---
id: RAILIANCE-WP-0013
type: workplan
title: "activity-core verifier evidence hardening"
domain: railiance
repo: railiance-cluster
status: finished
owner: codex
topic_slug: railiance
created: "2026-06-16"
updated: "2026-06-16"
state_hub_workstream_id: "a3abb83a-2d42-40f9-a5f6-1dbc36903436"
---

# activity-core verifier evidence hardening

## Context

`RAILIANCE-WP-0012` moved activity-core live deploy/verify ownership into
`railiance-cluster` and produced State Hub evidence
`baeeaeac-aa6d-4406-ae64-e54577f21386`, with `ops_inventory_probe` progress
`4c82360d-33e7-455b-8ab4-33facd4a3f8e`.

A follow-up review found hardening work that matters for routine verifier use:
the verifier should prove the State Hub progress event belongs to the specific
manual trigger it launched, evidence should include an immutable runtime
identity, and local `kubectl` mode should require an explicit double opt-in.

This is a hardening follow-up only; it does not reopen activity-core
`ACTIVITY-WP-0007-T06`.

## Correlate State Hub progress to the manual trigger

```task
id: RAILIANCE-WP-0013-T01
status: done
priority: high
state_hub_task_id: "d013a4a9-77fc-4cf0-babf-528d71acc0a1"
```

Update `tools/cmd/railiance-verify-activity-core` so after
`POST /activity-definitions/<id>/trigger` it parses `trigger_key`, derives the
expected activity-core manual `run_id`, and polls State Hub until it finds
`ops_inventory_probe` where:

- `detail.activity_id == DEFINITION_ID`;
- `detail.activity_core_run_id == expected_run_id`.

The verifier must not pass on merely any event created after `STARTED_AT`.
Include the expected run id and matched progress id in the evidence note.

2026-06-16: Implemented exact correlation. The verifier now derives the
expected UUIDv5 `activity_core_run_id` from `<DEFINITION_ID>:<trigger_key>` and
requires State Hub `ops_inventory_probe` detail to match both `activity_id` and
`activity_core_run_id`.

## Record immutable runtime evidence

```task
id: RAILIANCE-WP-0013-T02
status: done
priority: medium
state_hub_task_id: "c5780ec1-9a74-401e-b60e-a0fdf2b7e5d2"
```

Ensure successful evidence includes either `activity_core_revision` or an
immutable Kubernetes image ID/digest. When the remote repo revision is
unavailable, fall back to the live `actcore-api` pod container `imageID`.

2026-06-16: Implemented `api_image_id` capture from the live `actcore-api` pod
container status and added a guard so passed evidence must include either the
remote repo revision or the immutable image ID.

## Guard explicit local kubectl override

```task
id: RAILIANCE-WP-0013-T03
status: done
priority: medium
state_hub_task_id: "0d60809f-3f1d-4ea9-a96f-af074911acc0"
```

Keep `railiance01`/SSH as the default executor. If
`ACTIVITY_CORE_CLUSTER_HOST=local` is selected, require an additional explicit
opt-in such as `ACTIVITY_CORE_ALLOW_LOCAL_KUBECTL=1` and print the current
`kubectl` context before continuing.

2026-06-16: Implemented the double opt-in. `ACTIVITY_CORE_CLUSTER_HOST=local`
now exits before cluster access unless `ACTIVITY_CORE_ALLOW_LOCAL_KUBECTL=1` is
also set, and accepted local mode prints the current `kubectl` context.

## Verify and publish hardening evidence

```task
id: RAILIANCE-WP-0013-T04
status: done
priority: medium
state_hub_task_id: "150e4fa3-800c-4997-baaa-da696f5a0fc0"
```

Run `bash -n tools/cmd/railiance-verify-activity-core`, run
`make verify-activity-core` against Railiance01, confirm the evidence note
matched the manual trigger run id, and post a non-secret State Hub note citing
the new evidence.

2026-06-16: Verified with `bash -n tools/cmd/railiance-verify-activity-core`
and a live Railiance01 `make verify-activity-core` run. The verifier posted
State Hub evidence note `60256e9a-9d1b-44db-8999-738cf03bca2e`, matched manual
run id `90e3b112-d1e3-51af-8fb2-cb61f26add17`, matched
`ops_inventory_probe` progress `db408146-0310-4ac3-ac77-f73c5a41e070`, and
included `api_image_id`
`sha256:5ff92a8217c450ae06075d00862b6e2a92a83ca09eea18b5a5e96b5d2d728b35`.

Done when:

- the verifier rejects unrelated fresh `ops_inventory_probe` events;
- evidence includes a non-null revision or image digest;
- local `kubectl` mode requires explicit double opt-in;
- the Railiance01 verifier run posts a passed evidence note with matched run id;
- `make fix-consistency REPO=railiance-cluster` has synced the workplan.