Define governed forms runtime profiles

docs/FORMS_RUNTIME_DOMAIN_BOUNDARY.md

@@ -71,6 +71,35 @@ stores only same-tenant evidence references. Cases and Workflow Engine retain
 their own target state; Runtime stores only a permitted same-tenant handoff
 reference and status evidence.
 
+## Approved Intake And Evidence Profiles
+
+The product and security profile approved on 2026-08-04 sets the next
+implementation boundary:
+
+- authenticated-account and invitation-token intake are the first public entry
+  profiles;
+- anonymous intake is available only through an explicit per-form policy
+  opt-in, while a pseudonymous profile remains deferred;
+- an anonymous submission cannot later be claimed by an identity; an invitation
+  submission can be linked only with explicit consent and proof of that
+  invitation;
+- invitation tokens are hashed, tenant/form bound, replay safe, rate limited,
+  and expire after 14 days by default;
+- drafts expire after 30 days by default, while every service/form must declare
+  submitted-data retention explicitly; and
+- CAPTCHA remains an optional privacy-approved provider instead of a mandatory
+  external dependency.
+
+Files is the first attachment provider and retains byte storage, quarantine,
+scanning, classification, retention, and legal-hold ownership. Runtime stores
+only immutable same-tenant evidence references and must fail closed when a
+required item is pending, rejected, expired, unavailable, or unverifiable.
+
+The first native signature profile is an authenticated acknowledgement. It is
+not an advanced or qualified electronic signature. Those assurance levels
+require a separately selected external trust-service provider and current
+provider evidence; a required signature never silently degrades.
+
 ## Recovery And Operations
 
 Database recovery restores identities, revisions, and events together. After
@@ -84,8 +113,8 @@ Destructive retirement is blocked while state exists and requires a verified
 database snapshot plus an export or retention decision for referenced evidence.
 No local generated files are required, so API and worker nodes remain stateless.
 
-Anonymous public intake and concrete file/signature upload adapters remain
-product depth. Conditional multi-page definitions are resolved from Forms, and
+The approved public-intake and concrete file/signature provider profiles remain
+implementation depth. Conditional multi-page definitions are resolved from Forms, and
 native Case/Workflow handoffs execute automatically when the exact owner
 capability is installed. Additional target kinds remain adapter depth; the
 owner and security boundaries no longer depend on those additions.