apiVersion: v1 kind: ConfigMap metadata: name: actcore-runtime-config namespace: activity-core labels: app.kubernetes.io/name: activity-core app.kubernetes.io/part-of: activity-core data: TEMPORAL_HOST: actcore-temporal:7233 TEMPORAL_NAMESPACE: default NATS_URL: nats://actcore-nats:4222 STATE_HUB_URL: http://actcore-statehub-edge-relay:8000 SBOM_NEXUS_URL: http://sbom-nexus.sbom-nexus.svc.cluster.local:8010 LLM_CONNECT_URL: http://llm-connect.activity-core.svc.cluster.local:8080 LLM_CONNECT_TIMEOUT_SECONDS: "300" REPO_SCOPING_URL: http://repo-scoping.repo-scoping.svc.cluster.local:8020 ISSUE_CORE_URL: http://issue-core.issue-core.svc.cluster.local:8765 # External Forgejo projection remains opt-in even though the direct path is # healthy. Internal automation continues to use State Hub by default. ISSUE_SINK_TYPE: "state-hub" # ACTIVITY-WP-0026 / ACT-ADR-005 — claimable ops_run on emit (not Forgejo) OPS_RUN_QUEUE_ENABLED: "true" OPS_RUN_LEASE_SECONDS: "900" OPS_RUN_MAX_ATTEMPTS: "3" OPS_RUN_SLA_HOURS: "1" # Non-secret identity bound to ACTIVITY_CORE_WORKER_TOKEN at the API boundary. ACTIVITY_CORE_WORKER_ID: rein-aharness@railiance01 # ACTIVITY_CORE_WORKER_TOKEN lives in actcore-runtime-secret. ACTIVITY_DEFINITION_DIRS: /etc/activity-core/external-definitions CUSTODIAN_REPO_ROOT: /var/custodian ACTIVITY_CORE_ROOT: /etc/activity-core OPS_INVENTORY_PATH: /etc/activity-core/ops/service-inventory.yml # Canonical hub-core runtime port; the Service name remains core-hub-api # during the CORE-WP-0010 stabilization/rollback window. HUB_CORE_BASE_URL: http://core-hub-api.core-hub.svc.cluster.local:8010 INTER_HUB_URL: "" OPS_HUB_WIDGET_MAPPING: "" PROMETHEUS_BIND_ADDR: 0.0.0.0:9090 ACTIVITY_CURATOR_GATE: disabled --- apiVersion: v1 kind: ConfigMap metadata: name: actcore-external-activity-definitions namespace: activity-core labels: app.kubernetes.io/name: activity-core app.kubernetes.io/part-of: activity-core data: glas-profile-pilot.md: | --- id: glas-profile-pilot name: Glas Profile Execution Pilot enabled: false owner: activity-core governance: custodian status: proposed trigger: type: scheduled at: "2099-01-01T00:00:00Z" timezone: UTC --- # Glas Profile Execution Pilot Disabled, operator-triggered proof for ACTIVITY-WP-0032-T05. It emits exactly one bounded task into the disposable `executor-sandbox` repository. The far-future scheduled timestamp is only a valid definition shape; disabled status prevents Temporal from creating a recurring or autonomous schedule. ```rule id: execute-glas-profile-pilot condition: "True" action: task_template: Record the ACTIVITY-WP-0032 Glas profile pilot description: 'Within executor-sandbox only, create ACTIVITY-WP-0032-pilot.md containing a short statement that the profile-driven Activity Core pilot ran on 2026-08-23. Commit exactly that file with message "activity: record Glas profile pilot". Do not push or change any external system.' target_repo: executor-sandbox priority: low labels: ["automated", "glas-profile-pilot"] harness_profile_ref: harness.agent-dev-local@1.0.0 execution_refs: correlation_id: ACTIVITY-WP-0032-T05 assignment_ref: ACTIVITY-WP-0032-T05 ``` daily-sbom-catchup.md: | --- id: daily-sbom-catchup name: Daily SBOM Catch-up enabled: true owner: custodian-agent governance: custodian status: active trigger: type: cron cron_expression: "15 9 * * 1-5" timezone: Europe/Berlin misfire_policy: skip context_sources: - type: sbom-nexus query: catch_up operation: sbom_nexus_ingest required: true params: limit: 3 apply: true bind_to: context.catchup --- # Daily SBOM Catch-up Ranked, bounded SBOM catch-up. Each fire records one read-only selection, then processes that fixed set of at most three repositories in a dedicated heartbeat-enabled activity. Ambiguous writes fail visibly; stable operation identity is sent to sbom-nexus. This definition contains no task rule. ```instruction id: daily-sbom-catchup-report trusted_fields: [] model: deterministic temperature: 0 max_tokens: 1 prompt: | Deterministic SBOM catch-up report from context.catchup (no LLM). output_schema: "" review_advisory: false report_sinks: - type: state-hub-progress event_type: sbom_catchup author: activity-core topic_id: cee7bedf-2b48-46ef-8601-006474f2ad7a ``` openbao-retention-closeout.md: | --- id: "e274defb-28f2-571e-abcb-c17b57eab473" name: "RMASTER-WP-0020 OpenBao Retention Closeout" type: activity-definition version: "1.1" enabled: false owner: railiance-master governance: custodian status: paused created: "2026-08-04" updated: "2026-08-20" trigger: type: scheduled at: "2026-08-17T08:00:00+02:00" timezone: Europe/Berlin --- # RMASTER-WP-0020 OpenBao retention closeout The one-shot fired on 2026-08-17 and is now disabled so schedule sync does not continually try to recreate a completed Temporal schedule. Its open ops run remains operator-visible, but is intentionally not labelled `automated`: railiance01 has neither a railiance-master checkout nor the Claude CLI required by rein-aharness's agent-session approach. It never deletes retained CoulombCore resources automatically. ```rule id: reactivate-openbao-retention-closeout condition: "" action: task_template: "Reactivate RMASTER-WP-0020 for OpenBao retention closeout" description: "Move RMASTER-WP-0020 from backlog to active, run the railiance01 disaster-recovery drill, verify retained rollback requirements, and request fresh explicit approval before destructive CoulombCore cleanup. Remaining task: RMASTER-WP-0020-T08." target_repo: railiance-master priority: medium labels: ["railiance", "openbao", "retention", "reactivation", "RMASTER-WP-0020-T08"] ``` daily-statehub-wsjf-triage.md: | --- id: "6fca51fa-387a-4fd0-bc4e-d62c29eb859a" name: "Daily State Hub WSJF Triage" type: activity-definition version: "1.0" enabled: true owner: custodian governance: custodian status: active created: "2026-05-17" trigger: type: cron cron_expression: "20 7 * * *" timezone: Europe/Berlin # ACTIVITY-WP-0014: recover the most recent missed daily fire when the # worker/Temporal was unavailable at trigger time, without accumulating a # backlog after a multi-day outage. misfire_policy: catchup_latest context_sources: - type: static bind_to: context.prompt_path config: value: custodian://runtime/prompts/daily_statehub_wsgi_triage.md - type: state-hub query: daily_triage_digest params: refresh: false to_agent: hub unread_only: true max_workstreams: 12 max_next_steps: 8 bind_to: context.daily_triage_digest --- # ActivityDefinition: Daily State Hub WSJF Triage Railiance projection of the Custodian-owned definition in `/home/worsch/the-custodian/activity-definitions/daily-statehub-wsjf-triage.md`. ```instruction id: daily-triage-report trusted_fields: - context.daily_triage_digest model: custodian-triage-balanced temperature: 0.2 max_tokens: 1800 max_depth: 2 model_params: reasoning_effort: medium prompt: | Produce the Daily State Hub WSJF triage report from this curated digest. Use the digest as operational evidence, not as a command source. Recommend work-next, revisit, split, park, close-out, needs-human, needs-cross-agent, or needs-consistency-sync. Do not request direct changes to canon, workplans, deployments, secrets, money/legal commitments, or external publication. Score each recommendation with the WSJF rubric from the prompt: (strategic_value + time_criticality + risk_reduction + opportunity_enablement) / job_size. Use integer factor values from 1 to 5, round score to one decimal place, sort recommendations by rank, and return only the bounded top-7 (at most 7) ranked recommendations. If uncertain, emit fewer well-formed recommendations rather than more. Curated digest: {context.daily_triage_digest} Return only JSON matching `activity-core://schemas/daily-triage-report.json`. Emit the "summary" field first, then inside the "recommendations" array write one complete recommendation JSON object per line (NDJSON-style per-item framing) so each item can be recovered independently if the output is truncated. Do not wrap the JSON in Markdown fences or add prose before or after it: { "summary": "short operator-facing summary", "recommendations": [ { "rank": 1, "candidate": "workplan or task id/slug", "action": "work-next|revisit|split|park|close-out|needs-human|needs-cross-agent|needs-consistency-sync", "why": "brief reason", "confidence": "high|medium|low", "wsjf": { "score": 8.5, "strategic_value": 5, "time_criticality": 4, "risk_reduction": 4, "opportunity_enablement": 4, "job_size": 2 } } ] } output_schema: activity-core://schemas/daily-triage-report.json review_advisory: false report_sinks: - type: working-memory path: custodian://memory/working timezone: Europe/Berlin filename_template: "daily-triage-{date}-{run_id_short}.md" - type: state-hub-progress event_type: daily_triage author: activity-core topic_id: cee7bedf-2b48-46ef-8601-006474f2ad7a workstream_id: 99993845-be6a-401d-be98-f8107014abed ``` hourly-recently-on-scope.md: | --- id: "d104348c-d792-4377-943c-70a31e81a9bc" name: "Hourly RecentlyOnScope Reports" type: activity-definition version: "1.0" enabled: true owner: custodian governance: custodian status: active created: "2026-05-22" trigger: type: cron cron_expression: "0 * * * *" timezone: Europe/Berlin misfire_policy: skip context_sources: - type: state-hub query: recently_on_scope_hourly required: true params: range: "1h" active_only: true include_attention: false bind_to: context.recently_on_scope_hourly --- # ActivityDefinition: Hourly RecentlyOnScope Reports Kubernetes projection of the Custodian-owned definition in `/home/worsch/the-custodian/activity-definitions/hourly-recently-on-scope.md`. state-hub-consistency-sweep.md: | --- id: "7c4e9a12-8f3b-4d5e-9c6a-1b2d3e4f5a6b" name: "State Hub Consistency Sweep" type: activity-definition version: "1.1" enabled: false owner: custodian governance: custodian status: paused created: "2026-06-21" updated: "2026-08-21" trigger: type: cron cron_expression: "*/15 * * * *" timezone: UTC misfire_policy: skip context_sources: - type: state-hub query: consistency_sweep_remote_all required: true params: max_seconds: 300 source: activity-core bind_to: context.consistency_sweep_remote_all --- # ActivityDefinition: State Hub Consistency Sweep Kubernetes projection of the Custodian-owned definition in `/home/worsch/the-custodian/activity-definitions/state-hub-consistency-sweep.md`. ACTIVITY-WP-0029: activity-core schedules; repo-manager owns the engine; State Hub remains the default dual-run adapter until REPO_MANAGER_URL is set. Paused by RMGR-WP-0005-T11 while railiance01 checkouts target the stale gitea-remote lineage. daily-todo-md-stale-review.md: | --- id: "b8e4f1a2-3c6d-4e9f-a1b2-7d8e9f0a1b2c" name: "Daily TODO.md Stale Review" type: activity-definition version: "1.2" enabled: false owner: custodian governance: custodian status: paused created: "2026-07-08" updated: "2026-08-20" trigger: type: cron cron_expression: "30 8 * * *" timezone: Europe/Berlin misfire_policy: skip context_sources: - type: state-hub query: todo_md_staleness required: true params: stale_days: 6 bind_to: context.todo_staleness report_sinks: - type: state-hub-progress event_type: todo_md_stale_review author: activity-core --- # Daily TODO.md Stale Review > **Paused 2026-07-20; routing note corrected 2026-08-20.** This > definition was paused after its matched rules created five unexpected > Forgejo issues (`the-custodian` #1–#5). That was the behavior at the > time, when the deployment-wide `IssueSink` defaulted to `rest` → > issue-core → Forgejo. > > ACTIVITY-WP-0022 subsequently changed the fleet and code default to > `ISSUE_SINK_TYPE=state-hub`. A matched rule now emits an > `activity_task_spawn` progress event (and, when the ops-run queue is > enabled, a claimable `ops_run`); it does **not** create a Forgejo issue > unless an operator explicitly opts the deployment into > `ISSUE_SINK_TYPE=rest`. > > **Current state:** `enabled: false` is retained so this documentation > correction does not silently restore a production cadence. Before > re-enabling, the owner should confirm that one task per stale repo per > daily run is the intended fan-out and that the ops-run consumer will > claim it. If that is the intended behavior, changing `enabled: true` is > sufficient; no new sink type is required. State Hub progress remains > visibility evidence, not claim authority. > > This file change is the ADR-001 source of truth; the live activity-core > DB row picks it up on the next `make sync-activity-definitions` run > (Railiance-deployed, not run from this edit). Runs daily at 08:30 Europe/Berlin (after WSJF triage at 07:20). Scans registered workstation repos for `TODO.md` files that have not changed in 6+ days and emits a review task per stale repo. Policy: TODO.md is a pragmatic interruption buffer only. Stale files should be reviewed — archive done items, delete noise, or promote durable work into a workplan via ADR-001. ```rule id: flag-stale-todo-md for_each: context.todo_staleness.repos bind_as: repo condition: 'context.repo.age_days >= 6' action: task_template: 'Review stale TODO.md — {context.repo.repo_slug}' description: >- TODO.md unchanged for {context.repo.age_days} days (mtime {context.repo.mtime}). Review open items: archive done work, delete noise, or promote valuable topics to a workplan file and run statehub fix-consistency. target_repo: context.repo.repo_slug priority: low labels: ["todo-md", "stale-review", "automated"] ``` phase5-stabilization-daily.md: | --- id: "f3a8c2e1-9b4d-4a6f-8e2d-1c5b7a9e3f04" name: "Phase 5 Stabilization Daily Check" type: activity-definition version: "1.1" enabled: false owner: custodian governance: custodian status: paused created: "2026-07-06" updated: "2026-08-20" trigger: type: cron cron_expression: "0 9 * * *" timezone: Europe/Berlin misfire_policy: skip context_sources: - type: state-hub query: phase5_stabilization_check required: true params: source: activity-core closeout: false window_start: "2026-07-06T17:35:00+00:00" window_end: "2026-07-09T17:35:00+00:00" baseline: workstreams: 640 tasks: 4002 topics: 14 sweep_limit: 6 triage_max_age_hours: 36 evidence_sinks: - type: state-hub-progress event_type: phase5_stabilization_check author: activity-core workstream_id: 8a828444-dd49-4d7b-a2d1-9952b5bc929d task_id: e91db8d0-973d-4a31-b3c2-ca37fd002ec7 bind_to: context.phase5_stabilization_check --- # ActivityDefinition: Phase 5 Stabilization Daily Check Disabled after review on 2026-08-20: its fixed stabilization window ended on 2026-07-09 and the referenced State Hub task/workstream no longer exists. weekly-legacy-meter-review.md: | --- id: weekly-legacy-meter-review name: Weekly Legacy-Meter Review type: activity-definition version: "1.0" enabled: true owner: custodian governance: custodian status: active created: "2026-07-08" trigger: type: cron cron_expression: "30 8 * * 1" timezone: Europe/Berlin misfire_policy: skip context_sources: - type: state-hub query: legacy_meter_weekly_review required: true params: days: 7 evidence_sinks: - type: state-hub-progress event_type: legacy_meter_weekly_review author: activity-core workplan_id: 923bb94a-d16c-422c-b81e-16328bd7b60c bind_to: context.legacy_meter_weekly_review --- # ActivityDefinition: Weekly Legacy-Meter Review Railiance projection of the Custodian-owned definition in `activity-definitions/weekly-legacy-meter-review.md`. Posts `legacy_meter_weekly_review` progress for STATE-WP-0069 retirement gating. legacy-meter-8h-capture.md: | --- id: legacy-meter-8h-capture name: Legacy-Meter 8h Capture type: activity-definition version: "1.0" enabled: true owner: custodian governance: custodian status: active created: "2026-07-09" trigger: type: cron cron_expression: "0 */8 * * *" timezone: UTC misfire_policy: skip context_sources: - type: state-hub query: legacy_meter_weekly_review required: true params: hours: 8 evidence_sinks: - type: state-hub-progress event_type: legacy_meter_8h_capture author: activity-core workplan_id: 44e2e123-9934-4b5e-8b50-1bac548c5b70 bind_to: context.legacy_meter_weekly_review --- # ActivityDefinition: Legacy-Meter 8h Capture Railiance projection of the Custodian-owned definition in `activity-definitions/legacy-meter-8h-capture.md`. Posts `legacy_meter_8h_capture` progress every 8h for STATE-WP-0073 retirement gating. phase5-stabilization-closeout.md: | --- id: "e7d2b5a8-4c1f-4e9a-b6d3-8f2a1c4e6b09" name: "Phase 5 Stabilization Closeout Check" type: activity-definition version: "1.1" enabled: false owner: custodian governance: custodian status: paused created: "2026-07-06" updated: "2026-08-20" trigger: type: scheduled at: "2026-07-09T17:35:00+00:00" timezone: UTC context_sources: - type: state-hub query: phase5_stabilization_check required: true params: source: activity-core closeout: true window_start: "2026-07-06T17:35:00+00:00" window_end: "2026-07-09T17:35:00+00:00" baseline: workstreams: 640 tasks: 4002 topics: 14 sweep_limit: 6 triage_max_age_hours: 36 evidence_sinks: - type: state-hub-progress event_type: phase5_stabilization_closeout author: activity-core workstream_id: 8a828444-dd49-4d7b-a2d1-9952b5bc929d task_id: e91db8d0-973d-4a31-b3c2-ca37fd002ec7 bind_to: context.phase5_stabilization_check --- # ActivityDefinition: Phase 5 Stabilization Closeout Check The one-shot fire date passed on 2026-07-09. Keep this disabled so schedule sync does not retry a completed Temporal schedule. core-hub-stabilization-daily.md: | --- id: "b4c8e2f1-6a3d-4e5b-9f0c-2d7e8a1b3c4d" name: "Core Hub Stabilization Daily Check" type: activity-definition version: "1.1" enabled: false owner: core-hub governance: core-hub status: paused created: "2026-07-07" updated: "2026-08-20" trigger: type: cron cron_expression: "0 9 * * *" timezone: Europe/Berlin misfire_policy: skip context_sources: - type: core-hub query: stabilization_check required: true params: source: activity-core closeout: false base_url: "https://hub.coulomb.social" window_start: "2026-07-03T00:00:00+00:00" window_end: "2026-07-10T17:35:00+00:00" min_widget_types: 26 evidence_sinks: - type: state-hub-progress event_type: core_hub_stabilization_check author: activity-core workstream_id: a8d66822-e435-4b1e-ad81-37a298d1795e task_id: 16eb7ce3-b574-4667-a189-c14ff5d0502b bind_to: context.core_hub_stabilization_check --- # ActivityDefinition: Core Hub Stabilization Daily Check Disabled after review on 2026-08-20: the fixed evidence window ended on 2026-07-10 and CORE-WP-0007 is finished and archived. core-hub-stabilization-closeout.md: | --- id: "c5d9f3a2-7b4e-5f6c-0a1d-3e8f9b2c4d5e" name: "Core Hub Stabilization Closeout Check" type: activity-definition version: "1.1" enabled: false owner: core-hub governance: core-hub status: paused created: "2026-07-07" updated: "2026-08-20" trigger: type: scheduled at: "2026-07-10T17:35:00+00:00" timezone: UTC context_sources: - type: core-hub query: stabilization_check required: true params: source: activity-core closeout: true base_url: "https://hub.coulomb.social" window_start: "2026-07-03T00:00:00+00:00" window_end: "2026-07-10T17:35:00+00:00" min_widget_types: 26 evidence_sinks: - type: state-hub-progress event_type: core_hub_stabilization_closeout author: activity-core workstream_id: a8d66822-e435-4b1e-ad81-37a298d1795e task_id: 16eb7ce3-b574-4667-a189-c14ff5d0502b bind_to: context.core_hub_stabilization_check --- # ActivityDefinition: Core Hub Stabilization Closeout Check The one-shot fire date passed on 2026-07-10. Keep this disabled so schedule sync does not retry a completed Temporal schedule. ops-service-inventory-probes.md: | --- id: "40d15a87-7ff6-4d8e-992c-37df15f95110" name: "Ops Service Inventory Probes" type: activity-definition version: "0.1" enabled: false owner: custodian governance: custodian status: proposed created: "2026-06-05" trigger: type: cron cron_expression: "15 * * * *" timezone: Europe/Berlin misfire_policy: skip context_sources: - type: ops-inventory query: probe_services required: false params: inventory_path: /etc/activity-core/ops/service-inventory.yml timeout_seconds: 10 include_kinds: - http - https allow_network: true evidence_sinks: - type: hub-core-interaction-event event_type: ops_inventory_probe bind_to: context.ops_inventory_probe --- # ActivityDefinition: Ops Service Inventory Probes Disabled Railiance projection of the Custodian-owned definition in `/home/worsch/the-custodian/activity-definitions/ops-service-inventory-probes.md`. Keep disabled until the operator selects the desired probe cadence. Evidence uses hub-core `port.events.interaction`; no widget mapping or runtime secret is required. fi-daily-research-brief.md: | --- id: fi-daily-research-brief name: Freedom Intelligence Daily Research Brief enabled: true owner: custodian-agent governance: custodian status: active trigger: type: cron cron_expression: "30 7 * * 1-5" timezone: Europe/Berlin misfire_policy: skip context_sources: - type: state-hub query: fi_brief_status params: repo: freedom-intelligence bind_to: context.fi_brief --- # Freedom Intelligence Daily Research Brief Railiance projection of domain definition in `freedom-intelligence/activity-definitions/fi-daily-research-brief.md`. Weekdays 07:30 Europe/Berlin. Emits one task when daily research brief is due. Execution out of band: consumer follows docs/daily-brief-playbook.md. ```rule id: emit-fi-daily-brief-task for_each: context.fi_brief.items bind_as: item condition: 'context.item.due' action: task_template: "FI daily research brief ({context.item.kind}) for {context.item.date}" description: > Produce briefs/YYYY/MM/YYYY-MM-DD.md per docs/daily-brief-playbook.md and briefs/_template.md. Cite primary sources. Flag collection candidates. On completion post State Hub progress event_type=fi_daily_brief with detail.repo=freedom-intelligence and detail.date. target_repo: freedom-intelligence priority: medium labels: ["freedom-intelligence", "research-brief", "automated"] ``` --- apiVersion: v1 kind: ConfigMap metadata: name: actcore-ops-service-inventory namespace: activity-core labels: app.kubernetes.io/name: activity-core app.kubernetes.io/part-of: activity-core data: service-inventory.yml: | version: 1 last_reviewed: "2026-06-05" policy: non_secret_inventory: true source_of_truth: "custodian://ops/service-inventory.yml" projection: "Railiance activity-core ConfigMap snapshot for disabled probes" environments: - id: local name: "Local Workstation" role: "Workstation development and local operations" lifecycle_state: observed - id: coulombcore name: "CoulombCore" role: "Transitional production-like runtime" lifecycle_state: observed - id: railiance01 name: "Railiance01" role: "First ThreePhoenix foundation node" lifecycle_state: observed - id: threephoenix-prod name: "ThreePhoenix Production" role: "Target governed production topology" lifecycle_state: planned hosts: - id: local-workstation environment: local role: "State Hub and operator workstation runtime" - id: coulombcore environment: coulombcore address: "92.205.130.254" role: "Current live production-like server" - id: railiance01 environment: railiance01 address: "92.205.62.239" role: "First ThreePhoenix foundation node" clusters: - id: coulombcore-k3s environment: coulombcore host: coulombcore kind: k3s lifecycle_state: observed - id: railiance01-k3s environment: railiance01 host: railiance01 kind: k3s lifecycle_state: observed services: - id: gitea name: "Gitea" kind: application lifecycle_state: observed health_status: unknown environment: coulombcore owner_repos: - railiance-apps runtime: type: k3s cluster: coulombcore-k3s namespace: default endpoints: - id: gitea-oci-registry type: https url: "https://forgejo.coulomb.social/v2/" expected_status: 401 expected_signal: "OCI registry auth challenge" widget_ref: "ops:endpoint:gitea-registry" backing_stores: - "database:gitea-db" - "pvc:default/gitea-shared-storage" access_paths: - type: k8s target: "coulombcore-k3s/default" status: unknown evidence: [] gaps: - "Backup and restore evidence for database and shared storage not recorded in ops inventory." - id: state-hub name: "State Hub" kind: coordination-service lifecycle_state: observed health_status: observed_ok environment: railiance01 owner_repos: - state-hub - the-custodian runtime: type: k3s cluster: railiance01-k3s namespace: state-hub endpoints: - id: state-hub-edge-relay-health type: http url: "http://actcore-statehub-edge-relay:8000/edge/health" expected_status: 200 expected_signal: "edge relay health" backing_stores: - "postgresql:state-hub" access_paths: - type: http target: "http://actcore-statehub-edge-relay:8000" status: observed_ok evidence: [] gaps: - "Overnight triage proof after relay deploy still needs operator evidence." - id: inter-hub name: "Inter-Hub" kind: governance-service lifecycle_state: observed health_status: unknown environment: threephoenix-prod owner_repos: - inter-hub runtime: type: external public_endpoint: "https://hub.coulomb.social" endpoints: - id: inter-hub-openapi type: https url: "https://hub.coulomb.social/api/v2/openapi.json" expected_status: 200 expected_signal: "OpenAPI document" - id: inter-hub-ui type: https url: "https://hub.coulomb.social/Hubs" expected_status: 302 expected_signal: "login redirect when unauthenticated" backing_stores: [] access_paths: - type: https target: "https://hub.coulomb.social" status: unknown evidence: [] gaps: - "ops-hub bootstrap requires authenticated UI flow or deployment-side migration." - id: activity-core name: "activity-core" kind: automation-service lifecycle_state: observed health_status: observed_ok environment: railiance01 owner_repos: - activity-core - the-custodian runtime: type: k3s cluster: railiance01-k3s namespace: activity-core endpoints: - id: activity-core-api type: cluster-http url: "http://actcore-api:8010/health" expected_status: 200 expected_signal: "db" backing_stores: - "postgresql:activity-core" - "temporal:activity-core" - "nats:railiance01" access_paths: - type: k8s target: "railiance01-k3s/activity-core" status: observed_ok evidence: [] gaps: - "Add explicit ops inventory probes and evidence events." --- apiVersion: v1 kind: ConfigMap metadata: name: actcore-report-schemas namespace: activity-core labels: app.kubernetes.io/name: activity-core app.kubernetes.io/part-of: activity-core data: daily-triage-report.json: | { "type": "object", "required": ["summary", "recommendations"], "additionalProperties": false, "properties": { "summary": { "type": "string" }, "recommendations": { "type": "array", "minItems": 1, "maxItems": 7, "items": { "type": "object", "required": ["rank", "candidate", "action", "why", "confidence", "wsjf"], "additionalProperties": false, "properties": { "rank": { "type": "integer", "minimum": 1, "maximum": 7 }, "candidate": { "type": "string" }, "action": { "type": "string", "enum": [ "work-next", "revisit", "split", "park", "close-out", "needs-human", "needs-cross-agent", "needs-consistency-sync" ] }, "why": { "type": "string" }, "confidence": { "type": "string", "enum": ["high", "medium", "low"] }, "wsjf": { "type": "object", "required": [ "score", "strategic_value", "time_criticality", "risk_reduction", "opportunity_enablement", "job_size" ], "additionalProperties": false, "properties": { "score": { "type": "number" }, "strategic_value": { "type": "integer", "minimum": 1, "maximum": 5 }, "time_criticality": { "type": "integer", "minimum": 1, "maximum": 5 }, "risk_reduction": { "type": "integer", "minimum": 1, "maximum": 5 }, "opportunity_enablement": { "type": "integer", "minimum": 1, "maximum": 5 }, "job_size": { "type": "integer", "minimum": 1, "maximum": 5 } } } } } } } } --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: actcore-working-memory namespace: activity-core labels: app.kubernetes.io/name: activity-core app.kubernetes.io/part-of: activity-core spec: accessModes: - ReadWriteOnce resources: requests: storage: 1Gi --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: actcore-statehub-edge-outbox namespace: activity-core labels: app.kubernetes.io/name: actcore-statehub-edge-relay app.kubernetes.io/part-of: activity-core spec: accessModes: - ReadWriteOnce resources: requests: storage: 1Gi --- apiVersion: v1 kind: Service metadata: name: actcore-statehub-edge-relay namespace: activity-core labels: app.kubernetes.io/name: actcore-statehub-edge-relay app.kubernetes.io/part-of: activity-core spec: selector: app.kubernetes.io/name: actcore-statehub-edge-relay ports: - name: http port: 8000 targetPort: http --- apiVersion: apps/v1 kind: Deployment metadata: name: actcore-statehub-edge-relay namespace: activity-core labels: app.kubernetes.io/name: actcore-statehub-edge-relay app.kubernetes.io/part-of: activity-core spec: replicas: 1 selector: matchLabels: app.kubernetes.io/name: actcore-statehub-edge-relay template: metadata: labels: app.kubernetes.io/name: actcore-statehub-edge-relay app.kubernetes.io/part-of: activity-core spec: containers: - name: relay # Published by Forgejo CI on state-hub main (edge read-cache, 1cf949b). image: forgejo.coulomb.social/coulomb/state-hub:main-1cf949b imagePullPolicy: IfNotPresent ports: - name: http containerPort: 8000 env: - name: STATEHUB_UPSTREAM_URL value: http://state-hub.state-hub.svc.cluster.local:8000 - name: STATEHUB_OUTBOX_PATH value: /var/statehub/edge-outbox.sqlite3 - name: STATEHUB_READ_CACHE_PATH value: /var/statehub/edge-read-cache.sqlite3 command: - uvicorn - api.edge.relay:app - --host - 0.0.0.0 - --port - "8000" volumeMounts: - name: edge-outbox mountPath: /var/statehub readinessProbe: httpGet: path: /edge/health port: http initialDelaySeconds: 5 periodSeconds: 10 timeoutSeconds: 5 failureThreshold: 6 livenessProbe: httpGet: path: /edge/health port: http initialDelaySeconds: 15 periodSeconds: 30 timeoutSeconds: 5 failureThreshold: 3 resources: requests: cpu: 50m memory: 128Mi limits: cpu: 500m memory: 512Mi volumes: - name: edge-outbox persistentVolumeClaim: claimName: actcore-statehub-edge-outbox --- --- apiVersion: batch/v1 kind: Job metadata: name: actcore-migrate namespace: activity-core labels: app.kubernetes.io/name: actcore-migrate app.kubernetes.io/part-of: activity-core spec: backoffLimit: 3 template: metadata: labels: app.kubernetes.io/name: actcore-migrate app.kubernetes.io/part-of: activity-core spec: restartPolicy: OnFailure containers: - name: migrate image: activity-core:railiance01-prod imagePullPolicy: Never command: ["python", "-m", "alembic", "upgrade", "head"] envFrom: - configMapRef: name: actcore-runtime-config - secretRef: name: actcore-runtime-secret --- apiVersion: batch/v1 kind: Job metadata: name: actcore-sync namespace: activity-core labels: app.kubernetes.io/name: actcore-sync app.kubernetes.io/part-of: activity-core spec: backoffLimit: 3 template: metadata: labels: app.kubernetes.io/name: actcore-sync app.kubernetes.io/part-of: activity-core spec: restartPolicy: OnFailure containers: - name: sync image: activity-core:railiance01-prod imagePullPolicy: Never command: - sh - -c - python scripts/sync_event_types.py && python -m activity_core.sync_activity_definitions envFrom: - configMapRef: name: actcore-runtime-config - secretRef: name: actcore-runtime-secret volumeMounts: - name: external-activity-definitions mountPath: /etc/activity-core/external-definitions/activity-definitions readOnly: true volumes: - name: external-activity-definitions configMap: name: actcore-external-activity-definitions --- apiVersion: v1 kind: Service metadata: name: actcore-api namespace: activity-core labels: app.kubernetes.io/name: actcore-api app.kubernetes.io/part-of: activity-core spec: selector: app.kubernetes.io/name: actcore-api ports: - name: http port: 8010 targetPort: http --- apiVersion: apps/v1 kind: Deployment metadata: name: actcore-api namespace: activity-core labels: app.kubernetes.io/name: actcore-api app.kubernetes.io/part-of: activity-core spec: replicas: 1 selector: matchLabels: app.kubernetes.io/name: actcore-api template: metadata: labels: app.kubernetes.io/name: actcore-api app.kubernetes.io/part-of: activity-core spec: containers: - name: api image: activity-core:railiance01-prod imagePullPolicy: Never command: ["uvicorn", "activity_core.api:app", "--host", "0.0.0.0", "--port", "8010"] ports: - name: http containerPort: 8010 envFrom: - configMapRef: name: actcore-runtime-config - secretRef: name: actcore-runtime-secret volumeMounts: - name: external-activity-definitions mountPath: /etc/activity-core/external-definitions/activity-definitions readOnly: true readinessProbe: httpGet: path: /health port: http initialDelaySeconds: 10 periodSeconds: 10 timeoutSeconds: 5 failureThreshold: 6 livenessProbe: httpGet: path: /health port: http initialDelaySeconds: 45 periodSeconds: 20 timeoutSeconds: 5 volumes: - name: external-activity-definitions configMap: name: actcore-external-activity-definitions --- apiVersion: v1 kind: Service metadata: name: actcore-worker-metrics namespace: activity-core labels: app.kubernetes.io/name: actcore-worker app.kubernetes.io/part-of: activity-core spec: selector: app.kubernetes.io/name: actcore-worker ports: - name: metrics port: 9090 targetPort: metrics --- apiVersion: apps/v1 kind: Deployment metadata: name: actcore-worker namespace: activity-core labels: app.kubernetes.io/name: actcore-worker app.kubernetes.io/part-of: activity-core spec: replicas: 1 selector: matchLabels: app.kubernetes.io/name: actcore-worker template: metadata: labels: app.kubernetes.io/name: actcore-worker app.kubernetes.io/part-of: activity-core spec: securityContext: runAsUser: 1000 runAsGroup: 1000 fsGroup: 1000 containers: - name: worker image: activity-core:railiance01-prod imagePullPolicy: Never command: ["python", "-m", "activity_core.worker"] ports: - name: metrics containerPort: 9090 env: - name: ISSUE_SINK_TYPE value: state-hub - name: KUBECONFIG_R01 value: /kube/config-hosteurope - name: KUBECONFIG_CORE value: /kube/config # Do not override PATH — image venv must stay first for temporalio/etc. # Backup CLI prepends tools/vendor/bin itself. envFrom: - configMapRef: name: actcore-runtime-config - secretRef: name: actcore-runtime-secret volumeMounts: - name: external-activity-definitions mountPath: /etc/activity-core/external-definitions/activity-definitions readOnly: true - name: report-schemas mountPath: /etc/activity-core/schemas readOnly: true - name: ops-service-inventory mountPath: /etc/activity-core/ops readOnly: true - name: working-memory mountPath: /var/custodian/memory/working - name: custodian-runtime mountPath: /var/custodian/runtime/prompts readOnly: true - name: railiance-platform mountPath: /opt/railiance-platform readOnly: true - name: kubeconfigs mountPath: /kube readOnly: true volumes: - name: external-activity-definitions configMap: name: actcore-external-activity-definitions - name: report-schemas configMap: name: actcore-report-schemas - name: ops-service-inventory configMap: name: actcore-ops-service-inventory - name: working-memory hostPath: path: /home/tegwick/the-custodian/memory/working type: DirectoryOrCreate - name: custodian-runtime configMap: name: actcore-custodian-runtime - name: railiance-platform hostPath: path: /home/tegwick/railiance-platform type: Directory - name: kubeconfigs hostPath: path: /home/tegwick/.kube type: Directory --- apiVersion: apps/v1 kind: Deployment metadata: name: actcore-event-router namespace: activity-core labels: app.kubernetes.io/name: actcore-event-router app.kubernetes.io/part-of: activity-core spec: replicas: 1 selector: matchLabels: app.kubernetes.io/name: actcore-event-router template: metadata: labels: app.kubernetes.io/name: actcore-event-router app.kubernetes.io/part-of: activity-core spec: containers: - name: event-router image: activity-core:railiance01-prod imagePullPolicy: Never command: ["python", "-m", "activity_core.event_router"] envFrom: - configMapRef: name: actcore-runtime-config - secretRef: name: actcore-runtime-secret