frontend-patterns/docs/ActivityCoreLoop.md

# Activity-core receipt loop

FEP-WP-0008 owns this integration. The initial delivery is deterministic collection
and reporting. Automatic investigation and publication are a separate, outstanding
execution dependency; a weekly report is not evidence of an improvement cycle.

| Definition | Europe/Berlin schedule | Output event |
|---|---|---|
| frontend-patterns-daily | Daily 02:00 | fep_feedback_intake |
| frontend-patterns-weekly | Tuesday 03:00 | fep_improvement_review |
| frontend-patterns-monthly | First day 09:00 | fep_monthly_review |

Definitions live in `activity-definitions/`. Activity-core projects the identical
Markdown into its external-definition ConfigMap. Its `frontend-patterns` context
resolver reads this repository's `feedback/sources.json` at a resolved commit,
then reads enrolled consumer indexes and receipts at resolved commits. See
[the enrollment contract](../feedback/README.md). Initially the roster is empty;
reports must say `no_consumers`, never imply measured usefulness or coverage.

The collector validates identities, hashes, chronology, decisions and evidence
presence, reduces immutable event chains to one observation per use, and
quarantines ambiguous chains. Synthetic outcomes have separate counts. Outcomes
remain producer assertions until investigation verifies their evidence. Missing or
malformed sources produce a degraded report. Monthly reports cover the previous
calendar month in Europe/Berlin, using observations available before its end.
They are receipt summaries, not yet the complete cost/decision review packet.

Collection allows ten repositories, 100 events per run, 128 KiB per source file
and a 45-second fetch deadline (an in-flight read may finish up to five seconds
later). Over-limit sources are reported as errors; durable pagination is still
required before expanding enrollment. Only the fixed Forgejo host and validated
relative paths are read. No secret retrieval, shell execution, LLM calls or
repository mutation is performed. Required context prevents an absent resolver
from silently producing a successful empty report.

## Activation and proof

Current state: deployed and all three schedules enabled on 2026-09-27 under the
founder's explicit scoped exception, State Hub decision
`e5dd02cb-b5b2-45c8-a600-748ea2ffd31b` (`ADMINISTER @ realm:kubernetes/railiance01`,
`activation=APPROVED`). This is not a standing waiver of the estate deployment gate.

[Setup evidence](evidence/2026-09-27-activity-core-setup.json) records the tests,
image and preflight. [Activation evidence](evidence/2026-09-27-activity-core-activation.json)
records the successful worker rollout, three completed manual workflows and their
State Hub reports, active Temporal schedules without drift, and a completed
one-shot scheduled smoke at 11:28:45 UTC. That smoke was started by Temporal;
it is distinct from the first natural recurring runs, which are still ahead.

The next regular runs are September 28 at 02:00, September 29 at 03:00, and
October 1 at 09:00, respectively, in Europe/Berlin. All verified reports correctly
say `no_consumers`, zero model calls and automatic edits disabled. Reports are
stored in State Hub under the frontend-patterns topic and the event types above.

The reporting binaries are now deployed through Git and ArgoCD using immutable
registry digests. The user authorized this adoption separately on September 27
(decision `78a4b859-dd00-4623-b95b-121b0e1c915d`). Nine runtime resources are
managed; secrets and infrastructure remain with their existing owners. The first
adoption changed tracking metadata only. The subsequent digest rollout preserved
the same binaries; all three deployments are ready and ArgoCD is Synced/Healthy.
A post-release Temporal scheduled smoke completed successfully at 13:39 UTC.

[Release evidence](evidence/2026-09-27-activity-core-gitops.json) records revisions,
digests, CI, health and registry retention protection. The conservative 24-hour
healthy observation window begins at 13:38:21 UTC; earliest eligibility is
September 28 at 15:38:21 Berlin, conditional on healthy evidence. Automatic sync
and pruning remain disabled.

[ACTIVITY-WP-0041](../../activity-core/workplans/ACTIVITY-WP-0041-gitops-adoption.md)
retains authenticated review/health receipts, narrowly bound unattended release
identity and failed-health automatic rollback proof. RPF-WP-0048 owns platform
observation and digest-aware retention; current baseline tag aliases are already
protected. A tested image-only validator exists, but is not an authority grant.
These remaining gates prevent routine releases from needing fresh exceptions.
Policy/access/budget changes remain monthly decisions.

The owner handoff is [ACTIVITY-WP-0040](../../activity-core/workplans/ACTIVITY-WP-0040-frontend-patterns-feedback.md).

## Unattended improvement remains open

GLAS-WP-0012 and HFACT-WP-0001 own the missing admitted executor proof. The
available development profile is operationally unverified and does not enforce
the loop's llm-connect budget (six calls / 40,000 aggregate tokens / 30 minutes).
Do not emit unexecutable work or fall back to an unrestricted legacy worker.
WP-0008-T03 retains the end-to-end execution, independent review, publication and
rollback proofs. WP-0008-T01/T02 retain first real consumer integration, frozen
release validation, producer closeout hooks and delayed-outcome refresh. These
are live tasks, not implied completions of this reporting foundation.


## Retention safeguard follow-up

The digest-retention fix is now deployed through GitOps and verified in the worker.
Packages referenced by digest in the additive live/rollback inventory are protected
in full; unrelated package cleanup retains its normal policy. Twenty platform
retention/inventory tests and seventeen GitOps tests pass; CI and live script hash
checks passed. No prune was manually run. The worker rollout restarts conservative
healthy observation at September 27, 14:06:22 UTC: earliest eligibility is
**September 28, 16:06:22 Berlin**, conditional on healthy evidence and admission.
This supersedes the earlier observation timestamp above.

The remaining release dependency is a narrowly enforced source/sync broker,
authenticated review/CI/health receipts and failed-health automatic rollback proof.
ArgoCD Core has no reusable API-server token lane; an Application patch grant
alone would allow more than syncing. ACTIVITY-WP-0041-T03 and RPF-WP-0048-T02 retain
that work. Consumer enrollment and pattern-editing executor readiness remain open.

The release-broker core is now implemented in activity-core: signed role-bound
receipts, exact image-only admission, durable serialization, restart recovery,
and isolated rollback tests. See
[the implementation boundary](../../activity-core/docs/release-broker.md).
It is not connected to production credentials or scheduling. Authenticated
Git/ArgoCD transport, admitted identity, real receipt issuers/continuous observer
and transport-level rollback proof remain required. This source-only change does
not reset the production observation window.


The fixed Git/ArgoCD transport adapter and persistent health observer are now
implemented and tested with disposable real Git repositories and simulated
Kubernetes responses. Real Git rollback, lost-response recovery, concurrent-writer
refusal and wrong-cluster refusal pass. Health attestation requires a full 24 hours
of actual samples, no more than 90 seconds apart; gaps and clock regressions reset
or invalidate the interval. It cannot infer that history from the rollout timestamp.
Production credential admission, real invariant probes/signing issuers, Temporal
registration and authenticated Kubernetes failure tests remain open. See the
[broker implementation](../../activity-core/docs/release-broker.md) for that boundary.


## Cadence evidence recheck — 2026-09-28

The expected first natural daily receipt (September 28 02:00 Berlin) was absent
from the queried State Hub intake events before 09:00 UTC; the latest remained the
September 27 14:07Z smoke receipt. See [recheck](evidence/2026-09-28-loop-recheck.json).
Enabled schedules and prior smoke success do not prove this recurring execution.
WP-0008 T03 retains cadence/sink diagnosis; no outage cause or live fix is claimed.
The roster remains empty and mutation execution remains unadmitted.