Add challenge and exclusion review handling

docs/ASSESSMENT-OPERATIONS.md

@@ -27,7 +27,8 @@ Every run needs:
 
 The target profile describes the candidate system or artifact being assessed.
 The assessment profile selects frameworks, extensions, check groups, runtime
-policy, waivers, expectations, and output policy.
+policy, expectations, waivers, challenges, authority exclusions, and output
+policy.
 
 ## CLI Flow
 
@@ -99,10 +100,10 @@ artifacts/
 ```
 
 `sources.lock.json` records the framework refs, extension versions, mapping
-sets, profile snapshots, policy refs, authority refs, and extension metadata
-hooks used for the run. `reports/submission-package.json` points at the
-reviewable package files, includes checksums where files exist, carries the raw
-artifact manifest, and repeats the certification boundary. It is a portable
+sets, profile snapshots, policy and review refs, authority refs, and extension
+metadata hooks used for the run. `reports/submission-package.json` points at
+the reviewable package files, includes checksums where files exist, carries the
+raw artifact manifest, and repeats the certification boundary. It is a portable
 handoff manifest for preparation evidence, not an authority-specific final
 submission.
 
@@ -200,6 +201,23 @@ Individual evidence items use:
 - `expected_gap`
 - `infrastructure_error`
 
+## Review State
+
+Assessment profiles may reference:
+
+- `expectations_ref`: known target posture, optional scope, or accepted gaps,
+- `waivers_ref`: approved, time-bounded exceptions,
+- `challenges_ref`: review claims that a finding, check, mapping, or native
+  result should be challenged,
+- `exclusions_ref`: authority or program exclusions that apply to selected
+  findings.
+
+Challenges and exclusions annotate findings and evidence. They do not silently
+turn failures into passing evidence and they do not reduce the
+`unexpected_findings` count used by default gates. Retained summaries expose
+separate counts for expected findings, waived findings, challenged findings,
+authority exclusions, unresolved defects, and unresolved review items.
+
 ## Candidate System Checklist
 
 Before starting a run against candidate software, confirm: