Record deployed queue boundary

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d

docs/adr/ADR-002-governed-execution-responsibility-chain.md

@@ -37,11 +37,16 @@ but it is not an accurate description of the current governed chain:
   normalization. It neither stores credentials nor chooses organizational
   policy.
 
-The current Activity Core worker API does not yet authenticate an individual
+At the first proposed revision of this decision, the Activity Core worker API
-worker identity. `ACTIVITY_CORE_WORKER_TOKEN` authenticates a shared caller
+authenticated a shared caller class while `worker_id` was request-supplied and
-class, while `worker_id` is request-supplied and is not bound to that principal.
+not principal-bound. Activity Core subsequently deployed `ACTIVITY-WP-0036` at
-That is a current-state limitation, not a property this decision may silently
+revisions `f0a897e` and `3cd5250`: `ACTIVITY_CORE_WORKER_TOKEN` is now bound to
-upgrade into an identity guarantee.
+configured `ACTIVITY_CORE_WORKER_ID=rein-aharness@railiance01`; mismatched body
+identity and operator/SSO mutation credentials are rejected; and heartbeat,
+completion, and failure row-lock and reject missing, equal-to-expiry, or expired
+leases. The rollout has automated and live spoof-refusal evidence; a natural
+late-heartbeat/close production observation remains pending because no claimed
+row existed and no unrelated run was manufactured for the proof.
 
 Calling the rein the only enforcement point obscures these fail-closed
 boundaries. Calling it the only credential holder obscures custody and release
@@ -61,7 +66,7 @@ The production target for unattended agentic repository mutation is:
 
 ```text
 Activity Core ops_run + lease
-  -> rein-aharness queue adapter (configured worker_id; principal binding target)
+  -> rein-aharness queue adapter (Activity-Core-bound configured worker_id)
   -> Glas pinned execution profile
   -> sand-boxer isolated venue
   -> selected rein and model/provider adapter
@@ -102,7 +107,7 @@ recording evidence does not transfer that authority.
 | Concern | Authority / enforcement | Required evidence at the handoff |
 |---|---|---|
 | Schedule and task definition | Activity Core definition owner | definition id, trigger/idempotency key, target repo, bounded task, pinned profile, allowlisted organizational refs |
-| Queue caller, identity, and lease | Current: Activity Core authenticates a shared worker caller class; `worker_id` is request-supplied, and rein-aharness claims, heartbeats, and closes with its configured value. Required target: Activity Core binds an approved credential/principal to that configured `worker_id`, rejects mismatches, and rejects heartbeat/completion/failure at or after lease expiry | caller/principal class, binding contract/version, configured and accepted worker id, ops_run id, claim owner, attempt, lease/heartbeat outcome, final queue state |
+| Queue caller, identity, and lease | Activity Core binds the approved worker token to configured `worker_id`, rejects body/principal mismatch and non-worker mutation credentials, and rejects heartbeat/completion/failure at or after lease expiry; rein-aharness claims, heartbeats, and closes with that configured identity | caller/principal class, binding contract/version, configured and accepted worker id, ops_run id, claim owner, attempt, lease/heartbeat outcome, final queue state |
 | Governed actor identity | Channel/rein adapter maps this runtime to `agt`; Glas and sand-boxer validate the governed actor enum | actor plus request/run correlation; queue `worker_id` remains separate |
 | Organizational authority | Workforce/leadership owners upstream of Activity Core | allowlisted assignment, role, duty, goal, and resource-envelope refs; refs are attribution, not authorization |
 | Execution constellation | Glas profile catalog and resolver | exact profile/rein/model/tool/sandbox revisions, readiness state, resolution outcome |
@@ -160,9 +165,10 @@ does not reopen profiled failures itself.
   runtime wiring remains unchanged.
 - T02 must make Activity Core lease loss observable inside execution and bind a
   repository lock/transaction to the claimed run.
-- Before the strategic route is ready, Activity Core must publish and enforce a
+- Activity Core deployed the required worker-principal/`worker_id` binding and
-  worker-principal/`worker_id` binding contract plus fail-closed expired-lease
+  fail-closed expired-lease mutation semantics under `ACTIVITY-WP-0036`.
-  mutation semantics. A shared caller token is not sufficient identity proof.
+  A natural late-heartbeat/close observation remains integration evidence for a
+  future real claimed row, not a reason to manufacture unrelated work.
 - T03 must make repository acceptance and required result delivery
   reconcilable. Best-effort Hub telemetry is not sufficient completion proof.
 - T04 may migrate, but may not expand, the profile-absent compatibility table.
@@ -200,6 +206,9 @@ Reviews requiring follow-up:
   route and no-fallback posture confirmed, but acknowledgement withheld until
   the shared-caller/current-state limitation, principal-to-`worker_id` target,
   Activity-Core-side expired-lease rejection, and explicit break-glass boundary
-  were recorded. Those edits are incorporated in this revision.
+  were recorded. Message `900801f4-0641-4e87-90e6-0279b6c892a6` reports those
+  boundaries deployed at revisions `f0a897e` and `3cd5250`, with 468 tests,
+  live spoof-refusal evidence, and no manufactured late-close run. Those facts
+  are incorporated in this revision for final Activity Core acknowledgement.
 
 Pending: revised Activity Core acknowledgement, sand-boxer, and llm-connect.

workplans/HARNESS-WP-0003-governed-runtime-integrity.md

@@ -126,6 +126,15 @@ and T02–T06 can cite stable decisions rather than infer ownership from code.
   (`704aa396-52b7-4c9f-80b7-6cf8a81ce0a1`). Glas reconfirmed the exact
   revision and digest in `9638537b-e3c3-414d-a2d7-8beab61a4e1f`; revised
   Activity Core, sand-boxer, and llm-connect acknowledgements remain pending.
+- Activity Core message `900801f4-0641-4e87-90e6-0279b6c892a6` reports the
+  requested boundary deployed under `ACTIVITY-WP-0036` at revisions `f0a897e`
+  and `3cd5250`: the worker token is bound to configured
+  `rein-aharness@railiance01`, mismatched body and operator/SSO identities are
+  rejected, and heartbeat/complete/fail enforce row-locked active leases with
+  equal-to-expiry treated as expired. Its 468-test suite and live spoof refusal
+  passed. ADR-002 now records this as deployed current state; natural
+  heartbeat/late-close production evidence remains pending for the next real
+  claimed row rather than a manufactured run.
 
 ## Make each repository run a lease-bound transaction