Clarify Activity Core queue boundary

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d

docs/adr/ADR-002-governed-execution-responsibility-chain.md

@@ -37,6 +37,12 @@ but it is not an accurate description of the current governed chain:
   normalization. It neither stores credentials nor chooses organizational
   policy.
 
+The current Activity Core worker API does not yet authenticate an individual
+worker identity. `ACTIVITY_CORE_WORKER_TOKEN` authenticates a shared caller
+class, while `worker_id` is request-supplied and is not bound to that principal.
+That is a current-state limitation, not a property this decision may silently
+upgrade into an identity guarantee.
+
 Calling the rein the only enforcement point obscures these fail-closed
 boundaries. Calling it the only credential holder obscures custody and release
 authority. Conversely, moving provider or tenant credentials into Glas would
@@ -55,7 +61,7 @@ The production target for unattended agentic repository mutation is:
 
 ```text
 Activity Core ops_run + lease
-  -> rein-aharness queue adapter (worker identity -> actor agt)
+  -> rein-aharness queue adapter (configured worker_id; principal binding target)
   -> Glas pinned execution profile
   -> sand-boxer isolated venue
   -> selected rein and model/provider adapter
@@ -96,7 +102,7 @@ recording evidence does not transfer that authority.
 | Concern | Authority / enforcement | Required evidence at the handoff |
 |---|---|---|
 | Schedule and task definition | Activity Core definition owner | definition id, trigger/idempotency key, target repo, bounded task, pinned profile, allowlisted organizational refs |
-| Queue identity and lease | Activity Core authenticates the worker; rein-aharness claims, heartbeats, and closes as its configured `worker_id` | ops_run id, claim owner, attempt, lease/heartbeat outcome, final queue state |
+| Queue caller, identity, and lease | Current: Activity Core authenticates a shared worker caller class; `worker_id` is request-supplied, and rein-aharness claims, heartbeats, and closes with its configured value. Required target: Activity Core binds an approved credential/principal to that configured `worker_id`, rejects mismatches, and rejects heartbeat/completion/failure at or after lease expiry | caller/principal class, binding contract/version, configured and accepted worker id, ops_run id, claim owner, attempt, lease/heartbeat outcome, final queue state |
 | Governed actor identity | Channel/rein adapter maps this runtime to `agt`; Glas and sand-boxer validate the governed actor enum | actor plus request/run correlation; queue `worker_id` remains separate |
 | Organizational authority | Workforce/leadership owners upstream of Activity Core | allowlisted assignment, role, duty, goal, and resource-envelope refs; refs are attribution, not authorization |
 | Execution constellation | Glas profile catalog and resolver | exact profile/rein/model/tool/sandbox revisions, readiness state, resolution outcome |
@@ -108,7 +114,7 @@ recording evidence does not transfer that authority.
 | Repository grant | Consuming repo manifest/blueprint and the emitted task/profile define the allowed repository and paths | canonical repo identity, baseline, declared path/publish grant |
 | Repository transaction and acceptance | rein-aharness | transaction id, lease status, baseline and accepted commits, changed paths, clean post-state, remote-ref outcome |
 | Sandbox execution evidence | Glas normalizes rein and sand-boxer lifecycle facts | compact `ExecutionEvidence`, including outcome/failure stage and teardown; no prompts/tool/provider bodies |
-| Queue result | Activity Core allowlists and stores the completion/failure envelope | terminal/reopened state and normalized execution evidence |
+| Queue result | Activity Core allowlists and stores the completion/failure envelope; it must independently enforce active ownership and an unexpired lease on heartbeat, completion, and failure mutations | terminal/reopened state, mutation acceptance/refusal reason, lease state at mutation, and normalized execution evidence |
 | Work history and decisions | State Hub projects progress/decision records; repository workplan files remain work authority | correlation refs and value-safe progress/decision ids |
 | Instance learning/metrics | Consuming repo and kaizen-agentic own the schema; T03 will choose an atomic commit or durable external projection | run/transaction correlation and reconciled projection state |
 
@@ -123,6 +129,11 @@ the repository-transaction and rein-local tool-policy enforcement point within
 a chained grant; it must not weaken or duplicate the authorities at queue,
 profile, credential, sandbox, and provider boundaries.**
 
+Operator or SSO authentication is not worker mutation identity. It may cross
+that boundary only through an explicit, separately authorized and audited
+break-glass contract that records the operator principal, reason, scope, and
+expiry; ordinary worker calls must not inherit operator authority.
+
 ### 4. Failure classification
 
 | Failure | Current required disposition | Why |
@@ -132,7 +143,7 @@ profile, credential, sandbox, and provider boundaries.**
 | Invalid actor or incomplete/ambiguous reachability | Terminal refusal/failure; no host-checkout fallback | Actor and execution venue are governed inputs |
 | Sandbox create, session start/execution/end, credential acquisition, or teardown failure | Terminal profiled attempt with normalized stage evidence; no legacy fallback | Re-running may duplicate effects; a new run may be emitted after repair or explicit policy |
 | Claim/list transport error before ownership | Retry after the configured full polling interval | No repository work has begun |
-| Heartbeat rejection or confirmed lease loss | Stop dispatch, refuse repository acceptance, clean up, and leave reconciliation evidence | Work must not be accepted after ownership expires; T02 implements this |
+| Heartbeat rejection or confirmed lease loss | Activity Core rejects heartbeat/completion/failure at or after lease expiry; rein-aharness stops dispatch, refuses repository acceptance, cleans up, and leaves reconciliation evidence | Both queue-side mutation rejection and executor-side cancellation are required; neither boundary can substitute for the other |
 | Legacy executor failure | Reopen only when the typed executor explicitly marks it retryable and Activity Core attempts remain; unmatched routes are terminal | Preserves current bounded coexistence without making all errors retryable |
 | Required close/evidence API outage after repository mutation | Reconcile the same transaction; do not rerun or create another workload commit | Completion delivery is uncertain, not the workload outcome; T03 implements the outbox/reconciler |
 | Optional State Hub telemetry outage | Continue only when the event is explicitly labelled best-effort and required evidence remains durable elsewhere | Observability must not masquerade as acceptance authority |
@@ -149,6 +160,9 @@ does not reopen profiled failures itself.
   runtime wiring remains unchanged.
 - T02 must make Activity Core lease loss observable inside execution and bind a
   repository lock/transaction to the claimed run.
+- Before the strategic route is ready, Activity Core must publish and enforce a
+  worker-principal/`worker_id` binding contract plus fail-closed expired-lease
+  mutation semantics. A shared caller token is not sufficient identity proof.
 - T03 must make repository acceptance and required result delivery
   reconcilable. Best-effort Hub telemetry is not sufficient completion proof.
 - T04 may migrate, but may not expand, the profile-absent compatibility table.
@@ -177,4 +191,12 @@ Acknowledgements received:
   readiness, outer lifecycle/evidence, rein-local credential resolution, and
   no-fallback semantics approved with no edits.
 
-Pending: Activity Core, sand-boxer, and llm-connect.
+Reviews requiring follow-up:
+
+- Activity Core — message `428abb02-75dc-450d-a7f6-56fc715409ab`: strategic
+  route and no-fallback posture confirmed, but acknowledgement withheld until
+  the shared-caller/current-state limitation, principal-to-`worker_id` target,
+  Activity-Core-side expired-lease rejection, and explicit break-glass boundary
+  were recorded. Those edits are incorporated in this revision.
+
+Pending: revised Activity Core acknowledgement, sand-boxer, and llm-connect.

workplans/HARNESS-WP-0003-governed-runtime-integrity.md

@@ -112,6 +112,13 @@ and T02–T06 can cite stable decisions rather than infer ownership from code.
 - Glas approved the proposed boundary without edits in message
   `006fa46f-9419-4f61-90ff-0c3b6bc294c1`. Activity Core, sand-boxer, and
   llm-connect acknowledgements remain pending.
+- Activity Core review `428abb02-75dc-450d-a7f6-56fc715409ab` confirmed the
+  strategic route and no-fallback posture but correctly rejected an overstated
+  queue-identity guarantee. ADR-002 now distinguishes the current shared caller
+  token from the required principal-to-`worker_id` binding, requires Activity
+  Core itself to reject heartbeat/close mutations at or after lease expiry,
+  and excludes operator/SSO identity except through an audited break-glass
+  contract. Revised acknowledgement remains pending.
 
 ## Make each repository run a lease-bound transaction