[PLT.46] Publish the four Security packages and record package-level integration evidence

[deku2026]

Publish the four ArcForges Security packages and record package-level real-integration evidence (WP-11.90 package acceptance). This is a selected row of the Final.md scope.

Claim: PLT.46 epoch 1 (w-deku-20261010-plt-46)

Task record: Design docs/planning/delivery/delivery-graph.json PLT.46. Coordinator ruling S52 (brief section 12) narrows it to the four Security packages: helper, broker and per-RID helper packaging is out of scope and not completed. Planning repair fix8 carries the record text, and this PR merges after fix8.

Commits

• 4a5e1ee adds a new exact-row gitleaks block (S52(2)) for the successor Security.Secrets csproj digest lines in dependency-policy.json and in receipt plt-46-r1. No existing block changes and the any-receipt group is not widened. eng/test_dependency_policy.py registers the block, with positive and negative controls, and moves the active-digest pin while keeping the historical one.
• d1bb49c: IsPackable on ArcForges.Security, Security.Audit, Security.Secrets and Security.CapabilityEnforcement, with the ArcForges.Contributions pack-metadata pattern (S52(3)): PackageReadmeFile, README/LICENSE/NOTICE pack items, None Remove Tests/** where a Tests folder exists, and a Description where one was missing. It has no PackageId, reference or version change. The commit also adds four rows to eng/packaging/packages.json, the reconciliation blob refreshes, the dependency input rebinding, the immutable receipt plt-46-r1 (chained from nat-11-r1 with an unchanged closure; reviewer w-deku-20261010-rev-plt-46) and the files.json row.
• 61e11b7 records the pack and clean-consumer evidence in plt-46-r1.

ADP-07 supporting files (beyond the record writes)

• .gitleaks.toml and eng/test_dependency_policy.py (S52(2)).
• eng/test_desktop_rids.py: the active-receipt pin moves from nat-11-r1 to plt-46-r1, and the chain check now also covers gov-30-r1 (the NAT.11 D5 precedent). Intermediate commit d1bb49c fails this test, and 61e11b7 fixes it, so the history is not bisect-clean at that one commit.
• The three Security READMEs carry factual packaging-status lines, because they ship as the package readmes.

Evidence (local, under CI conditions; hosted CI is authoritative)

• Locked restore, format, a Release build, every pr-gate Python policy job, ArchitectureTests and the Security/Audit/Secrets/Capabilities suites.
• A pack of the six projects from the exact commit: the nuspec dependency sets match the generated rows.
• A local opt-in clean consumer, outside any checkout, with its own feed of only the owned ids. It ran a locked restore with warnings as errors, a JIT run and a Native AOT win-x64 publish and run, and the restored bytes equal the candidate bytes. Through the package boundary it exercised:
  • cross-boundary owner refusal through CapabilityEnforcementGate over the real CapabilityInvocationPipeline;
  • stale approval and lease revocation;
  • SecretBroker use without reveal;
  • a real AuditStore with the egress and lease sinks, read back, and a failing store refusing the transfer.
• gitleaks (pinned image, WSL Docker, full history): 0.
• Not proven:
  • The hosted candidate and the published bytes, until the main-push Publish NuGet run.
  • OS isolation, which is cross-referenced from PLT.45 (Windows). Linux is "blocked on a real Linux-kernel run of the PLT.45 profile, not proven". macOS is never claimed.
  • Durable audit of registry capabilities, because of a defect found here: AuditCapabilityId accepts only lowercase canonical keys, so the registry keys (for example IChatOperations.AppendUserMessage) fail closed. This is a WP-11 contract defect between the PLT.44 audit model and the registry/PLT.57 gate, and it is outside these writes. The coordinator assigns its fix before APP.03 composes durable audit with the gate. PLT.46 is therefore recorded delivered, not complete.

Notes

• Pre-existing, not caused by this PR: a Windows-only test isolation race in TracePolicyTests (the process-wide ActivityListener). It passes on Linux and hosted CI runs Linux. Also pre-existing: the actionlint queue key in publish-nuget.yml.
• Lockstep publication (RES-desktopplatform-package-inventory): the main-push Publish NuGet run publishes every package at one version.

🤖 Generated with Claude Code

[deku2026]

Independent review record: PLT.46 epoch 1. Reviewer w-deku-20261010-rev-plt-46 (Opus 5.5), an independent session that authored nothing.

Reviewed 61e11b7 for [PLT.46] epoch 1: approved.

Verified:

• All 15 changed paths are record writes or ADP-07/S52 supporting files.
• Receipt plt-46-r1 names this reviewer (decision approved, reviewedOn 2026-10-10), chains from nat-11-r1 (the receipt active on main), equals the policy mirror, and leaves the NuGet (58) and Python (10) closures unchanged. Only the four csproj files and packages.json changed as inputs.
• The gitleaks block follows the S52(2)/S50(3) form.
• The pack metadata is exactly the Contributions pattern. Package IDs equal the existing assembly names.
• Gates re-run under CI conditions in a fresh clone: the pr-gate Python jobs, managed build and tests, and pack. I ran my own clean consumer and gitleaks; both are clean.

Non-blocking (for the record):

• Durable audit defect. AuditCapabilityId accepts only lowercase canonical keys, so registry-key capabilities fail closed in the durable audit sinks behind the gate. I reproduced this independently. It is recorded honestly in plt-46-r1. PLT.46 is delivered, not complete. The coordinator must assign an owner before APP.03.
• eng/test_desktop_rids.py is an ADP-07 supporting edit and is listed in the PR body.
• ContentSandbox READMEs outside the writes still say "non-packable until PLT.46". Route them to fix8.
• A pre-existing Windows-only TracePolicyTests isolation race (passes on Linux and in hosted CI).
• The pre-existing actionlint queue key.