diff --git a/checkpoints/EXECUTION_DECLARATION.md b/checkpoints/EXECUTION_DECLARATION.md
new file mode 100644
index 0000000..42c1e11
--- /dev/null
+++ b/checkpoints/EXECUTION_DECLARATION.md
@@ -0,0 +1,58 @@
+# Execution declaration: assembly-checkpoint
+
+**Status:** draft for owner approval (ASSEMBLY-WP-0014-T01), 2026-10-13.
+**Purpose:** the per-definition declaration that rein-aharness requires before
+a scheduled definition can leave legacy, profile-absent routing
+(`rein-aharness/docs/legacy-runtime-inventory.md`, migration step 2). It
+replaces the legacy route that is allowed until 2026-12-31
+(`AGENT_HARNESS_LEGACY_APPROACHES_UNTIL`).
+
+Approval: the founder approves this declaration. The approval is recorded as
+an addendum to `docs/decisions/2026-10-12-checkpoint-origin-publication.md`.
+
+## Definitions covered
+
+activity-core: `assembly-checkpoint-setup-daily` (until 2026-12-31),
+`assembly-checkpoint-monthly-2026` (until 2026-12-31),
+`assembly-checkpoint-quarterly`, `assembly-checkpoint-annual`. Executor
+today: the rein-aharness approach `assembly-checkpoint` (rein-aharness commit
+06bd08c).
+
+## Nature of the work
+
+Mostly **deterministic**: fetch, render and commit. One optional **agentic**
+step: drafting the assessment paragraph through llm-connect. The runner
+rejects any assessment that contains a number not present in the fetched
+data. Following migration step 3, the deterministic part fits a
+tenant-owned blueprint. The assessment can run without a Glas profile only
+if it stays this narrow; otherwise it belongs behind a versioned Glas
+profile. Decision for rein-aharness and glas-harness: see "Open questions".
+
+## Declaration
+
+| Field | Value |
+|---|---|
+| Input schema | `--kind light\|full`, `--date YYYY-MM-DD` (Europe/Berlin day; default today). No other inputs. |
+| Repository input | `coulomb/assembly-economics` at a verified Forgejo commit (main); `coulomb/web-fetcher` at a verified Forgejo commit (main). |
+| Code executed | `checkpoints/run_checkpoint.py` (standard library) and `web_fetcher` (standard library). No package installation. |
+| Allowed write paths | `checkpoints/<year>/<date>-<kind>.md`, `checkpoints/data/<date>-<kind>.jsonl`. Nothing outside `checkpoints/`. |
+| Network egress | Hosts in `checkpoints/sources.json` (www.census.gov, ec.europa.eu, fred.stlouisfed.org, ghoapi.azureedge.net, api.worldbank.org, api.openalex.org) and the llm-connect endpoint. Nothing else. |
+| Model route | llm-connect, one request per run, prompt built only from fetched observations. Optional: `--no-llm` produces a valid record without it. |
+| Credential route | None for data sources (all public). llm-connect access per its own route (`warden route find "llm-connect inference"`). Forgejo push credential per the publish lane (below). No secrets in the repository or the record. |
+| Completion event | Exit 0 and a JSON summary line `{"status": "ok"\|"out-of-window", ...}`. `out-of-window` is a successful no-op. |
+| Commit policy | One commit per run, message `Checkpoint <date> (<kind>) — activity-core`, author `rein-aharness`, containing only the allowed write paths. |
+| Publication policy | Push to `coulomb/assembly-economics` main: fast-forward only; on rejection rebase once if all unpublished commits stay within `checkpoints/`; never force. (Unchanged from the 2026-10-12 decision; to move into a path-scoped grant in the governed publish lane.) |
+| Rollback | Revert the checkpoint commit. Records are append-only by convention, so a revert is visible. Disable a definition by `enabled: false` in the activity-core projection. |
+| Idempotency | Same date and kind overwrite the same two files. A second run on one day produces no diff if the sources did not change. |
+| Failure handling | Source errors become `not_found` / `error` rows in the record; the run still succeeds. A rejected assessment is recorded as skipped. |
+
+## Open questions for rein-aharness / glas-harness
+
+1. Should the deterministic part become a tenant-owned blueprint here, with the
+   assessment step a separate Glas-profiled call, or should one profile cover
+   both?
+2. Where does the path-scoped publish grant live (`coulomb/assembly-economics`,
+   `checkpoints/**`)? Is the Freedom Intelligence brief grant the template?
+3. The legacy inventory lists four committed definitions. The
+   `assembly-checkpoint-*` definitions were added on 2026-10-12. Are they in
+   the inventory's migration sequence?