Smith / Assimilation — foreign source to reviewed candidate #35

Planning representation replaced — 6 November 2026. The accepted Investigation and software-change applications outcome is retained in #62. Reopen one bounded task when selected. This closure does not mean the capability is complete or cancelled. The original scope and evidence below remain preserved; current selected work starts at #52.

Prepare one bounded foreign-code study and attributable local candidate, ending before activation.

Starting point: Current delivery: Assimilation is a governance protocol, not an implemented coordinator or automatic installer.

First working slice

• Create one Dossier with exact source/base revisions, license/provenance, desired local behaviour, allowed paths and a verification plan.
• Quarantine admitted source and produce a bounded candidate in a disposable workspace; foreign instructions cannot authorize tools, credentials or promotion.
• Return candidate diff, independent verification evidence and a typed promotion request; demonstrate rejection after base changes or missing provenance.

Connections: Uses #23, #33 and #21. Automated commands require #27; a foreign coding agent requires #28. Any executable application path must be admitted under #29, without inventing a second coordinator.

Later: Target-owned promotion, packaging, migration and activation with recovery; A2A teaching bundles enter the same quarantine.

References: Smith operating guide · ADR 35 · ADR 16 · ADR 18.

Shared candidate lifecycle: #40 owns Creation request → verified candidate → promotion request. This issue adds foreign-source provenance, license and quarantine requirements.

Contribution entry: Prepare one source/provenance dossier or rejection fixture.
Open decision: Choose the foreign source, bounded adaptation and independent verification target.
Verification: Quarantined candidate review; effects only through an admitted executor. Shared contribution and touched-docs rules: #52.