whetstone_DSL/sprint220_plan.md

Sprint 220 Plan: Security Propagation Contract Gate

Goal

Require explicit deny-by-default security propagation constraints.

Steps

• Step 2139: Enforce security.deny_by_default=true contract.
• Step 2140: Emit security contract invalid diagnostics.
• Step 2141: Add security category closure metrics in summary outputs.
• Step 2142: Include security contract packet in benchmark rows.
• Step 2143: Add Sprint220IntegrationSummary.h.