FI-WP-0005 T01-T03: owner declaration, publication decision, egress hosts.

- Owner declaration for the profiled fi-daily-research-brief (proposed):
  inputs, single-commit briefs/** grant, fast-forward-only publication,
  quality rules, model requirements without env selection, completion
  evidence and rollback pins.
- Decision: origin publication is a typed grant on the run, not an
  executor default.
- docs/sources-egress.yaml: 17 exact host:443 entries for the sandbox,
  tested for sand-boxer format and drift against the prose allowlist.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 51320@bnt-lap001
Assistant-Session: 9d40b4c7-8e3c-42ee-b755-d658d4640d6c

docs/decisions/2026-09-22-brief-origin-publication.md

@@ -0,0 +1,60 @@
+# Decision: Origin publication of daily briefs is an explicit, typed grant
+
+**Date:** 2026-09-22  
+**Status:** accepted  
+**Decided by:** Bernd Worsch (operator), FI owner  
+**Affects:** `activity-definitions/fi-daily-research-brief.md`,
+`activity-definitions/fi-daily-research-brief.declaration.yaml`, FI-WP-0005  
+**Supersedes:** the grant wording in FI-WP-0004-T04, which granted "origin
+publication as a named capability of `fi-research-brief`". That capability
+lived inside one rein command. This decision moves it to the queued run's
+repository grant.
+
+---
+
+## Context
+
+A brief day counts only when the brief is on `origin/main` (FI-WP-0004). The
+executor therefore has to push. rein-aharness (`d0b45acb`, REINAH-WP-0003-T04)
+requires that publication be a separate, owner-approved decision, not a
+default of the executor. activity-core repository-grant v1 is local-only and
+rejects `publish: true`.
+
+## Decision
+
+1. **FI grants publication, scoped exactly:**
+   - remote `origin`, ref `main`
+   - mode **fast-forward only**: no force push, no other refs, no tags
+   - only commits whose changes stay within `briefs/**`
+   - at most one commit per run
+2. **The grant rides on the run, not the executor.** It is carried as
+   activity-core repository-grant v2 `publication` (requested in FI-WP-0005-T04).
+   No rein, profile or tool may publish FI content without that grant on the
+   claimed `ops_run`.
+3. **Failure semantics:**
+   - Push rejected or failed: the run fails, no `fi_daily_brief` is posted,
+     and the day stays due.
+   - Non-fast-forward (origin moved): the executor may rebase its single
+     brief commit onto the new origin head once, then retry. A second failure
+     is a failed run. It never merges and never forces.
+   - Success requires `origin_sha` evidence, and activity-core close
+     reconciliation checks it against the grant.
+4. **Until grant v2 is live**, the compatibility path (`rein-aharness
+   fi-research-brief`, commit `11020e8`) continues under FI-WP-0004-T04 semantics.
+   It ends at cutover (FI-WP-0005-T08) or at the legacy expiry, whichever
+   comes first.
+
+## Not granted
+
+- Writes outside `briefs/**`. The catalog, inventory, workplans and docs stay
+  human- or workplan-driven.
+- Publication to any other remote or mirror.
+- Opening PRs or issues, or posting to other external systems.
+
+## Consequences
+
+- activity-core needs grant v2 and origin-SHA close evidence (FI-WP-0005-T04).
+- The Glas tool profile must be able to push, but only under a grant
+  (FI-WP-0005-T05).
+- `scripts/verify_brief_durability.py` remains the independent audit of the
+  result.