B2: a second source canary against a different real product

[ChelseaKR]

Track B phase 2 in docs/ROADMAP.md, blocked by #51.

The roadmap flags this as the first thing the freeze forbids, and it carries two prerequisites of its own:

• its own ADR;
• a threat-model update.

Today there is one source canary (Directus 11.17.4, with an adversarial derivative) and one target-roundtrip canary (CiviCRM 6.16.2, with indexed verified evidence). A second source is what turns one worked pair into evidence about the shape.

Blocked on: #51.

Done when: a second real product has a source canary, with the ADR and threat-model update landed alongside it.

Imported from docs/ROADMAP.md (Track B) with AI assistance.

[ChelseaKR]

Triaged 2026-09-06 against origin/main at 857a411. Blocked three ways, and two of the three are not #51.

Nothing has been started: no open pull request, no branch, no git log --all --grep '#110' hit, and no second source normalizer anywhere in the tree — examples/ holds exactly the two canaries the issue names (directus-11.17.4-civic-case and civicrm-6.16.2-target-roundtrip) plus the synthetic CRM fixtures.

The three blockers, in the order they bite:

1. The freeze. docs/ROADMAP.md names a second source canary as "the first thing the freeze forbids", and the freeze is opened only by Outside-person demo walkthrough (usability gate) #51 — by a person who did not build this, per the roadmap's own gate table.
2. A real product, obtained and run. A source canary here is not a fixture: the Directus one was captured from a real local Directus 11.17.4 instance under the conditions docs/DATA-GOVERNANCE.md spells out (isolated synthetic sandbox, digest-pinned Compose topology, run-owned volumes, no host port). Choosing which product is a product-direction call, and standing up its lab is not something this repository's automation can do on its own.
3. An ADR and a threat-model update, before the code. Both are REVIEW-gated in the roadmap's metrics table with the maintainer as owner. An agent-written threat model for a trust surface nobody has yet observed would be the "check that reports a clean result whether or not it is still checking anything" that Track A exists to remove.

Deliberately not built. The one piece that could be written ahead — a skeleton ADR — is the piece AGENTS.md most directly forbids: a shared design invented before two real pairs exist. Nothing was written.

Prepared with AI assistance; reviewed before submission.