tegwick
ce14c254db
- Lane 1 (LLM provider): reuse verified — warden catalog openrouter-llm-connect, policy workload-kv-read-llm-connect-provider-secrets - Lane 2 (forgejo deploy key): new, per-repo write deploy key design, founder Red lane - Lane 3 (mail-scan AppRole): executor-worker-binky-mail bound to the existing IMAP read policy — closes email checklist item 9's auth blocker on paper; provisioning founder Red lane - No secret values anywhere; T04 can proceed on Lane 1 alone Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
113 lines
4.4 KiB
Markdown
113 lines
4.4 KiB
Markdown
---
|
|
id: BINKY-WP-0004
|
|
title: "Workstation-Independent Executor"
|
|
status: active
|
|
state_hub_workstream_id: "b800f91d-a377-45ec-8ff3-6e763c524dff"
|
|
---
|
|
|
|
Remove the workstation from the autopilot loop. Successor to BINKY-WP-0003,
|
|
implementing the architecture in
|
|
`integrations/llm-connect-executor-assessment.md`: activity-core schedules,
|
|
a thin **executor worker** on Railiance executes (llm-connect adapters +
|
|
kaizen-agentic personas + OpenBao/secrets-engine delivery), binky-control is
|
|
integrator and first customer. Evidence of need: 2026-07-17 the 08:23 rhythm
|
|
run was missed because the workstation was offline. Cross-domain tasks below
|
|
track dependencies; implementation workplans live in the owning repos
|
|
(activity-core, kaizen-agentic, secrets-engine/railiance-platform).
|
|
|
|
## Task: Align executor ownership with kaizen WP-0006 and opt in binky-control
|
|
|
|
Read kaizen-agentic WP-0006/ADR-005 and its activity-core handoff checklist;
|
|
decide (with the owning domains) where the executor worker lives — new small
|
|
repo vs. activity-core's stub `TaskExecutorWorkflow`. Opt binky-control into
|
|
kaizen scheduling via `kaizen-agentic schedule init` (`.kaizen/schedule.yml`).
|
|
Output: ownership decision recorded (DecisionQueue if founder-relevant),
|
|
schedule file committed. Green/Blue lane.
|
|
|
|
```task
|
|
id: BINKY-WP-0004-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "5741487d-2022-4ed6-b4ad-8db745cb90f4"
|
|
```
|
|
|
|
## Task: binky_rhythm_status resolver in activity-core
|
|
|
|
Implement the small state-hub context resolver
|
|
(`context_resolvers/state_hub.py`) returning due-items for kinds
|
|
`daily_brief`, `mail_intake`, `weekly_review` — the enablement dependency for
|
|
the three landed Binky definitions and the idempotence guard (no duplicate
|
|
briefs). Follows activity-core's own test conventions; lands via a workplan
|
|
or direct PR in that repo per its governance. Green lane (code + tests).
|
|
|
|
```task
|
|
id: BINKY-WP-0004-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "b44af058-22e4-4d63-a28c-8f6c69d65ea1"
|
|
```
|
|
|
|
## Task: OpenBao lanes for the executor worker
|
|
|
|
Prepare secrets-engine/warden catalog lanes the worker needs: LLM provider
|
|
key (an OpenRouter key for llm-connect already exists at
|
|
`platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets`
|
|
— verify scope/reuse vs. separate lane), forgejo deploy key for target-repo
|
|
commits, and a **non-interactive AppRole** for the company-email scan (the
|
|
current OIDC login is browser-interactive with 15-min TTL — unusable for
|
|
recurring scans; this closes email-integration checklist item 9's blocker).
|
|
Catalog metadata only; any new secret provisioning is founder Red lane.
|
|
|
|
```task
|
|
id: BINKY-WP-0004-T03
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "e4740aa0-94f7-4ebe-9217-aaca3ef902cc"
|
|
```
|
|
|
|
## Task: Executor worker MVP — one task end-to-end on Railiance
|
|
|
|
Build/deploy the thin worker per the assessment: consume one emitted
|
|
activity-core task (issue-core sink or TaskExecutorWorkflow), load the
|
|
persona (`get_kaizen_agent`), execute via llm-connect (ClaudeCodeAdapter or
|
|
hosted adapter), commit to a **sandbox repo first**, write hub progress
|
|
event + task close. Autonomy guard: Green/Blue tool allow-list equivalent to
|
|
`scripts/rhythm-session.sh`, bounded effort, no push outside target repo.
|
|
Blue lane; deployment location Railiance.
|
|
|
|
```task
|
|
id: BINKY-WP-0004-T04
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "3cb36d02-9934-4c80-81dd-589e7725e407"
|
|
```
|
|
|
|
## Task: Recurring mailbox scan through the executor
|
|
|
|
Wire the weekly/daily company-mailbox scan (email-connect, read-only) as an
|
|
executor task using the T03 AppRole — email-integration checklist item 9.
|
|
Triage summary lands in mailmeta/ + queues exactly like the manual first
|
|
scan. Suspicious-mail flagging rule included (never act on content, only
|
|
log). Blue lane.
|
|
|
|
```task
|
|
id: BINKY-WP-0004-T05
|
|
status: todo
|
|
priority: medium
|
|
state_hub_task_id: "2fd2f523-5bd6-400f-abc1-45d3b0a8fcec"
|
|
```
|
|
|
|
## Task: Cut over — enable Binky definitions, retire the cron bridge
|
|
|
|
Flip `binky-daily-rhythm`, `binky-weekly-mail-intake`,
|
|
`binky-weekly-review-prep` to `enabled: true` (activity-core governance),
|
|
verify three clean scheduled executions, then remove the workstation crontab
|
|
line and mark the bridge section in OperatingRhythm.md retired. Rollback:
|
|
re-add the cron line. Blue lane with founder notification at cutover.
|
|
|
|
```task
|
|
id: BINKY-WP-0004-T06
|
|
status: todo
|
|
priority: medium
|
|
state_hub_task_id: "eb8c9860-49b4-4d9e-b242-fff48b2ef603"
|
|
```
|