more audit work

src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/TASKS.md

@@ -5,6 +5,6 @@ Source of truth: `docs/implplan/SPRINT_20251229_049_BE_csproj_audit_maint_tests.
 
 | Task ID | Status | Notes |
 | --- | --- | --- |
-| AUDIT-0252-M | DONE | Revalidated 2026-01-07. |
-| AUDIT-0252-T | DONE | Revalidated 2026-01-07. |
-| AUDIT-0252-A | TODO | Revalidated 2026-01-07 (open findings). |
+| AUDIT-0053-M | DONE | Revalidated 2026-01-08. |
+| AUDIT-0053-T | DONE | Revalidated 2026-01-08. |
+| AUDIT-0053-A | TODO | Revalidated 2026-01-08 (open findings). |

src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/AGENTS.md

@@ -0,0 +1,20 @@
+# AlexMAS.GostCryptography (Vendored) AGENTS
+
+## Purpose & Scope
+- Working directory: `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/`.
+- Role: document reviewer for audit purposes only.
+- Vendored code; treat as read-only unless a sprint explicitly authorizes changes.
+
+## Required Reading (treat as read before DOING)
+- `docs/README.md`
+- `docs/07_HIGH_LEVEL_ARCHITECTURE.md`
+- `docs/modules/platform/architecture-overview.md`
+- Relevant sprint notes for third-party handling.
+
+## Working Agreements
+- Do not reformat or modify vendored sources unless explicitly approved.
+- Record audit findings in the sprint report and leave APPLY tasks waived unless approved.
+- Keep all updates ASCII-only.
+
+## Testing & Validation
+- Do not execute third-party tests unless the sprint explicitly requests it.