---
id: ACTIVITY-WP-0042
type: workplan
title: "Scheduling role for recurring platform backup/restore evidence runs"
domain: infotech
repo: activity-core
status: proposed
owner: codex
topic_slug: activity-core
created: "2026-10-03"
updated: "2026-10-03"
state_hub_workstream_id: "e1bfb5a4-e647-592d-883f-fe8728ad2f5f"
---

Origin: State Hub message e3668cd9 from railiance-platform (RPF-WP-0036-T03,
RPF-WP-0038-T04) proposing activity-core as execution owner for recurring
backup/restore evidence runs. This plan is a proposal. Acceptance of the role
is a founder/owner decision and is NOT recorded here.

Facts from the repo (2026-10-03):

- `daily-cnpg-option-a-backup` already runs a cron-scheduled bounded operation
  (`cnpg_option_a_backup`, ACT-ADR-007) with state-hub-progress evidence. Its
  definition targets the Nextcloud lane and covers forgejo-db, net-kingdom-pg,
  state-hub-db; it does not cover apps-pg/platform-pg/platform-pg-2 or the
  Scaleway primary, and it never performs restores.
- ACT-ADR-007 allowlist is closed. A restore-evidence or Scaleway-backup run
  needs a new code-registered operation plus an ADR successor, tests, a
  credential route and an evidence contract. A definition string cannot add one.
- The `actcore-backup-offsite` lane depends on ClusterSecretStore
  `openbao-activity-core`, reported failing since 2026-09-19 (expired token).

## Decide whether activity-core accepts the scheduling role

```task
id: ACTIVITY-WP-0042-T01
status: wait
needs_human: true
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
blocking_reason: "Founder decision: accept scheduling only, scheduling plus a bounded operation, or decline the role."
priority: high
state_hub_task_id: "2a368988-2611-596a-a847-82c048bd179e"
```

Founder decision. Options: accept scheduling only (when/what/where; S3 keeps
validators, cadence, expiry and evidence), accept scheduling plus a bounded
operation, or decline. Needs: restore execution stays with an S3-owned tool
invoked as a fixed bounded operation; approval-engine authority supplied per
run; no general executor behaviour.

2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.

## Admit a bounded operation and credential lane

```task
id: ACTIVITY-WP-0042-T02
status: wait
depends_on: [ACTIVITY-WP-0042-T01]
blocking_reason: "Depends on T01: no bounded operation or credential lane until the founder accepts the role."
priority: medium
state_hub_task_id: "250c6e8e-7281-5dec-9a92-06081b8c96bb"
```

Blocked on T01. Successor to ACT-ADR-007, registry entry (target bounds,
timeout, idempotency, dry_run explicit), tests, credential route via OpenBao
(owner railiance-platform) with a repaired `openbao-activity-core` store, and
non-secret evidence mode. Scheduled caller satisfies RPF-WP-0038-T04 only
once recurring tiered scheduling and retention are accepted by their owners.

## Answer ops-warden on atm-backup-daily

```task
id: ACTIVITY-WP-0042-T03
status: wait
needs_human: true
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
blocking_reason: "Founder must confirm whether activity-core's backup worker is the atm-backup-daily unit before declaring to ops-warden."
priority: low
state_hub_task_id: "e1c313dc-9a94-5b7c-b406-604b700bf3eb"
```

WARDEN-WP-0040 asks which owner declares workload resolution `backup-daily`
for `atm-backup-daily`. activity-core has no `atm-*` identity of its own in
this repo and no evidence that the actor was minted for its worker. Declare
only if the founder confirms activity-core's backup worker is that unit;
otherwise the declaring owner is whoever holds the actor's issuance
(railiance-platform was also asked). Never infer membership.

2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.