artifact refs and manifest fingerprinting

workplans/GUIDE-BOARD-WP-0001-bootstrapping.md

@@ -184,6 +184,8 @@ Acceptance:
   of CMIS.
 - The baseline executor writes the run directory contract, normalized evidence,
   an assessment package, and a Markdown report.
+- The assessment package includes a fingerprinted artifact manifest for
+  runner-emitted raw artifacts.
 
 ## D1.7 - Extension SDK Skeleton
 
@@ -204,6 +206,8 @@ Acceptance:
 - Python module runner contracts are documented in `docs/EXTENSION-SDK.md`.
 - Manifest-declared command runners execute without shell expansion and return
   normalized evidence through the same runner result contract.
+- Runner artifact refs are constrained to the run directory and fingerprinted in
+  the assessment package artifact manifest.
 
 ## D1.8 - CMIS Seed Extension Integration