Conditional security and optional WAP profiles

1. OPT-1101Todo
   Record, alert, handshake, crypto, key exchange, certificate, and failure behavior are either implemented/tested or explicitly not claimed.→
2. OPT-1102Todo
   Identity-module capabilities remain separate from the data-only strict profile and have explicit host/security boundaries.→
3. OPT-1103Todo
   Push activation, content types, DTDs, PPG/PAP boundaries, SI/SL behavior, and cache operation are fully profile-gated.→
4. OPT-1104Todo
   Telephony functions and bearer addenda remain capability- and platform-gated and cannot affect Class C strict behavior.→
5. OPT-1105Todo
   Capability description, advertisement, and privacy behavior are explicit and do not change unprofiled strict requests.→
6. OPT-1106Todo
   Approved optional features receive isolated profiles; proposed-only documents remain historical and cannot create strict requirements.→

Exit contract

Evidence required to leave this sprint

• Each optional profile has its own capability declaration and test lane.
• Strict Class C outcomes are unchanged when optional profiles are disabled.
• Proposed documents remain non-normative.