| Network egress | Hosts in `checkpoints/sources.json` (www.census.gov, ec.europa.eu, fred.stlouisfed.org, ghoapi.azureedge.net, api.worldbank.org, api.openalex.org) and the llm-connect endpoint. Nothing else. |
| Model route | llm-connect, one request per run, prompt built only from fetched observations. Optional: `--no-llm` produces a valid record without it. |
| Credential route | None for data sources (all public). llm-connect access per its own route (`warden route find "llm-connect inference"`). Forgejo push credential per the publish lane (below). No secrets in the repository or the record. |
| Completion event | Exit 0 and a JSON summary line `{"status": "ok"\|"out-of-window", ...}`. `out-of-window` is a successful no-op. |
| Commit policy | One commit per run, message `Checkpoint <date> (<kind>) — activity-core`, author `rein-aharness`, containing only the allowed write paths. |
| Publication policy | Push to `coulomb/assembly-economics` main: fast-forward only; on rejection rebase once if all unpublished commits stay within `checkpoints/`; never force. (Unchanged from the 2026-10-12 decision; to move into a path-scoped grant in the governed publish lane.) |
| Rollback | Revert the checkpoint commit. Records are append-only by convention, so a revert is visible. Disable a definition by `enabled: false` in the activity-core projection. |
| Idempotency | Same date and kind overwrite the same two files. A second run on one day produces no diff if the sources did not change. |
| Failure handling | Source errors become `not_found` / `error` rows in the record; the run still succeeds. A rejected assessment is recorded as skipped. |
## Open questions for rein-aharness / glas-harness
1. Should the deterministic part become a tenant-owned blueprint here, with the
assessment step a separate Glas-profiled call, or should one profile cover
both?
2. Where does the path-scoped publish grant live (`coulomb/assembly-economics`,
`checkpoints/**`)? Is the Freedom Intelligence brief grant the template?
3. The legacy inventory lists four committed definitions. The
`assembly-checkpoint-*` definitions were added on 2026-10-12. Are they in