Implement source lock and submission package baseline

workplans/GUIDE-BOARD-WP-0004-source-lock-and-submission-package-baseline.md

@@ -4,12 +4,12 @@ type: workplan
 title: "Source Lock And Submission Package Baseline"
 repo: guide-board
 domain: markitect
-status: active
+status: completed
 owner: codex
 planning_priority: high
 planning_order: 4
 created: "2026-05-15"
-updated: "2026-05-15"
+updated: "2026-05-16"
 state_hub_workstream_id: "6dd2832b-d1d9-43bc-ad5c-d16f399930dc"
 ---
 
@@ -41,7 +41,7 @@ submission rules, and licensed or restricted assets remain extension-owned.
 
 ```task
 id: GUIDE-BOARD-WP-0004-T001
-status: todo
+status: done
 priority: high
 state_hub_task_id: "d5a7a18f-941b-47b8-9992-2cb54bc5ad06"
 ```
@@ -55,11 +55,20 @@ Acceptance:
 - Keep the schema backward-compatible with existing retained runs.
 - Add tests for source lock shape and retained run compatibility.
 
+Progress:
+
+- Added `docs/schemas/source-lock.schema.json`.
+- Expanded run-plan source locks with framework, extension, mapping-set,
+  profile snapshot, policy-ref, authority, and metadata-hook records.
+- Preserved the original `framework_refs` and `extension_refs` fields for
+  retained-run compatibility.
+- Added tests for source-lock shape and older retained summary compatibility.
+
 ## D4.2 - Harness And Extension Metadata Hooks
 
 ```task
 id: GUIDE-BOARD-WP-0004-T002
-status: todo
+status: done
 priority: high
 state_hub_task_id: "7abd5a66-5784-41b9-a361-6572290923cc"
 ```
@@ -75,11 +84,20 @@ Acceptance:
   provide this metadata yet.
 - Cover the SDK fixture and at least one no-metadata extension path in tests.
 
+Progress:
+
+- Added optional manifest metadata for extensions, authorities, frameworks,
+  runner entrypoints, and normalizers.
+- Preserved runner and normalizer returned `metadata` and requirement refs.
+- Recorded merged metadata under evidence `facts.source_metadata`.
+- Updated `sdk-fixture` to exercise harness, test-suite, adapter, source URL,
+  and native result metadata while keeping `sample-noop` as a no-metadata path.
+
 ## D4.3 - Submission Package Manifest
 
 ```task
 id: GUIDE-BOARD-WP-0004-T003
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "c54273d6-1fc2-4444-92cf-74f2a5e614ec"
 ```
@@ -95,11 +113,21 @@ Acceptance:
   packs.
 - Document how this differs from an authority-specific final submission.
 
+Progress:
+
+- Added `docs/schemas/submission-package.schema.json`.
+- Wrote `reports/submission-package.json` for each run.
+- Included package identity, source lock checksum, report paths, normalized
+  output paths, profile snapshots, artifact manifest entries, reported
+  metadata, and the certification boundary.
+- Exposed the submission manifest path in CLI/service run results and retained
+  report refs.
+
 ## D4.4 - Documentation And Acceptance Tests
 
 ```task
 id: GUIDE-BOARD-WP-0004-T004
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "ad37baeb-973c-4399-96d0-c9cb7fc6b761"
 ```
@@ -113,6 +141,15 @@ Acceptance:
 - Include compatibility notes for older retained runs.
 - Keep the output paths aligned with existing CLI and service result retrieval.
 
+Progress:
+
+- Updated assessment operations, extension SDK, architecture blueprint, and
+  README references.
+- Added focused unit assertions for the sample and SDK fixture assessment
+  outputs.
+- Kept retained run listing compatible with older `retention-summary.json`
+  files that do not reference a submission manifest.
+
 ## Definition Of Done
 
 - Every new run writes a richer source lock and submission package manifest.