---
id: daily-security-flow
name: Daily Security Flow
enabled: false
owner: activity-core
governance: custodian
status: proposed
trigger:
  type: cron
  cron_expression: "30 7 * * *"
  timezone: Europe/Berlin
  misfire_policy: skip
---

# Daily Security Flow

Adopted from the-custodian CUST-WP-0079-T03, tracked in ACTIVITY-WP-0047.
Activity Core owns the schedule; the-custodian owns the runner
(`scripts/security_flow_daily.py`), its report and its delivery checkpoints.

Each fire emits one ops_run for a rein on the workstation profile, which runs a
fixed command in the-custodian checkout:

```text
python3 scripts/security_flow_daily.py --apply
```

The runner resolves hub decisions already recorded as resolved in repo decision
logs (the sanctioned `POST /decisions/{id}/resolve`), writes a deterministic
JSON report, and messages coding agents only when READY/UNBLOCKED change and the
founder only when ATTENDED is nonempty. Its per-recipient checkpoint and run
lock make a repeated or overlapping fire safe.

- Daily 07:30 Europe/Berlin; misfires are skipped, never replayed.
- No repository grant: the run reads repo files and changes nothing in any
  repository. A rein must not commit or push for this run.
- Activity Core does not run the script itself (out of scope: general
  execution); it dispatches and records the ops_run outcome.

**Not yet enabled.** Activation (ACTIVITY-WP-0047-T02) flips `enabled: true`
once the claiming rein confirms it can run the command against workstation
checkouts. Rollback: `enabled: false`.

```rule
id: run-daily-security-flow
condition: "True"
action:
  task_template: Run the daily security flow
  description: 'In the-custodian checkout run exactly: python3 scripts/security_flow_daily.py --apply. Report its exit code and the printed JSON report. Do not edit, commit or push any repository and do not send messages yourself; the script handles delivery.'
  target_repo: the-custodian
  priority: medium
  labels: ["automated", "security-flow"]
  harness_profile_ref: harness.agent-dev-local@1.1.1
  execution_refs:
    correlation_id: CUST-WP-0079-T03
    assignment_ref: ACTIVITY-WP-0047-T01
```