feat(event-bridge): WP-0003a — domain model, rules module, event type registry

Implements phases 7–8 of the Event Bridge architecture (custodian-WP-0003a).

Domain model (T34, T40):
- Added RuleDef, InstructionDef, ActionDef to models.py
- Updated ActivityDefinition with rules/instructions fields (task_templates deprecated)
- Formalized EventEnvelope: id, type, version, timestamp, publisher, attributes
- Added from_nats_message() and from_webhook_payload() classmethods

Rules module (T35, T36, T37):
- src/activity_core/rules/ skeleton with boundary enforcement
- evaluate_condition() — sandboxed AST walker, whitelisted nodes only, never exec()
- execute_instruction() — LLM task generation with trusted_fields injection guard
- tests/rules/test_boundary.py verifies no cross-boundary imports

Infrastructure (T38, T39):
- Alembic migrations 0004 (task_spawn_log) and 0005 (event_types)
- IssueSink ABC + IssueCoreRestSink (REST) + NullSink (testing)
- TaskSpawnLog and EventType ORM models

Event type registry (T41, T42, T43):
- event_type_registry.py: file scanner, parser, DB sync, in-process lookup
- ACTIVITY_CURATOR_GATE env var (disabled|required) + approve endpoint
- Three org event type definitions: org.repo.registered, org.workstream.completed,
  org.activity.run.completed

All 10 tests pass. Boundary test confirms rules/ isolation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

workplans/custodian-WP-0003a-event-bridge-model-rules-registry.md

@@ -3,59 +3,59 @@ id: custodian-WP-0003a
 type: workplan
 domain: custodian
 repo: activity-core
-status: active
+status: done
 state_hub_workstream_id: b4eb45a9-69e3-4ab0-b00c-67a53c3117c5
 split_from: custodian-WP-0003
 split_part: 1 of 3
 tasks:
   - id: T34
     title: Refactor ActivityDefinition model — add rules/instructions fields
-    status: todo
+    status: done
     priority: high
     state_hub_task_id: ca1bf66f-7094-459c-9abf-5f5c6414c91a
   - id: T35
     title: Create src/activity_core/rules/ module skeleton
-    status: todo
+    status: done
     priority: high
     state_hub_task_id: 54c25eae-4fad-42d8-bb15-9c1e7532425e
   - id: T36
     title: Implement RuleEvaluator (sandboxed AST walker)
-    status: todo
+    status: done
     priority: high
     state_hub_task_id: a1ed0d8b-df59-4af1-82a1-d01628919689
   - id: T37
     title: Implement InstructionExecutor
-    status: todo
+    status: done
     priority: high
     state_hub_task_id: cdd349f1-b7ad-4a3a-afa0-ae671a7addb8
   - id: T38
     title: Alembic migration — add task_spawn_log table
-    status: todo
+    status: done
     priority: high
     state_hub_task_id: 4cd9833c-fbc4-4b10-b6f2-85c028c8c557
   - id: T39
     title: Implement IssueSink adapter interface and IssueCoreRestSink
-    status: todo
+    status: done
     priority: high
     state_hub_task_id: 38177fcf-c468-4424-9938-1b01038a386b
   - id: T40
     title: Formalize EventEnvelope model
-    status: todo
+    status: done
     priority: high
     state_hub_task_id: 65d77939-6972-4450-993e-23ccb25d9454
   - id: T41
     title: Event type registry — file scanner, parser, DB model, sync command
-    status: todo
+    status: done
     priority: high
     state_hub_task_id: 7a182265-4013-4272-8540-cfb4e2079eb3
   - id: T42
     title: Curator gate configuration
-    status: todo
+    status: done
     priority: medium
     state_hub_task_id: 229d99ca-2d09-4c96-b3d2-da8b2d14c5b7
   - id: T43
     title: Write first event type definitions
-    status: todo
+    status: done
     priority: medium
     state_hub_task_id: 78b9d642-17b1-46c7-8e5f-c0a948821993
 created: "2026-05-14"