GLAS-WP-0016/0017: plan FI brief profile, assembly-checkpoint route and shared publish grant

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 269924@bnt-lap001
Assistant-Session: 02bbdd77-e96c-4580-8952-f4dc9d8a8508

docs/publish-grant-design.md

@@ -0,0 +1,58 @@
+# Path-scoped publish grants
+
+Status: proposed (GLAS-WP-0016-T05, 2026-10-13). One design for every tenant
+that publishes a governed run's commit to its own remote. First consumers:
+freedom-intelligence daily brief (`briefs/**`) and assembly-economics
+checkpoints (`checkpoints/**`).
+
+## Problem
+
+Both tenants need the same thing: a run produces commits confined to declared
+paths, and those commits reach `origin/main` fast-forward only, with at most one
+rebase retry, never merge or force. Today the assembly push lives inside
+rein-aharness `assembly_checkpoint.py` (legacy inventory gap 6) and the FI push
+is requested as part of a tool profile. Neither is a named, separately granted
+capability.
+
+## Design
+
+1. **The grant is declared by the tenant, carried by Activity Core.** The
+   tenant's activity definition holds a `repository_grant` v2 block
+   (`allowed_paths`, `commit_count`, `publication: {remote, ref, mode,
+   decision}`). Activity Core validates it and attaches it to the claimed
+   ops_run. The FI declaration
+   (`freedom-intelligence/activity-definitions/fi-daily-research-brief.declaration.yaml`)
+   is the template; assembly-economics copies its shape with
+   `allowed_paths: [checkpoints/**]` and `commit_count.max` as its run needs.
+2. **The session never publishes.** Agent sessions keep a commit-only tool
+   profile with no push and no Forgejo credential. A Glas profile's tool
+   profile does not carry publication rights; it only names the paths the
+   session may write.
+3. **Publication is a deterministic step after the run.** The Glas worker
+   already captures the one-commit result as a Git bundle through the sandbox
+   owner and imports it under the original baseline, grant and lease
+   (GLAS-WP-0015, 2026-09-09). A publisher step outside the sandbox then:
+   - checks every commit touches only `allowed_paths` and the count is within
+     `commit_count`;
+   - pushes fast-forward only to `publication.ref`;
+   - on rejection fetches, rebases once if every unpublished commit is still
+     inside `allowed_paths`, and pushes again; otherwise it stops and records
+     the failure;
+   - never merges or forces;
+   - records the pushed SHA as run evidence.
+   It publishes only when the claimed ops_run carries a publication grant.
+4. **The push credential belongs to the publisher, not to the run.** It is a
+   per-tenant, per-repository Forgejo credential under OpenBao custody, found
+   with `warden route find`. It never enters the sandbox.
+5. **Deterministic runs use the same publisher.** A tenant-owned blueprint (no
+   Glas profile) hands its commits to the same publisher under the same grant
+   shape. Assembly-checkpoint does not need an agent session for this.
+
+## Open: who owns the publisher
+
+The publisher is one capability serving both Glas-profiled and blueprint runs.
+Candidates: Activity Core (it already holds the grant and ops_run), rein-aharness
+(it runs the worker that imports the bundle), or a separate typed capability.
+Recommendation: Activity Core, because it validates and holds the grant, and
+both execution paths already pass through it. This is the operator's decision,
+tracked as GLAS-WP-0016-T05.

workplans/GLAS-WP-0016-fi-research-brief-profile.md

@@ -0,0 +1,114 @@
+---
+id: GLAS-WP-0016
+type: workplan
+title: "Versioned Glas profile for the FI daily research brief"
+domain: infotech
+repo: glas-harness
+status: ready
+flavor: implementation
+owner: claude
+topic_slug: fi-research-brief-profile
+created: "2026-10-13"
+updated: "2026-10-13"
+---
+
+# FI daily research brief profile
+
+Request: freedom-intelligence message `c7f2df46` (FI-WP-0005-T05, 2026-09-22)
+asks for `harness.fi-research-brief@1.0.0`. FI's profile-absent routing expires
+2026-12-31; FI-WP-0005-T07 wires the canary only after a positive sandboxed
+proof run. Owner declaration:
+`freedom-intelligence/activity-definitions/fi-daily-research-brief.declaration.yaml`.
+Egress list: `freedom-intelligence/docs/sources-egress.yaml` (17 hosts, :443).
+Publication design: `docs/publish-grant-design.md`.
+
+## Add the Glas profile harness.fi-research-brief@1.0.0
+
+```task
+id: GLAS-WP-0016-T01
+status: todo
+priority: high
+```
+
+Add `profiles/harness.fi-research-brief.yaml`: rein-aharness, session_style
+unattended, model_class frontier, model pinned by Glas (same pin as
+harness.agent-dev-local 1.1.1 unless the operator chooses otherwise), limits
+timeout 1800s / max_turns 60, `max_budget_usd` inside an accepted spend
+envelope, sandbox profile from T02, tool profile from T03, documented rollback
+pin. `operational_readiness.status: unverified` until T04 passes. Catalog
+validation (`glas-harness profiles`) and tests must pass. Depends on T02/T03
+names being agreed, not on their release.
+
+## Add the sand-boxer egress sandbox profile
+
+```task
+id: GLAS-WP-0016-T02
+status: todo
+priority: high
+```
+
+Owner: sand-boxer. Request a bwrap profile (working name
+`profile.bwrap-fi-research`) with `network.default: deny` and `network.egress`
+equal to the model route plus exactly the 17 hosts in FI's
+`sources-egress.yaml`, per `sand-boxer/docs/bwrap-egress.md` (exact lowercase
+DNS names, :443, no wildcards or IP literals). Owner config `allowed_egress`
+must be a superset. Glas sends the handoff and records the owner's return.
+
+## Add the rein-aharness research tool profile
+
+```task
+id: GLAS-WP-0016-T03
+status: todo
+priority: high
+```
+
+Owner: rein-aharness. Request a tool profile (working name
+`green-research-commit`): read/edit tools, HTTPS fetch through the sandbox
+proxy, git add/commit/status/log/diff limited to granted paths (`briefs/**`),
+no push and no arbitrary shell. Publication is not part of the tool profile;
+it is the deterministic publisher step in `docs/publish-grant-design.md`.
+
+## Prove one sandboxed run and mark the profile ready
+
+```task
+id: GLAS-WP-0016-T04
+status: wait
+priority: high
+blocking_reason: "Depends on T01-T03 and on the publisher owner (T05)."
+```
+
+Run one bounded brief through the profile inside the sandbox: egress limited
+to the declared hosts, exactly one new file under `briefs/`, one commit, no
+push from the session. Publish evidence under `docs/evidence/`, then set
+`operational_readiness.status: ready` and notify FI for FI-WP-0005-T07.
+
+## Operator decision: owner of the publish-grant publisher
+
+```task
+id: GLAS-WP-0016-T05
+status: wait
+needs_human: true
+priority: high
+blocking_reason: "Operator decision: which subsystem owns the deterministic publisher (recommendation: Activity Core)."
+```
+
+`docs/publish-grant-design.md` defines one path-scoped publish grant for FI and
+assembly-checkpoint. Open: who owns the publisher step and its push
+credentials. Recommendation: Activity Core. Resolve before T04 publishes.
+
+## Operator decision: is a sandboxed pinned agent a host installation?
+
+```task
+id: GLAS-WP-0016-T06
+status: wait
+needs_human: true
+priority: high
+blocking_reason: "Operator decision on FI's playbook question; FI decides its rhythm on that basis."
+```
+
+FI's playbook forbids installing Claude Code / Codex on railiance01 for this
+rhythm. Question: does a pinned agent executable that runs only inside the Glas
+bwrap sandbox count as a host installation? Glas view: no. The binary is a
+pinned runtime artifact owned by rein-aharness/sand-boxer, not on the host PATH,
+not user-installed, carries no host credentials and runs only under deny-default
+egress. Answer FI explicitly once the operator decides.

workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md

@@ -0,0 +1,51 @@
+---
+id: GLAS-WP-0017
+type: workplan
+title: "Governed route for assembly-checkpoint before legacy routing ends"
+domain: infotech
+repo: glas-harness
+status: ready
+flavor: implementation
+owner: claude
+topic_slug: assembly-checkpoint-governed-route
+created: "2026-10-13"
+updated: "2026-10-13"
+---
+
+# Assembly-checkpoint governed route
+
+Request: assembly-economics messages `713cd2a8` and `d9cc84e6`
+(ASSEMBLY-WP-0014-T01). Declaration `checkpoints/EXECUTION_DECLARATION.md`
+founder-approved 2026-10-13. Target: December monthly run on the governed
+route by 2026-12-15, ahead of the 2026-12-31 compatibility flag.
+
+## Operator decision: profile shape for assembly-checkpoint
+
+```task
+id: GLAS-WP-0017-T01
+status: wait
+needs_human: true
+priority: high
+blocking_reason: "Operator decision: tenant-owned blueprint only, or blueprint plus a Glas profile for the assessment."
+```
+
+Options: (a) tenant-owned blueprint for the whole run, with the optional
+assessment as one bounded llm-connect call inside it and no Glas profile;
+(b) blueprint plus a separate Glas-profiled call for the assessment; (c) one
+Glas profile for both. Glas recommendation: (a), matching rein-aharness
+`docs/legacy-runtime-inventory.md` step 3. A Glas profile is needed only if the
+assessment becomes an agent loop. Publication uses the shared grant in
+`docs/publish-grant-design.md` either way.
+
+## Confirm the grant shape with assembly-economics
+
+```task
+id: GLAS-WP-0017-T02
+status: wait
+priority: medium
+blocking_reason: "Depends on T01 and GLAS-WP-0016-T05 (publisher owner)."
+```
+
+Once the decisions land, confirm with assembly-economics a `repository_grant`
+v2 block (`allowed_paths: [checkpoints/**]`, fast-forward only, one rebase,
+never force) in its activity definition, copied from the FI template.