activity-core/workplans/ACTIVITY-WP-0042-platform-backup-restore-evidence-scheduling.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
ACTIVITY-WP-0042	workplan	Scheduling role for recurring platform backup/restore evidence runs	infotech	activity-core	proposed	codex	activity-core	2026-10-03	2026-10-03	e1bfb5a4-e647-592d-883f-fe8728ad2f5f

Origin: State Hub message e3668cd9 from railiance-platform (RPF-WP-0036-T03, RPF-WP-0038-T04) proposing activity-core as execution owner for recurring backup/restore evidence runs. This plan is a proposal. Acceptance of the role is a founder/owner decision and is NOT recorded here.

Facts from the repo (2026-10-03):

• daily-cnpg-option-a-backup already runs a cron-scheduled bounded operation (cnpg_option_a_backup, ACT-ADR-007) with state-hub-progress evidence. Its definition targets the Nextcloud lane and covers forgejo-db, net-kingdom-pg, state-hub-db; it does not cover apps-pg/platform-pg/platform-pg-2 or the Scaleway primary, and it never performs restores.
• ACT-ADR-007 allowlist is closed. A restore-evidence or Scaleway-backup run needs a new code-registered operation plus an ADR successor, tests, a credential route and an evidence contract. A definition string cannot add one.
• The old expired-token finding is superseded: RPF-WP-0045 replaced static tokens with Kubernetes auth. On 2026-10-03, read-only railiance01 inspection confirmed openbao-activity-core Ready/Valid and actcore-backup-offsite Ready/SecretSynced (refresh 09:29:02Z). This verifies the existing Nextcloud lane only; new recovery authority and credential scope remain unapproved.

Decide whether activity-core accepts the scheduling role

id: ACTIVITY-WP-0042-T01
status: wait
needs_human: true
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
blocking_reason: "Founder decision: accept scheduling only, scheduling plus a bounded operation, or decline the role."
priority: high
state_hub_task_id: "2a368988-2611-596a-a847-82c048bd179e"

Founder decision. Options: accept scheduling only (when/what/where; S3 keeps validators, cadence, expiry and evidence), accept scheduling plus a bounded operation, or decline. Needs: restore execution stays with an S3-owned tool invoked as a fixed bounded operation; approval-engine authority supplied per run; no general executor behaviour.

2026-10-03 (CUST-WP-0075 inbox sweep): railiance-platform replied (message 0638c13b) asking activity-core to proceed under its conditions, because "roles tie to the source repo". That is the S3 owner's consent. It does not resolve this founder gate, so T01 stays waiting on D2 and the plan stays proposed. It also asks activity-core to declare atm-backup-daily, which remains T03's founder confirmation. activity-core replied with the same position.

2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.

Admit a bounded operation and credential lane

id: ACTIVITY-WP-0042-T02
status: wait
depends_on: [ACTIVITY-WP-0042-T01, ACTIVITY-WP-0042-T05]
blocking_reason: "Requires role acceptance (T01) and the agreed platform runner contract (T05) before operation or credential admission."
priority: medium
state_hub_task_id: "250c6e8e-7281-5dec-9a92-06081b8c96bb"

Blocked on T01. Successor to ACT-ADR-007, registry entry (target bounds, timeout, idempotency, dry_run explicit), tests, credential route via OpenBao (owner railiance-platform; existing store health verified), and non-secret evidence mode. Scheduled caller satisfies RPF-WP-0038-T04 only once recurring tiered scheduling and retention are accepted by their owners.

Answer ops-warden on atm-backup-daily

id: ACTIVITY-WP-0042-T03
status: wait
needs_human: true
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
blocking_reason: "Founder must confirm whether activity-core's backup worker is the atm-backup-daily unit before declaring to ops-warden."
priority: low
state_hub_task_id: "e1c313dc-9a94-5b7c-b406-604b700bf3eb"

WARDEN-WP-0040 asks which owner declares workload resolution backup-daily for atm-backup-daily. activity-core has no atm-* identity of its own in this repo and no evidence that the actor was minted for its worker. Declare only if the founder confirms activity-core's backup worker is that unit; otherwise the declaring owner is whoever holds the actor's issuance (railiance-platform was also asked). Never infer membership.

2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.

Prepare the concrete scheduling and runner proposal

id: ACTIVITY-WP-0042-T04
status: done
priority: high
state_hub_task_id: "859e8857-ea51-5147-bd3a-70acac1426dc"

User requested investigation and forward progress on 2026-10-03. Reviewed the existing definition, bounded-operation registry, platform recovery entry points, credential route and actor declaration. Removed the stale ESO blocker after a fresh metadata-only check. Concrete recommendation and staged acceptance: docs/platform-recovery-scheduling-plan.md.

Recommend scheduling-only ownership; platform retains the recovery runner and policy. First proposed slice is one disabled/manual apps-pg recovery-evidence operation, with offline contract tests before any live admission. T01 is still an explicit role choice; this investigation does not record acceptance of it or resolve the broader D2 decision. The actor ownership question is separate.

Agree the platform runner contract

id: ACTIVITY-WP-0042-T05
status: wait
priority: high
depends_on: [ACTIVITY-WP-0042-T01]
blocking_reason: "Scheduling role acceptance and platform agreement on the fixed runner contract are needed before adapter admission."
state_hub_task_id: "a2d95c80-bfc5-54b7-9987-ad3571d9c75f"

Use the contract table in docs/platform-recovery-scheduling-plan.md for an owner review: authority verification, exact target, implementation version, durable run receipts, overlap/retry behavior, cleanup, resource ceilings and credential scope. Existing restore CLIs are not an admitted unattended API. This task records the dependency; no external acceptance or message is claimed. T02 implements/adopts the agreed contract; T03 does not gate offline design.