docs: define modular local agent contracts

docs/development/AGENT_SECURITY_PROTOCOL.md

@@ -1,11 +1,15 @@
 # Agent contribution and security protocol
 
-Status: proposed v0.1, 12 October 2026. Contracts: [architecture](../architecture/ARCHITECTURE.md) and [acceptance](../architecture/ACCEPTANCE_CONTRACT.md).
+Status: proposed v0.2, revised 13 October 2026. Contracts: [architecture](../architecture/ARCHITECTURE.md), [local agent](../architecture/LOCAL_AGENT.md) and [acceptance](../architecture/ACCEPTANCE_CONTRACT.md).
 
 ## Agent workflow
 
 Publish one harness-neutral skill pack with four entry points: `kb-ingest`, `kb-query`, `kb-curate` and `kb-synthesize`. Each names its version, supported service/schema versions, inputs, outputs, relevant protocols and resume behavior. Installers translate configuration/discovery; they do not fork the workflow or validator rules for each harness.
 
+The [GEWU source pack](../../agents/gewu/README.md) follows the owner's RESEARCH workspace pattern: profile, shared protocols, modular skills and coordinating pipeline instructions. The selected host supplies the model/runtime. Its manifest currently declares no verified service compatibility. Install into a dedicated research workspace and preserve existing profiles; source-pack creation is not host installation or a successful connection. Local host execution does not establish local-only inference.
+
+Pin pack/skill/pipeline content for active runs, and record version/hash bindings with checkpoints. A profile cannot enforce isolation through prose; service capabilities and deployment permissions remain authoritative. A pipeline Markdown file cannot guarantee durable scheduling. Resume uses service status/receipts and retained output artifacts; missing compatibility or unavailable old instructions must be reported explicitly.
+
 An ingestion run reads explicit project intent, registers a source artifact, records coverage and skips, extracts bounded proposals, supplies evidence-bound support assessments, submits bundles and reports receipts. The service persists the run but does not execute the agent's reasoning stages. A resume inspects existing source/proposal IDs and verified artifacts before repeating work.
 
 Query results preserve citations, scope, dates, omissions and uncertainty. Curators propose corrections, contradiction links and duplicate candidates without overwriting disagreements. Synthesis cites accepted node revisions and records dependencies; later input changes produce warnings until an external agent proposes a refresh.