kit module:on activities includes task creation/editing, complete/reopen, discussion and a project task timeline. It requests only Activities read/write and comment-write scopes. An owner/admin must separately enable the service and approve permissions; the current verified binding, compatible service release and dependencies must be ready. Convex is explicitly unsupported. Turning the module off retains service records.

The adapter resolves the current server-prepared RequestBusinessBinding after app membership and permission checks. There is no deployment singleton or organization-wide fallback. The service enforces the complete app/environment partition; this module additionally derives the app project reference from resolved scope and refuses foreign-project task IDs before reads or mutations. Browser input cannot select a binding, actor, participant or arbitrary subject.

Tasks and comments live only in the Activities service. Member participant references are opaque and attributable; scoped export/erasure and retained audit obligations remain mandatory. There is no duplicate app activity table, browser storage, default delete/administrative privacy grant, email transmission or AI processing. Pending scoped privacy/job/callback acceptance is a blocker, not proof that a legacy organization-only callback erased app data.

Mutations use stable per-submission request UUIDs, project/operation namespaces and the revision shown to the reviewer. Task updates preserve fields the form does not edit. Service policy refusals are bounded app states; remote error bodies are never rendered or logged by this module.

Run the packed-template gate and module isolation suite. Fake ports prove UI/contracts and project ownership handling only. J10/J14/J16/J18 require the real signed gateway, database runtime roles, persisted results, callbacks, privacy obligations and browser/API/MCP verification.