activity-core/workplans/ACTIVITY-WP-0047-daily-security-flow-adoption.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	related	state_hub_workstream_id
ACTIVITY-WP-0047	workplan	Adopt the daily security-flow schedule (CUST-WP-0079-T03)	infotech	activity-core	active	claude-activity-core	activity-core	2026-10-13	2026-10-19	implementation	CUST-WP-0079	ee97869b-dca2-54c9-aa18-0b479c244fb3

Origin: the-custodian handed over the daily security-flow lane (message 117e538e, case case:cross-owner:CUST-WP-0079-T03:activity-core). The workstation user systemd bus is unavailable, so no host timer can run it. Founder accepted adoption on 2026-10-13.

Boundary, corrected 2026-10-19: Activity Core owns the schedule, bounded operation activity/context and progress-sink evidence. the-custodian owns scripts/security_flow_daily.py, report and delivery checkpoints. The fixed routine uses ACT-ADR-007 existing registered owner-operation exception, not general coding execution or a rein task. No repository grant is implied. The original ops_run/profile mechanism remains historical T01 preparation and is superseded by T04; T02/T03 use the corrected receipt contract.

Source definition

id: ACTIVITY-WP-0047-T01
status: done
priority: high
state_hub_task_id: "cbe8cfe2-43ef-5a31-b163-c473572754b7"

activity-definitions/daily-security-flow.md: daily 07:30 Europe/Berlin, misfire skip, one unconditional rule emitting an ops_run on harness.agent-dev-local@1.1.1 with the fixed command and correlation CUST-WP-0079-T03. Committed with enabled: false.

Activation

id: ACTIVITY-WP-0047-T02
status: wait
priority: high
state_hub_task_id: "d0d5fddd-2d73-5156-aac3-49837aec2988"

Wait: executor owner accepts the bounded-operation runtime in docs/custodian-bounded-operations.md: pinned owner source/dependencies, scoped fleet snapshots/repository list, private state outside source roots, admitted Hub access and checkpointed command behavior. Then enable through the normal release/admin-sync path and run one manual trigger. The historical coding-profile route cannot execute this command and must not be activated. T04 supplies local source integration, not runtime acceptance.

First unassisted fire

id: ACTIVITY-WP-0047-T03
status: wait
priority: medium
state_hub_task_id: "d692a3eb-7878-5405-931c-e11db494f803"

Observe one scheduled fire end to end: bounded activity completed, refreshed owner report and compact receipt retained, progress sink outcome verified and no duplicate owner deliveries. Return evidence to the-custodian for CUST-WP-0079-T03; exercise missed/failed-run detection and recovery. This updated operation emits no ops_run. Command success is not delivery or acknowledgment. Wait: T02.

Fixed owner-command integration

id: ACTIVITY-WP-0047-T04
status: done
priority: high

Completed 2026-10-19: the historical harness.agent-dev-local@1.1.1 pin forbids Python under green-commit-only and denies Hub egress. Replaced its disabled rule with a registered ACT-ADR-007 operation using shared fixed-command execution, explicit runtime bindings and existing compact evidence sinks. Weekly CUST-WP-0071-T05 consumes the wrapper through its own disabled definition. Fixture tests cover admission, redirection, unbound input, fixed argv, failed and stale output, sanitized receipts and Temporal dispatch. T01 remains the historical initial definition outcome; T04 records the distinct compatibility repair. No schedule, profile widening, real command or credential access was performed. T02/T03 retain operational acceptance.