Extend autonomous participant activity with work windows and deterministic action policy

[Brad-Edwards]

Need

The autonomous benign-participant support delivered for #861 admits a fixed cadence, but a continuously operating enterprise scenario also needs bounded, reproducible activity that does not execute every action mechanically at one interval.

Required capability

• Participant work/calendar windows and pauses expressed against the shared RAES time model.
• Deterministic bounded timing variation and weighted action selection from governed random streams.
• Action dependencies, bounded retries/failures, cooldowns, and limited bursts.
• Causal continuity with participant and service state across occurrences and reset generations.
• Clear separation from pre-run experiment variation (SCE-002: add experiment variation-selection policies and allocation bindings #787): this is admitted participant behavior during one run.
• Compiler/runtime carriage, backend capability admission, occurrence provenance, and negative validation for unsupported policy.

Consumer

Required by autarchy-ai/penumbra-scenarios#556. Keep the capability role-neutral and product-neutral; no KeplerOps or pack-local semantics.

Architecture and governance requirements

Before implementation, reconcile this need against existing requirements, issues, ADRs, architecture, semantic owners, and already-provided capability; extend an incumbent concept rather than creating a parallel surface. Record relevant external and internal precedent and fully update the RAES lineage material. Add or amend ADRs when the design changes architecture or authority. Update normative specification, schemas/contracts, compiler, validator, runtime, backend manifests and admission, conformance guards, documentation, tests, release notes, and migration guidance wherever the chosen design applies. Establish and verify bidirectional requirement, issue, implementation, test, and release traceability. The issue is not complete until the released package exposes and guards the capability end to end.

[Brad-Edwards]

🛠️ Picked up by /implement - driver codex, branch 897-autonomous-activity-policy, 2026-07-26T14:19:30.895Z.

[Brad-Edwards]

Execution obligation ISSUE-897-PREFLIGHT-TIMEOUT — Opened

Category: workflow
Observed state: The first asynchronous architecture-preflight worker was killed at its execution timeout after producing guidance but before returning a successful envelope.
Impact: The Step 4 implementation-plan gate cannot proceed without a successful preflight phase marker.
Current obligation: Complete the canonical architecture preflight successfully and confirm its durable marker before planning or implementation.

Evidence

• gc_codex_architecture_preflight job rjob-ms1vwzb2-1 terminated after the enforced 1200000ms timeout
• docs/decisions/issue-897-autonomous-activity-policy-preflight.md was created before termination, but the preflight completion marker was not confirmed

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #897). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

Execution obligation ISSUE-897-PREFLIGHT-TIMEOUT — Resolved

Category: workflow
Observed state: The original architecture-preflight job timed out before returning a successful envelope.
Impact: The Step 4 implementation-plan gate is now unblocked.
Current obligation: Complete the canonical architecture preflight successfully and confirm its durable marker before planning or implementation.

Evidence

• Retry job rjob-ms1wohd8-2 completed successfully
• The successful envelope reported phase_marker.phase=preflight for issue 897

Disposition: fix
Corrective action: Retried the canonical asynchronous architecture preflight after preserving its completed guidance files.

Verification

• gc_codex_job returned status=done and result.phase_marker.phase=preflight
• The preflight guidance, ADR amendment, and ADR index update are present in the checkout

[Brad-Edwards]

gc workflow phase recorded: plan (issue #897). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

Architecture and scope

Extend the incumbent ParticipantBehaviorSpecification.autonomous_execution surface with an explicit participant-autonomous-execution/v2 variant while preserving v1 byte-for-byte semantics. Reuse ADR-092, shared-time windows and lifecycle, action contracts/failure classes, the stateless governed random-stream engine, typed autonomous scheduler state, behavior history, runtime target admission, and existing stores/conformance paths. No parallel actor, scheduler, clock, calendar, RNG, persistence map, API, or exception hierarchy will be introduced.

Use DSL-437 only as the existing repository-governance context (ACES_REQUIREMENT_UID=DSL-437) because it owns autonomous benign participant execution; issue #897 remains the acceptance contract for this requirement-free workflow. Do not invent a new requirement or edit release-owned CHANGELOG.md/_version.py.

TDD implementation workstreams

1. Authored policy and semantic validation. Add failing tests for discriminated v1/v2 parsing, stable keyed weighted candidates, bounded timing intervals, work/pause window refs, dependency DAG and initial eligibility, retryable portable failure classes, cooldown/burst/occurrence/attempt limits, unknown fields, invalid bounds/weights/cycles, wrong-clock/non-window refs, unsupported stochastic-control shapes, and unchanged v1 behavior. Implement the closed v2 SDL models in implementations/python/packages/raes/participant_execution.py, union carriage in participant_behavior_specification.py, and canonical semantic issues/renderers in raes/semantics/participant_behavior.py and raes/validator/_participant_execution_renderers.py.

2. Canonical compilation and policy identity. Add failing compiler tests for canonical candidate/action/window addresses, profile/strategy/control identity, and deterministic output independent of mapping order. Extend _compile_autonomous_execution and ParticipantAutonomousExecutionRuntime without weakening v1 _policy_digest; use canonical contract digesting for the complete resolved v2 policy. Preserve action/observation/target refresh dependencies through existing address helpers.

3. Governed participant-runtime draws. Add a closed participant occurrence address model and immutable random-stream profile/version that reuses unbiased bounded-integer draws for timing and exact integer-weight mapping. Add failing determinism, collision, reorder, reset-generation, unsupported-profile, exhaustion, and no-resampling tests. Update the controlled draw-purpose vocabulary, random-stream profile artifact/vector fixtures, closed dispatcher, and schema bundle; never expose seeds, entropy, derived keys, raw blocks, candidate domains, or selections through argv/env/logs.

4. Run handoff, scheduler, state, and provenance. Add a typed runtime binding for one admitted agent-policy stochastic control and make unresolved/duplicate/wrong-role/governed-entropy-without-resolver cases fail closed. Drive failing runtime tests for half-open work/pause eligibility, bounded next-opening search, timing variation, dependency filtering before selection, exact weighted choice, cooldowns, finite serialized bursts, distinct occurrence/attempt identities, retry only for declared terminal failure classes, no retry of success/protocol-invalid work, committed service-state continuity after terminal failure, pause/resume, reset generation, reapplication drift, and missed-due transitions. Extend ParticipantScheduler, participant_scheduler_operations, runtime-manager execution handoff, ParticipantAutonomousExecutionStateModel, canonical snapshot invariants, and nested behavior-history/API-408 provenance rather than adding metadata bags.

5. Backend admission and conformance. Add failing manifest/planner tests for exact v2 profile, activity features, selection/timing/random profile support, constraint kinds, actions/observations/targets, and finite participant/occurrence/attempt/retry/burst/in-flight limits. Extend ParticipantRuntimeCapabilities, manifest conversion/schema/fixtures, participant_autonomous_execution_capability_gaps, registry probes where needed, durable store/API conversions, and snapshot conformance so unsupported or contradictory policy/state fails before provisioning or persistence.

6. Authority, publication, documentation, and lineage. Complete the preflight-started ADR-092 amendment and ADR index pin; update the normative autonomous-execution spec, SDL/reference docs, backend conformance docs, and migration guidance showing v1 unchanged and explicit v2 authoring. Update hand-governed published schemas plus schema_bundle() parity and record every changed schema’s summary/content hash in contracts/schema-publication-manifest.json. Extend the existing revision-pinned lineage ledger/research audit rather than creating a second bibliography. Release exposure is carried by a valid consumer-visible feat(runtime): ... PR title for release-please.

Cross-cutting design checks

• Security: preserve parser resource limits, safe YAML/duplicate checks, closed Pydantic shapes, semantic validation, exact control/profile/namespace resolution, strict API-408 authentication/read-target/audit controls, native binding and terminal-result validation, typed persistence checks, bounded safe diagnostics, and redacted HTTP failures. Public seeds stay in the admitted apparatus binding; governed entropy fails closed because this issue does not authorize a resolver.
• Maintainability: extend canonical SDL/compiler/scheduler/capability/store/history/schema helpers named in the preflight; no duplicate DTOs, validators, loaders, stores, diagnostics, workflows, or logging paths.
• Extensibility: the seam is the closed v2 profile/strategy ids plus stable keyed candidates and versioned participant draw address. Future selection mappings add exact profile/capability terms; recurring civil calendars extend shared-time authority rather than this scheduler.
• Whole-repo: cover authored SDL, compiler IR, planner/backend manifests, runtime registry/execution/time control, snapshot/store/API/conformance, controlled vocabulary/random vectors, published schemas/manifest, ADR/spec/migration/lineage, and the canonical nox/policy graph.

Verification

Run red-green focused tests per workstream, then targeted DSL-437/#897 runtime, random-stream, manifest, schema, durability, API, and conformance suites. At completion run, with ACES_REQUIREMENT_UID=DSL-437, implementations/python/.venv/bin/python tools/check_repo_policy.py, implementations/python/.venv/bin/python tools/check_requirement_governance.py, and implementations/python/.venv/bin/python tools/verify_all.py; the mechanical completion gate will additionally run the configured nox verify, make policy, quality gates, pre-push reviews, CI, and SonarCloud. Every issue acceptance clause will be mapped to concrete code/test/spec lines before publication.

[Brad-Edwards]

gc_codex_review — cycle 1 of 1 (pre-push) on issue #897 (branch 897-DSL-437-autonomous-activity-policy)
Diff mode: manifest — the complete diff exceeded one prompt and was reviewed as 2/2 inline slice(s) (file-slices) covering 59/59 file(s)

Core review

Verdict: ship-with-fixes

Slice 1/2: The v2 activity policy is shaped correctly: it is an explicit versioned extension of the incumbent autonomous-execution root, preserves the v1 contract, and routes capability admission, random addressing, compilation, continuation, and history through typed existing surfaces. The remaining seams are in scheduler continuation identity and reference normalization; those must be closed before this otherwise well-factored cross-cutting change is production-ready.

Slice 2/2: This slice gives the v2 activity policy a coherent contract surface: the formal semantics preserve the existing shared-time and native-action boundaries, while the tests exercise compilation, capability admission, deterministic addressed randomness, execution, retries, availability windows, dependency/cooldown bursts, reset segmentation, and fail-closed control resolution. The design seam remains the admitted stochastic-control and shared-time scheduler boundary, so it leaves room for additional profiles or policy features without coupling activity execution to wall time or backend internals.

Blocking findings (3):

1. [one-off] Breaks stable policy identity for persisted autonomous state — implementations/python/packages/raes_runtime/participant_scheduler.py:68
   The added fields are included unconditionally in _policy_digest, changing the digest bytes of every v1 policy by hashing newly introduced defaults and empty v2 members. That contradicts the stated requirement that persisted v1 digests remain stable. Conversely, the state-reuse identity includes profile/control identifiers but not policy_digest, so a v2 policy can change its timing, windows, candidates, or recovery rules and resume an incompatible continuation. Preserve the exact legacy v1 digest encoding, give v2 a resolved canonical policy digest, and require a digest match before reusing persisted state.
2. [one-off] V2 attempt IDs repeat after a shared-clock reset — implementations/python/packages/raes_runtime/participant_scheduler_operations.py:94
   The v2 action_instance_id contains policy, participant, occurrence ordinal, and retry, but not the clock segment or episode/generation. Reset resets occurrence and retry to zero, so later attempts reuse prior IDs. annotate_activity_history then updates every history event with that ID, allowing a later attempt to rewrite provenance on earlier append-only events. Include the time segment plus stable episode/generation in the attempt identity, and derive predecessor IDs from that same identity.
3. [one-off] Compiles activity window aliases into unusable addresses — implementations/python/packages/raes_processor/compiler/participant_autonomous_execution.py:114
temporal_constraint_addresses resolves each reference through _section_ref_name, but work_window_addresses and pause_window_addresses use the raw authoring reference. The activity resolver indexes compiled constraints by these addresses, so an alias can pass semantic reference resolution yet fail at scheduling with a missing constraint address. Resolve window references through the same canonical section-name helper before constructing their runtime addresses.

Security review

Verdict: ship

Slice 1/2: This change introduces the richer autonomous activity behavior as an explicit v2 policy while preserving v1 semantics, carries the new bounded-randomness and capability concepts through schema, compilation, runtime state, and safe provenance, and keeps raw entropy out of authored input and projections. The design seam is the versioned policy/profile and closed participant stream address; it leaves room for future profiles without weakening existing validation or admission boundaries.

Slice 2/2: This slice extends the v2 activity-policy contract through conformance tests and formal semantics: addressed randomness, bounded retries and bursts, shared-time availability, capability admission, reset scoping, and provenance are exercised at the intended seam. The design keeps stochastic control separate from runtime action execution and explicitly preserves fail-closed handling for unresolved governed entropy; it leaves room for additional candidate types and availability policies without weakening the stated boundaries.

No blocking findings.

[Brad-Edwards]

gc_codex_review pre-push cycle 1 of 1 complete for issue #897 on branch '897-DSL-437-autonomous-activity-policy'. Posted by the MCP server to enforce the pre-push hard-cap-1 contract (issues #796, #804, #906). Do not edit or delete — used by the next gc_codex_review (uncommitted) invocation to count cycles.

[Brad-Edwards]

Review decision record — codex cycle 1 (issue #897)

Reviewer: codex
Cycle: 1

Architectural read:

Core reviewer: Slice 1/2: The v2 activity policy is shaped correctly: it is an explicit versioned extension of the incumbent autonomous-execution root, preserves the v1 contract, and routes capability admission, random addressing, compilation, continuation, and history through typed existing surfaces. The remaining seams are in scheduler continuation identity and reference normalization; those must be closed before this otherwise well-factored cross-cutting change is production-ready.

Slice 2/2: This slice gives the v2 activity policy a coherent contract surface: the formal semantics preserve the existing shared-time and native-action boundaries, while the tests exercise compilation, capability admission, deterministic addressed randomness, execution, retries, availability windows, dependency/cooldown bursts, reset segmentation, and fail-closed control resolution. The design seam remains the admitted stochastic-control and shared-time scheduler boundary, so it leaves room for additional profiles or policy features without coupling activity execution to wall time or backend internals.

Security reviewer: Slice 1/2: This change introduces the richer autonomous activity behavior as an explicit v2 policy while preserving v1 semantics, carries the new bounded-randomness and capability concepts through schema, compilation, runtime state, and safe provenance, and keeps raw entropy out of authored input and projections. The design seam is the versioned policy/profile and closed participant stream address; it leaves room for future profiles without weakening existing validation or admission boundaries.

Slice 2/2: This slice extends the v2 activity-policy contract through conformance tests and formal semantics: addressed randomness, bounded retries and bursts, shared-time availability, capability admission, reset scoping, and provenance are exercised at the intended seam. The design keeps stochastic control separate from runtime action execution and explicitly preserves fail-closed handling for unresolved governed entropy; it leaves room for additional candidate types and availability policies without weakening the stated boundaries.

Blocking findings: 3

Finding 1 — one-off

• ID: F1
• Title: [core] Breaks stable policy identity for persisted autonomous state
• Location: implementations/python/packages/raes_runtime/participant_scheduler.py:68
• Decision: fix
• Rationale: The added fields are included unconditionally in _policy_digest, changing the digest bytes of every v1 policy by hashing newly introduced defaults and empty v2 members. That contradicts the stated requirement that persisted v1 digests re…

Finding 2 — one-off

• ID: F2
• Title: [core] V2 attempt IDs repeat after a shared-clock reset
• Location: implementations/python/packages/raes_runtime/participant_scheduler_operations.py:94
• Decision: fix
• Rationale: The v2 action_instance_id contains policy, participant, occurrence ordinal, and retry, but not the clock segment or episode/generation. Reset resets occurrence and retry to zero, so later attempts reuse prior IDs. `annotate_activity_hist…

Finding 3 — one-off

• ID: F3
• Title: [core] Compiles activity window aliases into unusable addresses
• Location: implementations/python/packages/raes_processor/compiler/participant_autonomous_execution.py:114
• Decision: fix
• Rationale: temporal_constraint_addresses resolves each reference through _section_ref_name, but work_window_addresses and pause_window_addresses use the raw authoring reference. The activity resolver indexes compiled constraints by these addr…

[Brad-Edwards]

gc_test_quality_review cycle 1 of 1 — issue #897

Reviewer: test-quality (claude-sonnet-5 via gc_test_quality_review)
Branch: 897-DSL-437-autonomous-activity-policy
Cycle: 1 / 1
Findings: 2

Finding 1 — [critical] implementations/python/packages/raes_runtime/participant_activity.py::select_activity_candidate / next_activity_timing

Problem: Every v2 activity scenario across test_dsl_437_benign_participant_execution.py builds a policy with exactly one work_window_refs entry and, except for one strictly-ordered dependency pair (portal_login -> follow_up, which serializes eligibility to one candidate at a time), exactly one simultaneously-eligible weighted candidate. empty_eligible_disposition is hardcoded to 'complete' in every payload and outside_window_disposition is hardcoded to 'next_opening' in every payload.
Why it matters: select_activity_candidate's cumulative-weight loop (the entire point of 'weighted' selection_strategy) is never called with more than one eligible index, so it could be replaced with return eligible_indices[0] and every test would still pass. Likewise next_activity_timing's for start, end in work: forward-search loop never has to cross from an exhausted window into a second one, and the 'wait' / 'skip' disposition branches in _run_participant_activity_due / next_activity_timing are never invoked by any test.
Fix: Add v2 activity scenarios that: (1) declare >=2 candidates with no dependency/cooldown ordering between them so both are simultaneously eligible, and assert the cumulative-weight boundary picks the correct candidate (e.g. by asserting occurrence-history candidate_ids over enough draws, or by directly unit-testing select_activity_candidate with a stubbed draw value at each weight boundary); (2) declare two disjoint work windows separated by a gap so next_activity_timing must hop from the first into the second; (3) set empty_eligible_disposition='wait' with all candidates cooling down and assert the participant stays 'running' with next_tick advanced rather than transitioning to 'completed'; (4) set outside_window_disposition='skip' and assert the occurrence is skipped immediately rather than forward-searched.

Finding 2 — [warning] implementations/python/tests/test_random_stream_determinism.py:185

Problem: ParticipantStreamAddressModel's new _validate_address validator (policy_address must start with 'participant.autonomous-execution.', participant_address must start with 'participant.behavior.', and draw_purpose must be a governed controlled-vocabulary term) is constructed exactly once in the entire test tree, and that construction always uses valid values.
Why it matters: If any of the three checks in _validate_address were dropped or inverted, no existing test would notice, since none ever supplies a policy_address/participant_address with the wrong prefix or an ungoverned draw_purpose.
Fix: Add a small negative-path test (in test_random_stream_determinism.py, or alongside TestUnsupportedAndMalformedInputsFailClosed in test_random_stream_vectors.py) that constructs ParticipantStreamAddressModel with a non-prefixed policy_address, a non-prefixed participant_address, and an ungoverned draw_purpose in turn, asserting ValidationError for each.

[Brad-Edwards]

gc_test_quality_review cycle 1 of 1 complete for issue #897 on branch '897-DSL-437-autonomous-activity-policy'. Posted by the MCP server to enforce the gc_test_quality_review hard-cap-1 contract (issue #884 follow-up, default lowered in #906). Do not edit or delete — used by the next gc_test_quality_review invocation to count cycles.

[Brad-Edwards]

Review decision record — test-quality cycle 1 (issue #897)

Reviewer: test-quality
Cycle: 1

Architectural read:

This PR layers a governed "v2" weighted/randomized activity policy on top of the existing v1 fixed-cadence autonomous-participant scheduler, threading a new stochastic-control resolution (participant_activity.py / participant_activity_support.py, both new) through ParticipantScheduler, RuntimeManager, and the execution-control mixin, and extends the BLAKE3 random-stream engine/profile corpus with a dedicated blake3-xof-participant-v1 profile and ParticipantStreamAddressModel. The seam is right: v2 selection/timing/provenance logic lives in its own module rather than bloating the scheduler, the new branch reuses the existing action-protocol-violation/rollback machinery instead of duplicating it, and the random-stream engine stays pure/stateless per its established pattern. The test suite matches this seam with unusually deep state-machine assertions — exact retry/burst/cooldown counters, protocol-violation rollback exercised across six deliberately malformed participant-runtime shapes, half-open window boundary ticks, and capability-gap flips that toggle one manifest field at a time and assert the resulting diagnostic. That is real regression-catching coverage, not existence-checking. The one structural gap: every v2 activity scenario in the suite is built from a policy with exactly one work window and, except for one dependency-chained pair, exactly one weighted candidate eligible at any draw — so the code paths that differentiate this from a trivial single-candidate/single-window scheduler (the weighted cumulative-selection loop, the multi-window forward search, and the wait/skip disposition branches) are structurally unreachable by any test in the file.

Blocking findings: 2

Finding 1 — class (4 instances)

• ID: F1
• Title: (no title)
• Decision: fix
• Rationale: Addressed by next cycle
• Instances:
  • participant_activity.py::select_activity_candidate — cumulative weighted loop, never called with >1 eligible index anywhere in test_dsl_437_benign_participant_execution.py
  • participant_activity.py::next_activity_timing — for start, end in work: forward-search loop, never exercised with >1 entry in work_window_refs
  • test_dsl_437_benign_participant_execution.py — empty_eligible_disposition is hardcoded to 'complete' in every payload (lines 172, and every _activity_policy_yaml()-derived payload); the 'wait' branch of _run_participant_activity_due is never reached
  • test_dsl_437_benign_participant_execution.py — outside_window_disposition is hardcoded to 'next_opening' in every payload (line 171); the immediate-skip branch of next_activity_timing is never reached

Finding 2 — one-off

• ID: F2
• Title: (no title)
• Decision: fix
• Rationale: Addressed by next cycle

[Brad-Edwards]

Pre-PR base synchronization

• Source: refs/remotes/origin/dev at 1e9988d928c7d598e19cdcaf0825b93660e8f883
• Outcome: merged_clean
• Published feature head: 4a86badfa60712c4693c50c69ac20b7c364d252d
• Verified tree: 416a24b120f54633e1f8d3511b4c70ad79c5ab49