docs(kernel): drop the Security row from the runtime-services Source-of-Truth list, and gate that list

`services.security` is ruled an internal accessor, not a publicly documented
runtime accessor (maintainer ruling, 2026-08-18). The chapter's Source-of-Truth
list carried `Security: packages/spec/src/contracts/security-service.ts` while
`services.security` was documented nowhere under `content/docs/`, so the list's
own sentence -- "Each page links the canonical TypeScript source used to derive
signatures" -- was false for exactly that row: a reader following it landed on a
contract file with nothing explaining the accessor.

The row is dropped. No page is created and the accessor is not relocated. A short
note in its place says where security really lives for a reader who needs it: the
permissions chapter for access decisions, `permissions/explain` for the one
in-process call, and `ISecurityService` in kernel contracts for the interface an
implementation must provide. Five of the chapter's six enumerations already
omitted Security (meta.json "pages", the chapter list, the kernel/index.mdx
table, versioning.mdx's Current Matrix, the Stability Legend), so this is the
whole edit -- nothing else in the chapter names it.

check-runtime-services-index gains a sixth claim rather than losing one. That
list was left unheld on purpose while this was an open product question: any rule
written over it -- an allowlist entry included -- would have answered the question
in a gate, and #9684 pinned that restraint with two self-test assertions. Now
that it is ruled, "one row per page" is decidable, so the limb is built and those
two pins are re-aimed at the answer: the page-less row is CAUGHT, and caught as a
canonical-source row rather than misread as a stability claim. Membership runs
both ways, duplicates are rejected, and each row's path must be a file that
exists. Row ORDER is deliberately not held -- unlike the chapter list and the
matrix, this list has never followed meta.json nav order, and enforcing it would
re-sort a published list to a convention it never had.

The existing six checks are untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XqDQYVU5smx29ts9pAErja

Author: claude

.github/workflows/lint.yml

@@ -557,6 +557,17 @@ jobs:
       # too, and holds every stability LABEL it and the kernel/index.mdx table
       # publish to the page's own Stability bullet. That second half catches a
       # WRONG row, which membership checking passes silently.
+      #
+      # #9629 closed the last gap. The chapter's "Source of Truth" canonical-source
+      # list -- a SIXTH enumeration -- was deliberately left unheld while
+      # `services.security` was an open product question: it carried a row for a
+      # service with no page, and any rule written over the list would have
+      # answered that question in a gate rather than by ruling. The 2026-08-18
+      # maintainer ruling made the accessor internal, the row is dropped, and the
+      # list is now held to the pages too -- one row per page, labelled with the
+      # accessor, each path a file that exists. Row ORDER is deliberately still
+      # not held: unlike the chapter list and the matrix, this list has never
+      # followed meta.json nav order.
       - name: Runtime-services indexes enumerate the chapter's real pages
         run: pnpm check:runtime-services-index
 

content/docs/kernel/runtime-services/index.mdx

@@ -46,7 +46,6 @@ This chapter documents the runtime `services.*` APIs used in hook/action/flow/pl
 Each page links the canonical TypeScript source used to derive signatures.
 
 - Data: `packages/client/src/index.ts`
-- Security: `packages/spec/src/contracts/security-service.ts`
 - Sharing: `packages/spec/src/contracts/sharing-service.ts`
 - Queue: `packages/spec/src/contracts/queue-service.ts`
 - Email: `packages/spec/src/contracts/email-service.ts`
@@ -55,6 +54,14 @@ Each page links the canonical TypeScript source used to derive signatures.
 - Settings: `packages/services/service-settings/src/settings-service.ts`
 - Audit: `packages/plugins/plugin-audit/src/auth-event-audit.ts`
 
+`services.security` is **not** on this list. The kernel registers a `security` service,
+but it is an internal accessor rather than a documented runtime service, so this chapter
+has no page for it. For access decisions read the
+[permissions guide](/docs/permissions) — the one in-process call most readers need is
+shown in [Explain Access](/docs/permissions/explain) — and the interface an
+implementation must provide, `ISecurityService`, is listed with the other
+[kernel contracts](/docs/kernel/contracts).
+
 <Callout type="warn" title="Not this: the settings audit sink">
 A second audit shape shares the word and is easy to reach for by mistake.
 `SettingsAuditSink` — canonical source