rein-aharness/docs/legacy-runtime-inventory.md

Legacy profile-absent runtime inventory

Status: active migration inventory for REINAH-WP-0003-T04

Captured: 2026-08-23; compatibility guard added 2026-09-04

Initial inventory source: rein-aharness 6e0e23c; guard behavior updated in the implementation recorded by this workplan.

This inventory records the tenant-specific execution paths selected when an Activity Core ops_run has no harness_profile_ref. It began as read-only preparation; after ADR-002 acceptance it also records the dated compatibility guard. This document does not itself enable a definition.

The definition state below is the committed file state in Activity Core, freedom-intelligence, and binky-control. Live schedule projection, timer state, and deployed revisions must be reverified before a migration or rollback.

Shared compatibility dispatcher

rein_aharness/claim_loop.py sends every profile-absent row through select_approach() in rein_aharness/approaches.py. Selection is first-match and may use an explicit approach_hint, labels, or substrings from definition id, title, hint, labels, source id, and target repo.

None of the four committed definitions below declares harness_profile_ref or approach_hint; their current route therefore depends on labels and substring matching. Dispatch now additionally requires an explicit, non-expired ISO date in AGENT_HARNESS_LEGACY_APPROACHES_UNTIL. Missing, malformed, or expired values fail terminally before target resolution or executor invocation. A present profile ref bypasses both this table and the compatibility flag and must never fall back to either.

Selector	Tenant coupling	Direct executor
fi-research-brief	FI labels, names, output schema, completion event, literal result repo	fi_research_brief.run_fi_research_brief
brief-daily	Binky labels, files, prompt/output schema, completion event, literal result repo	brief_daily.run_brief_daily
brief-weekly	Binky labels, milestone/RISK-005 semantics, completion event, literal result repo	brief_weekly.run_brief_weekly
mail-scan+triage	Binky labels, mailbox config/path, OpenBao path, report/log schema and events	mailscan.run_mail_scan then mail_triage.run_mail_triage
mail-scan / mail-triage	Same Binky internals, exposed as separately callable compatibility commands	The corresponding half of the pipeline
agent-session	Generic-looking entry with Binky-specific agent/event inference in intake.py	runner.run_task through ops_run_to_taskspec

An unmatched route fails terminally. Most matched executor failures set reopen=true; an unexpected exception also reopens. Activity Core applies its attempt limit. The harness now records a repository transaction identity, but Activity Core does not yet carry an accepted repository grant or reconcile a response-lost terminal close, so a retry after ambiguous completion remains a T03 gate.

Scheduled definitions

Freedom Intelligence daily research brief

Field	Current contract
Definition authority	freedom-intelligence/activity-definitions/fi-daily-research-brief.md; owner custodian-agent, governance custodian
File-state cadence	Enabled/active; weekdays 07:30 Europe/Berlin; skip misfires
Current selection	Labels freedom-intelligence, research-brief, automated select fi-research-brief
Inputs	FI sources allowlist, daily playbook, reserve status, two fixed research baselines/plans, recent briefs, and recent git log
Model/credential lane	HTTP LLM_CONNECT_URL; model from FI_RESEARCH_BRIEF_MODEL, then Binky-named BRIEF_DAILY_MODEL / MAIL_TRIAGE_MODEL; provider credential remains behind llm-connect
Output	briefs/YYYY/MM/YYYY-MM-DD.md; model JSON is rendered deterministically
Repository mutation	Stages only the brief path and creates one local commit
Publication	Local commit only. The former FI_RESEARCH_BRIEF_PUSH path was removed 2026-09-04; publication requires a separate owner/grant.
Completion	Best-effort State Hub fi_daily_brief with path/date/candidate count; fi_brief_status uses it to clear due state
Failure/retry	Normal generation/commit failure reopens; an existing daily path succeeds idempotently
Current rollback material	Disable/pause the Activity Core definition. FI documents a disabled 07:35 host timer as break-glass, but its installer still enables that timer and must not be invoked casually

Publication, if still needed, must become a separately named and granted capability with remote-ref and result evidence. The Binky-named fallback model environment variables must not survive in an FI owned declaration.

Binky daily operating rhythm

Field	Current contract
Definition authority	activity-core/activity-definitions/binky-daily-rhythm.md; owner custodian-agent, governance custodian
File-state cadence	Enabled/active; weekdays 08:23 Europe/Berlin; skip misfires
Current selection	Labels binky, rhythm, automated select brief-daily
Inputs	DecisionQueue.md, OfficeHourQueue.md, AutopilotWorkQueue.md, RiskRegister.md, SuccessMilestones.md, WORK-RECORDS.md, recent briefs, and git log
Model/credential lane	HTTP LLM_CONNECT_URL; BRIEF_DAILY_MODEL falling back to MAIL_TRIAGE_MODEL; provider credential remains behind llm-connect
Output	briefs/YYYY-MM-DD-daily-brief.md; structured JSON rendered to the Binky one-screen format
Repository mutation	Stages only the new brief and creates one local commit; no push in this executor
Completion	Best-effort State Hub binky_daily_brief; binky_rhythm_status uses it as the daily due bit
Failure/retry	Generation/commit failure reopens; an existing daily path succeeds idempotently
Current rollback material	Disable/pause the definition. Binky host rhythm timers remain in the tenant repo as an older executor path; current live timer state must be checked before treating them as rollback

The source definition still says tasks land in issue-core and require an executor, although the current primary claim authority is ops_run. That stale description is a T05 documentation/conformance input.

Binky weekly founder-review preparation

Field	Current contract
Definition authority	activity-core/activity-definitions/binky-weekly-review-prep.md; owner custodian-agent, governance custodian
File-state cadence	Enabled/active; Fridays 16:43 Europe/Berlin; skip misfires
Current selection	Labels binky, weekly-review, automated select brief-weekly
Inputs	SuccessMilestones.md, DecisionQueue.md, RiskRegister.md, WORK-RECORDS.md, current-week daily briefs, prior weekly review, and git history
Deterministic tenant policy	Computes milestone movement and Binky RISK-005 state (clear, watch, escalate, quiet) in runtime code
Model/credential lane	HTTP LLM_CONNECT_URL; BRIEF_WEEKLY_MODEL falling back to BRIEF_DAILY_MODEL
Output	briefs/YYYY-MM-DD-weekly-founder-review.md
Repository mutation	Stages only the review and creates one local commit; no push
Completion	Best-effort State Hub binky_weekly_review; used as the weekly due bit
Failure/retry	Signal derivation, generation, or commit failure reopens; an existing dated path succeeds idempotently
Current rollback material	Disable/pause the definition; tenant-owned host review timer exists but must be verified before use

The milestone/RISK-005 calculation is business logic. It belongs in a tenant-owned blueprint or typed capability, not in the shared rein selector.

Binky weekly mailbox intake

Field	Current contract
Definition authority	activity-core/activity-definitions/binky-weekly-mail-intake.md; owner custodian-agent, governance custodian
File-state cadence	Enabled/active; Mondays 09:37 Europe/Berlin; skip misfires
Current selection	Labels binky, mail-intake, automated select mail-scan+triage
Scan inputs	Hard-coded OpenBao KV path tenants/binky/company-email/imap, AppRole files under EXECUTOR_APPROLE_DIR or ambient Bao token, tenant config integrations/mailbox-binky-company.yml, and mutable sibling source default ~/email-connect/src
Scan output	A new mailmeta/reports/*.csv metadata report from email-connect
Triage inputs	Newest report, eight allowlisted metadata columns capped to 40 rows, and tail of mailmeta/mail-log.md
Model/credential lane	Scan injects IMAP username/password only into the email-connect child environment. Triage calls LLM_CONNECT_URL with optional MAIL_TRIAGE_MODEL; provider credentials stay behind llm-connect
Triage output	Deterministic rows inserted into mailmeta/mail-log.md; suspicious mail is log-only
Repository mutation	Triage stages and commits only mailmeta/mail-log.md; the generated CSV is not included in that commit and can leave the checkout dirty
Completion	Scan success immediately posts binky_mail_intake; triage separately posts binky_mail_triage. The schedule resolver clears its due bit from the scan event even if later triage fails
Failure/retry	Scan or triage failure reopens the ops run; scan can already have written a report and cleared the intake due bit before that failure
Current rollback material	Disable/pause the definition; tenant-owned host mail timer exists, but it is the same two-phase implementation and is not an independent code rollback

Migration must explicitly decide whether the scheduled unit is “mailbox scan” or “scan plus successful triage.” The completion event cannot keep both meanings. The report retention/commit policy and credential revocation or expiry evidence also need named owners.

Direct and issue-core compatibility

The issue-core path maps Binky definition/label substrings through _DEFINITION_HINTS in intake.py. Unknown issues default to agent coach and generic executor_run. The agent-session approach repeats that inference for profile-absent ops runs, converts the row to TaskSpec, and calls the older host-checkout runner. Its assertion that the resolved targets agree is effectively disabled by or True.

Direct task-file examples in binky-control name agent instances and completion events, but those files are attended development/onboarding inputs, not the Activity Core scheduling authority. Their descriptions promise “Never push”; that policy is enforced only by the selected legacy runner/tool profile, not by a repository transaction or remote-ref check.

Cross-cutting gaps to preserve as migration gates

1. No exact selector: all four scheduled definitions route from labels and substrings. The global Activity Core profile requirement cannot be enabled while they remain profile-absent.
2. Tenant code in the shared runtime: prompts, output schemas, file paths, event types, FI publication, Binky risk logic, mailbox paths, and credential lanes require edits to rein-aharness.
3. Queue acceptance is incomplete: T02 now bounds dirty baselines, transaction identity, and lease-loss cancellation, and local granted tasks have T03 acceptance. Activity Core still lacks authoritative grant carriage and terminal-close reconciliation for queued execution.
4. Required evidence is best-effort: Hub delivery failure does not fail or reconcile a run even though the due resolvers depend on those events.
5. Completion meanings diverge: mailbox scan and triage have different events, while the Activity definition describes one intake task.
6. FI publication is now separated: the compatibility executor is local-commit-only; any future publish lane still needs an explicit owner, grant, and evidence contract.
7. Mutable sibling/runtime dependencies: mail scan defaults to a sibling email-connect checkout, and model selection depends on process environment rather than a versioned execution declaration.
8. Rollback documentation is stale: tenant host timers remain in source and some installers enable them, while newer docs call them disabled, interim, or break-glass.

Candidate migration sequence

This sequence is preparatory and does not choose a profile or capability owner before ADR-002 acknowledgement.

1. Carry T02's transaction/lease evidence and T03's repository grant through Activity Core, then activate reconciled close evidence for any compatibility executor that remains callable.
2. For each scheduled definition, obtain an owner-approved declaration of the exact input schema, allowed paths, model route, credential route, completion event, commit policy, publication policy, and rollback.
3. Put agentic work behind a versioned Glas profile. Put deterministic tenant-specific transformations in a tenant-owned blueprint or separately owned typed capability; do not force every deterministic adapter into a rein merely to remove it from this repository.
4. Add the explicit selector to one disabled/canary definition, prove the new and compatibility outputs against controlled inputs, and retain a dated rollback pin.
5. Enable the replacement, verify the due resolver and durable evidence, then remove that definition from substring routing.
6. After all four definitions migrate, enable ACTIVITY_CORE_REQUIRE_HARNESS_PROFILE=true for governed execution, remove AGENT_HARNESS_LEGACY_APPROACHES_UNTIL, delete _DEFINITION_HINTS and tenant approach rules, and reconcile or retire the tenant host timers.