tegwick
d6807b8c7e
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181
96 lines
3.6 KiB
Markdown
96 lines
3.6 KiB
Markdown
---
|
|
id: ACTIVITY-WP-0047
|
|
type: workplan
|
|
title: "Adopt the daily security-flow schedule (CUST-WP-0079-T03)"
|
|
domain: infotech
|
|
repo: activity-core
|
|
status: active
|
|
owner: claude-activity-core
|
|
topic_slug: activity-core
|
|
created: "2026-10-13"
|
|
updated: "2026-10-19"
|
|
flavor: implementation
|
|
related: [CUST-WP-0079]
|
|
state_hub_workstream_id: "ee97869b-dca2-54c9-aa18-0b479c244fb3"
|
|
---
|
|
|
|
Origin: the-custodian handed over the daily security-flow lane (message
|
|
117e538e, case `case:cross-owner:CUST-WP-0079-T03:activity-core`). The workstation
|
|
user systemd bus is unavailable, so no host timer can run it. Founder accepted
|
|
adoption on 2026-10-13.
|
|
|
|
Boundary, corrected 2026-10-19: Activity Core owns the schedule, bounded
|
|
operation activity/context and progress-sink evidence. the-custodian owns
|
|
scripts/security_flow_daily.py, report and delivery checkpoints. The fixed
|
|
routine uses ACT-ADR-007 existing registered owner-operation exception, not
|
|
general coding execution or a rein task. No repository grant is implied.
|
|
The original ops_run/profile mechanism remains historical T01 preparation
|
|
and is superseded by T04; T02/T03 use the corrected receipt contract.
|
|
|
|
## Source definition
|
|
|
|
```task
|
|
id: ACTIVITY-WP-0047-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "cbe8cfe2-43ef-5a31-b163-c473572754b7"
|
|
```
|
|
|
|
`activity-definitions/daily-security-flow.md`: daily 07:30 Europe/Berlin,
|
|
misfire skip, one unconditional rule emitting an ops_run on
|
|
`harness.agent-dev-local@1.1.1` with the fixed command and correlation
|
|
`CUST-WP-0079-T03`. Committed with `enabled: false`.
|
|
|
|
## Activation
|
|
|
|
```task
|
|
id: ACTIVITY-WP-0047-T02
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "d0d5fddd-2d73-5156-aac3-49837aec2988"
|
|
```
|
|
|
|
Wait: executor owner accepts the bounded-operation runtime in
|
|
docs/custodian-bounded-operations.md: pinned owner source/dependencies,
|
|
scoped fleet snapshots/repository list, private state outside source roots,
|
|
admitted Hub access and checkpointed command behavior. Then enable through
|
|
the normal release/admin-sync path and run one manual trigger. The historical
|
|
coding-profile route cannot execute this command and must not be activated.
|
|
T04 supplies local source integration, not runtime acceptance.
|
|
|
|
## First unassisted fire
|
|
|
|
```task
|
|
id: ACTIVITY-WP-0047-T03
|
|
status: wait
|
|
priority: medium
|
|
state_hub_task_id: "d692a3eb-7878-5405-931c-e11db494f803"
|
|
```
|
|
|
|
Observe one scheduled fire end to end: bounded activity completed, refreshed
|
|
owner report and compact receipt retained, progress sink outcome verified and
|
|
no duplicate owner deliveries. Return evidence to the-custodian for
|
|
CUST-WP-0079-T03; exercise missed/failed-run detection and recovery. This updated
|
|
operation emits no ops_run. Command success is not delivery or acknowledgment.
|
|
Wait: T02.
|
|
|
|
|
|
## Fixed owner-command integration
|
|
|
|
```task
|
|
id: ACTIVITY-WP-0047-T04
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "c249b64e-710a-5941-97e5-d8672ee27de9"
|
|
```
|
|
|
|
Completed 2026-10-19: the historical harness.agent-dev-local@1.1.1 pin forbids
|
|
Python under green-commit-only and denies Hub egress. Replaced its disabled rule
|
|
with a registered ACT-ADR-007 operation using shared fixed-command execution,
|
|
explicit runtime bindings and existing compact evidence sinks. Weekly
|
|
CUST-WP-0071-T05 consumes the wrapper through its own disabled definition.
|
|
Fixture tests cover admission, redirection, unbound input, fixed argv, failed
|
|
and stale output, sanitized receipts and Temporal dispatch. T01 remains the
|
|
historical initial definition outcome; T04 records the distinct compatibility
|
|
repair. No schedule, profile widening, real command or credential access was
|
|
performed. T02/T03 retain operational acceptance.
|