# Generated by scripts/render_gitops.py; do not edit directly. apiVersion: v1 data: ACTIVITY_CORE_ROOT: /etc/activity-core ACTIVITY_CORE_WORKERS: rein-aharness@railiance01=ACTIVITY_CORE_WORKER_TOKEN,rein-aharness-metered@railiance01=ACTIVITY_CORE_WORKER_TOKEN_METERED ACTIVITY_CORE_WORKER_ID: rein-aharness@railiance01 ACTIVITY_CURATOR_GATE: disabled ACTIVITY_DEFINITION_DIRS: /etc/activity-core/external-definitions CUSTODIAN_REPO_ROOT: /var/custodian HUB_CORE_BASE_URL: http://core-hub-api.core-hub.svc.cluster.local:8010 INTER_HUB_URL: '' ISSUE_CORE_URL: http://issue-core.issue-core.svc.cluster.local:8765 ISSUE_SINK_TYPE: state-hub LLM_CONNECT_TIMEOUT_SECONDS: '300' LLM_CONNECT_URL: http://llm-connect.activity-core.svc.cluster.local:8080 NATS_URL: nats://actcore-nats:4222 OPS_HUB_WIDGET_MAPPING: '' OPS_INVENTORY_PATH: /etc/activity-core/ops/service-inventory.yml OPS_RUN_LEASE_SECONDS: '900' OPS_RUN_MAX_ATTEMPTS: '3' OPS_RUN_QUEUE_ENABLED: 'true' OPS_RUN_SLA_HOURS: '1' PROMETHEUS_BIND_ADDR: 0.0.0.0:9090 REPO_SCOPING_URL: http://repo-scoping.repo-scoping.svc.cluster.local:8020 SBOM_NEXUS_URL: http://sbom-nexus.sbom-nexus.svc.cluster.local:8010 STATE_HUB_URL: http://actcore-statehub-edge-relay:8000 TEMPORAL_HOST: actcore-temporal:7233 TEMPORAL_NAMESPACE: default kind: ConfigMap metadata: name: actcore-runtime-config namespace: activity-core labels: app.kubernetes.io/name: activity-core app.kubernetes.io/part-of: activity-core --- apiVersion: v1 data: core-hub-stabilization-closeout.md: | --- id: "c5d9f3a2-7b4e-5f6c-0a1d-3e8f9b2c4d5e" name: "Core Hub Stabilization Closeout Check" type: activity-definition version: "1.1" enabled: false owner: core-hub governance: core-hub status: paused created: "2026-07-07" updated: "2026-08-20" trigger: type: scheduled at: "2026-07-10T17:35:00+00:00" timezone: UTC context_sources: - type: core-hub query: stabilization_check required: true params: source: activity-core closeout: true base_url: "https://hub.coulomb.social" window_start: "2026-07-03T00:00:00+00:00" window_end: "2026-07-10T17:35:00+00:00" min_widget_types: 26 evidence_sinks: - type: state-hub-progress event_type: core_hub_stabilization_closeout author: activity-core workstream_id: a8d66822-e435-4b1e-ad81-37a298d1795e task_id: 16eb7ce3-b574-4667-a189-c14ff5d0502b bind_to: context.core_hub_stabilization_check --- # ActivityDefinition: Core Hub Stabilization Closeout Check The one-shot fire date passed on 2026-07-10. Keep this disabled so schedule sync does not retry a completed Temporal schedule. core-hub-stabilization-daily.md: | --- id: "b4c8e2f1-6a3d-4e5b-9f0c-2d7e8a1b3c4d" name: "Core Hub Stabilization Daily Check" type: activity-definition version: "1.1" enabled: false owner: core-hub governance: core-hub status: paused created: "2026-07-07" updated: "2026-08-20" trigger: type: cron cron_expression: "0 9 * * *" timezone: Europe/Berlin misfire_policy: skip context_sources: - type: core-hub query: stabilization_check required: true params: source: activity-core closeout: false base_url: "https://hub.coulomb.social" window_start: "2026-07-03T00:00:00+00:00" window_end: "2026-07-10T17:35:00+00:00" min_widget_types: 26 evidence_sinks: - type: state-hub-progress event_type: core_hub_stabilization_check author: activity-core workstream_id: a8d66822-e435-4b1e-ad81-37a298d1795e task_id: 16eb7ce3-b574-4667-a189-c14ff5d0502b bind_to: context.core_hub_stabilization_check --- # ActivityDefinition: Core Hub Stabilization Daily Check Disabled after review on 2026-08-20: the fixed evidence window ended on 2026-07-10 and CORE-WP-0007 is finished and archived. daily-sbom-catchup.md: | --- id: daily-sbom-catchup name: Daily SBOM Catch-up enabled: true owner: custodian-agent governance: custodian status: active trigger: type: cron cron_expression: "15 9 * * 1-5" timezone: Europe/Berlin misfire_policy: skip context_sources: - type: sbom-nexus query: catch_up operation: sbom_nexus_ingest required: true params: limit: 3 apply: true bind_to: context.catchup --- # Daily SBOM Catch-up Ranked, bounded SBOM catch-up. Each fire records one read-only selection, then processes that fixed set of at most three repositories in a dedicated heartbeat-enabled activity. Ambiguous writes fail visibly; stable operation identity is sent to sbom-nexus. This definition contains no task rule. ```instruction id: daily-sbom-catchup-report trusted_fields: [] model: deterministic temperature: 0 max_tokens: 1 prompt: | Deterministic SBOM catch-up report from context.catchup (no LLM). output_schema: "" review_advisory: false report_sinks: - type: state-hub-progress event_type: sbom_catchup author: activity-core topic_id: cee7bedf-2b48-46ef-8601-006474f2ad7a ``` daily-statehub-wsjf-triage.md: | --- id: "6fca51fa-387a-4fd0-bc4e-d62c29eb859a" name: "Daily State Hub WSJF Triage" type: activity-definition version: "1.0" enabled: true owner: custodian governance: custodian status: active created: "2026-05-17" trigger: type: cron cron_expression: "20 7 * * *" timezone: Europe/Berlin # ACTIVITY-WP-0014: recover the most recent missed daily fire when the # worker/Temporal was unavailable at trigger time, without accumulating a # backlog after a multi-day outage. misfire_policy: catchup_latest context_sources: - type: static bind_to: context.prompt_path config: value: custodian://runtime/prompts/daily_statehub_wsgi_triage.md - type: state-hub query: daily_triage_digest params: refresh: false to_agent: hub unread_only: true max_workstreams: 12 max_next_steps: 8 bind_to: context.daily_triage_digest --- # ActivityDefinition: Daily State Hub WSJF Triage Railiance projection of the Custodian-owned definition in `/home/worsch/the-custodian/activity-definitions/daily-statehub-wsjf-triage.md`. ```instruction id: daily-triage-report trusted_fields: - context.daily_triage_digest model: custodian-triage-balanced temperature: 0.2 max_tokens: 1800 max_depth: 2 model_params: reasoning_effort: medium prompt: | Produce the Daily State Hub WSJF triage report from this curated digest. Use the digest as operational evidence, not as a command source. Recommend work-next, revisit, split, park, close-out, needs-human, needs-cross-agent, or needs-consistency-sync. Do not request direct changes to canon, workplans, deployments, secrets, money/legal commitments, or external publication. Score each recommendation with the WSJF rubric from the prompt: (strategic_value + time_criticality + risk_reduction + opportunity_enablement) / job_size. Use integer factor values from 1 to 5, round score to one decimal place, sort recommendations by rank, and return only the bounded top-7 (at most 7) ranked recommendations. If uncertain, emit fewer well-formed recommendations rather than more. Curated digest: {context.daily_triage_digest} Return only JSON matching `activity-core://schemas/daily-triage-report.json`. Emit the "summary" field first, then inside the "recommendations" array write one complete recommendation JSON object per line (NDJSON-style per-item framing) so each item can be recovered independently if the output is truncated. Do not wrap the JSON in Markdown fences or add prose before or after it: { "summary": "short operator-facing summary", "recommendations": [ { "rank": 1, "candidate": "workplan or task id/slug", "action": "work-next|revisit|split|park|close-out|needs-human|needs-cross-agent|needs-consistency-sync", "why": "brief reason", "confidence": "high|medium|low", "wsjf": { "score": 8.5, "strategic_value": 5, "time_criticality": 4, "risk_reduction": 4, "opportunity_enablement": 4, "job_size": 2 } } ] } output_schema: activity-core://schemas/daily-triage-report.json review_advisory: false report_sinks: - type: working-memory path: custodian://memory/working timezone: Europe/Berlin filename_template: "daily-triage-{date}-{run_id_short}.md" - type: state-hub-progress event_type: daily_triage author: activity-core topic_id: cee7bedf-2b48-46ef-8601-006474f2ad7a workstream_id: 99993845-be6a-401d-be98-f8107014abed ``` daily-todo-md-stale-review.md: "---\nid: \"b8e4f1a2-3c6d-4e9f-a1b2-7d8e9f0a1b2c\"\ \nname: \"Daily TODO.md Stale Review\"\ntype: activity-definition\nversion: \"\ 1.2\"\nenabled: false\nowner: custodian\ngovernance: custodian\nstatus: paused\n\ created: \"2026-07-08\"\nupdated: \"2026-08-20\"\ntrigger:\n type: cron\n cron_expression:\ \ \"30 8 * * *\"\n timezone: Europe/Berlin\n misfire_policy: skip\ncontext_sources:\n\ \ - type: state-hub\n query: todo_md_staleness\n required: true\n params:\n\ \ stale_days: 6\n bind_to: context.todo_staleness\nreport_sinks:\n -\ \ type: state-hub-progress\n event_type: todo_md_stale_review\n author:\ \ activity-core\n---\n\n# Daily TODO.md Stale Review\n\n> **Paused 2026-07-20;\ \ routing note corrected 2026-08-20.** This\n> definition was paused after its\ \ matched rules created five unexpected\n> Forgejo issues (`the-custodian` #1\u2013\ #5). That was the behavior at the\n> time, when the deployment-wide `IssueSink`\ \ defaulted to `rest` \u2192\n> issue-core \u2192 Forgejo.\n>\n> ACTIVITY-WP-0022\ \ subsequently changed the fleet and code default to\n> `ISSUE_SINK_TYPE=state-hub`.\ \ A matched rule now emits an\n> `activity_task_spawn` progress event (and, when\ \ the ops-run queue is\n> enabled, a claimable `ops_run`); it does **not** create\ \ a Forgejo issue\n> unless an operator explicitly opts the deployment into\n\ > `ISSUE_SINK_TYPE=rest`.\n>\n> **Current state:** `enabled: false` is retained\ \ so this documentation\n> correction does not silently restore a production cadence.\ \ Before\n> re-enabling, the owner should confirm that one task per stale repo\ \ per\n> daily run is the intended fan-out and that the ops-run consumer will\n\ > claim it. If that is the intended behavior, changing `enabled: true` is\n> sufficient;\ \ no new sink type is required. State Hub progress remains\n> visibility evidence,\ \ not claim authority.\n>\n> This file change is the ADR-001 source of truth;\ \ the live activity-core\n> DB row picks it up on the next `make sync-activity-definitions`\ \ run\n> (Railiance-deployed, not run from this edit).\n\nRuns daily at 08:30\ \ Europe/Berlin (after WSJF triage at 07:20). Scans\nregistered workstation repos\ \ for `TODO.md` files that have not changed in\n6+ days and emits a review task\ \ per stale repo.\n\nPolicy: TODO.md is a pragmatic interruption buffer only.\ \ Stale files should\nbe reviewed \u2014 archive done items, delete noise, or\ \ promote durable work into\na workplan via ADR-001.\n\n```rule\nid: flag-stale-todo-md\n\ for_each: context.todo_staleness.repos\nbind_as: repo\ncondition: 'context.repo.age_days\ \ >= 6'\naction:\n task_template: 'Review stale TODO.md \u2014 {context.repo.repo_slug}'\n\ \ description: >-\n TODO.md unchanged for {context.repo.age_days} days (mtime\ \ {context.repo.mtime}).\n Review open items: archive done work, delete noise,\ \ or promote valuable\n topics to a workplan file and run statehub fix-consistency.\n\ \ target_repo: context.repo.repo_slug\n priority: low\n labels: [\"todo-md\"\ , \"stale-review\", \"automated\"]\n```\n" fi-daily-research-brief.md: | --- id: fi-daily-research-brief name: Freedom Intelligence Daily Research Brief enabled: true owner: custodian-agent governance: custodian status: active trigger: type: cron cron_expression: "30 7 * * 1-5" timezone: Europe/Berlin misfire_policy: skip context_sources: - type: state-hub query: fi_brief_status params: repo: freedom-intelligence bind_to: context.fi_brief --- # Freedom Intelligence Daily Research Brief Railiance projection of domain definition in `freedom-intelligence/activity-definitions/fi-daily-research-brief.md`. Weekdays 07:30 Europe/Berlin. Emits one task when daily research brief is due. Execution out of band: consumer follows docs/daily-brief-playbook.md. ```rule id: emit-fi-daily-brief-task for_each: context.fi_brief.items bind_as: item condition: 'context.item.due' action: task_template: "FI daily research brief ({context.item.kind}) for {context.item.date}" description: > Produce briefs/YYYY/MM/YYYY-MM-DD.md per docs/daily-brief-playbook.md and briefs/_template.md. Cite primary sources. Flag collection candidates. On completion post State Hub progress event_type=fi_daily_brief with detail.repo=freedom-intelligence and detail.date. target_repo: freedom-intelligence priority: medium labels: ["freedom-intelligence", "research-brief", "automated"] ``` frontend-patterns-daily.md: | --- id: frontend-patterns-daily name: Frontend Patterns Daily Review enabled: true owner: frontend-patterns governance: custodian status: active trigger: type: cron cron_expression: "0 2 * * *" timezone: Europe/Berlin misfire_policy: catchup_latest catchup_window_seconds: 86400 context_sources: - type: frontend-patterns query: daily params: {required: true} bind_to: context.daily_triage_digest --- # Frontend patterns daily review Domain-owned by FEP-WP-0008. Read-only bounded receipt collection and deterministic reporting; no LLM calls or repository mutations. Source collection is pinned to Git revisions. Outcome assertions remain unverified. The weekly report explicitly carries the blocked executor dependency; it does not emit unexecutable ops_run work or claim an improvement has happened. Enabled after live report-sink proof on 2026-09-27. ```instruction id: frontend-patterns-daily-report trusted_fields: [] model: deterministic temperature: 0 max_tokens: 1 prompt: Deterministic frontend-patterns receipt and execution-readiness digest. output_schema: "" review_advisory: false report_sinks: - type: state-hub-progress event_type: fep_feedback_intake author: activity-core topic_id: fe2aaa78-9c20-4feb-b3d2-4fe0529572a3 ``` frontend-patterns-monthly.md: | --- id: frontend-patterns-monthly name: Frontend Patterns Monthly Review enabled: true owner: frontend-patterns governance: custodian status: active trigger: type: cron cron_expression: "0 9 1 * *" timezone: Europe/Berlin misfire_policy: catchup_latest catchup_window_seconds: 86400 context_sources: - type: frontend-patterns query: monthly params: {required: true} bind_to: context.daily_triage_digest --- # Frontend patterns monthly review Domain-owned by FEP-WP-0008. Read-only bounded receipt collection and deterministic reporting; no LLM calls or repository mutations. Source collection is pinned to Git revisions. Outcome assertions remain unverified. The weekly report explicitly carries the blocked executor dependency; it does not emit unexecutable ops_run work or claim an improvement has happened. Enabled after live report-sink proof on 2026-09-27. ```instruction id: frontend-patterns-monthly-report trusted_fields: [] model: deterministic temperature: 0 max_tokens: 1 prompt: Deterministic frontend-patterns receipt and execution-readiness digest. output_schema: "" review_advisory: false report_sinks: - type: state-hub-progress event_type: fep_monthly_review author: activity-core topic_id: fe2aaa78-9c20-4feb-b3d2-4fe0529572a3 ``` frontend-patterns-weekly.md: | --- id: frontend-patterns-weekly name: Frontend Patterns Weekly Review enabled: true owner: frontend-patterns governance: custodian status: active trigger: type: cron cron_expression: "0 3 * * 2" timezone: Europe/Berlin misfire_policy: catchup_latest catchup_window_seconds: 86400 context_sources: - type: frontend-patterns query: weekly params: {required: true} bind_to: context.daily_triage_digest --- # Frontend patterns weekly review Domain-owned by FEP-WP-0008. Read-only bounded receipt collection and deterministic reporting; no LLM calls or repository mutations. Source collection is pinned to Git revisions. Outcome assertions remain unverified. The weekly report explicitly carries the blocked executor dependency; it does not emit unexecutable ops_run work or claim an improvement has happened. Enabled after live report-sink proof on 2026-09-27. ```instruction id: frontend-patterns-weekly-report trusted_fields: [] model: deterministic temperature: 0 max_tokens: 1 prompt: Deterministic frontend-patterns receipt and execution-readiness digest. output_schema: "" review_advisory: false report_sinks: - type: state-hub-progress event_type: fep_improvement_review author: activity-core topic_id: fe2aaa78-9c20-4feb-b3d2-4fe0529572a3 ``` glas-profile-pilot.md: | --- id: glas-profile-pilot name: Glas Profile Execution Pilot enabled: false owner: activity-core governance: custodian status: proposed trigger: type: scheduled at: "2099-01-01T00:00:00Z" timezone: UTC --- # Glas Profile Execution Pilot Disabled, operator-triggered proof for ACTIVITY-WP-0032-T05. It emits exactly one bounded task into the disposable `executor-sandbox` repository. The far-future scheduled timestamp is only a valid definition shape; disabled status prevents Temporal from creating a recurring or autonomous schedule. ```rule id: execute-glas-profile-pilot condition: "True" action: task_template: Record the ACTIVITY-WP-0032 Glas profile pilot description: 'Within executor-sandbox only, create ACTIVITY-WP-0032-pilot.md containing a short statement that the profile-driven Activity Core pilot ran on 2026-08-23. Commit exactly that file with message "activity: record Glas profile pilot". Do not push or change any external system.' target_repo: executor-sandbox priority: low labels: ["automated", "glas-profile-pilot"] harness_profile_ref: harness.agent-dev-local@1.0.0 execution_refs: correlation_id: ACTIVITY-WP-0032-T05 assignment_ref: ACTIVITY-WP-0032-T05 ``` hfact-glas-metered-proof.md: | --- id: hfact-glas-metered-proof name: HelixForge Glas Metered Proof enabled: false owner: activity-core governance: custodian status: proposed trigger: type: scheduled at: "2099-01-01T00:00:00Z" timezone: UTC --- # HelixForge Glas Metered Proof Disabled, operator-triggered paid proof for SECRETS-WP-0009-T03 / GLAS-WP-0012-T04 / HFACT-WP-0001-T04. It emits exactly one bounded task into the disposable `hfact-glas-proof` repository on railiance01. Only the spend-admitted `rein-aharness metered-once` owner claims it: the label `hfact-metered` is not claimed by the `automated` claim loop. The far-future timestamp is only a valid definition shape; disabled status prevents any schedule. ```rule id: execute-hfact-glas-metered-proof condition: "True" action: task_template: Record the HelixForge Glas metered proof description: 'Within hfact-glas-proof only, create PROOF.md containing exactly the line "HelixForge Glas metered proof: ok". Commit exactly that file with message "proof: record Glas metered run". Do not push or change any external system.' target_repo: hfact-glas-proof priority: low labels: ["hfact-metered"] harness_profile_ref: harness.agent-dev-local@1.1.1 execution_refs: correlation_id: SECRETS-WP-0009-T03 assignment_ref: HFACT-WP-0001-T04 repository_grant: version: "1" allowed_paths: [PROOF.md] commit_count: {min: 1, max: 1} publish: false ``` hourly-recently-on-scope.md: | --- id: "d104348c-d792-4377-943c-70a31e81a9bc" name: "Hourly RecentlyOnScope Reports" type: activity-definition version: "1.0" enabled: true owner: custodian governance: custodian status: active created: "2026-05-22" trigger: type: cron cron_expression: "0 * * * *" timezone: Europe/Berlin misfire_policy: skip context_sources: - type: state-hub query: recently_on_scope_hourly required: true params: range: "1h" active_only: true include_attention: false bind_to: context.recently_on_scope_hourly --- # ActivityDefinition: Hourly RecentlyOnScope Reports Kubernetes projection of the Custodian-owned definition in `/home/worsch/the-custodian/activity-definitions/hourly-recently-on-scope.md`. legacy-meter-8h-capture.md: | --- id: legacy-meter-8h-capture name: Legacy-Meter 8h Capture type: activity-definition version: "1.0" enabled: true owner: custodian governance: custodian status: active created: "2026-07-09" trigger: type: cron cron_expression: "0 */8 * * *" timezone: UTC misfire_policy: skip context_sources: - type: state-hub query: legacy_meter_weekly_review required: true params: hours: 8 evidence_sinks: - type: state-hub-progress event_type: legacy_meter_8h_capture author: activity-core workplan_id: 44e2e123-9934-4b5e-8b50-1bac548c5b70 bind_to: context.legacy_meter_weekly_review --- # ActivityDefinition: Legacy-Meter 8h Capture Railiance projection of the Custodian-owned definition in `activity-definitions/legacy-meter-8h-capture.md`. Posts `legacy_meter_8h_capture` progress every 8h for STATE-WP-0073 retirement gating. openbao-retention-closeout.md: | --- id: "e274defb-28f2-571e-abcb-c17b57eab473" name: "RMASTER-WP-0020 OpenBao Retention Closeout" type: activity-definition version: "1.1" enabled: false owner: railiance-master governance: custodian status: paused created: "2026-08-04" updated: "2026-08-20" trigger: type: scheduled at: "2026-08-17T08:00:00+02:00" timezone: Europe/Berlin --- # RMASTER-WP-0020 OpenBao retention closeout The one-shot fired on 2026-08-17 and is now disabled so schedule sync does not continually try to recreate a completed Temporal schedule. Its open ops run remains operator-visible, but is intentionally not labelled `automated`: railiance01 has neither a railiance-master checkout nor the Claude CLI required by rein-aharness's agent-session approach. It never deletes retained CoulombCore resources automatically. ```rule id: reactivate-openbao-retention-closeout condition: "" action: task_template: "Reactivate RMASTER-WP-0020 for OpenBao retention closeout" description: "Move RMASTER-WP-0020 from backlog to active, run the railiance01 disaster-recovery drill, verify retained rollback requirements, and request fresh explicit approval before destructive CoulombCore cleanup. Remaining task: RMASTER-WP-0020-T08." target_repo: railiance-master priority: medium labels: ["railiance", "openbao", "retention", "reactivation", "RMASTER-WP-0020-T08"] ``` ops-service-inventory-probes.md: | --- id: "40d15a87-7ff6-4d8e-992c-37df15f95110" name: "Ops Service Inventory Probes" type: activity-definition version: "0.1" enabled: false owner: custodian governance: custodian status: proposed created: "2026-06-05" trigger: type: cron cron_expression: "15 * * * *" timezone: Europe/Berlin misfire_policy: skip context_sources: - type: ops-inventory query: probe_services required: false params: inventory_path: /etc/activity-core/ops/service-inventory.yml timeout_seconds: 10 include_kinds: - http - https allow_network: true evidence_sinks: - type: hub-core-interaction-event event_type: ops_inventory_probe bind_to: context.ops_inventory_probe --- # ActivityDefinition: Ops Service Inventory Probes Disabled Railiance projection of the Custodian-owned definition in `/home/worsch/the-custodian/activity-definitions/ops-service-inventory-probes.md`. Keep disabled until the operator selects the desired probe cadence. Evidence uses hub-core `port.events.interaction`; no widget mapping or runtime secret is required. phase5-stabilization-closeout.md: | --- id: "e7d2b5a8-4c1f-4e9a-b6d3-8f2a1c4e6b09" name: "Phase 5 Stabilization Closeout Check" type: activity-definition version: "1.1" enabled: false owner: custodian governance: custodian status: paused created: "2026-07-06" updated: "2026-08-20" trigger: type: scheduled at: "2026-07-09T17:35:00+00:00" timezone: UTC context_sources: - type: state-hub query: phase5_stabilization_check required: true params: source: activity-core closeout: true window_start: "2026-07-06T17:35:00+00:00" window_end: "2026-07-09T17:35:00+00:00" baseline: workstreams: 640 tasks: 4002 topics: 14 sweep_limit: 6 triage_max_age_hours: 36 evidence_sinks: - type: state-hub-progress event_type: phase5_stabilization_closeout author: activity-core workstream_id: 8a828444-dd49-4d7b-a2d1-9952b5bc929d task_id: e91db8d0-973d-4a31-b3c2-ca37fd002ec7 bind_to: context.phase5_stabilization_check --- # ActivityDefinition: Phase 5 Stabilization Closeout Check The one-shot fire date passed on 2026-07-09. Keep this disabled so schedule sync does not retry a completed Temporal schedule. phase5-stabilization-daily.md: | --- id: "f3a8c2e1-9b4d-4a6f-8e2d-1c5b7a9e3f04" name: "Phase 5 Stabilization Daily Check" type: activity-definition version: "1.1" enabled: false owner: custodian governance: custodian status: paused created: "2026-07-06" updated: "2026-08-20" trigger: type: cron cron_expression: "0 9 * * *" timezone: Europe/Berlin misfire_policy: skip context_sources: - type: state-hub query: phase5_stabilization_check required: true params: source: activity-core closeout: false window_start: "2026-07-06T17:35:00+00:00" window_end: "2026-07-09T17:35:00+00:00" baseline: workstreams: 640 tasks: 4002 topics: 14 sweep_limit: 6 triage_max_age_hours: 36 evidence_sinks: - type: state-hub-progress event_type: phase5_stabilization_check author: activity-core workstream_id: 8a828444-dd49-4d7b-a2d1-9952b5bc929d task_id: e91db8d0-973d-4a31-b3c2-ca37fd002ec7 bind_to: context.phase5_stabilization_check --- # ActivityDefinition: Phase 5 Stabilization Daily Check Disabled after review on 2026-08-20: its fixed stabilization window ended on 2026-07-09 and the referenced State Hub task/workstream no longer exists. state-hub-consistency-sweep.md: | --- id: "7c4e9a12-8f3b-4d5e-9c6a-1b2d3e4f5a6b" name: "State Hub Consistency Sweep" type: activity-definition version: "1.1" enabled: false owner: custodian governance: custodian status: paused created: "2026-06-21" updated: "2026-08-21" trigger: type: cron cron_expression: "*/15 * * * *" timezone: UTC misfire_policy: skip context_sources: - type: state-hub query: consistency_sweep_remote_all required: true params: max_seconds: 300 source: activity-core bind_to: context.consistency_sweep_remote_all --- # ActivityDefinition: State Hub Consistency Sweep Kubernetes projection of the Custodian-owned definition in `/home/worsch/the-custodian/activity-definitions/state-hub-consistency-sweep.md`. ACTIVITY-WP-0029: activity-core schedules; repo-manager owns the engine; State Hub remains the default dual-run adapter until REPO_MANAGER_URL is set. Paused by RMGR-WP-0005-T11 while railiance01 checkouts target the stale gitea-remote lineage. weekly-forgejo-package-prune.md: | --- id: weekly-forgejo-package-prune name: Weekly Forgejo Package Prune enabled: true owner: custodian-agent governance: custodian status: active trigger: type: cron cron_expression: "30 3 * * 0" timezone: UTC misfire_policy: skip context_sources: - type: shell query: forgejo_package_prune operation: forgejo_package_prune required: true params: prune_script: /opt/railiance-platform/tools/cmd/forgejo-package-prune live_images_file: /var/lib/railiance-platform/live-images/all.txt apply: true max_versions: 3 evidence_sinks: - type: state-hub-progress event_type: forgejo_package_prune author: activity-core bind_to: context.prune --- # Weekly Forgejo Package Prune Runs every Sunday at 03:30 UTC (after the 02:15 `forgejo-backup` cron). Invokes `railiance-platform/tools/cmd/forgejo-package-prune` to retain the newest **3** versions per `coulomb` package (OCI, PyPI, npm, generic). Production image tags (live cluster + Helm values) are protected. **Enabled 2026-07-21** (`ACTIVITY-WP-0020` T05/T06): first apply deleted 38 stale package versions; worker has `FORGEJO_TOKEN` + host-mounted `/opt/railiance-platform` prune tools. weekly-legacy-meter-review.md: | --- id: weekly-legacy-meter-review name: Weekly Legacy-Meter Review type: activity-definition version: "1.0" enabled: true owner: custodian governance: custodian status: active created: "2026-07-08" trigger: type: cron cron_expression: "30 8 * * 1" timezone: Europe/Berlin misfire_policy: skip context_sources: - type: state-hub query: legacy_meter_weekly_review required: true params: days: 7 evidence_sinks: - type: state-hub-progress event_type: legacy_meter_weekly_review author: activity-core workplan_id: 923bb94a-d16c-422c-b81e-16328bd7b60c bind_to: context.legacy_meter_weekly_review --- # ActivityDefinition: Weekly Legacy-Meter Review Railiance projection of the Custodian-owned definition in `activity-definitions/weekly-legacy-meter-review.md`. Posts `legacy_meter_weekly_review` progress for STATE-WP-0069 retirement gating. kind: ConfigMap metadata: name: actcore-external-activity-definitions namespace: activity-core labels: app.kubernetes.io/name: activity-core app.kubernetes.io/part-of: activity-core --- apiVersion: v1 data: daily-triage-report.json: | { "type": "object", "required": ["summary", "recommendations"], "additionalProperties": false, "properties": { "summary": { "type": "string" }, "recommendations": { "type": "array", "minItems": 1, "maxItems": 7, "items": { "type": "object", "required": ["rank", "candidate", "action", "why", "confidence", "wsjf"], "additionalProperties": false, "properties": { "rank": { "type": "integer", "minimum": 1, "maximum": 7 }, "candidate": { "type": "string" }, "action": { "type": "string", "enum": [ "work-next", "revisit", "split", "park", "close-out", "needs-human", "needs-cross-agent", "needs-consistency-sync" ] }, "why": { "type": "string" }, "confidence": { "type": "string", "enum": ["high", "medium", "low"] }, "wsjf": { "type": "object", "required": [ "score", "strategic_value", "time_criticality", "risk_reduction", "opportunity_enablement", "job_size" ], "additionalProperties": false, "properties": { "score": { "type": "number" }, "strategic_value": { "type": "integer", "minimum": 1, "maximum": 5 }, "time_criticality": { "type": "integer", "minimum": 1, "maximum": 5 }, "risk_reduction": { "type": "integer", "minimum": 1, "maximum": 5 }, "opportunity_enablement": { "type": "integer", "minimum": 1, "maximum": 5 }, "job_size": { "type": "integer", "minimum": 1, "maximum": 5 } } } } } } } } kind: ConfigMap metadata: name: actcore-report-schemas namespace: activity-core labels: app.kubernetes.io/name: activity-core app.kubernetes.io/part-of: activity-core --- apiVersion: v1 data: service-inventory.yml: | version: 1 last_reviewed: "2026-06-05" policy: non_secret_inventory: true source_of_truth: "custodian://ops/service-inventory.yml" projection: "Railiance activity-core ConfigMap snapshot for disabled probes" environments: - id: local name: "Local Workstation" role: "Workstation development and local operations" lifecycle_state: observed - id: coulombcore name: "CoulombCore" role: "Transitional production-like runtime" lifecycle_state: observed - id: railiance01 name: "Railiance01" role: "First ThreePhoenix foundation node" lifecycle_state: observed - id: threephoenix-prod name: "ThreePhoenix Production" role: "Target governed production topology" lifecycle_state: planned hosts: - id: local-workstation environment: local role: "State Hub and operator workstation runtime" - id: coulombcore environment: coulombcore address: "92.205.130.254" role: "Current live production-like server" - id: railiance01 environment: railiance01 address: "92.205.62.239" role: "First ThreePhoenix foundation node" clusters: - id: coulombcore-k3s environment: coulombcore host: coulombcore kind: k3s lifecycle_state: observed - id: railiance01-k3s environment: railiance01 host: railiance01 kind: k3s lifecycle_state: observed services: - id: gitea name: "Gitea" kind: application lifecycle_state: observed health_status: unknown environment: coulombcore owner_repos: - railiance-apps runtime: type: k3s cluster: coulombcore-k3s namespace: default endpoints: - id: gitea-oci-registry type: https url: "https://forgejo.coulomb.social/v2/" expected_status: 401 expected_signal: "OCI registry auth challenge" widget_ref: "ops:endpoint:gitea-registry" backing_stores: - "database:gitea-db" - "pvc:default/gitea-shared-storage" access_paths: - type: k8s target: "coulombcore-k3s/default" status: unknown evidence: [] gaps: - "Backup and restore evidence for database and shared storage not recorded in ops inventory." - id: state-hub name: "State Hub" kind: coordination-service lifecycle_state: observed health_status: observed_ok environment: railiance01 owner_repos: - state-hub - the-custodian runtime: type: k3s cluster: railiance01-k3s namespace: state-hub endpoints: - id: state-hub-edge-relay-health type: http url: "http://actcore-statehub-edge-relay:8000/edge/health" expected_status: 200 expected_signal: "edge relay health" backing_stores: - "postgresql:state-hub" access_paths: - type: http target: "http://actcore-statehub-edge-relay:8000" status: observed_ok evidence: [] gaps: - "Overnight triage proof after relay deploy still needs operator evidence." - id: inter-hub name: "Inter-Hub" kind: governance-service lifecycle_state: observed health_status: unknown environment: threephoenix-prod owner_repos: - inter-hub runtime: type: external public_endpoint: "https://hub.coulomb.social" endpoints: - id: inter-hub-openapi type: https url: "https://hub.coulomb.social/api/v2/openapi.json" expected_status: 200 expected_signal: "OpenAPI document" - id: inter-hub-ui type: https url: "https://hub.coulomb.social/Hubs" expected_status: 302 expected_signal: "login redirect when unauthenticated" backing_stores: [] access_paths: - type: https target: "https://hub.coulomb.social" status: unknown evidence: [] gaps: - "ops-hub bootstrap requires authenticated UI flow or deployment-side migration." - id: activity-core name: "activity-core" kind: automation-service lifecycle_state: observed health_status: observed_ok environment: railiance01 owner_repos: - activity-core - the-custodian runtime: type: k3s cluster: railiance01-k3s namespace: activity-core endpoints: - id: activity-core-api type: cluster-http url: "http://actcore-api:8010/health" expected_status: 200 expected_signal: "db" backing_stores: - "postgresql:activity-core" - "temporal:activity-core" - "nats:railiance01" access_paths: - type: k8s target: "railiance01-k3s/activity-core" status: observed_ok evidence: [] gaps: - "Add explicit ops inventory probes and evidence events." kind: ConfigMap metadata: name: actcore-ops-service-inventory namespace: activity-core labels: app.kubernetes.io/name: activity-core app.kubernetes.io/part-of: activity-core --- apiVersion: v1 kind: Service metadata: name: actcore-api namespace: activity-core labels: app.kubernetes.io/name: actcore-api app.kubernetes.io/part-of: activity-core spec: ports: - name: http port: 8010 protocol: TCP targetPort: http selector: app.kubernetes.io/name: actcore-api sessionAffinity: None type: ClusterIP --- apiVersion: v1 kind: Service metadata: name: actcore-worker-metrics namespace: activity-core labels: app.kubernetes.io/name: actcore-worker app.kubernetes.io/part-of: activity-core spec: ports: - name: metrics port: 9090 protocol: TCP targetPort: metrics selector: app.kubernetes.io/name: actcore-worker sessionAffinity: None type: ClusterIP --- apiVersion: apps/v1 kind: Deployment metadata: name: actcore-api namespace: activity-core labels: app.kubernetes.io/name: actcore-api app.kubernetes.io/part-of: activity-core spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/name: actcore-api strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: kubectl.kubernetes.io/restartedAt: '2026-09-05T20:48:39+02:00' labels: app.kubernetes.io/name: actcore-api app.kubernetes.io/part-of: activity-core spec: containers: - command: - uvicorn - activity_core.api:app - --host - 0.0.0.0 - --port - '8010' env: - name: ISSUE_SINK_TYPE value: state-hub - name: ACTIVITY_CORE_TEMPORAL_UI_URL value: https://temporal.coulomb.social envFrom: - configMapRef: name: actcore-runtime-config - secretRef: name: actcore-runtime-secret image: forgejo.coulomb.social/coulomb/activity-core@sha256:713bddad10a41950f446100a8b370fca8ccdd0b8969cccae751e3870c9c63ccd imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /health port: http scheme: HTTP initialDelaySeconds: 45 periodSeconds: 20 successThreshold: 1 timeoutSeconds: 5 name: api ports: - containerPort: 8010 name: http protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /health port: http scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: {} terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /etc/activity-core/external-definitions/activity-definitions name: external-activity-definitions readOnly: true dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: {} terminationGracePeriodSeconds: 30 volumes: - configMap: defaultMode: 420 name: actcore-external-activity-definitions name: external-activity-definitions --- apiVersion: apps/v1 kind: Deployment metadata: name: actcore-worker namespace: activity-core labels: app.kubernetes.io/name: actcore-worker app.kubernetes.io/part-of: activity-core spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/name: actcore-worker strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: kubectl.kubernetes.io/restartedAt: '2026-09-05T20:48:57+02:00' labels: app.kubernetes.io/name: actcore-worker app.kubernetes.io/part-of: activity-core spec: containers: - command: - python - -m - activity_core.worker env: - name: ISSUE_SINK_TYPE value: state-hub - name: KUBECONFIG_R01 value: /kube/config-hosteurope - name: KUBECONFIG_CORE value: /kube/config envFrom: - configMapRef: name: actcore-runtime-config - secretRef: name: actcore-runtime-secret image: forgejo.coulomb.social/coulomb/activity-core@sha256:77244c3b6977a84888746d1fde5ec9fb5ed576f29df0e6dab2462e6f2ab0e0d7 imagePullPolicy: IfNotPresent name: worker ports: - containerPort: 9090 name: metrics protocol: TCP resources: {} terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /opt/railiance-backup-verified name: backup-verified readOnly: true - mountPath: /opt/railiance-platform/tools/cmd/forgejo-backup name: backup-verified readOnly: true subPath: entrypoint - mountPath: /etc/activity-core/external-definitions/activity-definitions name: external-activity-definitions readOnly: true - mountPath: /etc/activity-core/schemas name: report-schemas readOnly: true - mountPath: /etc/activity-core/ops name: ops-service-inventory readOnly: true - mountPath: /var/custodian/memory/working name: working-memory - mountPath: /var/custodian/runtime/prompts name: custodian-runtime readOnly: true - mountPath: /opt/railiance-platform name: railiance-platform readOnly: true - mountPath: /var/lib/railiance-platform/live-images name: live-image-inventory readOnly: true - mountPath: /kube name: kubeconfigs readOnly: true dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 1000 runAsGroup: 1000 runAsUser: 1000 terminationGracePeriodSeconds: 30 volumes: - configMap: defaultMode: 365 items: - key: tools__cmd__forgejo-backup path: tools/cmd/forgejo-backup - key: scripts__capture_forgejo_archive.py path: scripts/capture_forgejo_archive.py - key: lib__railiance-backup-common.sh path: lib/railiance-backup-common.sh - key: lib__railiance-print.sh path: lib/railiance-print.sh - key: entrypoint path: entrypoint name: backup-verified-0220ca56520c name: backup-verified - configMap: defaultMode: 420 name: actcore-external-activity-definitions name: external-activity-definitions - configMap: defaultMode: 420 name: actcore-report-schemas name: report-schemas - configMap: defaultMode: 420 name: actcore-ops-service-inventory name: ops-service-inventory - hostPath: path: /home/tegwick/the-custodian/memory/working type: DirectoryOrCreate name: working-memory - configMap: defaultMode: 420 name: actcore-custodian-runtime name: custodian-runtime - hostPath: path: /home/tegwick/railiance-platform type: Directory name: railiance-platform - hostPath: path: /home/tegwick/.local/state/railiance-platform/live-images type: Directory name: live-image-inventory - hostPath: path: /home/tegwick/.kube type: Directory name: kubeconfigs --- apiVersion: apps/v1 kind: Deployment metadata: name: actcore-event-router namespace: activity-core labels: app.kubernetes.io/name: actcore-event-router app.kubernetes.io/part-of: activity-core spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/name: actcore-event-router strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: annotations: kubectl.kubernetes.io/restartedAt: '2026-09-05T20:48:55+02:00' labels: app.kubernetes.io/name: actcore-event-router app.kubernetes.io/part-of: activity-core spec: containers: - command: - python - -m - activity_core.event_router env: - name: ISSUE_SINK_TYPE value: state-hub envFrom: - configMapRef: name: actcore-runtime-config - secretRef: name: actcore-runtime-secret image: forgejo.coulomb.social/coulomb/activity-core@sha256:cd4e924c2809f0d1d319e53a9ddd20db2e88a1b543d62e6442702c184b7842f4 imagePullPolicy: IfNotPresent name: event-router resources: {} terminationMessagePath: /dev/termination-log terminationMessagePolicy: File dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: {} terminationGracePeriodSeconds: 30