coulomb/activity-core
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
activity-core/activity-definitions/daily-security-flow.md
tegwick 9737577f0b
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m30s
Details
Add repository grant v2 publish scope and adopt daily security flow 
ACTIVITY-WP-0046: grant v2 carries a publish scope (remote, branch, path
prefixes inside allowed_paths, fast-forward only) in its canonical grant id;
v1 stays local-only with unchanged ids.

ACTIVITY-WP-0047: disabled daily-security-flow definition dispatching the
the-custodian runner as an ops_run (CUST-WP-0079-T03).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 296847@bnt-lap001
Assistant-Session: 4f997d46-1b9d-4131-9699-0c353a215155
2026-10-13 21:08:15 +02:00

2.1 KiB
Raw Blame History

id name enabled owner governance status trigger
daily-security-flow Daily Security Flow false activity-core custodian proposed
type cron_expression timezone misfire_policy
cron 30 7 * * * Europe/Berlin skip

Daily Security Flow

Adopted from the-custodian CUST-WP-0079-T03, tracked in ACTIVITY-WP-0047. Activity Core owns the schedule; the-custodian owns the runner (scripts/security_flow_daily.py), its report and its delivery checkpoints.

Each fire emits one ops_run for a rein on the workstation profile, which runs a fixed command in the-custodian checkout:

python3 scripts/security_flow_daily.py --apply

The runner resolves hub decisions already recorded as resolved in repo decision logs (the sanctioned POST /decisions/{id}/resolve), writes a deterministic JSON report, and messages coding agents only when READY/UNBLOCKED change and the founder only when ATTENDED is nonempty. Its per-recipient checkpoint and run lock make a repeated or overlapping fire safe.

  • Daily 07:30 Europe/Berlin; misfires are skipped, never replayed.
  • No repository grant: the run reads repo files and changes nothing in any repository. A rein must not commit or push for this run.
  • Activity Core does not run the script itself (out of scope: general execution); it dispatches and records the ops_run outcome.

Not yet enabled. Activation (ACTIVITY-WP-0047-T02) flips enabled: true once the claiming rein confirms it can run the command against workstation checkouts. Rollback: enabled: false.

id: run-daily-security-flow
condition: "True"
action:
  task_template: Run the daily security flow
  description: 'In the-custodian checkout run exactly: python3 scripts/security_flow_daily.py --apply. Report its exit code and the printed JSON report. Do not edit, commit or push any repository and do not send messages yourself; the script handles delivery.'
  target_repo: the-custodian
  priority: medium
  labels: ["automated", "security-flow"]
  harness_profile_ref: harness.agent-dev-local@1.1.1
  execution_refs:
    correlation_id: CUST-WP-0079-T03
    assignment_ref: ACTIVITY-WP-0047-T01