diff --git a/AGENTS.md b/AGENTS.md
index d432a2a..10706f7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -32,6 +32,15 @@ cd simulations/gadm02 && python3 -B grounded_readings.py   # readings under grou
 cd simulations/gadm02 && python3 -B band_probe.py   # scenarios across the adoption band B1–B4
 ```
 
+Reality checkpoints (ASSEMBLY-WP-0010): scheduled by activity-core and
+executed by rein-aharness on railiance01. Do not run them from cron. Local dry
+run (writes files; delete them afterwards unless it is a real checkpoint):
+
+```bash
+python3 -B -m unittest discover -s checkpoints -p 'test_*.py'
+WEB_FETCHER_PATH=~/web-fetcher python3 -B checkpoints/run_checkpoint.py --kind light --date YYYY-MM-DD --no-llm
+```
+
 Use `python3 -B` after quick edits; a stale bytecode cache once masked a change.
 
 After changing `simulations/` or `scenarios/`, regenerate the results and
diff --git a/docs/decisions/2026-10-12-checkpoint-origin-publication.md b/docs/decisions/2026-10-12-checkpoint-origin-publication.md
new file mode 100644
index 0000000..4def523
--- /dev/null
+++ b/docs/decisions/2026-10-12-checkpoint-origin-publication.md
@@ -0,0 +1,29 @@
+# Decision 2026-10-12: unattended publication of reality checkpoints
+
+**Decided by:** the founder (Bernd Worsch), in session, 2026-10-12.
+**Context:** ASSEMBLY-WP-0010, `research/ScenarioBandMethod.md` § 6.
+
+## Decision
+
+1. Reality checkpoints are scheduled by **activity-core** on railiance01
+   (definitions `assembly-checkpoint-*`) and executed by **rein-aharness**
+   (approach `assembly-checkpoint`), following the org recurring-automations
+   playbook. They are not run by cloud routines or workstation cron.
+2. Data comes from deterministic fetchers (**web-fetcher**) with provenance.
+   **llm-connect** is used only to draft an assessment from fetched data. An
+   assessment containing numbers that are not in the data is rejected.
+3. rein-aharness may **commit and push to `assembly-economics` origin**
+   unattended, limited to paths under `checkpoints/`, fast-forward only. On
+   rejection it rebases once (only if all unpublished commits stay within
+   `checkpoints/`), and never forces. This mirrors the Freedom Intelligence
+   brief publication grant (FI decision 2026-09-22).
+
+## Consequences
+
+- The publish grant widens what an unattended executor writes to origin. It
+  is recorded on the security close-down checklist
+  (`the-custodian/docs/security-close-down-checklist.md`) for review at
+  close-down.
+- The approach runs on rein-aharness legacy (profile-absent) routing, which
+  is allowed until 2026-12-31 (`AGENT_HARNESS_LEGACY_APPROACHES_UNTIL`). A
+  governed execution profile is needed before then (ASSEMBLY-WP-0010-T05).
diff --git a/workplans/ASSEMBLY-WP-0010-reality-checkpoints.md b/workplans/ASSEMBLY-WP-0010-reality-checkpoints.md
index 673c260..efbb559 100644
--- a/workplans/ASSEMBLY-WP-0010-reality-checkpoints.md
+++ b/workplans/ASSEMBLY-WP-0010-reality-checkpoints.md
@@ -24,7 +24,7 @@ technical data, per jurisdiction where possible.
 
 ```task
 id: ASSEMBLY-WP-0010-T01
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "52cb88b0-9a5c-583f-a983-4b331f255f9e"
 ```
@@ -40,7 +40,7 @@ trackers. Store in `checkpoints/IndicatorCatalog.md`, linked to
 
 ```task
 id: ASSEMBLY-WP-0010-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "f03b5bbe-a40f-54a6-a77f-cdf18cc77950"
 ```
@@ -53,7 +53,7 @@ predictions and their later observations).
 
 ```task
 id: ASSEMBLY-WP-0010-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "2d236d7f-05b4-5219-aa40-7d83cce10bae"
 ```
@@ -66,7 +66,7 @@ jurisdiction sits relative to the band today.
 
 ```task
 id: ASSEMBLY-WP-0010-T04
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "ef899d58-d010-55f1-8f1e-7cef95f90fab"
 ```
@@ -74,3 +74,51 @@ state_hub_task_id: "ef899d58-d010-55f1-8f1e-7cef95f90fab"
 Set up the cadence (quarterly light, annual full). Each checkpoint is a dated
 record in `checkpoints/`. An automated reminder or scheduled agent run needs
 the owner's approval, so this task waits on that decision.
+
+**Done 2026-10-12 (founder-approved):** activity-core definitions
+`assembly-checkpoint-*` (setup daily 13–15 Oct 2026, monthly Nov–Dec 2026,
+quarterly, annual) are projected through the activity-core GitOps lane
+(commit f9f2640, ArgoCD synced). They are executed by the rein-aharness
+approach `assembly-checkpoint` (commit 06bd08c), with data via web-fetcher.
+Checkpoint 0 was produced end to end (`checkpoints/2026/2026-10-12-light.md`).
+Decision: `docs/decisions/2026-10-12-checkpoint-origin-publication.md`.
+
+## Governed execution profile before legacy routing expires
+
+```task
+id: ASSEMBLY-WP-0010-T05
+status: todo
+priority: high
+```
+
+The assembly-checkpoint approach runs on rein-aharness legacy (profile-absent)
+routing, which is allowed until 2026-12-31. Coordinate with rein-aharness and
+glas-harness on a governed execution profile and a path-scoped publish grant.
+Re-arm close-down checklist row 20 accordingly. Deadline: 2026-12-15, before
+the last monthly run.
+
+## Disable transitional definitions after 2026
+
+```task
+id: ASSEMBLY-WP-0010-T06
+status: wait
+priority: medium
+```
+
+After 2026-12-31, set `enabled: false` for `assembly-checkpoint-setup-daily`
+and `assembly-checkpoint-monthly-2026` (domain files and the activity-core
+projection), then run the GitOps lane and the admin sync. The window guard
+makes this harmless if late. Waits until January 2027.
+
+## Publish web-fetcher on Forgejo and register it
+
+```task
+id: ASSEMBLY-WP-0010-T07
+status: wait
+priority: medium
+```
+
+The founder creates `coulomb/web-fetcher` on forgejo.coulomb.social
+(push-to-create is disabled). Then: push from the workstation, repoint the
+railiance01 checkout (currently cloned from a git bundle) to origin, and
+register the repo with the State Hub (`statehub register`).