Prepare approved reporting repair and monthly review inputs

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e738-9e15-7600-87e6-90dec3a7beef

integrations/activity-core/README.md

@@ -0,0 +1,54 @@
+# Bounded reporting repair for Activity Core
+
+Owner task: FEP-WP-0008 T03, alongside existing ACTIVITY-WP-0041. No new workplan.
+
+The September 27 grant-aware image promotion removed the frontend resolver. Keep
+that grant-aware base. This overlay changes only the resolver module and its package
+registration; it does not roll back grants, change schedules, or admit a mutation
+executor. [Diagnosis](../../docs/evidence/2026-09-28-reporting-diagnosis.json).
+
+`source.json` pins the upstream source revision and resolver hashes. Reproduce with
+an isolated checkout of that exact activity-core revision:
+
+```sh
+git apply /home/worsch/frontend-patterns/integrations/activity-core/monthly-review.patch
+cp /home/worsch/frontend-patterns/integrations/activity-core/Dockerfile Dockerfile.reporting-repair
+cp /home/worsch/frontend-patterns/integrations/activity-core/test_frontend_monthly_review.py tests/
+PYTHONDONTWRITEBYTECODE=1 .venv/bin/python -m pytest -q -p no:cacheprovider \
+  tests/test_frontend_patterns.py tests/test_frontend_monthly_review.py \
+  tests/test_repository_grant.py tests/test_resolve_context_binding.py
+docker build -f Dockerfile.reporting-repair -t activity-core:fep-reporting-repair-20260928 .
+```
+
+The isolated checkout needs the owner's existing locked development environment.
+The Docker build itself needs no new dependency installation: it extends the pinned
+runtime and proves resolver registration plus typed grant support during construction.
+The review compares all Python source hashes against the base, not only image labels.
+
+The monthly extension reads this repository's `feedback/monthly-review-input.json`,
+its cited evidence and learning ledger at the same resolved Git revision. It reports
+six health dimensions as an **owner snapshot**, dated and stale after seven days;
+these fields cannot grant execution authority. Measured research/execution/token/cost
+sums include unknown-cycle counts and only the reporting month. Costs are not inferred
+from tokens. At most three bounded decision proposals carry no-response defaults.
+Missing input/evidence or invalid effort yields a degraded packet while retaining
+receipt totals. The existing 3,900-character digest bound still applies. Daily and
+weekly collection remain unchanged. It is not an independent live health observer.
+
+The [October fixture](../../docs/evidence/2026-09-28-monthly-packet-fixture.json)
+uses the built image with network disabled and a future clock. It is not an October
+production run or completed monthly review. The first actual packet is due October 1.
+
+Deploy only this worker's exact reviewed digest through the existing GitOps source
+and ArgoCD path; preserve the API and event-router images and all non-image fields.
+The current deployment is `428f2d7`, grant-aware base `713bddad…`; use that exact
+revision as the rollback target, acknowledging that rollback restores broken domain
+reporting. A rollback must preserve repository grants. Verify resolver and grant
+hashes, all three definitions, a report-only scheduled smoke and monthly sink after
+rollout. Do not retry the failed historical run as though it had succeeded naturally.
+
+The owner's [release runbook](../../../activity-core/docs/gitops-release.md) requires
+24 healthy hours and authenticated release authority. The domain failure invalidates
+continuous-health claims; no admitted routine identity exists. An exact attended repair
+exception is required before production promotion. Staging this artifact is not that
+exception. No access/budget/policy expansion is part of the repair.