diff --git a/.context/PROJECT.md b/.context/PROJECT.md
index cb84d7d..c4135e0 100644
--- a/.context/PROJECT.md
+++ b/.context/PROJECT.md
@@ -55,12 +55,15 @@ assessor-loop ledger) → `06 PR → CI` (go test/vet/lint/govulncheck + **var-g
 This repo is built *through* the workflow it depicts. It is `dispatch-allow`-enabled, and its
 own build increments are governed by a **var-go Oath** embedded in their spec issues (see the
 Stage-03 tracking issue). Bootstrapping honesty (per swedsl honest-stub discipline): `cmd/vargo-gate`
-is wired into `.gitea/workflows/cd.yml`'s `oath` job (issue #1) — it runs on every pull_request,
-fetches the linked issue's oath, and posts a `var-go/oath` commit status. But its candidate is
-still a hardcoded toy self-test registry, not a real PR-diff checker (swedsl's Executor question,
-swedsl#27, is unbuilt) — it fails closed against any real oath. The status is **not** required by
-branch protection, so it can't block merges yet; enabling that waits on the real-diff Executor.
-Disclosed in the CI config comment, this doc, and `docs/INCEPTION-OATH.md`.
+is wired into `.gitea/workflows/cd.yml`'s `oath` job (issue #1, verified with a real PR) — it runs
+on every pull_request, fetches the linked issue's oath, and posts a `var-go/oath` commit status.
+But its candidate is still swedsl's hardcoded toy self-test registry, not cad-atlas's own — it
+fails closed against any real oath. var-go's Executor/Reviewer path is **not** the blocker (that
+was explicitly killed by swedsl's ADR-0002, swedsl#27 — var-go is gate-only by design, each
+consumer supplies its own candidate). The real blocker is `swedsl/oath`'s import path
+(`swedsl#35`); once fixed, cad-atlas writes its own candidate (`#8`). The status is **not**
+required by branch protection, so it can't block merges yet. Disclosed in the CI config comment,
+this doc, and `docs/INCEPTION-OATH.md`.
 
 ## Brain references (source of truth — `brain_get <path>`)
 
diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index 7ececc2..e7d39f5 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -68,8 +68,9 @@ jobs:
     # own #1. A red or green "var-go/oath" status here currently proves the WIRING
     # (fetch issue -> gate -> post commit status) runs end-to-end on a real PR, not
     # that the PR satisfies its linked issue's oath. Deliberately NOT required by
-    # branch protection until swedsl ships a real-diff Executor (swedsl#27) — making
-    # it required now would permanently block every cad-atlas PR.
+    # branch protection until cad-atlas has its own candidate matching its real oath
+    # vocabulary (#8, blocked on swedsl/oath's import path, swedsl#35) — making it
+    # required now would permanently block every cad-atlas PR.
     if: needs.guard.outputs.is_template != 'true' && github.event_name == 'pull_request'
     runs-on: self-hosted
     steps:
diff --git a/docs/INCEPTION-OATH.md b/docs/INCEPTION-OATH.md
index 846ec24..5f01fa9 100644
--- a/docs/INCEPTION-OATH.md
+++ b/docs/INCEPTION-OATH.md
@@ -25,7 +25,7 @@ Oath holds. Methodology: brain `wiki/homelab/decisions/inception-sprint-and-oath
 |---|--------|--------|----------|
 | S1 | Atlas served at `/`, renders all 9 stages signal→pod | ✅ | `internal/web/handler.go` + `static/cad-atlas.html` |
 | S2 | Oath covered in the viz (stages 03 + 06) | ✅ | var-go Oath nodes in the atlas |
-| S3 | `var-go/oath` enforces cad-atlas's own PRs | ⏸ **wired, not enforcing → #1** | `oath` job runs + posts status (#1). Not branch-protection-required: candidate is still a toy self-test, fails closed on every real oath until swedsl's Executor (swedsl#27) exists. See honesty rule. |
+| S3 | `var-go/oath` enforces cad-atlas's own PRs | ⏸ **wired, not enforcing → #8** | `oath` job runs + posts status (#1, verified with a real PR). Not branch-protection-required: candidate is still swedsl's toy self-test, fails closed on every real oath. Blocked on `swedsl/oath` import path (swedsl#35) → cad-atlas writing its own candidate (#8). Not blocked on an Executor — that path was killed by swedsl's ADR-0002. See honesty rule. |
 
 ## Deployment
 
@@ -38,9 +38,9 @@ namespace `cad-atlas`, 1 replica, `cad-atlas:80 → :8080` (manifests in `mathia
 
 A clause blocked by an external dependency is **descoped and tracked, never marked satisfied** —
 a self-lying Oath is a rubber stamp, the exact failure the Oath exists to prevent. S3's real
-enforcement depends on a var-go Executor (swedsl#27) + a published `oath` module; it is tracked as
-a fast-follow on **#1**, not claimed here. The `DMABE_GITEA_API_TOKEN` Actions secret is
-pre-provisioned so #1 can land without a secret-write.
+enforcement depends on `swedsl/oath` becoming importable (swedsl#35) and cad-atlas writing its own
+candidate (#8); it is tracked there, not claimed here. The `DMABE_GITEA_API_TOKEN` Actions secret
+is pre-provisioned so #1 landed without a secret-write.
 
 ## The Oath (advisory form)