---
id: weekly-railiance-allocation-review
name: Weekly Railiance allocation review
enabled: false
owner: activity-core
governance: custodian
status: proposed
trigger:
  type: cron
  cron_expression: "0 8 * * 1"
  timezone: Europe/Berlin
  misfire_policy: skip
context_sources:
  - type: shell
    query: custodian_allocation_review
    operation: custodian_allocation_review
    required: true
    params:
      timeout_seconds: 240
      evidence_sinks:
        - type: state-hub-progress
          event_type: custodian_allocation_review
          author: activity-core
    bind_to: context.custodian_result
---

# Weekly Railiance allocation review

Disabled source preparation using the existing ACT-ADR-007 bounded-operation
stage. This definition emits no agent tasks or ops_runs. The worker runs one
code-fixed owner command, retains a counted/hash receipt in the activity context,
and passes it through the existing progress evidence sink. No model or coding
profile executes this routine. No arbitrary command, import, executable or path
is accepted from definition parameters.

The operator must bind the actual deployed owner code, fleet snapshot root,
private external state, and scoped Hub access/input request before enabling.
See `docs/custodian-bounded-operations.md`. These bindings are absent by default;
missing paths, redirected paths and unbound requests fail before subprocess
execution. This is not a credential-isolation claim or a runtime acceptance.

Single Temporal attempt; skip misfires. Owner checkpoint/retention semantics
govern retries. A completed command is not owner acknowledgment or independent
missed-run recovery. No schedule has been activated or deployed. Rollback is
`enabled: false`, retaining reports/checkpoints.

CUST-WP-0071-T05 owns acceptance, after T04. The fixed owner command is
`scripts/weekly_allocation_report.py --request <operator-bound request>`.
The request binds real retained captures, explicit as_of and durable output;
inputs remain under accepted roots and output stays in private runtime state.
The committed null request template is not production input. Stable recommendation
IDs are downstream upsert keys; the adapter neither creates owner work records
nor delivers their acknowledgments. Actual collection, durable retention,
accepted owner routing, weekly report receipt and missed-run recovery remain gates.