Mark T03–T05 and T07–T08 done after live Authelia/TLS verification,
prefer SSO principal in ops UI copy and audits, and document break-glass
port-forward. Leave T06 waiting on net-kingdom LLDAP/Authelia group rules.
Mark workplan active. Add Traefik ForwardAuth middleware and Ingress
manifests for activity.coulomb.social and activity-temporal.coulomb.social.
Prefer Authelia SSO identity for ops mutations; document DNS gate and
fleet pattern (docs/ops-sso-access.md).
Add nav/deep link to Temporal Web UI (configurable URL, default
127.0.0.1:8080 for port-forward). Document dual port-forward and draft
ACTIVITY-WP-0025 for Keycloak SSO ingress without port-forward.
Default ISSUE_SINK_TYPE to state-hub (no silent Forgejo issues), hard-fail
prune apply without live-images protection, refresh-live-images script,
disable TaskExecutor stub by default, and document consumer/sink contracts.
First apply deleted 38 stale versions; enable schedule with live-images
protection file for worker pods without kubectl; restore path for live
state-hub tags after an unprotected worker apply.
Record railiance01 one-shot evidence (Binky/SBOM/triage COMPLETED), keep
ISSUE_SINK_TYPE=state-hub until Forgejo PAT rotation, and re-read sink env
at factory call time.
Due-items for the three Binky operating-rhythm definitions
(BINKY-WP-0004-T02). Dueness derives from hub progress events recorded
by the executing session (binky_daily_brief / binky_mail_intake /
binky_weekly_review, detail.repo scoped); weekly_review carries
milestone_moved from event_type=milestone events in the last 7 days
(RISK-005 signal). Definitions' resolver comments updated; definitions
stay enabled:false until cutover (BINKY-WP-0004-T06).
7 new tests; resolver test file 31/31 green. Pre-existing failures in
test_railiance_ops_inventory_wiring/test_schedule_health are untouched.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Cherry-picked from stale branch codex/wp-0012-scope-context (9709692).
main was still calling the old /repos/{slug}/scope path; repo-scoping now
serves GET /repos/{slug}/scope/context (web_api/app.py:1449). Includes the
resolver test and consistent workplan-doc updates. Test: 2 passed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Deploy actcore-statehub-edge-relay, point STATE_HUB_URL at it, retire the
bespoke state-hub bridge, and accept edge-relay queued write receipts in
report and ops evidence sinks.
Prefer workplan_id in State Hub progress writes while dual-writing
workstream_id for wire-compat. Extend schedule_health, evidence/report
sinks, phase5 checks, k8s triage prose, and SCOPE terminology.
Introduce the core-hub context resolver stabilization_check query, State Hub
progress summaries, activity-definition projections, and unit tests for the
CORE-WP-0007 post-cutover window.
New context_resolvers/state_hub.py query type: pending_decisions, a thin
GET /decisions/ passthrough (topic_id/workstream_id/workplan_id/decision_type
passed through, status defaults to open). Generic -- not special-cased to
any one decision.
New activity-definitions/monthly-secrets-elevation-review.md: fires 08:00
Berlin on the 1st of each month, sweeps open State Hub decisions under the
infotech/reuse-surface topic, and opens a review task for each. First
target: the temporary autoMode.allow/permissions.allow elevation added to
~/.claude/settings.json on 2026-07-07 (decision 11bf5cbf-458d-4275-a870-
77a82b4058b9, deadline 2026-07-31) for ops-warden/kubectl/OpenBao secret
reads.
Requested by Bernd: no existing scheduling mechanism (session-only cron,
cloud routines with no local access) can durably re-check a local security
posture a month out -- this closes that gap using activity-core's own
durable Temporal-backed trigger instead.
Verified: definition_parser.parse_file + scan_and_parse load it cleanly
alongside the two existing definitions; new resolver tests pass (20/20 in
that file); pending_decisions confirmed against the live local State Hub.
Full suite: 241 passed, 2 pre-existing unrelated failures (confirmed via
git stash -- present before this change too).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Mount the-custodian memory/working from the railiance01 clone (hostPath)
so sweep writeback commits daily-triage notes; worker runs as uid 1000;
progress events store repo-relative working_memory_path; ops inventory
defaults use custodian:// URIs.
Add phase5_stabilization_check State Hub resolver with progress evidence
sinks, schedule projections for daily and closeout checks, custodian:// and
activity-core:// runtime path resolution, and Railiance mounts under /var/custodian.
Add ADR-004 documenting the producer trust boundary: untrusted producers (LLM,
agent, human; erroneous and malicious), the trust-but-handle vs verify-and-mitigate
postures, error-locality and quarantine-with-provenance principles, and the concrete
activity-core mechanisms.
Implement producer-agnostic guardrails in executor.py, applied uniformly on the
happy path and the recovery path via _partition_items: structural-type -> schema ->
structural caps (_MAX_DEPTH, _MAX_STRING_LEN) -> reference allow-list -> count cap.
Each quarantine carries a reason. Closes the happy-path maxItems count cap deferred
from T03 (valid 9-item report keeps 7, quarantines 2). Reference allow-list reads
context["known_candidates"] via _allow_list_from_context; inert until a resolver
populates it. SCOPE.md updated (executor bullet + ADR list); no INTENT drift.
New tests: happy-path count cap, oversized-string guardrail, allow-list rejection.
Full suite: 218 passed, 1 skipped.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
When the whole-document parse + one retry still fail, report instructions now run
_resilient_report before the total-loss path. A brace/quote-aware scanner
(_extract_object_spans) recovers each recommendation object whether pretty-printed
across many lines or NDJSON one-per-line; a truncated tail gets a best-effort
_try_repair; _partition_items validates each recovered object against the T02 item
schema. Valid items survive (output_validated=True, partial=True), malformed/
over-maxItems items are quarantined with provenance (index, error, raw, reason),
capped at 20. Error locality now matches the unit of work: one bad item costs one
item, not the whole report.
Verified against the real 06-26 shape: 7 valid recommendations + a truncated tail
now recovers all 7 and quarantines the broken tail (previously the whole run was
discarded). Happy-path maxItems top-N enforcement is deferred to T04 (count caps).
Full suite: 215 passed, 1 skipped.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add activity_core/state_hub_write: every State Hub write (report-sink,
ops-evidence, schedule-miss) now sends a stable Idempotency-Key header derived
from run_id:instruction_id:event_type. Makes writes safe to buffer/replay under
the future state-hub beachhead without duplicate progress/triage events. The
read-based _progress_exists dedup is now best-effort (returns False on connection
error instead of hard-failing), so the guarantee lives on the keyed write rather
than a live read. Tests + runbook note. Endpoint adoption / proxy retirement stays
blocked on the state-hub beachhead capability.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add activity_core/schedule_health: a pure evaluate_schedule_health() verdict
(built on Temporal's num_actions_missed_catchup_window plus a staleness check),
an async check_schedule_health() reader, and post_missed_fire_alert() that emits
a schedule_miss State Hub progress event. Makes a missed fire visible even under
misfire_policy=skip, where Temporal drops it by design. Unit tests for the
verdict logic.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Set Temporal catchup_window on cron schedules so a fire missed during a
worker/Temporal outage is no longer silently dropped. Redefine misfire_policy
into three explicit modes — skip, catchup_all, catchup_latest — mapping to
(catchup_window, overlap) pairs; legacy catchup/compress aliased. Add
catchup_window_seconds override. Remove the ad-hoc upsert-time 1h backfill in
favour of native catchup. Apply catchup_latest to daily-statehub-wsjf-triage in
the Railiance runtime manifest and document run-miss policies in the runbook.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
IssueCoreRestSink.emit() passed task_spec.triggering_event_id straight
into the httpx json= payload. When the field is a UUID object (rather
than a string), httpx's JSON encoder raised
"TypeError: Object of type UUID is not JSON serializable", failing the
emission. Guard with str(), preserving None for optional event ids.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Issue-core requires a shared ingestion key on POST /issues/. The REST sink
now sends Authorization: Bearer using ISSUE_CORE_API_KEY and fails fast
when the key is missing under ISSUE_SINK_TYPE=rest.
Updates .env.example, emission boundary docs, and unit tests for the
header contract and missing-key error.
When discover_kaizen_projects returns {"projects": [...]} bound to
context.projects, for_each can iterate the list directly. Multi-key
summaries (e.g. repo SBOM bulk) remain unchanged.
Implement discover_kaizen_scheduled_repos and discover_kaizen_projects per
kaizen-agentic ADR-005 contract: State Hub roster, roster.yaml filter, schedule
validation, and prepare_command emission. Register kaizen/resolver/shell source
types with unit tests and runbook dry-run instructions.
