docs: mark secrets contract complete

05_Official_Plugins.md

@@ -317,6 +317,12 @@ secrets.write-ui
 - доступ к secret-store должен идти через permissions;
 - плагины не получают `secrets.read` автоматически.
 
+Текущий статус: platform contract defines the draft `secret-store`,
+`secrets.read-ui`, and `secrets.write-ui` capabilities plus dangerous
+`secrets.read` / `secrets.write` permissions in the SDK manifest contract.
+Encrypted local storage and the official UI-only Secrets plugin are still
+future work.
+
 ## 11. `official.templates`
 
 Назначение:

07_Full_Implementation_Roadmap.md

@@ -187,7 +187,7 @@ notes or plain files.
 
 Tasks:
 
-- define secret-store capability and permissions;
+- [x] define secret-store capability and permissions;
 - implement encrypted local secret storage;
 - add UI-only official secrets plugin;
 - integrate secret references with workspaces without exposing raw values to