# Bounded-operation compatibility report — 2026-08-23

Scope: all 12 checked-in `activity-definitions/*.md` files plus the production
runtime projection in `k8s/railiance/20-runtime.yaml`.

## Baseline classification

The pre-enforcement inventory found three mutating definitions:

| Definition | Previous source/query | Admitted operation | Bound |
| --- | --- | --- | --- |
| `daily-sbom-catchup` | `sbom-nexus/catch_up` | `sbom_nexus_ingest` | `apply` explicit; limit 1–3; mandatory `sbom_catchup` report sink |
| `weekly-forgejo-package-prune` | `shell/forgejo_package_prune` | `forgejo_package_prune` | canonical script; `apply` explicit; retain 1–10; protected live-image file; one Temporal attempt |
| `daily-cnpg-option-a-backup` | `shell/cnpg_option_a_backup` | `cnpg_option_a_backup` | canonical script; `dry_run` explicit; 1–10 named targets; timeout ≤7200s; one Temporal attempt |

The other nine definitions contain no mutating source. Three named `shell`
queries remain registered as read-only discovery/report queries. No definition
contained definition-supplied command text or an unknown shell query.

## Migration result

The three definitions and their Kubernetes projection now declare an explicit
code-owned `operation` id. Strict parsing succeeds for all 12 definitions.
Negative tests prove refusal of unknown shell queries, missing/mismatched
operation ids, arbitrary script paths, absent evidence sinks, excessive target
or SBOM limits, and multiple operations in one definition.

Package prune and CNPG backup dispatch moved out of the generic shell resolver.
Their activity result crosses the Temporal boundary only after operation-specific
allowlist projection; raw stdout/stderr and credential-shaped fields are not
workflow context or progress evidence.

## Legacy executor production inventory

Before removal, read-only production checks found:

- `task_instances`: `0` rows; `max(created_at) = none`;
- worker deployment: no `ACTIVITY_CORE_ENABLE_TASK_EXECUTOR_STUB` variable; and
- Temporal visibility query for `WorkflowType="TaskExecutorWorkflow"`: `[]`.

This met the ACTIVITY-WP-0035-T07 removal gate. Migration `0009` drops the empty
table and renames the spawn-audit column from `review_required` to
`review_advisory`.