feat: add institutional governance and recovery contracts

docs/EXTERNAL_REFERENCES_AND_INTEGRATION_MATURITY.md

@@ -35,6 +35,26 @@ Connectors must declare and document the maturity they actually implement.
 handling, deletion semantics, and observable failures. A link-only connector
 must not imply that GovOPlaN holds an authoritative copy.
 
+## Source Authority Is A Separate Dimension
+
+Integration maturity states what an adapter is capable of doing. It does not
+decide which system owns truth for a configured object or field group. A
+binding separately selects one of the source-authority modes defined by the
+[institutional governance target architecture](../../govoplan/docs/INSTITUTIONAL_GOVERNANCE_TARGET_ARCHITECTURE.md):
+
+- `native_authoritative`
+- `external_authoritative`
+- `external_mirror`
+- `governed_sync`
+- `governance_overlay`
+- `linked_reference`
+
+A connector can therefore support `synchronize` while a tenant deliberately
+uses it only as an external mirror. Conversely, a native GovOPlaN object may
+retain link-only references to several external systems. Authority may be
+narrowed by tenant, organization, service, object type, object, field group, or
+process step and must be visible in provenance and configuration preflight.
+
 ## Domain Ownership
 
 - Domain modules own native GovOPlaN objects and their authorization.