Gate ESO adoption on verified predecessors and receive release custody handoff

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

intakes/RPF-IN-0011-activity-core-release-custody.md

@@ -0,0 +1,48 @@
+---
+id: RPF-IN-0011
+kind: intake
+type: intake
+title: "Prepare dedicated activity-core image-only release principal and custody"
+repo: railiance-platform
+lane: supervised
+status: open
+owner: railiance-platform
+requested_by: activity-core
+origin: handoff
+origin_ref: ACTIVITY-WP-0041-T03
+priority: high
+created: "2026-10-11"
+updated: "2026-10-11"
+tags: [security, cross-owner, release, credential-custody]
+---
+
+Prepare and return an exact owner workplan/task binding for the already D2-authorized
+`ACTIVITY-WP-0041-image-only-v1` release scope. This intake is independent of the
+RPF48 gate that awaits ACT41 acceptance. It requests owner implementation and native
+acceptance, not another founder approval or a secret value. RPF-WP-0036-T03 is
+backup freshness work and does not supply this release identity/custody commitment.
+
+Fixed intended Kubernetes identity is
+`system:serviceaccount:activity-core:activity-core-release-broker` on estate
+92.205.62.239, cluster UID a553c742-0115-43d4-99a4-a5ca56fe0786. Native read-only
+metadata found no dedicated account, only default/activity-core-eso, with no matching
+namespace/ArgoCD role bindings. ESO projection custody cannot be borrowed for release.
+Platform must choose and independently attest the fixed Git publication identity
+and exclusive broker custody, plus distinct build/review/health/retention issuer
+principals and Ed25519 key custody/rotation; no local fixture key is acceptance.
+
+Activity-core source supplies bounded health GET, 60-second durable observer,
+private config/credential drift checks, actual Kubernetes username and eleven
+allow/deny checks, dedicated Temporal worker, exact one-field Git publication,
+targeted non-pruning Argo operations, durable rollback and sanitized audit sink.
+See activity-core docs/release-runtime-owner-handoff.md and this repo's
+ docs/activity-core-release-admission.md for exact boundaries. Keep privileged
+transport behind this reviewed broker because Application RBAC and repository-write
+credentials alone cannot enforce the one-field scope.
+
+Return source-bound owner acceptance and actual Git/Kubernetes allow/deny, custody,
+revocation, independent signed receipts, continuous observer/ledger, Temporal
+registration, normal release and failed-health rollback proof. No native activation
+is claimed. If preparation requires attended admin authentication, stage the exact
+reviewed custody command first, then place that login in the orange checklist.
+Only a genuinely expanded action/access/custody scope goes to the red daily batch.