---
id: ACTIVITY-WP-0042
type: workplan
title: "Scheduling role for recurring platform backup/restore evidence runs"
domain: infotech
repo: activity-core
status: proposed
owner: codex
topic_slug: activity-core
created: "2026-10-03"
updated: "2026-10-03"
state_hub_workstream_id: "e1bfb5a4-e647-592d-883f-fe8728ad2f5f"
---

Origin: State Hub message e3668cd9 from railiance-platform (RPF-WP-0036-T03,
RPF-WP-0038-T04) proposing activity-core as execution owner for recurring
backup/restore evidence runs. This plan is a proposal. Acceptance of the role
is a founder/owner decision and is NOT recorded here.

Facts from the repo (2026-10-03):

- `daily-cnpg-option-a-backup` already runs a cron-scheduled bounded operation
  (`cnpg_option_a_backup`, ACT-ADR-007) with state-hub-progress evidence. Its
  definition targets the Nextcloud lane and covers forgejo-db, net-kingdom-pg,
  state-hub-db; it does not cover apps-pg/platform-pg/platform-pg-2 or the
  Scaleway primary, and it never performs restores.
- ACT-ADR-007 allowlist is closed. A restore-evidence or Scaleway-backup run
  needs a new code-registered operation plus an ADR successor, tests, a
  credential route and an evidence contract. A definition string cannot add one.
- The `actcore-backup-offsite` lane depends on ClusterSecretStore
  `openbao-activity-core`, reported failing since 2026-09-19 (expired token).

## Decide whether activity-core accepts the scheduling role

```task
id: ACTIVITY-WP-0042-T01
status: wait
needs_human: true
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
blocking_reason: "Founder decision: accept scheduling only, scheduling plus a bounded operation, or decline the role."
priority: high
state_hub_task_id: "2a368988-2611-596a-a847-82c048bd179e"
```

Founder decision. Options: accept scheduling only (when/what/where; S3 keeps
validators, cadence, expiry and evidence), accept scheduling plus a bounded
operation, or decline. Needs: restore execution stays with an S3-owned tool
invoked as a fixed bounded operation; approval-engine authority supplied per
run; no general executor behaviour.

2026-10-03 (CUST-WP-0075 inbox sweep): railiance-platform replied (message
0638c13b) asking activity-core to proceed under its conditions, because "roles
tie to the source repo". That is the S3 owner's consent. It does not resolve
this founder gate, so T01 stays waiting on D2 and the plan stays `proposed`. It
also asks activity-core to declare `atm-backup-daily`, which remains T03's
founder confirmation. activity-core replied with the same position.

2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.

## Admit a bounded operation and credential lane

```task
id: ACTIVITY-WP-0042-T02
status: wait
depends_on: [ACTIVITY-WP-0042-T01]
blocking_reason: "Depends on T01: no bounded operation or credential lane until the founder accepts the role."
priority: medium
state_hub_task_id: "250c6e8e-7281-5dec-9a92-06081b8c96bb"
```

Blocked on T01. Successor to ACT-ADR-007, registry entry (target bounds,
timeout, idempotency, dry_run explicit), tests, credential route via OpenBao
(owner railiance-platform) with a repaired `openbao-activity-core` store, and
non-secret evidence mode. Scheduled caller satisfies RPF-WP-0038-T04 only
once recurring tiered scheduling and retention are accepted by their owners.

## Answer ops-warden on atm-backup-daily

```task
id: ACTIVITY-WP-0042-T03
status: wait
needs_human: true
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
blocking_reason: "Founder must confirm whether activity-core's backup worker is the atm-backup-daily unit before declaring to ops-warden."
priority: low
state_hub_task_id: "e1c313dc-9a94-5b7c-b406-604b700bf3eb"
```

WARDEN-WP-0040 asks which owner declares workload resolution `backup-daily`
for `atm-backup-daily`. activity-core has no `atm-*` identity of its own in
this repo and no evidence that the actor was minted for its worker. Declare
only if the founder confirms activity-core's backup worker is that unit;
otherwise the declaring owner is whoever holds the actor's issuance
(railiance-platform was also asked). Never infer membership.

2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.