docs(access-control-prover): locate family contract boundary

.kiro/specs/access-control-prover/design.md

@@ -127,6 +127,7 @@ src/openultrasast/
 │   ├── cst.py                            # receiver, arity and signature capture
 │   └── obligations/
 │       ├── abstract_domain.py            # relations, completeness, resources, authorities, judgments
+│       ├── core_contract.py              # production access-control FamilyContract
 │       ├── resolution.py                 # SymbolId, symbol index and CallTargetSet
 │       ├── summaries.py                  # monotone FunctionSummary computation over call components
 │       ├── paths.py                      # concrete evidence paths and cutoff records
@@ -153,6 +154,7 @@ benchmarks/valid/
 └── prover_admission.py                   # frozen-manifest admission orchestration
 tests/
 ├── test_obligation_abstract_domain.py
+├── test_obligation_core_contract.py
 ├── test_obligation_resolution.py
 ├── test_obligation_summaries.py
 ├── test_obligation_judgment.py

.kiro/specs/access-control-prover/spec.json

@@ -1,7 +1,7 @@
 {
   "feature_name": "access-control-prover",
   "created_at": "2026-10-14T13:48:18Z",
-  "updated_at": "2026-11-01T13:57:54Z",
+  "updated_at": "2026-11-01T14:01:30Z",
   "language": "en",
   "phase": "tasks-generated",
   "approvals": {

.kiro/specs/access-control-prover/tasks.md

@@ -333,7 +333,7 @@ its final resolution, dominance, fact-acquisition and measurement semantics with
 - [ ] 14. Reviewed detection-core fact adapter
 - [ ] 14.1 Define the production access-control family contract
   - Encode the versioned access-control security object, roles, three decision rules, residual question and closed incompleteness reasons through public detection-core types.
-  - Keep target names outside the contract while pinning every digest-affecting field, status, origin policy and ecosystem declared by the design.
+  - Keep target names confined to the reviewed ecosystem declaration while pinning every digest-affecting field, status, origin policy and decision semantic declared by the design.
   - Done when the canonical production contract validates, round-trips deterministically, and rejects every altered or undeclared role, decision, field and reason fixture.
   - _Requirements: 13.1_
   - _Boundary: Access-Control Family Contract_