activity-core/k8s/custodian-release/publisher-access-delta.md

Exact publisher and access delta for review

Source inspection, 2026-10-19. No credentials read or runtime changed.

Recommended producer: existing core-hub-api-repository-publisher:8020 in namespace core-hub, owned by Repo Manager source and rapp-core-hub packaging. rapp-core-hub/values/production.yaml enables it with immutable image sha256:69d00898cfa1ff0a4b7db8cdc86d15f5f4bea4526915019d3ca82b6f5574354c and repo-manager-forgejo-source Secret. CCR-2026-0031 is applied: its dedicated core-hub-source identity already has read:repository for coulomb repositories, restricted to the core-hub workload. Do not copy that Secret or identity into Activity Core. The Activity Core Forge reader design explicitly has no admitted CCR and is not an existing usable worker credential.

Current Repo Manager runtime.py exports classifications only; it has no file snapshot endpoint or retained artifact volume. Current rapp-core-hub publisher NetworkPolicy admits only candidate pods in core-hub, and egress only to Forgejo and DNS. There is no accepted file transport to Activity Core. The owner-return pickup adapter consumes operator-supplied C-25 JSON; it is not an artifact transfer channel and must not be repurposed by relabelling a snapshot.

Recommended minimal extension (not implemented or approved by this note)

Add one opt-in endpoint to the existing Repo Manager publisher, for the server's fixed custodian-security-flow export policy. It must not accept arbitrary repository names, paths, URLs, refs, commands or target output locations from callers. The configured exact 15-repo policy controls source disclosure. Default enabled=false. Require an idempotent per-activity capture ID and bound concurrent captures to one, with explicit time/file/byte limits; do not add a scheduler.

For each requested capture, run targeted freshness for every policy repo, then read the allowlisted workplan/decision content at those exact Forge commits via the existing authenticated Forge transport. Native rmgr freshness run --repos source now supports exact selection and refuses an undersized limit or missing active repo. Rotating disabled limit6/every2h freshness is not sufficient for this 15-repo/2h policy. A partial, failed, stale or unknown capture must not be published. Existing native receipt trust and no-op issuer semantics are reused.

Return a bounded immutable data bundle with per-file hashes, full existing freshness receipt rows and manifest identity. Do not return credentials, source archives, unrelated files or arbitrary Forge download URLs. Activity Core receives and verifies it under private retained state/snapshot storage, then atomically advances its regular descriptor. Use the existing daily workflow's pre-run stage; no separate recurrence is introduced. Interrupted/partial reception never updates the descriptor. Content transfer and receiver remain required source work, not claimed done by offline export or descriptor selection.

Required source/network scope deltas for owner review:

• Add publisher ingress on TCP8020 only from namespace label kubernetes.io/metadata.name: activity-core and pod label app.kubernetes.io/name: actcore-worker in the same peer selector. Preserve existing candidate ingress. Add matching worker egress only if its active policy otherwise denies this destination.
• Targeted native freshness also requires publisher egress to the existing State Hub service on TCP8000 for primary verification, active registry and per-repo projection reconciliation. This is absent today; admit only that namespace/pod selector after verifying its actual labels. No broad Internet or namespace egress is proposed.
• NetworkPolicy is L4: it cannot limit a caller to the new endpoint. Endpoint caller admission must use the existing service identity/auth model if available; current publisher API-token setting is optional and not configured in the inspected package. Do not claim a path-scoped grant from port filtering alone. An explicit owner decision must accept worker access to the publisher API or supply an existing authenticated gateway. Do not invent a new token mount.
• New disclosure is the private workplan and decision contents of the explicit 15 repos to the existing Activity Core worker, beyond current classification metadata. Existing Forge read scope does not itself approve that downstream disclosure. This is the specific access review, not a generic deployment gate.

No source packaging or mount choice can remove this transport/access prerequisite. The existing worker placement remains selected. The next review should accept or narrow the exact downstream data/endpoint access above; then implement and test capture/receiver before enabling the daily workflow. Private storage capacity, source bytes, no extra resource requests, rollback and unattended evidence stay as documented in the adjacent release README.