D5-S18 — Packages, documentation and the corrected plan

[The-Running-Dev]

Someone outside this repository can take Platform's commercial surface as published packages, follow written instructions to build either deployment shape, and find the effort's own plan describing what was actually built rather than what was once intended.

Done when

• S18.1 Every D5 package is packed in CI as a versioned 0.x artifact, and the sample solution restores them from those artifacts rather than through project references.
• S18.2 SubZeroDev.Platform.Testing exposes a fake principal of each of the four kinds, a fake tenant resolver, a fake entitlement contributor, a fake permission provider, an audit inspector and the composition profile on the test host — and no fake organization, subscription or licence.
• S18.3 The audit inspector reads records and exposes no write and no clear.
• S18.4 The human-facing documentation covers registration, optional composition, both deployment shapes, security defaults, failure semantics and the sample's asserted scenarios, and the documentation build passes with no broken link.
• S18.5 implementation-plan.md's D5 capability list includes Platform.Mcp, and its done-when matches 00-brief.md.
• S18.6 The retained consumer-evidence objection for Authorization, Licensing, Audit and the shared web UI is recorded in 90-decisions.md and is not written as resolved.

---

Agent instructions

Run /slice S18.

• Scope and criteria: design/30-slices.md § S18 @ d752008
• Signatures: design/20-contract.md
• Depends on: S17.
• Out of scope here: publishing to a public registry, and onboarding any named consumer — external adoption is separate work.

Stop conditions and procedure: .claude/commands/slice.md. Not restated here.