Summary

• Tighten docs/sdlc-harness boundaries against the latest product architecture docs.
• Clarify authoritative owners for task/audit facts, tool results, security decisions, readiness/gate projections, and QDP projections.
• Reduce early SDLC scope for P0/P1 events, metrics, graph/eval/gate behavior, and separate product runtime P0 OpenCode-compatible plugin slice from later full runtime work.

Fixes: N/A

Type and Areas

Type: docs

Areas: docs, architecture, SDLC Harness

Motivation / Impact

This addresses architecture-review findings where SDLC Harness docs could be read as over-designing early phases, assigning Quality Data Plane too much ownership, or replacing the product architecture P0 plugin runtime slice with a future-only contract.

No runtime or schema behavior changes are introduced. The docs now state that product runtime P0 still needs the Desktop settings/command + CLI diagnostics OpenCode-compatible plugin vertical slice, while writable JS/TS plugin runtime, non-Desktop/CLI full runtime, ACP permission bridge, and ecosystem-wide compatibility remain separate product decisions after that slice.

Verification

• Independent third-party review: initial review found owner/prod-scope issues; follow-up review returned Ready with no findings.
• git fetch gcwing main --prune
• git rev-list --left-right --count HEAD...gcwing/main -> 1 0
• rg scan for old conflicting SDLC Harness boundary wording -> no matches
• git diff --check -> exit 0; only LF-to-CRLF working-copy warnings

Runtime tests were not run because this PR changes documentation only.

Reviewer Notes

• This PR is a documentation boundary fix, not an implementation of plugin runtime, QDP schema, or gate behavior.
• QDP is described as an append-only event/fact projection and query layer, not the authoritative owner of task, tool, security, or gate state.
• P0+ in the plugin context is explicitly disambiguated from SDLC Harness P1.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.