# Moonfish generic MoonFlow closed loop

This workflow is a pack boundary, not a MoonFlow implementation. Moonfish owns
all A-share terms and calculations. MoonFlow receives only generic references,
opaque wire envelopes, authority decisions, evidence references, human-review
records, scheduled actions, and receipts.

Current implementation status: this remains a declared boundary contract and
is not exposed by the native app as an executable workflow. The actual MoonFlow
host remains responsible for constructing canonical MoonFlow values, committing
its records, enforcing authority, and returning opaque receipts. Moonfish must
not import MoonFlow packages or write MoonFlow storage directly.

## Fast loop

1. Moonfish freezes one approved recommendation artifact containing the share,
   goal-price range, approved goal price, expected after-cost increase,
   invalidation, and valid-session sale horizon.
2. `moonflow.intake.authority.request` asks the host for generic candidate
   intake authority. It grants no authority by itself.
3. `moonflow.deliverable.candidate.prepare` consumes the returned granted
   authority and emits constructor arguments for
   `FinalDeliverableCandidateV1` with the recommendation encoded as opaque
   canonical bytes.
4. The host obtains the generic review request and named Bookkeeper review. It
   returns one canonical `FinalDeliverableDecisionV1`: accepted, rejected,
   revision-requested, or escalated.
5. `moonflow.bookkeeper.decision.record` writes an immutable pack-owned receipt
   for that returned host record. It neither changes the recommendation nor
   invokes a provider.
6. Acceptance may prepare an immutable `DeliverableArtifactRevisionV1`.
   External delivery remains a separate authority and human-review step; only a
   returned `GovernedDeliveryReceiptV1` can be recorded.

## Observation loop

After acceptance, Moonfish prepares exactly two inert `ScheduledActionV3`
requests: the next valid exchange-session close and the approved horizon close.
Due-state evaluation must use MoonFlow committed-time evidence. Ambient local
wall-clock time cannot trigger an observation.

Later price, paper-position, exit-advisory, provenance, and contradictory
evidence remain Moonfish-owned. The pack validates them with its existing
Bookkeeper outcome contract, then encodes the result as an opaque
`OutcomeObservationV1` payload.

## Slow learning loop

The named Bookkeeper supplies exactly one Information Gap, Recognition Gap, and
Decisiveness Gap assessment. Moonfish emits:

- an `OpaqueThreeGapAssessmentV1` constructor request bound to the exact outcome
  history;
- up to one finite `BoundedImprovementProposalV1` request for each gap;
- exact old/new version references, expiration, offline-evaluation bounds, and
  follow-up bounds; and
- explicit denial of automatic activation, recursive proposals,
  self-modification, policy mutation, trading, and deployment.

Every proposal requires later named-human adoption or rejection. A code route
is only a MoonCode work order; a policy route is only a qualified policy-review
request. Neither route applies a change.

## Storage boundary

Moonfish can retain exported/imported transport receipts in its own
`moonflow-boundary-ledger.json`. It never opens or writes MoonFlow event-store
files. The MoonFlow host alone constructs and commits MoonFlow canonical
records, then returns their generic canonical host-record envelopes.