Close Milestone 4 with adapter adoption evidence

docs/CONTRACT.md

@@ -29,6 +29,9 @@ commit when Git is available; it cannot change repository state.
 - Projection package: `schemas/projection-package.schema.json`, version 1.
 - Projection receipt: `schemas/projection-receipt.schema.json`, version 1.
 - Independent projection policy: `schemas/projection-policy.schema.json`, version 2.
+- Adapter launcher: `schemas/adapter-launcher.schema.json`, version 1.
+- Adapter client configuration: `schemas/adapter-client-configuration.schema.json`, version 1.
+- Reference adapter configuration: `schemas/reference-adapter.schema.json`, version 1.
 - Index schema: version 3, disposable and reproducible.
 - Index attestation: schema version 1, disposable and reproducible.
 - Core, CLI, and MCP server: version 1.3.0.dev0.
@@ -103,6 +106,42 @@ complete projection, opens SQLite, starts MCP, executes the configured command,
 builds, renders, starts a viewer, or writes configuration. Unprovable client behavior is a warning,
 not an invented success.
 
+## Public adapter SDK and reference binding
+
+`docforge.adapter_sdk` is the stable adapter-authoring import boundary. It exposes the typed
+projection, manifest, source contribution, complete assembly, project wrapper, graph model, and
+conformance contracts needed by an adapter without requiring authors to import core implementation
+modules.
+
+Complete evidence includes the primary graph and function Logic. An incremental adapter that
+publishes Logic must implement `load_complete_assembly()` as an independent complete oracle.
+`verify_adapter_conformance()` proves repeated complete determinism, equality between the complete
+assembly and `load_projection()`, and exact complete/incremental graph-plus-Logic parity. Separate
+tests remain responsible for confinement, restart behavior, no-AST behavior, cache recovery, and
+retrieval.
+
+Adapter assemblies are bounded before publication. Primary nodes use the descriptor `max_nodes`
+limit. Primary edges, Logic nodes, and Logic edges use fixed deterministic multipliers over that
+limit. Version-1 extraction caches are regular-file-only, bounded to 10,000 sources and
+64,000,000 bytes, and are treated as misses when corrupt, oversized, foreign, or incompatible.
+
+`.docforge/reference-adapter.toml` is a closed version-1 selection among `python`, `javascript`,
+`typescript`, and `cpp`. It declares one project identity and explicit non-overlapping source
+roots. C++ additionally requires a confined `compile_commands.json`. It cannot declare a command,
+module, environment, writer, applier, or remote endpoint.
+
+`python -m docforge.reference_mcp --project-root ROOT` constructs only the selected fixed
+repository reference adapter and exposes the read surface. It never registers proposal or
+application tools.
+
+`AdapterLauncherV1` is an immutable project-bound Python-module declaration. It accepts no
+arbitrary command, arguments, working directory, environment, discovery, callable selector, or
+module reload. Custom launchers resolve one installed top-level module through isolated Python and
+require its origin inside the project root. The fixed `docforge.reference_mcp` module is the only
+trusted dotted exception. `generate_adapter_client_configuration()` binds generated Codex,
+Claude, and OpenClaw fragments to that launcher, current source availability, effective policy,
+descriptor, interpreter, and exact artifact bytes.
+
 ## Isolated proposal model
 
 Create, update, move, and delete are ordered node operations inside an isolated changeset. Every