Implement source lock and submission package baseline

docs/EXTENSION-SDK.md

@@ -71,7 +71,12 @@ The key runtime fields are:
 - `extension_type`: one of the supported archetypes from the architecture
   blueprint.
 - `supported_frameworks`: framework IDs this extension can contribute evidence
-  for.
+  for. Descriptor objects with `id`, `version`, `source_url`, and
+  `authority_ref` may be used when source metadata is available.
+- `authorities`: authority IDs or descriptor objects with optional source URL,
+  version, license, and access notes.
+- `metadata`: optional extension-level metadata such as adapter version or
+  source URL. The core preserves it in source locks and evidence metadata.
 - `check_groups`: named groups that assessment profiles can select.
 - `preflight_runner`: optional runner ID used before selected check groups.
 - `runner_entrypoints`: concrete runner declarations.
@@ -141,6 +146,11 @@ Example:
   "module_path": "src/open_cmis_tck/preflight.py",
   "callable": "run",
   "command": null,
+  "metadata": {
+    "harness_id": "opencmis-tck",
+    "harness_version": "extension-detected-or-declared",
+    "source_url": "https://chemistry.apache.org/java/opencmis.html"
+  },
   "description": "Checks whether the CMIS Browser Binding endpoint is reachable."
 }
 ```
@@ -272,11 +282,20 @@ Result fields:
 - `observations`: human-readable observations.
 - `facts`: structured facts extracted by the runner.
 - `artifact_refs`: references to raw artifacts written by the runner.
+- `requirement_refs`: optional requirement refs discovered by the runner.
+- `metadata`: optional generic metadata such as `harness_version`,
+  `test_suite_id`, `adapter_version`, `source_url`, or native result IDs.
 
 Artifact refs must be paths relative to the run directory. After runner
 execution, the core fingerprints existing artifact refs into the assessment
 package `artifact_manifest`.
 
+Runner metadata is merged with manifest entrypoint metadata and preserved under
+evidence `facts.source_metadata`. The same metadata is also summarized in the
+submission package manifest, which lets reviewers distinguish the extension
+version from the harness or native test-suite version without adding
+domain-specific fields to the core.
+
 If a Python runner raises an exception, the core converts that failure into
 `infrastructure_error` evidence so the assessment package remains complete.
 
@@ -298,6 +317,9 @@ extension can add a normalizer descriptor:
   "module_path": "normalizers/native_probe.py",
   "callable": "normalize",
   "runner_ref": "native-probe",
+  "metadata": {
+    "adapter_version": "0.1.0"
+  },
   "description": "Converts native runner output into guide-board evidence."
 }
 ```
@@ -340,6 +362,7 @@ The core merges the normalizer output over the runner result:
 - `observations` are appended.
 - `facts` are merged.
 - `artifact_refs` and `requirement_refs` are deduplicated.
+- `metadata` is merged.
 - `normalizer_refs` is recorded in evidence facts when any normalizer runs.
 
 If a normalizer raises an exception, the step becomes
@@ -350,6 +373,25 @@ The bundled `extensions/sdk-fixture` extension is the copyable reference path
 for profile schemas, a native-output runner, a normalizer, mappings, and fixture
 profiles.
 
+## Source Lock And Submission Package
+
+Every new run writes `sources.lock.json` and
+`reports/submission-package.json`. Extension authors should treat source
+metadata as part of the evidence contract:
+
+- declare extension, authority, framework, runner, and normalizer metadata in
+  `extension.json` when it is static;
+- return runner or normalizer `metadata` when versions, native result IDs, or
+  test-suite IDs are detected at runtime;
+- keep mapping sets under `mappings/` so the core can checksum them in the
+  source lock;
+- keep restricted or licensed assets referenced by metadata or artifacts rather
+  than vendored into the core.
+
+The submission package manifest is generic guide-board output. Authority-specific
+final submissions, trademark assertions, or certification conclusions remain
+extension-owned or reviewer-owned.
+
 ## Result Statuses
 
 Initial statuses: