activity-core/workplans/ACTIVITY-WP-0042-platform-backup-restore-evidence-scheduling.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
ACTIVITY-WP-0042	workplan	Scheduling role for recurring platform backup/restore evidence runs	infotech	activity-core	proposed	codex	activity-core	2026-10-03	2026-10-03	e1bfb5a4-e647-592d-883f-fe8728ad2f5f

Origin: State Hub message e3668cd9 from railiance-platform (RPF-WP-0036-T03, RPF-WP-0038-T04) proposing activity-core as execution owner for recurring backup/restore evidence runs. This plan is a proposal. Acceptance of the role is a founder/owner decision and is NOT recorded here.

Facts from the repo (2026-10-03):

• daily-cnpg-option-a-backup already runs a cron-scheduled bounded operation (cnpg_option_a_backup, ACT-ADR-007) with state-hub-progress evidence. Its definition targets the Nextcloud lane and covers forgejo-db, net-kingdom-pg, state-hub-db; it does not cover apps-pg/platform-pg/platform-pg-2 or the Scaleway primary, and it never performs restores.
• ACT-ADR-007 allowlist is closed. A restore-evidence or Scaleway-backup run needs a new code-registered operation plus an ADR successor, tests, a credential route and an evidence contract. A definition string cannot add one.
• The actcore-backup-offsite lane depends on ClusterSecretStore openbao-activity-core, reported failing since 2026-09-19 (expired token).

Decide whether activity-core accepts the scheduling role

id: ACTIVITY-WP-0042-T01
status: wait
needs_human: true
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
blocking_reason: "Founder decision: accept scheduling only, scheduling plus a bounded operation, or decline the role."
priority: high
state_hub_task_id: "2a368988-2611-596a-a847-82c048bd179e"

Founder decision. Options: accept scheduling only (when/what/where; S3 keeps validators, cadence, expiry and evidence), accept scheduling plus a bounded operation, or decline. Needs: restore execution stays with an S3-owned tool invoked as a fixed bounded operation; approval-engine authority supplied per run; no general executor behaviour.

2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.

Admit a bounded operation and credential lane

id: ACTIVITY-WP-0042-T02
status: wait
depends_on: [ACTIVITY-WP-0042-T01]
blocking_reason: "Depends on T01: no bounded operation or credential lane until the founder accepts the role."
priority: medium
state_hub_task_id: "250c6e8e-7281-5dec-9a92-06081b8c96bb"

Blocked on T01. Successor to ACT-ADR-007, registry entry (target bounds, timeout, idempotency, dry_run explicit), tests, credential route via OpenBao (owner railiance-platform) with a repaired openbao-activity-core store, and non-secret evidence mode. Scheduled caller satisfies RPF-WP-0038-T04 only once recurring tiered scheduling and retention are accepted by their owners.

Answer ops-warden on atm-backup-daily

id: ACTIVITY-WP-0042-T03
status: wait
needs_human: true
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
blocking_reason: "Founder must confirm whether activity-core's backup worker is the atm-backup-daily unit before declaring to ops-warden."
priority: low
state_hub_task_id: "e1c313dc-9a94-5b7c-b406-604b700bf3eb"

WARDEN-WP-0040 asks which owner declares workload resolution backup-daily for atm-backup-daily. activity-core has no atm-* identity of its own in this repo and no evidence that the actor was minted for its worker. Declare only if the founder confirms activity-core's backup worker is that unit; otherwise the declaring owner is whoever holds the actor's issuance (railiance-platform was also asked). Never infer membership.

2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.