frontend-patterns/docs/ActivityCoreLoop.md

Activity-core receipt loop

Current state (2026-09-28): repaired through the user-approved, scoped GitOps exception. The grant-aware worker now includes the domain resolver; daily, weekly and monthly scheduled smoke runs produced validated receipts. The first natural daily failure remains historical evidence; subsequent natural cadence and the October 1 packet remain due. See live proof.

FEP-WP-0008 owns this integration. The initial delivery is deterministic collection and reporting. Automatic investigation and publication are a separate, outstanding execution dependency; a weekly report is not evidence of an improvement cycle.

Definition	Europe/Berlin schedule	Output event
frontend-patterns-daily	Daily 02:00	fep_feedback_intake
frontend-patterns-weekly	Tuesday 03:00	fep_improvement_review
frontend-patterns-monthly	First day 09:00	fep_monthly_review

Definitions live in activity-definitions/. Activity-core projects the identical Markdown into its external-definition ConfigMap. Its frontend-patterns context resolver reads this repository's feedback/sources.json at a resolved commit, then reads enrolled consumer indexes and receipts at resolved commits. See the enrollment contract. Initially the roster is empty; reports must say no_consumers, never imply measured usefulness or coverage.

The collector validates identities, hashes, chronology, decisions and evidence presence, reduces immutable event chains to one observation per use, and quarantines ambiguous chains. Synthetic outcomes have separate counts. Outcomes remain producer assertions until investigation verifies their evidence. Missing or malformed sources produce a degraded report. Monthly reports cover the previous calendar month in Europe/Berlin, using observations available before its end. They are receipt summaries, not yet the complete cost/decision review packet.

Collection allows ten repositories, 100 events per run, 128 KiB per source file and a 45-second fetch deadline (an in-flight read may finish up to five seconds later). Over-limit sources are reported as errors; durable pagination is still required before expanding enrollment. Only the fixed Forgejo host and validated relative paths are read. No secret retrieval, shell execution, LLM calls or repository mutation is performed. Required context prevents an absent resolver from silently producing a successful empty report.

Activation and proof

Current state: deployed and all three schedules enabled on 2026-09-27 under the founder's explicit scoped exception, State Hub decision e5dd02cb-b5b2-45c8-a600-748ea2ffd31b (ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED). This is not a standing waiver of the estate deployment gate.

Setup evidence records the tests, image and preflight. Activation evidence records the successful worker rollout, three completed manual workflows and their State Hub reports, active Temporal schedules without drift, and a completed one-shot scheduled smoke at 11:28:45 UTC. That smoke was started by Temporal; it is distinct from the first natural recurring runs, which are still ahead.

The next regular runs are September 28 at 02:00, September 29 at 03:00, and October 1 at 09:00, respectively, in Europe/Berlin. All verified reports correctly say no_consumers, zero model calls and automatic edits disabled. Reports are stored in State Hub under the frontend-patterns topic and the event types above.

The reporting binaries are now deployed through Git and ArgoCD using immutable registry digests. The user authorized this adoption separately on September 27 (decision 78a4b859-dd00-4623-b95b-121b0e1c915d). Nine runtime resources are managed; secrets and infrastructure remain with their existing owners. The first adoption changed tracking metadata only. The subsequent digest rollout preserved the same binaries; all three deployments are ready and ArgoCD is Synced/Healthy. A post-release Temporal scheduled smoke completed successfully at 13:39 UTC.

Release evidence records revisions, digests, CI, health and registry retention protection. The conservative 24-hour healthy observation window begins at 13:38:21 UTC; earliest eligibility is September 28 at 15:38:21 Berlin, conditional on healthy evidence. Automatic sync and pruning remain disabled.

ACTIVITY-WP-0041 retains authenticated review/health receipts, narrowly bound unattended release identity and failed-health automatic rollback proof. RPF-WP-0048 owns platform observation and digest-aware retention; current baseline tag aliases are already protected. A tested image-only validator exists, but is not an authority grant. These remaining gates prevent routine releases from needing fresh exceptions. Policy/access/budget changes remain monthly decisions.

The owner handoff is ACTIVITY-WP-0040.

Unattended improvement remains open

GLAS-WP-0012 and HFACT-WP-0001 own the missing admitted executor proof. The available development profile is operationally unverified and does not enforce the loop's llm-connect budget (six calls / 40,000 aggregate tokens / 30 minutes). Do not emit unexecutable work or fall back to an unrestricted legacy worker. WP-0008-T03 retains the end-to-end execution, independent review, publication and rollback proofs. WP-0008-T01/T02 retain first real consumer integration, frozen release validation, producer closeout hooks and delayed-outcome refresh. These are live tasks, not implied completions of this reporting foundation.

Retention safeguard follow-up

The digest-retention fix is now deployed through GitOps and verified in the worker. Packages referenced by digest in the additive live/rollback inventory are protected in full; unrelated package cleanup retains its normal policy. Twenty platform retention/inventory tests and seventeen GitOps tests pass; CI and live script hash checks passed. No prune was manually run. The worker rollout restarts conservative healthy observation at September 27, 14:06:22 UTC: earliest eligibility is September 28, 16:06:22 Berlin, conditional on healthy evidence and admission. This supersedes the earlier observation timestamp above.

The remaining release dependency is a narrowly enforced source/sync broker, authenticated review/CI/health receipts and failed-health automatic rollback proof. ArgoCD Core has no reusable API-server token lane; an Application patch grant alone would allow more than syncing. ACTIVITY-WP-0041-T03 and RPF-WP-0048-T02 retain that work. Consumer enrollment and pattern-editing executor readiness remain open.

The release-broker core is now implemented in activity-core: signed role-bound receipts, exact image-only admission, durable serialization, restart recovery, and isolated rollback tests. See the implementation boundary. It is not connected to production credentials or scheduling. Authenticated Git/ArgoCD transport, admitted identity, real receipt issuers/continuous observer and transport-level rollback proof remain required. This source-only change does not reset the production observation window.

The fixed Git/ArgoCD transport adapter and persistent health observer are now implemented and tested with disposable real Git repositories and simulated Kubernetes responses. Real Git rollback, lost-response recovery, concurrent-writer refusal and wrong-cluster refusal pass. Health attestation requires a full 24 hours of actual samples, no more than 90 seconds apart; gaps and clock regressions reset or invalidate the interval. It cannot infer that history from the rollout timestamp. Production credential admission, real invariant probes/signing issuers, Temporal registration and authenticated Kubernetes failure tests remain open. See the broker implementation for that boundary.

Cadence evidence recheck — 2026-09-28

The expected first natural daily receipt (September 28 02:00 Berlin) was absent from the queried State Hub intake events before 09:00 UTC; the latest remained the September 27 14:07Z smoke receipt. See recheck. Enabled schedules and prior smoke success do not prove this recurring execution. WP-0008 T03 retains cadence/sink diagnosis; no outage cause or live fix is claimed. The roster remains empty and mutation execution remains unadmitted.

Diagnosed failure and prepared repair — 2026-09-28

Temporal fired the daily definition at 00:00Z. Worker run 01a0e54f-c690-7caa-bae6-81cd5ed32416 failed with required context source frontend-patterns not registered. Source 428f2d7 changed the worker from the frontend overlay to the grant-aware API image; the running image has neither the resolver module nor its registration. ArgoCD and pod readiness were healthy, so those probes did not establish domain functionality.

Diagnosis, schedule readback, and repair contract pin the evidence. The prepared overlay keeps the current grant-aware base and changes only the domain resolver and its registration. Hash comparison preserves all other Python source and the grant identity. The candidate also adds monthly owner-snapshot health, decisions and measured research effort with unknown counts; it never grants execution authority. Missing review inputs degrade the report visibly.

58 focused tests and 17 GitOps tests pass. Server dry-run passes for the same nine resources; the actual resource diff is only the worker image. The published digest is afd8a7af73132becba432e7b315d70f88d66676020169d5d8811641304136437. The October 1 built-image fixture is 1,699 characters and contains no consumers, unknown eligible-task denominator and unknown cost observations. This is fixture proof, not an actual October run. Production promotion remains separately gated.

Hosted discovery is still unregistered (404) and its routed write credential is unavailable to the current operator session. Public source publication passed. The consumer hook is prepared, but no real consumer was fabricated or enrolled. These obligations remain WP-0008 T01/T02.

Approved repair completed — 2026-09-28

User decision abdea390-1039-4da1-b129-33aad00b4396 approved the exact attended repair. Activity Core source 4bd07a4 and platform pin 986b002 were pushed; ArgoCD root synced only the activity-core Application, then the child synced only its worker Deployment. ArgoCD is Synced/Healthy at the intended revision. Live Python source hashes, resolver registry and grant identity match the tested image. All three Temporal scheduled smokes completed with no tasks or model calls, and all three State Hub receipts validate. Temporary smoke schedules are removed; recurring schedules remain active. Live evidence and next fires.

The monthly sink now carries review health, decisions/defaults and measured effort with unknown-cycle counts. Today's actual monthly smoke covers August; the separately labeled October fixture checks September data. October 1 09:00 Berlin remains the first natural monthly packet, not completed early. Health fields are explicitly dated owner snapshots, not independently sampled live attestations. The current input is versioned here; stale snapshots are flagged.

ACTIVITY-WP-0040 T02 retains natural cadence evidence; ACTIVITY-WP-0041 and RPF-WP-0048 retain continuous-health observation and standing release authority. Their old September 27 observation interval is invalidated by the reporting failure. The scoped exception does not enable automatic pattern editing or routine releases.