docs: pin OpenViking evidence and guard admission

CONTRIBUTING.md

@@ -147,8 +147,10 @@ first, or declined.
 
 ### Controlled third-party reuse
 
-The design draws on architectural study of **Dify**, **RAGFlow**, **MaxKB**,
-**Onyx**, and conditionally admitted **OpenViking**. Code reuse follows
+The design draws on architectural study of the four admitted repositories
+**Dify**, **RAGFlow**, **MaxKB**, and **Onyx**. The versioned evidence baseline
+also carries an **OpenViking** candidate packet, but OpenViking is not public
+authority while issue #205 remains open. Code reuse follows
 [ADR-0074](./docs/decisions/0074-adopt-controlled-third-party-code-reuse.md),
 per source region, never per product: Apache-2.0 regions (RAGFlow) and MIT
 regions (Onyx outside every `ee/` directory; separately-licensed SDK subtrees)

PLAN.md

@@ -135,4 +135,4 @@ M6 之后坚持 **one connector per milestone**,不把两个新权限模型压
 
 ## 8. 致谢与参照
 
-设计吸收了对五个固定公开开源项目 **Dify、RAGFlow、MaxKB、Onyx、OpenViking** 的架构研究，仅学习可观察行为、Interface 形状、测试 oracle 与产品工作流。OpenViking 的白名单仅限 context filesystem/L0–L2 tiering、session→candidate UX、observable trajectory 与 agent exposure；它不证明多租户授权或安全，不作为 Runtime foundation，且任何 copy+patch 都被禁止。固定版本与一手链接见 `docs/research/2026-08-02-five-public-repositories-evidence.md`。安全与多租户协议由 ContextEngine 根据自身 requirement 与 threat model 独立设计；仓库外研究不是公开 authority 或 provenance。
+设计吸收了对四个已准入固定公开开源项目 **Dify、RAGFlow、MaxKB、Onyx** 的架构研究，仅学习可观察行为、Interface 形状、测试 oracle 与产品工作流。版本化后继基线 `docs/research/2026-08-02-five-public-repositories-evidence.md` 另含 OpenViking 候选包；#205 保持 open 时，本 PLAN 不把 OpenViking 引作 authority。候选白名单仅限 context filesystem/L0–L2 tiering、session→candidate UX、observable trajectory 与 agent exposure；它不证明多租户授权或安全，不作为 Runtime foundation，且任何 copy+patch 都被禁止。安全与多租户协议由 ContextEngine 根据自身 requirement 与 threat model 独立设计；仓库外研究不是公开 authority 或 provenance。

README.md

@@ -598,18 +598,19 @@ masquerade as a passing one.
 | [Implementation Design](./docs/design/2026-07-18-context-engine-implementation-design.md) | The integrated implementation authority and milestone boundaries |
 | [Threat Model](./docs/security/context-engine-threat-model.md) | Assets, trust boundaries, threats, hard oracles |
 | [Program PRD](./docs/agents/prd-contextengine-implementation.md) · [Epic Tech Spec](./docs/specs/2026-07-19-context-engine-implementation-epic.md) | Requirements, 100 user stories, contract shapes, work packages |
-| [Prior-art evidence baseline](./docs/research/2026-08-02-five-public-repositories-evidence.md) | Strengths, limits, clean-room breakdown, and evidence gaps of five fixed public repositories |
+| [Prior-art evidence baseline](./docs/research/2026-08-02-five-public-repositories-evidence.md) | Versioned successor for four admitted fixed repositories plus the OpenViking candidate packet, which is non-authoritative while issue #205 remains open |
 | [D0 Baseline Candidate](./DESIGN-BASELINE.md) | Current candidate state and unclosed evidence gates |
 
 ## Prior art
 
-The design draws on architectural study of five fixed public open-source projects —
-**Dify**, **RAGFlow**, **MaxKB**, **Onyx**, and conditionally admitted
-**OpenViking** — limited strictly to observable
-behavior, interface shape, test oracles, and product workflows. **No OpenViking
-code was copied; other reuse remains governed per exact source region by
-ADR-0074.** Pinned versions and first-party links are recorded in the
-[evidence baseline](./docs/research/2026-08-02-five-public-repositories-evidence.md).
+The design draws on architectural study of four admitted fixed public
+open-source projects — **Dify**, **RAGFlow**, **MaxKB**, and **Onyx** — limited
+strictly to observable behavior, interface shape, test oracles, and product
+workflows. The versioned
+[evidence baseline](./docs/research/2026-08-02-five-public-repositories-evidence.md)
+also carries an OpenViking candidate packet, but this README does not cite
+OpenViking as authority while issue #205 remains open. **No OpenViking code was
+copied; other reuse remains governed per exact source region by ADR-0074.**
 
 ContextEngine's security and multi-tenancy protocols are designed independently
 from its own requirements and threat model. Research from outside this

README.zh-CN.md

@@ -299,10 +299,10 @@ IM 交付由 `BotDelivery` 这个受信深模块完成。它从 M2 起作为独
 
 ## 参照与致谢
 
-设计吸收了对五个固定公开开源项目——**Dify**、**RAGFlow**、**MaxKB**、**Onyx**，
-以及有条件准入的 **OpenViking**——的
+设计吸收了对四个已准入固定公开开源项目——**Dify**、**RAGFlow**、**MaxKB**、**Onyx**——的
 架构研究，且严格限于可观察行为、interface 形状、测试 oracle 与产品工作流。
-**OpenViking 零代码复制；其他复用仍由 ADR-0074 按精确源码区域治理。** 固定版本与一手链接记录在
+版本化基线另含 **OpenViking** 候选包；#205 保持 open 时，本 README 不把 OpenViking
+引作 authority。**OpenViking 零代码复制；其他复用仍由 ADR-0074 按精确源码区域治理。** 固定版本与一手链接记录在
 [证据基线](./docs/research/2026-08-02-five-public-repositories-evidence.md)。
 
 ContextEngine 的安全与多租户协议依据自身 requirement 与威胁模型独立设计。

STATUS.md

@@ -72,7 +72,7 @@ designed, and deliberately not active:
 | Session-derived Learning intake | ADR-0100 accepts only a future consented, minimized, provenance-bound candidate path; raw tape reads/storage, extractor model egress, candidate carrier, governed Memory artifact, release bridge, and Runtime serving remain `NOT_ACTIVE` |
 | Deployment/plugin productization | ADR-0101 bounds any future plugin to static composition at accepted ports, but defers generic categories/manifest/loader until a second implementation or measured drift; tenant code, hot loading, marketplace, and plugin-created service remain `NOT_ACTIVE` |
 | MCP ingress | Only the maintainer's spawn-per-session local stdio `context_resolve` tool is active; remote/shared HTTP, multi-user/tenant, private/group, `Continue`, `OpenCitation`, generation, effects, resources/prompts, and MCP egress-grant handling remain `NOT_ACTIVE` |
-| OpenViking public-reference admission | The versioned five-repository baseline, permalink audit, legal dossier, and upstream license-metadata question are prepared in #205; maintainer/legal sign-off and the maintainer doc-steward decision remain pending. This activates no code reuse, dependency, Runtime carrier, or security claim. |
+| OpenViking public-reference admission | The versioned successor baseline, permalink audit, legal dossier, and upstream license-metadata question are prepared in #205, but the OpenViking packet is not authority while #205 remains open; maintainer/legal sign-off and the maintainer doc-steward decision remain pending. This activates no code reuse, dependency, Runtime carrier, or security claim. |
 | Worker dead-letter transition / operator requeue | ADR-0060 adds bounded reclaim only; generation four is left untouched after expiry |
 | Provider polling, delete execution beyond ADR-0057 | See the File Provider ADRs for exact boundaries |
 | Streaming delivery | Explicit V1 non-goal — placeholder + edit instead |
@@ -602,12 +602,15 @@ yet in M0 scope and are explicitly recorded as `not-evaluated`, so the report
 emits only an `m0SecurityDecision` — a passing security gate is never reported
 as an overall release or promotion PASS.
 
-Beyond the pinned-commit evidence for Dify, RAGFlow, MaxKB, Onyx, and the
-conditionally admitted OpenViking claim families in the
+Beyond the pinned-commit evidence for the four admitted repositories Dify,
+RAGFlow, MaxKB, and Onyx in the
 [versioned five-repository baseline](./docs/research/2026-08-02-five-public-repositories-evidence.md),
 the dynamic evidence that exists today is
 the `compose.yaml`-pinned PostgreSQL + pgvector harness and RLS evidence for the
 first Organization-owned representative table. Dynamic evidence for the complete
 domain schema, ActorContext, filtered ANN, and Feishu capability is still
 outstanding — which is why this evidence slice is not described as a complete
 product authorization capability.
+
+The same versioned baseline carries an OpenViking candidate packet, but this
+STATUS does not cite OpenViking as authority while issue #205 remains open.

docs/agents/prd-contextengine-implementation.md

@@ -36,7 +36,7 @@ ContextEngine 已经形成了较完整的产品定位、Domain Model、安全不
 
 ### Public provenance and design ownership
 
-- 公开 prior art 只允许引用五个固定版本的公开仓：Dify、RAGFlow、MaxKB、Onyx、OpenViking；证据索引统一见 `docs/research/2026-08-02-five-public-repositories-evidence.md`。OpenViking 只准入 context filesystem/L0–L2 tiering、session→candidate UX、observable trajectory 与 agent exposure 四类 claim，禁止作为多租户授权/安全证明、Runtime foundation 或任何 copy+patch 来源。
+- 公开 prior art 在 #205 保持 open 时只允许引用四个已准入固定版本的公开仓：Dify、RAGFlow、MaxKB、Onyx；证据索引统一见 `docs/research/2026-08-02-five-public-repositories-evidence.md`。该基线另含 OpenViking 候选包，但本 PRD 不把 OpenViking 引作 authority；候选范围只包括 context filesystem/L0–L2 tiering、session→candidate UX、observable trajectory 与 agent exposure 四类 claim，禁止作为多租户授权/安全证明、Runtime foundation 或任何 copy+patch 来源。
 - 五仓只提供可观察的产品流程、Interface 形状、测试 oracle 与工程 pattern。ContextEngine 的 tenant model、AuthorizationKernel、SourceAclEvidence、WorkerLease、audience-bound delivery、ActionTicket、publication transaction 与 release authority 均是本项目根据自身威胁模型独立设计。
 - 仓库之外的笔记、私有实现、本机路径或未署名综合结论不构成实现权威。任何探索性想法必须先改写成仓库内可独立审查的 requirement、threat、decision 或 evidence-gated hypothesis，才能进入 Design、ADR、PRD 或 Tech Spec。
 - 不复制参考仓代码。公开设计不得通过删去来源名称来保留不可验证归因，也不得把 ContextEngine 自有协议描述成参考仓已经证明的能力。

docs/decisions/0016-implementation-authority-and-vertical-slice-roadmap.md

@@ -1,6 +1,6 @@
 ---
 name: adr-0016-implementation-authority-and-vertical-slice-roadmap
-version: "1.1.0"
+version: "1.2.0"
 description: >
   Make the concise current implementation design authoritative and deliver the
   program as testable vertical slices with a separate launch gate. Use when
@@ -31,11 +31,13 @@ assets, trust boundaries, threats, and hard oracles. These responsibilities are
 scoped, not a total precedence order; a contradiction blocks implementation
 until the owning documents are reconciled explicitly. `PLAN.md` plus the program
 PRD form the implementation-facing summary.
-`docs/research/2026-07-19-four-public-repositories-evidence.md` fixes
-the allowlisted public evidence behind reference-repository claims; it informs
-design but does not override ContextEngine requirements, threat model, design,
-or ADRs. Repository-external research inputs are neither public authority nor
-public provenance.
+`docs/research/2026-08-02-five-public-repositories-evidence.md` is the versioned
+successor that fixes public evidence behind reference-repository claims. While
+issue #205 remains open, only its Dify, RAGFlow, MaxKB, and Onyx rows are
+admitted public authority; its OpenViking candidate packet is non-authoritative.
+The baseline informs design but does not override ContextEngine requirements,
+threat model, design, or ADRs. Repository-external research inputs are neither
+public authority nor public provenance.
 
 D0 must record an immutable commit and digest for the publication-ready
 authority bundle after its allowlist and provenance scans pass. Implementation

docs/design/2026-07-18-context-engine-implementation-design.md

@@ -29,14 +29,16 @@ reproducible report/digest is recorded.
 
 ### 0.1 Public provenance and independent design ownership
 
-Public prior-art claims are allowlisted to Dify, RAGFlow, MaxKB, Onyx, and
-conditionally admitted OpenViking at the fixed revisions recorded in
-`docs/research/2026-08-02-five-public-repositories-evidence.md`. Those projects
-provide observable patterns for product orchestration, document compilation,
-knowledge operations, connectors, checkpointing, retrieval, and test layering.
-They do not establish ContextEngine's security guarantees. OpenViking is
-further restricted to the baseline's four behavioral claim families; it is no
-Runtime foundation and supplies no code or dependency.
+Public prior-art claims are allowlisted to Dify, RAGFlow, MaxKB, and Onyx at
+the fixed revisions recorded in
+`docs/research/2026-08-02-five-public-repositories-evidence.md`. Those four
+projects provide observable patterns for product orchestration, document
+compilation, knowledge operations, connectors, checkpointing, retrieval, and
+test layering. They do not establish ContextEngine's security guarantees. The
+same versioned baseline carries an OpenViking candidate packet, but this design
+does not cite OpenViking as authority while issue #205 remains open; no
+OpenViking code or dependency is admitted, and it cannot serve as a Runtime
+foundation.
 
 ContextEngine independently owns the tenant model, AuthorizationKernel,
 AuthorizedProjection type flow, SourceAclEvidence semantics, WorkerLease,

docs/design/2026-07-26-repo-state-review-and-course-correction.md

@@ -88,8 +88,8 @@ status: review record; decision boundaries owned by ADR-0061..ADR-0064
 - **以创始论题为准绳:分叉。** 四支柱现状——真实检索:占位符;结构化
   DB/API 族:路线图与领域模型零出现;adapter 群:一个 provider 且 seam
   为名义;深度清洗:仅确定性 Markdown 编译。
-- 与四个公开参考仓(见
-  `docs/research/2026-07-19-four-public-repositories-evidence.md`)呈镜像:
+- 与四个已准入公开参考仓(见版本化后继基线
+  `docs/research/2026-08-02-five-public-repositories-evidence.md`)呈镜像:
   证据基线显示它们集体薄弱的授权/撤销/租户隔离恰是本仓已建成者;它们各自
   擅长的摄取与检索广度恰是本仓未建者。此镜像可成为差异化,但必须出自
   自觉选择——本次评审即为该选择补办手续(ADR-0061)。