activity-core/history/2026-08-23-bounded-operation-compatibility-report.md

Bounded-operation compatibility report — 2026-08-23

Scope: all 12 checked-in activity-definitions/*.md files plus the production runtime projection in k8s/railiance/20-runtime.yaml.

Baseline classification

The pre-enforcement inventory found three mutating definitions:

Definition	Previous source/query	Admitted operation	Bound
daily-sbom-catchup	sbom-nexus/catch_up	sbom_nexus_ingest	apply explicit; limit 1–3; mandatory sbom_catchup report sink
weekly-forgejo-package-prune	shell/forgejo_package_prune	forgejo_package_prune	canonical script; apply explicit; retain 1–10; protected live-image file; one Temporal attempt
daily-cnpg-option-a-backup	shell/cnpg_option_a_backup	cnpg_option_a_backup	canonical script; dry_run explicit; 1–10 named targets; timeout ≤7200s; one Temporal attempt

The other nine definitions contain no mutating source. Three named shell queries remain registered as read-only discovery/report queries. No definition contained definition-supplied command text or an unknown shell query.

Migration result

The three definitions and their Kubernetes projection now declare an explicit code-owned operation id. Strict parsing succeeds for all 12 definitions. Negative tests prove refusal of unknown shell queries, missing/mismatched operation ids, arbitrary script paths, absent evidence sinks, excessive target or SBOM limits, and multiple operations in one definition.

Package prune and CNPG backup dispatch moved out of the generic shell resolver. Their activity result crosses the Temporal boundary only after operation-specific allowlist projection; raw stdout/stderr and credential-shaped fields are not workflow context or progress evidence.

Legacy executor production inventory

Before removal, read-only production checks found:

• task_instances: 0 rows; max(created_at) = none;
• worker deployment: no ACTIVITY_CORE_ENABLE_TASK_EXECUTOR_STUB variable; and
• Temporal visibility query for WorkflowType="TaskExecutorWorkflow": [].

This met the ACTIVITY-WP-0035-T07 removal gate. Migration 0009 drops the empty table and renames the spawn-audit column from review_required to review_advisory.