docs(architecture): define admitted executable operation packages

docs/adr/0015-registry-provider-host-boundary.md

@@ -3,7 +3,9 @@
 
 # ADR 0015: Registry, Provider, and Host Boundary
 
-- **Status:** Accepted
+- **Status:** Partially superseded
+- **Superseded in part by:**
+  [ADR 0023](0023-admitted-executable-operation-packages.md)
 - **Date:** 2026-07-13
 
 ## Context
@@ -31,6 +33,18 @@ query, and compatibility mappings before mutating engine state.
   coordinates to the application.
 - Application nouns remain in contracts and adapters outside Echo core.
 
+## Partial Supersession
+
+ADR 0023 governs newly authored executable operation packages. Their semantic
+execution must come from an admitted program interpreted by Echo rather than a
+host-supplied application matcher, executor, or footprint callback.
+
+This record remains authoritative for provider-v1 callback-shaped
+compatibility infrastructure and for the separation between application,
+runtime-owner, registry, and installation authority while that corridor is
+retained. Provider v1 is not silently reinterpreted as the new executable
+operation category.
+
 ## Evidence Anchors
 
 - `docs/architecture/application-contract-hosting.md`

docs/adr/README.md

@@ -36,14 +36,15 @@ track work, progress, priority, or release readiness.
 | [0012](0012-repository-knowledge-model.md)                       | Accepted             | Repository knowledge model after Method                        |
 | [0013](0013-echo-continuum-authority-boundary.md)                | Accepted             | Echo and Continuum authority boundary                          |
 | [0014](0014-generated-rule-authorship-and-footprints.md)         | Accepted             | Generated rule authorship and footprint honesty                |
-| [0015](0015-registry-provider-host-boundary.md)                  | Accepted             | Compiler, registry, provider, and host responsibilities        |
+| [0015](0015-registry-provider-host-boundary.md)                  | Partially superseded | Compiler, registry, provider, and host responsibilities        |
 | [0016](0016-continuum-transport-identity.md)                     | Accepted             | Causal transport identity and idempotence                      |
 | [0017](0017-universal-little-endian-codec.md)                    | Accepted             | Canonical little-endian binary boundary                        |
 | [0018](0018-sessions-causal-posture-and-authority.md)            | Accepted             | Sessions as causal contexts                                    |
 | [0019](0019-bunny-owns-reusable-geometry.md)                     | Accepted             | Bunny owns reusable geometry                                   |
 | [0020](0020-retained-reading-storage-and-proof-boundary.md)      | Accepted             | Retained reading storage and proof boundary                    |
 | [0021](0021-public-optic-observation-boundary.md)                | Accepted             | Public WARP optic over internal observation                    |
 | [0022](0022-application-requested-causal-anchor-admission.md)    | Accepted             | Application-requested, Echo-owned anchor admission             |
+| [0023](0023-admitted-executable-operation-packages.md)           | Accepted             | Admitted executable operation packages                         |
 
 ADR 0006 predates this index contract and did not declare a status. Its
 superseded tombstone preserves that fact without silently ratifying the old

docs/architecture/application-contract-hosting.md

@@ -66,6 +66,7 @@ Current authority for this boundary lives in:
 - [Runtime authority](../topics/RuntimeAuthority.md)
 - [Registry, provider, and host boundary](../adr/0015-registry-provider-host-boundary.md)
 - [Generated rule authorship and footprints](../adr/0014-generated-rule-authorship-and-footprints.md)
+- [Admitted executable operation packages](../adr/0023-admitted-executable-operation-packages.md)
 - [Declarative rule authorship](../invariants/DECLARATIVE-RULE-AUTHORSHIP.md)
 
 ## Ownership Split
@@ -144,6 +145,19 @@ mutation-specific; generated reads remain a separate bounded observer/optic
 crossing. Neither compiler path may claim that generated authority facts are
 Echo runtime authority.
 
+The preceding paragraph describes the implemented provider-v1 compatibility
+corridor. [ADR 0023](../adr/0023-admitted-executable-operation-packages.md)
+accepts a distinct, not-yet-implemented executable-operation category for new
+application mutations. That category installs a digest-bound declarative
+program interpreted by Echo and exposes no application matcher, executor, or
+footprint callback. Provider v1 remains stable while consumers migrate; it is
+not renamed or silently reinterpreted as the executable-operation corridor.
+The program digest supplies executable meaning only: it cannot independently
+confer an operation coordinate, invocability, or authority, and Echo cannot
+install or invoke it naked. The admitted Edict operation package binds the
+public contract and semantic closure to the exact program, after which Echo
+independently admits each invocation.
+
 ## External Edict Provider Artifacts
 
 Echo also owns the runtime-specific semantics supplied to Edict's generic