fix: separate OpenViking candidate synthesis

docs/research/2026-08-02-five-public-repositories-evidence.md

@@ -182,16 +182,17 @@ authorize copying, vendoring, linking, execution, or a Runtime dependency.
 
 ## 5. Synthesis and evidence gaps
 
-The five-repository synthesis retains ContextEngine's existing module ownership:
-
-| ContextEngine area | Public reference input | Boundary ContextEngine must own |
-|---|---|---|
-| Product/Control UX | Dify orchestration; MaxKB preview/confirm; OpenViking browse/trajectory UX | Operator authorization, versioned candidate, sole promote authority |
-| Document compilation | RAGFlow structural compiler | ParsedDocument family, deterministic provenance, publication transaction |
-| Supply/freshness | Onyx checkpoint/staging; RAGFlow recovery; Dify visibility | Signed WorkerLease, dual watermarks, atomic active pointer |
-| Retrieval/assembly | RAGFlow/Onyx retrieval; Dify routing; OpenViking density tiering | CandidateRef → Kernel → AuthorizedProjection, budget, provenance, audit |
-| Curation/Learning | MaxKB operations; OpenViking session candidate UX | Authorized-only input, consent, review, ReleaseManifest promotion |
-| Delivery/exposure | Dify/Onyx transport; OpenViking agent lifecycle UX | One sealed Runtime, trusted delivery, audience-bound ContextPackage |
+The synthesis retains ContextEngine's existing module ownership while separating
+the four admitted public-reference inputs from OpenViking candidate observations:
+
+| ContextEngine area | Admitted public reference input | Non-authoritative candidate observation | Boundary ContextEngine must own |
+|---|---|---|---|
+| Product/Control UX | Dify orchestration; MaxKB preview/confirm | OpenViking browse/trajectory UX; candidate and non-authoritative while `#205` is open | Operator authorization, versioned candidate, sole promote authority |
+| Document compilation | RAGFlow structural compiler | — | ParsedDocument family, deterministic provenance, publication transaction |
+| Supply/freshness | Onyx checkpoint/staging; RAGFlow recovery; Dify visibility | — | Signed WorkerLease, dual watermarks, atomic active pointer |
+| Retrieval/assembly | RAGFlow/Onyx retrieval; Dify routing | OpenViking density tiering; candidate and non-authoritative while `#205` is open | CandidateRef → Kernel → AuthorizedProjection, budget, provenance, audit |
+| Curation/Learning | MaxKB operations | OpenViking session candidate UX; candidate and non-authoritative while `#205` is open | Authorized-only input, consent, review, ReleaseManifest promotion |
+| Delivery/exposure | Dify/Onyx transport | OpenViking agent lifecycle UX; candidate and non-authoritative while `#205` is open | One sealed Runtime, trusted delivery, audience-bound ContextPackage |
 
 Remaining evidence gaps are unchanged in kind:
 

tests/unit/test_openviking_governance.py

@@ -163,6 +163,38 @@ def test_five_repository_baseline_is_an_explicit_versioned_successor() -> None:
     )
 
 
+def test_synthesis_separates_admitted_inputs_from_candidate_observations() -> None:
+    baseline = _read(BASELINE_PATH)
+    expected_candidate_cells = {
+        "Product/Control UX": "OpenViking browse/trajectory UX",
+        "Document compilation": "—",
+        "Supply/freshness": "—",
+        "Retrieval/assembly": "OpenViking density tiering",
+        "Curation/Learning": "OpenViking session candidate UX",
+        "Delivery/exposure": "OpenViking agent lifecycle UX",
+    }
+
+    assert (
+        "| ContextEngine area | Admitted public reference input | "
+        "Non-authoritative candidate observation | Boundary ContextEngine must own |"
+        in baseline
+    )
+    for area, candidate in expected_candidate_cells.items():
+        row = next(
+            line for line in baseline.splitlines() if line.startswith(f"| {area} |")
+        )
+        cells = [cell.strip() for cell in row.strip("|").split("|")]
+        assert len(cells) == 4, row
+        assert cells[0] == area
+        if candidate == "—":
+            assert cells[2] == candidate
+        else:
+            assert cells[2] == (
+                f"{candidate}; candidate and non-authoritative while `#205` is open"
+            )
+        assert "OpenViking" not in cells[1]
+
+
 def test_public_docs_keep_openviking_non_authoritative_until_issue_205_closes() -> None:
     baseline_paths = (
         Path("CONTRIBUTING.md"),