# Daily brief durability audit

The verifier resolves the live `origin/main` commit with `git ls-remote` and
reads that immutable Git tree. If necessary, it fetches missing objects. Local
files, local commits and stale remote-tracking refs cannot establish completion.
An unreachable remote or Hub is an error (exit 2), never a successful check.
Hub progress reads are paginated; repeating/malformed pages fail closed.

```bash
python3 scripts/verify_brief_durability.py --require-hub
python3 scripts/verify_brief_durability.py --allow-reconciled --json
python3 scripts/verify_brief_durability.py --allow-reconciled --require-date 2026-09-14
```

The last command is the acceptance check for the September 14 scheduled run.
Before that run publishes, it must fail. A known historical gap cannot satisfy
`--require-date`.

For events dated September 13, 2026 onward (or any event containing push
attestation), the verifier requires `pushed=true`, the canonical date/path,
and a full `origin_sha` that is an ancestor of the live remote head and contains
the nonempty brief. The current remote tree must also contain the file.
Earlier events with files on origin are reported separately as legacy evidence;
the audit does not invent historical push attestations.

## September 7–11 reconciliation

The five original `fi_daily_brief` events remain intact in the append-only Hub
log. The evidence file
[`2026-09-14-brief-completion-reconciliation.json`](evidence/2026-09-14-brief-completion-reconciliation.json)
records exact event IDs, original details and the audited remote commit. No
missing brief is reconstructed or counted as successful.

After publishing this evidence to origin, append one correction per event:

```bash
python3 scripts/reconcile_brief_completions.py          # review, read-only
python3 scripts/reconcile_brief_completions.py --apply  # append corrections
```

The helper validates every source event and missing path before writing. It
uses stable idempotency keys and skips already recorded corrections. Correction
events use `fi_daily_brief_reconciliation`, never the completion event type.

The verifier accepts a correction only when its event ID/date/path/disposition/
reason matches the evidence JSON in a published ancestor commit. Default strict
mode still fails on these missing dates. `--allow-reconciled` explicitly allows
the acknowledged historical debt, prints every gap, and fails on any new gap or
invalid attestation.

## Next-run readiness (2026-09-14 Berlin)

Temporal schedule `activity-schedule-3169ab1f-882b-59c7-9763-d014dc96f4fc` is
unpaused; its next action is September 14 at 07:30 Europe/Berlin (05:30 UTC).
The claim-loop service is active and was restarted after executor commit
`11020e8` (push-before-completion). Keep its FI checkout synchronized before the
run: the executor pushes its current branch and does not pull automatically.

The deployed activity-core resolver now enforces the publication contract: only an event
with `pushed=true`, a full SHA, canonical path and matching `detail.date` may
clear today's due bit. An event for yesterday delivered today must leave today
due. The Git audit remains the authoritative check of actual origin objects;
the resolver checks the executor's attestation.

This preflight is not evidence that the future scheduled run succeeded. Run
the exact-date audit after publication and retain its result.

## Applied repair evidence

FI implementation/evidence commit: `8bd2e5f`; activity-core fix: `289aff3`.
Twelve verifier regression tests
passed; the activity-core resolver suite passed all 47 tests. The resolver-only
image `activity-core:fi-publication-20260914` passed three container smoke cases
and rolled out successfully to API, worker and event-router. Live resolver
inspection confirms the new code and September 14 due=true.

Five correction IDs (original events remain unchanged):

| Missing day | Correction event |
| --- | --- |
| 2026-09-07 | `3b23c7d9-e8fc-4750-8a35-682771303b85` |
| 2026-09-08 | `4fa69450-9b11-4d98-a870-70a755dd7ca0` |
| 2026-09-09 | `53fc8e47-b246-47a9-90da-6b7f5d11ce71` |
| 2026-09-10 | `b33c3abe-7a59-4096-8bd1-ac5998d0b303` |
| 2026-09-11 | `ea5cf3b4-cfd1-4e69-836c-5771099c4049` |

Re-running reconciliation skipped all five records (no duplicate writes).
Live audit checks: strict mode exits 1 for the five missing dates;
`--allow-reconciled --require-date 2026-09-13` exits 0;
`--allow-reconciled --require-date 2026-09-14` exits 1 because that day's
scheduled publication has not occurred. Progress note:
`687fee6f-e080-40f4-a62c-ffb23face166`.

## 2026-09-22: stranded briefs 2026-09-15 to 2026-09-22 recovered

The claim loop produced a brief every weekday, but every push was rejected
non-fast-forward (`! [rejected] HEAD -> main (fetch first)`). Origin had
moved through workstation commits and the executor never fetched. The
FI-WP-0004 safeguard held: each run failed and reopened, and no
`fi_daily_brief` was posted, so there were no false completions. Six
commits stayed local on railiance01.

Recovery: the six brief-only commits were rebased onto `origin/main` on
railiance01 and pushed (`166fda3..5c2dd69`). Completion events were then
posted with `recovered: true` and the rebased `origin_sha`:

| Day | origin_sha | Event |
| --- | --- | --- |
| 2026-09-15 | `93f0b97` | `3cfceabb` |
| 2026-09-16 | `f912c18` | `14b2c7df` |
| 2026-09-17 | `083bd28` | `163cf2d4` |
| 2026-09-18 | `4a4eb0c` | `88877318` |
| 2026-09-21 | `9cb00d3` | `65c37af3` |
| 2026-09-22 | `5c2dd69` | `9b85f21b` |

`--allow-reconciled --require-date 2026-09-22` exits 0 with 8 valid published
events. Strict mode still exits 1, only for the acknowledged 09-07 to 09-11 gaps.

Root-cause fix: rein-aharness `294201a` implements the publication decision
(`docs/decisions/2026-09-22-brief-origin-publication.md`). On rejection it
fetches, confirms that unpublished commits touch only `briefs/`, rebases
once and retries; a conflict aborts and fails the day. It is deployed on
railiance01 (editable install at `294201a`), and the claim loop was
restarted 2026-09-22 14:26 CEST.