# Decision: Origin publication of daily briefs is an explicit, typed grant

**Date:** 2026-09-22  
**Status:** accepted  
**Decided by:** Bernd Worsch (operator), FI owner  
**Affects:** `activity-definitions/fi-daily-research-brief.md`,
`activity-definitions/fi-daily-research-brief.declaration.yaml`, FI-WP-0005  
**Supersedes:** the grant wording in FI-WP-0004-T04, which granted "origin
publication as a named capability of `fi-research-brief`". That capability
lived inside one rein command. This decision moves it to the queued run's
repository grant.

---

## Context

A brief day counts only when the brief is on `origin/main` (FI-WP-0004). The
executor therefore has to push. rein-aharness (`d0b45acb`, REINAH-WP-0003-T04)
requires that publication be a separate, owner-approved decision, not a
default of the executor. activity-core repository-grant v1 is local-only and
rejects `publish: true`.

## Decision

1. **FI grants publication, scoped exactly:**
   - remote `origin`, ref `main`
   - mode **fast-forward only**: no force push, no other refs, no tags
   - only commits whose changes stay within `briefs/**`
   - at most one commit per run
2. **The grant rides on the run, not the executor.** It is carried as
   activity-core repository-grant v2 `publication` (requested in FI-WP-0005-T04).
   No rein, profile or tool may publish FI content without that grant on the
   claimed `ops_run`.
3. **Failure semantics:**
   - Push rejected or failed: the run fails, no `fi_daily_brief` is posted,
     and the day stays due.
   - Non-fast-forward (origin moved): the executor may rebase its single
     brief commit onto the new origin head once, then retry. A second failure
     is a failed run. It never merges and never forces.
   - Success requires `origin_sha` evidence, and activity-core close
     reconciliation checks it against the grant.
4. **Until grant v2 is live**, the compatibility path (`rein-aharness
   fi-research-brief`, commit `11020e8`) continues under FI-WP-0004-T04 semantics.
   It ends at cutover (FI-WP-0005-T08) or at the legacy expiry, whichever
   comes first.

## Not granted

- Writes outside `briefs/**`. The catalog, inventory, workplans and docs stay
  human- or workplan-driven.
- Publication to any other remote or mirror.
- Opening PRs or issues, or posting to other external systems.

## Consequences

- activity-core needs grant v2 and origin-SHA close evidence (FI-WP-0005-T04).
- The Glas tool profile must be able to push, but only under a grant
  (FI-WP-0005-T05).
- `scripts/verify_brief_durability.py` remains the independent audit of the
  result.