docs: define modular local agent contracts

agents/gewu/README.md

@@ -14,3 +14,11 @@ The pack is source material for a dedicated research workspace. Keep the complet
 | [kb-synthesize](skills/kb-synthesize/SKILL.md) | Build a synthesis with revision-bound dependencies. |
 
 The [manifest](manifest.json) records versions and explicit compatibility status. Pending service compatibility means no connected workflow is claimed. Until tools exist, requested local drafts stay under the selected workspace's `Drafts/` and remain unaccepted; no canonical writes or fabricated receipts are permitted.
+
+The manifest's `modules` array is the authoritative descriptor registry for the profile, protocols, skills and pipelines. Each entry identifies its implementation, provided/required instruction contracts, compatible checkpoint contract and exact file hash. Its snapshot digest covers that array using the declared canonical serialization. Recompute hashes and the snapshot after changing a module; any published pack change requires a new pack version. The entry lists above are discovery indexes and must agree with the registry.
+
+For portable Markdown hashing, decode UTF-8, remove an optional BOM and normalize CRLF/CR line endings to LF, then hash the UTF-8 bytes with SHA-256. Preserve every other character and the final newline. This keeps Windows checkout conversion from changing instruction identity; it is not a signature or proof of trusted origin.
+
+Checkpoint contract `gewu.local-checkpoint@0.1.0` requires run identity, explicit scope/objective, snapshot digest, resolved module contract IDs and file hashes, host/model metadata where available, input/output hashes, stage, coverage, budgets, pending operation identities and last service receipt. Unavailable service fields are explicitly absent; they are never fabricated. This is a draft instruction contract, not an executable checkpoint validator. Resume must verify the saved snapshot and hashes before using saved stages. A successor run requires explicit contract compatibility and downstream revalidation.
+
+Empty service-capability lists mean schema binding is pending, as declared by `service_capability_status`; they do not mean connected workflows need no capabilities. Bind and test those requirements when the service schemas exist. Host-adapter descriptors belong to a future installer/configuration implementation and are not supplied by this pack.