Require published FI brief evidence before clearing daily due

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbd-43c1-79f3-809e-1ee97b40b64d

workplans/ADHOC-2026-06-01.md

@@ -9,6 +9,7 @@ owner: custodian
 topic_slug: custodian
 created: "2026-06-01"
 updated: "2026-06-03"
+state_hub_workstream_id: "4b5abcd1-e1a2-5840-a852-2d14c867c5f8"
 ---
 
 # ACTIVITY-WP-ADHOC-2026-06-01 — activity-core opportunistic fixes

workplans/ADHOC-2026-09-14.md

@@ -0,0 +1,49 @@
+---
+id: ACTIVITY-WP-ADHOC-2026-09-14
+type: workplan
+title: Require publication evidence for the FI daily due gate
+domain: infotech
+repo: activity-core
+status: finished
+owner: codex
+created: "2026-09-14"
+updated: "2026-09-14"
+state_hub_workstream_id: "5434dcd8-f1a4-5869-a306-dfa7eaff5885"
+---
+
+## Reject unpublished and misdated FI completion events
+
+```task
+id: ACTIVITY-WP-ADHOC-2026-09-14-T01
+status: done
+priority: high
+state_hub_task_id: "78b343f0-4059-5df6-b4e3-2187a97dccef"
+```
+
+Only pushed=true, full origin SHA and canonical date/path can clear due.
+Use detail.date rather than created_at, so late delivery cannot suppress the
+next day. The FI verifier checks actual origin objects. Resolver suite: 47
+passed, including invalid publication and delayed-delivery regression cases.
+
+## Deploy and verify the production resolver
+
+```task
+id: ACTIVITY-WP-ADHOC-2026-09-14-T02
+status: done
+priority: high
+state_hub_task_id: "0d1d729c-ce48-5784-99cc-dea4a5e5b587"
+```
+
+Use image activity-core:fi-publication-20260914, layered over the exact live
+baseline (container image ID sha256:e6e9f0171e36ce0f50a970435ea55f10d428f1743050d1629a94ff4fd19cec37).
+The baseline resolver module was byte-identical to pre-change repo HEAD;
+only the tested module is replaced. No schema or other application changes.
+Keep the remote checkout's unrelated dirty files untouched.
+
+Roll API, worker and event-router; verify rollout, live due=true for the
+September 14 brief, and Temporal next action 05:30 UTC / 07:30 Berlin.
+Future run completion must be proven separately by FI's --require-date audit.
+
+Live verification: API, worker and event-router run the new image and are ready.
+API imports the patched resolver; September 14 remains due until publication.
+The three image smoke cases (unpublished, published, late delivery) passed.