diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 35e932b..90f6c8c 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -285,7 +285,8 @@ | task | ACTIVITY-WP-ADHOC-2026-09-14-T01 | done | — | workplans/ADHOC-2026-09-14.md | | task | ACTIVITY-WP-ADHOC-2026-09-14-T02 | done | — | workplans/ADHOC-2026-09-14.md | | task | ACTIVITY-WP-ADHOC-2026-10-19-T01 | done | — | workplans/ADHOC-2026-10-19.md | -| task | ACTIVITY-WP-ADHOC-2026-10-19-T02 | wait | — | workplans/ADHOC-2026-10-19.md | +| task | ACTIVITY-WP-ADHOC-2026-10-19-T02 | done | — | workplans/ADHOC-2026-10-19.md | +| task | ACTIVITY-WP-ADHOC-2026-10-19-T03 | todo | — | workplans/ADHOC-2026-10-19.md | | task | T01 | done | — | workplans/custodian-WP-0001-temporal-backbone.md | | task | T02 | done | — | workplans/custodian-WP-0001-temporal-backbone.md | | task | T03 | done | — | workplans/custodian-WP-0001-temporal-backbone.md | diff --git a/docs/evidence/2026-10-19-grant-v2-lease-expiry-release.json b/docs/evidence/2026-10-19-grant-v2-lease-expiry-release.json new file mode 100644 index 0000000..bf44b25 --- /dev/null +++ b/docs/evidence/2026-10-19-grant-v2-lease-expiry-release.json @@ -0,0 +1,62 @@ +{ + "observed_at": "2026-10-19T21:34:04Z", + "authorization": { + "approved_by": "founder (Bernd), 2026-10-19, attended release from origin/main", + "candidate_choice": "founder chose the existing 9a46350 image after build-and-push run 427 for head 9ef75e0 failed on a transient PyPI timeout (hatchling); CI not re-run, 9ef75e0 not promoted" + }, + "executed_by": "activity-core release agent (Claude Code): review gate, pin commit, Argo child patch+sync (prune=false), read-only and operator post-checks", + "carries": { + "9737577": "repository grant v2 publish scope (ACTIVITY-WP-0046)", + "42347da": "ops_run lease-expiry ceiling, terminal expired (ACTIVITY-WP-ADHOC-2026-10-19)" + }, + "review_gate": { + "range": "34d1dc5..9ef75e0 (40 commits incl. pushed f718108, 9ef75e0)", + "runtime_yaml_beyond_images": "none at release time; f9f2640 assembly-checkpoint ConfigMap (founder-approved 2026-10-12) was already live (Argo at f9f2640)", + "migrations": "none; ops_runs.state is Text without constraint, expired needs no migration", + "inert": [ + "daily-security-flow and weekly-railiance-allocation-review definitions enabled:false/status:proposed (not synced)", + "k8s/custodian-release command bundle and input policy baked into image as hash-verified files only; worker-patch.yaml and publisher-access-delta.md not referenced by k8s/gitops", + "release runtime/sampler not started; release broker (ACTIVITY-WP-0041-T03) not used", + "custodian_capture.py (9ef75e0) not in the shipped image" + ], + "new_surface": "GET /release/health (read-only)" + }, + "image": { + "tag": "git-9a46350bb3e1192b76aab859218f95312e17fdf4", + "digest": "sha256:08966e8dd976d2e6f50711f33b2ab0abaa650aed998b28d743483999729e7d66", + "ci": "build-and-push for 9a46350 success 2026-10-19T13:33:14Z", + "anonymous_pull": "manifest 200 via anonymous registry token", + "components": ["actcore-api", "actcore-worker"], + "event_router": "unchanged, sha256:cd4e924c2809f0d1d319e53a9ddd20db2e88a1b543d62e6442702c184b7842f4", + "revision_note": "image revision 9a46350 differs from the source revision Argo tracks (8884b12); 9a46350..8884b12 changes only workplans/WORK-RECORDS, 9ef75e0 (custodian_capture.py, not in image) and the two image pins" + }, + "retention": "make refresh-live-images with EXTRA_LIVE_FILES listing 08966e8d (candidate), fdc631d7 and cd4e924c (rollback/live); union 100 images, sha256 da0a1e3e...", + "argo": { + "application": "argocd/activity-core", + "previous_revision": "f9f2640f38511d592bcdac47bef379333075ea46", + "revision": "8884b123c54877bec44fb8355792244a8353a8ff", + "method": "kubectl patch of child spec.source.targetRevision plus sync operation prune=false, ApplyOutOfSyncOnly (as 2026-10-04); root railiance-apps-root not synced", + "sync_result": "Deployment/actcore-api configured, Deployment/actcore-worker configured; nothing else", + "status": "Synced Healthy" + }, + "previous_images": { + "api": "sha256:fdc631d7a154e3ae57098ae8c6e5a399617c3180859971f5d5269ee33e93ff2c", + "worker": "sha256:fdc631d7a154e3ae57098ae8c6e5a399617c3180859971f5d5269ee33e93ff2c", + "event_router": "sha256:cd4e924c2809f0d1d319e53a9ddd20db2e88a1b543d62e6442702c184b7842f4" + }, + "post_checks": { + "rollouts": "api, worker, event-router successfully rolled out; api/worker running imageID == 08966e8d, 0 restarts", + "health": {"status": "ok", "db": true, "temporal": true}, + "expire_leases": {"reopened": 0, "expired": 0}, + "schedules": "frontend-patterns daily/weekly/monthly Temporal schedules unpaused; schedule_matches true for all three (catchup 1 day, BUFFER_ONE, RunActivityWorkflow on orchestrator-tq); daily last fired 2026-10-19T00:00Z", + "report_sinks": "DB definitions carry the source sinks: daily fep_feedback_intake, weekly fep_improvement_review, monthly fep_monthly_review (topic fe2aaa78)", + "release_health": { + "response": {"healthy": false, "definition_count": 3, "schedule_count": 0, "definitions_and_report_sinks_match": false, "schedules_match": false}, + "assessment": "probe defect, not a release regression; not a rollback trigger. definition_matches() requires trigger_config.catchup_window_seconds (DB rows, unchanged since 2026-09-27, lack it; catchup is enforced on the schedules) and hardcodes the fep_feedback_intake sink for all three, while weekly/monthly use their own event types. First live run of this endpoint; the rollback image does not have it.", + "residual": "ACTIVITY-WP-ADHOC-2026-10-19-T03" + }, + "worker_logs_10m": "no errors", + "admin_sync": "not run (no ConfigMap change in this release)" + }, + "rollback": "pin api/worker back to sha256:fdc631d7 (or set the child targetRevision back to f9f2640f38511d592bcdac47bef379333075ea46) and sync with prune=false" +} diff --git a/workplans/ACTIVITY-WP-0046-repository-grant-v2-publish-scope.md b/workplans/ACTIVITY-WP-0046-repository-grant-v2-publish-scope.md index 66ef9f8..3f66de4 100644 --- a/workplans/ACTIVITY-WP-0046-repository-grant-v2-publish-scope.md +++ b/workplans/ACTIVITY-WP-0046-repository-grant-v2-publish-scope.md @@ -75,3 +75,10 @@ state_hub_task_id: "0c3c628b-3456-5817-bcdd-0fa785a184b3" assembly-economics declares a v2 grant on its checkpoint definitions and the production image carrying this change is rolled out before 2026-12-15. Wait: T02, then an image release through the normal GitOps path. + +Image released 2026-10-19: api and worker run +`git-9a46350bb3e1192b76aab859218f95312e17fdf4` +(`sha256:08966e8dd976d2e6f50711f33b2ab0abaa650aed998b28d743483999729e7d66`), +Argo revision 8884b12 (evidence +`docs/evidence/2026-10-19-grant-v2-lease-expiry-release.json`). Still waiting: +assembly-economics must declare a v2 grant on its checkpoint definitions. diff --git a/workplans/ADHOC-2026-10-19.md b/workplans/ADHOC-2026-10-19.md index b1488ba..a3e69a1 100644 --- a/workplans/ADHOC-2026-10-19.md +++ b/workplans/ADHOC-2026-10-19.md @@ -40,12 +40,33 @@ refused as `state_conflict`. The endpoint returns ```task id: ACTIVITY-WP-ADHOC-2026-10-19-T02 -status: wait -blocked_on: human-gate:image-release +status: done priority: medium state_hub_task_id: "d94bfae7-c5ad-585f-96a0-a93a1010c111" ``` -Wait: this ships with the next image release through the normal GitOps path, -the same release that carries repository grant v2 (ACTIVITY-WP-0046-T03). No -rollout from this session. +Deployed 2026-10-19 (founder-approved attended release): api and worker run +`git-9a46350bb3e1192b76aab859218f95312e17fdf4` +(`sha256:08966e8dd976d2e6f50711f33b2ab0abaa650aed998b28d743483999729e7d66`), +Argo child `activity-core` at 8884b12, Synced Healthy. `POST +/ops-runs/expire-leases` returned `{"reopened":0,"expired":0}`. Rollback: +f9f2640 / `sha256:fdc631d7`. Evidence: +`docs/evidence/2026-10-19-grant-v2-lease-expiry-release.json`. + +## Fix the /release/health probe contract + +```task +id: ACTIVITY-WP-ADHOC-2026-10-19-T03 +status: todo +priority: medium +``` + +Residual of T02. The first live `GET /release/health` reported +`healthy:false` although the schedules and report sinks are correct. +`release_health.definition_matches()` requires +`trigger_config.catchup_window_seconds == 86400`, which the live rows (synced +2026-09-27) do not carry, and it expects the `fep_feedback_intake` sink on all +three frontend-patterns definitions, while weekly and monthly use +`fep_improvement_review` and `fep_monthly_review`. Fix the probe to check the +per-cadence sinks, and decide whether to run an admin definition sync or +accept a missing `catchup_window_seconds` when the schedule enforces it.