docs: define modular local agent contracts

docs/development/AGENT_SECURITY_PROTOCOL.md

@@ -1,11 +1,15 @@
 # Agent contribution and security protocol
 
-Status: proposed v0.1, 12 October 2026. Contracts: [architecture](../architecture/ARCHITECTURE.md) and [acceptance](../architecture/ACCEPTANCE_CONTRACT.md).
+Status: proposed v0.2, revised 13 October 2026. Contracts: [architecture](../architecture/ARCHITECTURE.md), [local agent](../architecture/LOCAL_AGENT.md) and [acceptance](../architecture/ACCEPTANCE_CONTRACT.md).
 
 ## Agent workflow
 
 Publish one harness-neutral skill pack with four entry points: `kb-ingest`, `kb-query`, `kb-curate` and `kb-synthesize`. Each names its version, supported service/schema versions, inputs, outputs, relevant protocols and resume behavior. Installers translate configuration/discovery; they do not fork the workflow or validator rules for each harness.
 
+The [GEWU source pack](../../agents/gewu/README.md) follows the owner's RESEARCH workspace pattern: profile, shared protocols, modular skills and coordinating pipeline instructions. The selected host supplies the model/runtime. Its manifest currently declares no verified service compatibility. Install into a dedicated research workspace and preserve existing profiles; source-pack creation is not host installation or a successful connection. Local host execution does not establish local-only inference.
+
+Pin pack/skill/pipeline content for active runs, and record version/hash bindings with checkpoints. A profile cannot enforce isolation through prose; service capabilities and deployment permissions remain authoritative. A pipeline Markdown file cannot guarantee durable scheduling. Resume uses service status/receipts and retained output artifacts; missing compatibility or unavailable old instructions must be reported explicitly.
+
 An ingestion run reads explicit project intent, registers a source artifact, records coverage and skips, extracts bounded proposals, supplies evidence-bound support assessments, submits bundles and reports receipts. The service persists the run but does not execute the agent's reasoning stages. A resume inspects existing source/proposal IDs and verified artifacts before repeating work.
 
 Query results preserve citations, scope, dates, omissions and uncertainty. Curators propose corrections, contradiction links and duplicate candidates without overwriting disagreements. Synthesis cites accepted node revisions and records dependencies; later input changes produce warnings until an external agent proposes a refresh.

docs/development/DEVELOPMENT_PROTOCOL.md

@@ -20,7 +20,7 @@ Every implementation task names its owning module, public boundary and affected
 | HTTP/MCP | Validate inputs and map outputs/errors; expose only operations in the allowlisted catalog. No duplicate business rules. |
 | Frontend | Read API data, route state and render evidence. No canonical mutation route or hidden browser proposal client. |
 | Local skills | Reason and propose using public contracts. No direct canonical edits, SQL tools or assumed human authority. |
-| Local agent runtime | Own bounded pipeline execution, model/tool dispatch and resumable client checkpoints. Use the service through public MCP contracts; never import its persistence or owner-credential internals. |
+| Local agent profile and pipelines | Own research-role routing, stage procedures, budgets and resumable checkpoint guidance. The existing host supplies model/tool execution. Use public MCP contracts; never depend on service persistence or owner-credential internals. |
 
 The operation catalog declares name/version, request/response schemas, handler, capabilities, permitted transports, idempotency semantics and limits. Test the generated route/tool surfaces, including forbidden exposure. An MCP `readOnlyHint` is documentation, not enforcement.
 

docs/development/MODULARITY_PROTOCOL.md

@@ -4,7 +4,7 @@
 
 ## Default structure
 
-Use a modular monolith for the service and a separate local-agent application. A module is a coherent responsibility with a public contract, private implementation and declared dependencies. It does not need its own process, repository or package release. Split deployment only when isolation, scaling or independent release needs justify it.
+Use a modular monolith for the service and a separate local-agent instruction pack executed by an existing host. A module is a coherent responsibility with a public contract, private implementation and declared dependencies. It does not need its own process, repository or package release. Split deployment only when isolation, scaling or independent release needs justify it.
 
 Every feature belongs to a named module. Consumers use its public interface; they cannot import private helpers, inspect its tables, edit its files or rely on provider-specific response objects. Cross-module payloads use GEWU-owned types. The composition root selects implementations and manages their lifetimes. Domain/application code cannot select a concrete implementation through scattered conditionals.
 
@@ -29,8 +29,8 @@ Compatibility is behavioral: valid inputs, errors, cancellation, ordering, idemp
 | Search and ranking | Scoped candidates, scores/explanations, revision and budget rules | Replace FTS/vector engine or ranking algorithm without modifying readers. |
 | Identity and credentials | Authenticated principal, capabilities, grants and revocation | Replace login backend without changing proposal authorization semantics. |
 | MCP and HTTP adapters | Versioned wire schemas and domain-error mapping | Update transport SDK without moving rules into routes. |
-| Agent model provider | Typed requests/results, usage, timeouts and declared capabilities | Change local/hosted provider without exposing SDK types to skills. |
-| Agent pipeline runner | Stage dispatch, bounded scheduling, checkpoints and outcomes | Replace orchestration library while preserving stage contracts and resume semantics. |
+| Agent host/model adapter | Profile discovery, model capabilities, tool access and execution metadata | Change configured host/model without baking provider syntax into shared skills. The host owns its provider SDK. |
+| Agent pipeline coordinator | Stage inputs/outputs, work budget, checkpoints and outcomes | Replace coordinating instructions while preserving skill contracts and resume obligations. The initial coordinator is host-executed Markdown, not a standalone engine. |
 | Skills and stage handlers | Declared inputs/outputs, tools, prompt/content versions and budget | Replace an extraction or assessment skill without rewriting the pipeline. |
 | Harness adapter | Profile/skill discovery and authenticated public tool access | Change a host's configuration format without duplicating the skill pack. |
 | Frontend feature modules | Route/data contract, component props, events and accessibility behavior | Replace an evidence viewer or result list while preserving API and navigation. |
@@ -40,7 +40,7 @@ Compatibility is behavioral: valid inputs, errors, cancellation, ordering, idemp
 
 Public contracts, implementation versions, persisted schemas and model/prompt artifacts have distinct identifiers. Use [semantic versioning](https://semver.org/) for declared stable contracts: compatible additions are minor, fixes are patch, breaking behavior is major. Before 1.0, explicitly list supported contract versions; do not assume every `0.x` update is compatible. Published immutable artifacts are never changed in place.
 
-Backend boundaries use typed ports with injected dependencies; the frontend imports feature public exports and shared primitives. Shared contract packages stay small and have no dependency on providers, storage engines or UI frameworks. Reject import cycles and cross-feature private imports in CI. The local agent cannot import service storage/auth internals; its GEWU access is through the public MCP client contract.
+Backend boundaries use typed ports with injected dependencies; the frontend imports feature public exports and shared primitives. Shared contract packages stay small and have no dependency on providers, storage engines or UI frameworks. Reject import cycles and cross-feature private imports in CI. Local-agent helper/connector code cannot import service storage/auth internals; its GEWU access is through the public MCP client contract.
 
 Configuration selects from installed, reviewed implementations by ID. Validate configuration and capability compatibility before activation. Do not discover executable modules from uploaded sources, skill text, arbitrary import strings or URL-supplied code. Python package entry points are a possible future distribution mechanism, not permission to auto-load third-party code; [the packaging guide](https://packaging.python.org/en/latest/guides/creating-and-discovering-plugins/) describes discovery mechanisms, not trust enforcement.