chore(consistency): sync task status from DB [auto]

Updated by fix-consistency on 2026-03-27:
  - update .custodian-brief.md for the-custodian

.custodian-brief.md

@@ -2,13 +2,13 @@
 # Custodian Brief — the-custodian
 
 **Domain:** railiance  
-**Last synced:** 2026-03-26 23:53 UTC  
+**Last synced:** 2026-03-27 00:45 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
 ### Cross-Repo E2E Sandbox Framework
-Progress: 5/5 done  |  workstream_id: `b68de20b-e397-4f97-b1be-ad30711fc2a6`
+Progress: 7/7 done  |  workstream_id: `b68de20b-e397-4f97-b1be-ad30711fc2a6`
 
 ### FOS Hub Bootstrap — Identity, Hub Extraction, Ops Hub, Fin Hub
 Progress: 0/26 done  |  workstream_id: `293a74fe-a85a-4ad6-8933-23d52a72fe8b`

Makefile

@@ -1,4 +1,69 @@
 # the-custodian top-level Makefile
+#
+# Custodian agent SSH identity
+# ----------------------------
+# make custodian-keygen        — generate ~/.ssh/id_custodian_agent (one-time)
+#                                and write the public key into railiance-infra
+#                                ansible/inventory/group_vars/all.yaml
+# make custodian-key-show      — print the current public key (for manual ops)
+#
+# After keygen, run in railiance-infra:
+#   make provision-custodian-agent   (deploys the key to all managed hosts)
+#
+# The private key is NEVER committed. The public key is committed via railiance-infra.
+
+CUSTODIAN_KEY     := $(HOME)/.ssh/id_custodian_agent
+RAILIANCE_INFRA   := $(HOME)/railiance-infra
+AGENT_VARS_FILE   := $(RAILIANCE_INFRA)/ansible/inventory/group_vars/all.yaml
+
+.PHONY: custodian-keygen
+custodian-keygen: ## Generate custodian agent SSH keypair (one-time setup)
+	@if [ -f "$(CUSTODIAN_KEY)" ]; then \
+	  echo "Key already exists at $(CUSTODIAN_KEY). Remove it first to regenerate."; \
+	  exit 1; \
+	fi
+	ssh-keygen -t ed25519 -f "$(CUSTODIAN_KEY)" -C "custodian-agent" -N ""
+	@echo ""
+	@echo "Public key:"
+	@cat "$(CUSTODIAN_KEY).pub"
+	@echo ""
+	@PUBKEY=$$(cat "$(CUSTODIAN_KEY).pub") && \
+	  python3 -c "\
+import sys, re; \
+content = open('$(AGENT_VARS_FILE)').read(); \
+updated = re.sub(r'custodian_agent_pubkey:.*', 'custodian_agent_pubkey: \"' + sys.argv[1] + '\"', content); \
+open('$(AGENT_VARS_FILE)', 'w').write(updated); \
+print('Public key written to $(AGENT_VARS_FILE)')" "$$PUBKEY"
+	@echo ""
+	@echo "Next steps:"
+	@echo "  1. cd $(RAILIANCE_INFRA) && git add ansible/inventory/group_vars/all.yaml && git commit -m 'feat: add custodian agent public key'"
+	@echo "  2. cd $(RAILIANCE_INFRA) && make provision-custodian-agent"
+
+.PHONY: custodian-key-show
+custodian-key-show: ## Print the custodian agent public key
+	@test -f "$(CUSTODIAN_KEY).pub" || (echo "No key found at $(CUSTODIAN_KEY). Run: make custodian-keygen"; exit 1)
+	@cat "$(CUSTODIAN_KEY).pub"
+
+## Deploy the custodian agent key directly via SSH (no Ansible required).
+## Use when ansible is unavailable. Requires an existing admin key with SSH access.
+## Usage: make custodian-key-deploy ADMIN_KEY=~/.ssh/id_ops
+##        make custodian-key-deploy ADMIN_KEY=~/.ssh/id_ops HOST=192.168.1.50 SSHUSER=admin
+
+.PHONY: custodian-key-deploy
+custodian-key-deploy:
+	@test -n "$(ADMIN_KEY)" || (echo "ERROR: ADMIN_KEY is required. Usage: make custodian-key-deploy ADMIN_KEY=~/.ssh/id_ops"; exit 1)
+	@test -f "$(CUSTODIAN_KEY).pub" || (echo "ERROR: No custodian key found. Run: make custodian-keygen"; exit 1)
+	$(eval PUBKEY := $(shell cat $(CUSTODIAN_KEY).pub))
+	@echo "Deploying custodian agent key to $(RAILIANCE_USER)@$(RAILIANCE_HOST)..."
+	@ssh -i "$(ADMIN_KEY)" -o StrictHostKeyChecking=no \
+	  $(RAILIANCE_USER)@$(RAILIANCE_HOST) \
+	  "mkdir -p ~/.ssh && chmod 700 ~/.ssh && \
+	   echo '$(PUBKEY)' | grep -qF - ~/.ssh/authorized_keys 2>/dev/null || \
+	   echo '$(PUBKEY)' >> ~/.ssh/authorized_keys && \
+	   chmod 600 ~/.ssh/authorized_keys && \
+	   echo 'Key deployed. Verifying...' && \
+	   grep -c 'custodian-agent' ~/.ssh/authorized_keys | xargs -I{} echo '{} custodian-agent key(s) in authorized_keys'"
+	@echo "Done. Test with: make e2e-cron-list"
 
 ## Run e2e tests for a repo in a remote sandbox
 ## Usage: make e2e REPO=activity-core
@@ -28,6 +93,8 @@ endif
 
 ifdef KEY
   E2E_KEY_FLAG := --key $(KEY)
+else ifneq ($(wildcard $(CUSTODIAN_KEY)),)
+  E2E_KEY_FLAG := --key $(CUSTODIAN_KEY)
 else
   E2E_KEY_FLAG :=
 endif
@@ -44,6 +111,44 @@ else
   E2E_WS_FLAG :=
 endif
 
+## Install e2e cron job on railiance01 for a repo.
+## Usage: make e2e-cron-install REPO=activity-core
+## Requires: RAILIANCE01_HOST / RAILIANCE01_USER set, or pass HOST= SSHUSER=
+## The cron runs e2e/run-on-host.sh weekly (Sunday 03:13) on railiance01.
+## Idempotent: safe to re-run (replaces existing entry for the same repo).
+
+RAILIANCE_HOST  := $(or $(HOST),$(RAILIANCE01_HOST),92.205.62.239)
+RAILIANCE_USER  := $(or $(SSHUSER),$(RAILIANCE01_USER),tegwick)
+# Default SSH key: custodian agent identity (generated via make custodian-keygen)
+# Override with KEY=~/.ssh/other_key if needed
+RAILIANCE_KEY   := $(or $(KEY),$(CUSTODIAN_KEY))
+RAILIANCE_SSH   := ssh -i "$(RAILIANCE_KEY)" -o StrictHostKeyChecking=no $(RAILIANCE_USER)@$(RAILIANCE_HOST)
+
+.PHONY: e2e-cron-install
+e2e-cron-install:
+	@test -n "$(REPO)" || (echo "ERROR: REPO is required."; exit 1)
+	$(eval REMOTE_REPO := /home/$(RAILIANCE_USER)/$(REPO))
+	$(eval CRON_CMD := $(REMOTE_REPO)/e2e/run-on-host.sh >> /var/log/$(REPO)-e2e.log 2>&1)
+	$(eval CRON_LINE := 13 3 * * 0 $(CRON_CMD))
+	@echo "Installing cron on $(RAILIANCE_USER)@$(RAILIANCE_HOST) for $(REPO)..."
+	@$(RAILIANCE_SSH) "chmod +x $(REMOTE_REPO)/e2e/run-on-host.sh && \
+		( crontab -l 2>/dev/null | grep -v '$(REPO)-e2e' ; echo '$(CRON_LINE)' ) | crontab - && \
+		echo 'Cron installed:' && crontab -l | grep '$(REPO)-e2e'"
+
+## Remove e2e cron job from railiance01 for a repo.
+## Usage: make e2e-cron-remove REPO=activity-core
+
+.PHONY: e2e-cron-remove
+e2e-cron-remove:
+	@test -n "$(REPO)" || (echo "ERROR: REPO is required."; exit 1)
+	@$(RAILIANCE_SSH) "( crontab -l 2>/dev/null | grep -v '$(REPO)-e2e' ) | crontab - && echo 'Cron entry removed'"
+
+## List e2e cron jobs on railiance01.
+
+.PHONY: e2e-cron-list
+e2e-cron-list:
+	@$(RAILIANCE_SSH) "crontab -l 2>/dev/null | grep 'e2e' || echo '(no e2e cron entries)'"
+
 .PHONY: e2e
 e2e:
 	@test -n "$(REPO)" || (echo "ERROR: REPO is required. Usage: make e2e REPO=activity-core"; exit 1)

workplans/CUST-WP-0028-e2e-sandbox-framework.md

@@ -160,10 +160,52 @@ Write `e2e-framework/RUNBOOK.md`:
 
 Note: manual validation on railiance01 still needed (first live run).
 
+---
+
+### T06 — automated cron on railiance01 (no manual trigger)
+
+```task
+id: CUST-WP-0028-T06
+status: done
+priority: high
+state_hub_task_id: "038d8085-d2a7-446d-9aff-211afdd5c163"
+```
+
+The framework is a runner — it still needs a trigger. This task wires up the
+automated scheduler so tests run without any manual invocation.
+
+**Deliverables:**
+
+1. `activity-core/e2e/run-on-host.sh` — standalone script that runs natively
+   on railiance01 (no SSH from workstation):
+   - `git pull --ff-only`
+   - `docker compose up -d`
+   - polls Temporal UI health (up to 180s)
+   - `uv run python e2e/tests/test_full_flow.py`
+   - `docker compose down -v`
+   - POSTs result to state-hub via ops-bridge tunnel (`http://127.0.0.1:18000`)
+
+2. `the-custodian/Makefile` — three new targets:
+   - `make e2e-cron-install REPO=activity-core` — SSHes to railiance01, installs
+     weekly cron (`13 3 * * 0`). Idempotent.
+   - `make e2e-cron-remove REPO=activity-core` — removes the entry
+   - `make e2e-cron-list` — shows installed e2e cron entries
+
+3. Run `make e2e-cron-install REPO=activity-core` to install on railiance01.
+   Verify: `make e2e-cron-list` shows the entry.
+
+**Why run-on-host.sh instead of the sandbox wrapper:**
+The sandbox wrapper SSHes from the workstation into railiance01. For automated
+runs the workstation may be off. `run-on-host.sh` runs directly on railiance01,
+so the only dependency is a working ops-bridge tunnel for state-hub reporting
+(which is separately monitored).
+
 ## Done Criteria
 
-- [ ] `make e2e REPO=activity-core` runs the full stack on railiance01, reports pass/fail
-- [ ] Sandbox is always cleaned up (compose down + dir removed) unless `--keep`
+- [ ] `make e2e REPO=activity-core` runs the full stack on railiance01 on demand
+- [ ] `make e2e-cron-install REPO=activity-core` installs weekly automated run
+- [ ] `make e2e-cron-list` confirms the cron entry on railiance01
+- [ ] Sandbox is always cleaned up (compose down) even on failure
 - [ ] Results posted to state-hub as progress event
 - [ ] activity-core T21 closed by the automated test script
-- [ ] Any repo can opt in by adding `e2e/e2e.yml`
+- [ ] Any repo can opt in by adding `e2e/e2e.yml` + `e2e/run-on-host.sh`