From 3e6e21bf0aa91e1d9a2997074548ea2b899fea41 Mon Sep 17 00:00:00 2001
From: Daniel Samson <12231216+daniel-samson@users.noreply.github.com>
Date: Sat, 1 Aug 2026 04:44:57 +0100
Subject: [PATCH] docs: security track group 2 merged

---
 docs/security-track-plan.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/security-track-plan.md b/docs/security-track-plan.md
index 38fbec6..6cba676 100644
--- a/docs/security-track-plan.md
+++ b/docs/security-track-plan.md
@@ -64,7 +64,7 @@ group boundary.
   the manifest gained a third permission, `supervise`, which names an authorized
   supervising task per contract and is deliberately **open-only**, leaving P2's
   bind attestation and every refusal it makes untouched (suite 109/109)
-- [ ] **merge** group 2 → main, push
+- [x] **merge** group 2 → main, push
 - [ ] **P4a** — clean protocols rebased onto `Define` (vfs, block, display, scanout, input)
 - [ ] **P4b** — misfit protocols rebased (device-manager, power, usb-transfer)
 - [ ] **P4c** — harness subscriber lift + badge-scoped per-client integers