docs: reconcile protected runtime and commercial gap authority

docs/CONTEXT_MAP.md

@@ -4,7 +4,7 @@
 
 This document separates protected behavior from the runtime-orchestration direction. Protected `main` remains the authority for what is shipped. A bounded context listed as a target does not become implemented merely because it appears here.
 
-Noema currently owns an evidence-producing credential and maintenance control plane. Expansion into agent/application runtime orchestration must reuse those existing authority boundaries rather than turning Noema into a model router, a foreign product system of record, or an arbitrary command runner.
+Noema owns an evidence-producing credential and maintenance control plane plus a narrow protected runtime-orchestration foundation. Expansion into broader agent/application runtime orchestration must reuse those existing authority boundaries rather than turning Noema into a model router, a foreign product system of record, or an arbitrary command runner.
 
 ## Current protected contexts
 
@@ -34,17 +34,19 @@ Owns bounded retry/timeout/cancellation semantics, fail-closed recovery evidence
 
 ## Runtime-orchestration target contexts
 
-The following contexts are accepted decomposition targets for new runtime behavior. They are not claims that protected `main` already implements a general-purpose agent runtime.
+The following contexts are the accepted decomposition for runtime behavior. Protected `main` already implements narrow foundations in Agent Runtime, Workflow / Task Execution, and State / Checkpoint; the remaining behavior in each context is added only by separately verified slices. These boundaries do not claim that Noema is already a general-purpose agent runtime.
 
 ### Agent Runtime
 
 Owns the lifecycle of one Noema agent/application execution: accepted execution identity, lifecycle state, cancellation, completion, and recovery routing. It does not discover or route models.
 
+Protected `main` includes the execution-lifecycle primitive introduced by #528: explicit accepted, running, cancellation-requested, and terminal transitions; exact duplicate delivery of the signal that established the current state is idempotent; contradictory or out-of-order signals fail closed; cancellation dominates late completion; retry/recovery uses a separate execution identity rather than inheriting implicit side-effect authority.
+
 ### Workflow / Task Execution
 
 Owns explicit workflow/task dependency and execution order, bounded concurrency, idempotent step identity, and side-effect classification. Recursive/unbounded task creation and implicit duplicate side effects are forbidden.
 
-PR #528 now carries a candidate bounded task-plan admission and runnable-task selector. It accepts one canonical execution identity, a finite acyclic dependency graph, explicit `pure`/`idempotent`/`side_effecting` classification, and bounded concurrency. Declared task order is deterministic scheduling priority. Runtime state must account for every admitted task exactly once; foreign, malformed, duplicate, or incomplete state evidence fails closed. Failed or cancelled work is never selected as an implicit retry, and failed dependencies do not release descendants. Authority-bearing plan fields and nested dependencies are detached and frozen after one-time reads so caller accessors or aliases cannot change an admitted execution plan. This remains candidate behavior until protected integration.
+Protected `main` includes bounded task-plan admission and runnable-task selection. It accepts one canonical execution identity, a finite acyclic dependency graph, explicit `pure`/`idempotent`/`side_effecting` classification, and bounded concurrency. Declared task order is deterministic scheduling priority. Runtime state must account for every admitted task exactly once; foreign, malformed, duplicate, or incomplete state evidence fails closed. Failed or cancelled work is never selected as an implicit retry, and failed dependencies do not release descendants. Authority-bearing plan fields and nested dependencies are detached and frozen after one-time reads so caller accessors or aliases cannot change an admitted execution plan. This protected foundation selects candidates only; it does not itself reserve work or grant side-effect authority.
 
 ### Tool / Capability Boundary
 
@@ -54,7 +56,7 @@ Owns versioned allowlisted tool/capability descriptors, least-authority invocati
 
 Owns versioned runtime checkpoint semantics needed for restart/cancellation/idempotency. Checkpoints contain only Noema runtime state and canonical foreign references; they must not copy another product's domain truth, provider credential state, or unrestricted reasoning/tool payloads.
 
-PR #528 currently carries candidate checkpoint admission for one retained execution identity. Sequence zero initializes the checkpoint stream; an exact same-sequence/same-digest replay is idempotent; conflicting replay, stale or gapped sequence, cross-execution identity, non-canonical execution identity, and non-SHA-256 state evidence fail closed. This remains candidate behavior until protected integration and does not itself persist checkpoint payloads or grant retry/side-effect authority.
+Protected `main` includes checkpoint admission for one retained execution identity. Sequence zero initializes the checkpoint stream; an exact same-sequence/same-digest replay is idempotent; conflicting replay, stale or gapped sequence, cross-execution identity, non-canonical execution identity, and non-SHA-256 state evidence fail closed. Returned checkpoint metadata is detached and frozen so caller-owned aliases cannot mutate admitted authority after validation. This primitive does not itself persist checkpoint payloads or grant retry/side-effect authority.
 
 ## Upstream and downstream boundaries
 

docs/LICENSING_AND_IP_TRANSFER.md

@@ -1,12 +1,12 @@
 # Noema Licensing and IP Transfer
 
-- **Status:** Repository rights policy/evidence baseline; Apache-2.0 source-license decision is integrated on protected `main@6b2b3e90dc3d5bd24cd27ed11db41b9eb7106010` through PR #530. This is not acquisition or transfer legal clearance.
+- **Status:** Repository rights policy/evidence baseline. Protected `main` carries the owner-selected Apache-2.0 source grant; this is not acquisition or transfer legal clearance.
 - **Scope:** Noema source rights, package/container metadata, third-party obligations, contributor/IP provenance, release distribution, and acquisition transfer evidence.
 - **Decision authority:** Repository automation may detect, authenticate, inventory, and compare evidence. The repository owner has explicitly selected Apache License 2.0 for Noema source; future outbound-license changes and transfer-rights decisions remain owner/legal governance actions.
 
 ## 1. Core invariant
 
-**Public source availability is not a grant of rights by itself.** The grant comes from the controlling repository rights file. Protected `main@6b2b3e90dc3d5bd24cd27ed11db41b9eb7106010` includes root `LICENSE` declaring Apache-2.0 for Noema source through merged PR #530.
+**Public source availability is not a grant of rights by itself.** The grant comes from the controlling repository rights file. Protected `main` contains root `LICENSE` with Apache License 2.0 for Noema source, integrated through #530. That protected source-rights decision does not itself establish package/artifact distribution rights, third-party compatibility, contributor ownership, or acquisition-transfer authority.
 
 Noema keeps source licensing, package publication, third-party obligations, and transfer authority separate:
 
@@ -96,9 +96,11 @@ Required evidence includes:
 
 ### 4.1 Current GPL-family tooling finding
 
-The current `package-lock.json` contains optional development/build packages on the `wrangler → miniflare → sharp → @img/sharp-libvips-*` path whose declared license is `LGPL-3.0-or-later`; `@img/sharp-wasm32` declares `Apache-2.0 AND LGPL-3.0-or-later AND MIT`. These packages are not relicensed by Noema's Apache-2.0 source license.
+The protected `package-lock.json` contains optional development/build packages on the `wrangler → miniflare → sharp → @img/sharp-libvips-*` path whose declared license is `LGPL-3.0-or-later`; `@img/sharp-wasm32` declares `Apache-2.0 AND LGPL-3.0-or-later AND MIT`. These packages are not relicensed by Noema's Apache-2.0 source license.
 
-Repository evidence also shows that the patch-validator runtime-image boundary explicitly excludes `wrangler`, `workerd`, and `miniflare`; therefore this finding must not be overstated as proof that LGPL code is bundled into that runtime image. It is nevertheless an inbound development/build-tooling policy gap because ContextualWisdomLab does not accept GPL-family software as the normal dependency baseline. Distribution/acquisition readiness must remain fail closed until issue #531 removes/replaces this dependency path or an explicit repository-level exception is approved for the exact use and distribution model.
+Repository evidence also shows that the patch-validator runtime-image boundary explicitly excludes `wrangler`, `workerd`, and `miniflare`; therefore this finding must not be overstated as proof that LGPL code is bundled into that runtime image. It is nevertheless an inbound development/build-tooling policy gap because ContextualWisdomLab does not accept GPL-family software as the normal dependency baseline.
+
+The active owner lane is issue #531 / PR #540. PR #540 replaces the intended Wrangler/Miniflare/Sharp/Libvips toolchain with direct `workerd`/`esbuild` and a bounded Cloudflare API adapter, but its exact-base lockfile policy must be rebound after protected-main movement and its unchanged current head must pass package, Worker dev/deploy, security, reviewer, image, SBOM, vulnerability, provenance, and license-inventory gates before integration. Distribution/acquisition readiness therefore remains fail closed until that protected evidence exists.
 
 Unknown or unresolved obligations fail closed for distribution/acquisition readiness. Vulnerability or provenance success does not prove license compatibility.
 
@@ -158,25 +160,25 @@ owner source-license decision
 
 Each arrow requires independent identity/consistency evidence. A mismatch, missing required record, malformed/ambiguous JSON, or unresolved right is a fail-closed condition.
 
-## 8. Current evidence and residual gap — 2026-09-02
+## 8. Current evidence and residual gap — 2026-09-06
 
-As observed after PR #530 merged, protected `main@6b2b3e90dc3d5bd24cd27ed11db41b9eb7106010` carries the explicit owner-selected Apache-2.0 source posture:
+Protected `main@5b8e620dbb01a794c1a38535bbcc32e41a80d0df` contains the owner-selected source-rights posture integrated through #530:
 
 - root `LICENSE`: Apache License 2.0;
 - root `README.md`: customer-facing Apache-2.0 source-license statement and separate third-party obligation boundary;
-- `package.json`: remains private and lock-stable; no npm package distribution claim is introduced.
+- `package.json`: remains private; no npm package distribution claim is introduced.
 
-These declarations are protected-main source truth. They do not by themselves establish acquisition-transfer authority, third-party compatibility, or release/publication evidence.
+That source grant is protected truth. It does not transfer later evidence classes into PASS.
 
 Current residual gaps remain deliberately separate:
 
-- the lockfile contains the GPL-family development/build tooling path described in §4.1 and therefore does not yet satisfy the organization default inbound-license policy;
+- issue #531 / PR #540 owns removal of the GPL-family development/build tooling path; candidate source replacement exists, but current-base lock policy and unchanged exact-head verification are not complete;
 - exact-release dependency/NOTICE evidence must still prove the actual distributed artifact contents;
 - contributor ownership/assignment and acquisition-transfer evidence remain separate from source licensing;
 - release/publication/deployment evidence remains separate from repository-source rights;
-- no source file, README sentence, scanner result, or successful CI run may upgrade those missing evidence classes into a commercial or legal PASS.
+- no source file, README sentence, scanner result, workflow success, SBOM, or model judgement may upgrade those missing evidence classes into a commercial or legal PASS.
 
-Issue #5 carries acquisition owner/legal and ownership/assignment evidence. Issue #66 carries remaining release/publication, NOTICE and provenance/activation boundaries. Issue #531 owns the GPL-family development/build-tool replacement. The integrated source-license decision narrows the gap but does not close those issues.
+Issue #5 carries acquisition owner/legal and ownership/assignment evidence. Issue #66 carries remaining release/publication, NOTICE and provenance/activation boundaries. Issue #531 owns the GPL-family development/build-tool replacement. The protected source-license decision closes only the source-grant gap; it does not close those later evidence families.
 
 ## 9. Non-goals
 

docs/PRD.md

@@ -88,13 +88,15 @@ Protected acquisition-integrity controls authenticate retained evidence and exac
 
 ### 4.7 Agent/application runtime orchestration
 
-On PR #528 this mode is **candidate truth only** until protected integration. Noema owns the lifecycle and safe execution mechanics of a Noema Agent/application execution; it does not acquire another CWL product's domain truth and does not become a model-provider router.
+Protected `main` includes the Agent Runtime lifecycle and State / Checkpoint admission foundation introduced by #528, together with bounded Workflow / Task plan admission and runnable-task candidate selection. Noema owns the lifecycle and safe execution mechanics of a Noema Agent/application execution; it does not acquire another CWL product's domain truth and does not become a model-provider router.
 
-The candidate Agent Runtime primitive owns explicit accepted, running, cancellation-requested, and terminal transitions. Exact duplicate delivery of the signal that already established the current state is idempotent, while contradictory or out-of-order signals fail closed. Cancellation dominates late completion. Retry/recovery uses a separate execution identity rather than receiving implicit duplicate-side-effect authority.
+The protected Agent Runtime primitive owns explicit accepted, running, cancellation-requested, and terminal transitions. Exact duplicate delivery of the signal that already established the current state is idempotent, while contradictory or out-of-order signals fail closed. Cancellation dominates late completion. Retry/recovery uses a separate execution identity rather than receiving implicit duplicate-side-effect authority.
 
-The candidate State / Checkpoint primitive admits sequence zero as initialization, an exact same-sequence/same-digest replay as idempotent, and only the immediately next sequence for the same canonical execution identity. Conflicting replay, stale/gapped sequence, cross-execution identity, malformed identity, or non-SHA-256 state evidence is rejected. Returned checkpoint metadata is a detached frozen snapshot so caller-owned aliases cannot mutate admitted authority after validation. This primitive does not persist checkpoint payloads by itself.
+The protected State / Checkpoint primitive admits sequence zero as initialization, an exact same-sequence/same-digest replay as idempotent, and only the immediately next sequence for the same canonical execution identity. Conflicting replay, stale/gapped sequence, cross-execution identity, malformed identity, or non-SHA-256 state evidence is rejected. Returned checkpoint metadata is a detached frozen snapshot so caller-owned aliases cannot mutate admitted authority after validation. This primitive does not persist checkpoint payloads by itself.
 
-`contextual-orchestrator remains the sole model discovery and routing owner`; Noema does not add direct provider SDKs, provider credentials, provider fallback lists, or local routing policy. Workflow / Task Execution, Tool / Capability Boundary, Isolation Integration, Policy / Approval, Observability, and Recovery remain separate bounded contexts under ADR 0012 and the canonical Context Map. Context Graph/EA integration requires an immutable released `context-graph-contracts` contract/profile and preserves EA Core as the authoritative Decision Plane; cross-service SQL is forbidden.
+The protected Workflow / Task foundation admits one canonical execution identity, a finite acyclic dependency graph, explicit `pure`/`idempotent`/`side_effecting` classification, bounded concurrency, and detached immutable authority-bearing plan data. Runnable selection fails closed on foreign, malformed, duplicate, incomplete, cross-execution, over-concurrency, or causally impossible state. Selection is candidate scheduling evidence only; it does not reserve work or grant side-effect authority. Durable workflow-state persistence, atomic claim/checkpoint execution, and richer recovery remain separate slices until independently integrated.
+
+`contextual-orchestrator` remains the sole model discovery and routing owner; Noema does not add direct provider SDKs, provider credentials, provider fallback lists, or local routing policy. Tool / Capability Boundary, Isolation Integration, Policy / Approval, Observability, and Recovery remain separate bounded contexts under ADR 0012 and the canonical Context Map. Context Graph/EA integration requires an immutable released `context-graph-contracts` contract/profile and preserves EA Core as the authoritative Decision Plane; cross-service SQL is forbidden.
 
 ## 5. Functional requirements