness/railiance work if the consumer is out of this repo;
do not implement a real `TaskExecutorWorkflow` here.
**Done when:** A scheduled or one-shot Binky daily produces both a spawn record
**and** a Binky-side completion evidence note within one business day of fire.
## Task: Side-effect resolver guardrails
```task
id: ACTIVITY-WP-0023-T03
status: todo
priority: medium
```
1. Codify in runbook which shell queries may set `apply: true` (today: Forgejo
package prune only).
2. Hard-fail prune apply when `live_images_file` is missing or empty when
`apply: true` (prevents 2026-07-21 worker incident recurrence).
3. Optional: unit test that apply without protection file is rejected.
**Done when:** apply path cannot run without an explicit non-empty protection
source; docs list allowed side-effect definitions.
## Task: Live-images protection refresh automation
```task
id: ACTIVITY-WP-0023-T04
status: todo
priority: medium
```
Non-blocking follow-up from ACTIVITY-WP-0020.
1. Script (railiance-platform or activity-core `scripts/`) that exports live
forgejo images from coulombcore + railiance01 and merges to
`railiance-platform/docs/evidence/live-images-all.txt` on the worker host.
2. Document cadence (post-deploy checklist or weekly pre-prune cron on host).
3. Prefer non-secret output only (image refs, no tokens).
**Done when:** operator can refresh protection with one documented command;
runbook links it from the prune section.
## Task: FORGEJO_TOKEN via ESO (retire bootstrap inject)
```task
id: ACTIVITY-WP-0023-T05
status: todo
priority: medium
```
1. OpenBao / railiance-platform: grant activity-core ESO token read on
`platform/workloads/forgejo/forgejo-admin` **or** a dedicated
`activity-core` prune token with package write only.
2. Land ExternalSecret merge into `actcore-runtime-secret` `FORGEJO_TOKEN`.
3. Remove reliance on one-shot `kubectl patch secret` bootstrap.
**Done when:** ExternalSecret Ready=True and worker restarts still see a
working token without manual patch.
## Task: issue-core path A (optional rest sink)
```task
id: ACTIVITY-WP-0023-T06
status: todo
priority: low
```
Non-blocking follow-up from ACTIVITY-WP-0021.
1. Rotate/fix issue-core `GITEA_BACKEND_TOKEN` so `POST /issues/` returns 201
(not 503 forgejo-inbox).
2. Smoke from actcore-worker with `ISSUE_SINK_TYPE=rest` only for definitions
that opt in (per WP-0022).
3. Do **not** flip global default to rest without WP-0022.
**Done when:** documented smoke 201 for one opt-in definition, or explicit
wontfix with issue-core owning the backend fix only.
## Task: ROS MarkiTect completeness
```task
id: ACTIVITY-WP-0023-T07
status: todo
priority: medium
```
1. Coordinate with state-hub image: ship MarkiTect / set
`STATE_HUB_MARKITECT_CLI_PATH` so `/recently-on-scope/hourly` does not fail
per-domain with MarkiTect-required errors.
2. Template `COPY templates/` already landed; verify after image roll.
3. Re-trigger ROS hourly; confirm `failed` list empty or only non-template
reasons.
**Done when:** one clean ROS hourly context snapshot without missing-template
or MarkiTect-missing errors for configured domains.
## Task: Retire or quarantine TaskExecutorWorkflow
```task
id: ACTIVITY-WP-0023-T08
status: todo
priority: low
```
1. Decide: remove registration from worker, or rename/document as
legacy-no-op with metrics alert if used.
2. Ensure no ActivityDefinition or API path depends on it.
3. Update SCOPE if removed.
**Done when:** stub cannot attract production execution by accident.
## Task: Review-required disposition
```task
id: ACTIVITY-WP-0023-T09
status: todo
priority: low
```
1. Document that `review_required` is metadata-only until issue-core or
work-record review lane exists.
2. Either file a cross-repo task for a real review queue **or** mark as
wontfix / future with link in SCOPE known gaps.
**Done when:** SCOPE G4 has a disposition date and owner, not an open lie.
## Task: Evidence visibility note (edge vs workstation hub)
```task
id: ACTIVITY-WP-0023-T10
status: todo
priority: low
```
1. Document in runbook: prod progress is on railiance01 state-hub/edge; use
edge query or tunnel, not only workstation `127.0.0.1:8000` history.
2. Optional: `prod-automation-status` prints last N edge progress event types
for `daily_triage` / `forgejo_package_prune` / `activity_task_spawn`.
**Done when:** an operator following runbook can find post-fire evidence without
guessing hub topology.
## Success criteria
- [ ] G1 closed via WP-0022 + T01 doc alignment
- [ ] G2 has a proven Binky executor path or explicit external workplan
- [ ] G3 apply-without-protection is impossible
- [ ] G6G8 operational follow-ups shipped or scheduled with owners
- [ ] G5/G9/G10 dispositioned
- [ ] `SCOPE.md` re-checked after close; no stale “rest default / WP-0006 gate”
language
## References
- `INTENT.md`, `SCOPE.md` (2026-07-21 refresh)
- `ACTIVITY-WP-0020` closeout (prune enable, live-images, token bootstrap)
- `ACTIVITY-WP-0021` closeout (state-hub sink, schedule harden, ROS template)
- `ACTIVITY-WP-0022` IssueSink no-default-Forgejo
- `docs/issue-core-emission-boundary.md`