tegwick
9737577f0b
ACTIVITY-WP-0046: grant v2 carries a publish scope (remote, branch, path prefixes inside allowed_paths, fast-forward only) in its canonical grant id; v1 stays local-only with unchanged ids. ACTIVITY-WP-0047: disabled daily-security-flow definition dispatching the the-custodian runner as an ops_run (CUST-WP-0079-T03). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 296847@bnt-lap001 Assistant-Session: 4f997d46-1b9d-4131-9699-0c353a215155
57 lines
2.1 KiB
Markdown
57 lines
2.1 KiB
Markdown
---
|
|
id: daily-security-flow
|
|
name: Daily Security Flow
|
|
enabled: false
|
|
owner: activity-core
|
|
governance: custodian
|
|
status: proposed
|
|
trigger:
|
|
type: cron
|
|
cron_expression: "30 7 * * *"
|
|
timezone: Europe/Berlin
|
|
misfire_policy: skip
|
|
---
|
|
|
|
# Daily Security Flow
|
|
|
|
Adopted from the-custodian CUST-WP-0079-T03, tracked in ACTIVITY-WP-0047.
|
|
Activity Core owns the schedule; the-custodian owns the runner
|
|
(`scripts/security_flow_daily.py`), its report and its delivery checkpoints.
|
|
|
|
Each fire emits one ops_run for a rein on the workstation profile, which runs a
|
|
fixed command in the-custodian checkout:
|
|
|
|
```text
|
|
python3 scripts/security_flow_daily.py --apply
|
|
```
|
|
|
|
The runner resolves hub decisions already recorded as resolved in repo decision
|
|
logs (the sanctioned `POST /decisions/{id}/resolve`), writes a deterministic
|
|
JSON report, and messages coding agents only when READY/UNBLOCKED change and the
|
|
founder only when ATTENDED is nonempty. Its per-recipient checkpoint and run
|
|
lock make a repeated or overlapping fire safe.
|
|
|
|
- Daily 07:30 Europe/Berlin; misfires are skipped, never replayed.
|
|
- No repository grant: the run reads repo files and changes nothing in any
|
|
repository. A rein must not commit or push for this run.
|
|
- Activity Core does not run the script itself (out of scope: general
|
|
execution); it dispatches and records the ops_run outcome.
|
|
|
|
**Not yet enabled.** Activation (ACTIVITY-WP-0047-T02) flips `enabled: true`
|
|
once the claiming rein confirms it can run the command against workstation
|
|
checkouts. Rollback: `enabled: false`.
|
|
|
|
```rule
|
|
id: run-daily-security-flow
|
|
condition: "True"
|
|
action:
|
|
task_template: Run the daily security flow
|
|
description: 'In the-custodian checkout run exactly: python3 scripts/security_flow_daily.py --apply. Report its exit code and the printed JSON report. Do not edit, commit or push any repository and do not send messages yourself; the script handles delivery.'
|
|
target_repo: the-custodian
|
|
priority: medium
|
|
labels: ["automated", "security-flow"]
|
|
harness_profile_ref: harness.agent-dev-local@1.1.1
|
|
execution_refs:
|
|
correlation_id: CUST-WP-0079-T03
|
|
assignment_ref: ACTIVITY-WP-0047-T01
|
|
```
|