fix(trading): bump LEAN Pkcs and Xml locks to 10.0.13 - #1098

Scope

Clear the required OSV failures caused by System.Security.Cryptography.Pkcs and .Xml 10.0.10 in the retained LEAN graph. Add a source-level Xml 10.0.13 version floor in Messaging and regenerate the four affected locks with the pinned .NET SDK; Xml's own dependency raises Pkcs to 10.0.13. This keeps the published locked-restore recipe reproducible.

• Base commit: 329985de1c8dccf0df7491373d0d9932eaa723d4 (fresh origin/main).
• Lane: lane:trading.
• Owned paths: blueprints/us-equities/engine/patches/lean-dependencies.patch, the Launcher/Messaging/Report/Tests files under engine/patches/lean-locks, engine/resolution.md and their six registrations in manifests/evidence.json.

SOTA sources

• Pinned vendor tool: .NET SDK 10.0.401, Microsoft source commit e34a38d2ae as reported by the installed dotnet --info. Its official Linux x64 SDK archive was verified against the SHA-512 in Microsoft's official .NET 10 release metadata, matching the repository's original runtime pin. Full publisher metadata, installed-version output and CLI help are retained.
• dotnet/docs at 3725139b4d18c135917b7c5d0f31f67f68115c2f, docs/core/tools/dotnet-restore.md:110-112,124-126,156-158: --force-evaluate reevaluates dependencies even with an existing lock; --use-lock-file generates and uses locks; --locked-mode refuses lock updates. The actual SDK 10.0.401 dotnet restore --help confirms all three options. Regeneration uses --use-lock-file --force-evaluate; verification uses --locked-mode --force against the published source patch.
• QuantConnect/Lean at 985ef30ad3ac774218c5ac516b4cb0aa2655730f is the blueprint's unchanged engine source pin. The existing three dependency replacements remain; the vendor dotnet add ... package ... --version 10.0.13 --no-restore command adds one Xml reference to Messaging, and native Git produces the published patch. The Microsoft Xml 10.0.13 package requires Pkcs 10.0.13; its installed, unmodified .nuspec and native lock output establish that edge.
• Advisory provenance: only OSV-Scanner's own output, retrieved with gh run view --log, from #1097 run 38468742363 / job 115542031292 and main run 38461582449. No alternate advisory source supplies the IDs below. Separate extended-hours paper startup readiness from order freshness #1097's later report contains all five; the earlier main report contains three of them.
• google/osv-scanner v2.6.0 at e840a6e8adb14b7777c78e26cfbf6e2abc1d1fc6, the existing required workflow pin. The checksum-verified native executable and actual workflow scan command are reused. Scanner configuration, input inventory, severity handling and frozen-evidence policy remain unchanged.

Advisory IDs from the two CI logs

Evidence-class table

Local commands run

gh run view 38468742363 --repo native-agent-stack/native-agent-stack --job 115542031292 --log
gh run view 38461582449 --repo native-agent-stack/native-agent-stack --log
exit 0; complete source captures retained

dotnet --info
SDK 10.0.401; original archive publisher SHA-512 verified

dotnet add Messaging/QuantConnect.Messaging.csproj package System.Security.Cryptography.Xml --version 10.0.13 --no-restore
exit 0; vendor writes the project input, then native Git generates the patch

dotnet restore QuantConnect.Lean.sln --use-lock-file --force-evaluate --disable-parallel --configfile <owned public-only NuGet.Config> -p:NuGetAuditMode=all
exit 0; vendor generates the locks without hand edits

dotnet restore QuantConnect.Lean.sln --locked-mode --force --disable-parallel --configfile <owned public-only NuGet.Config> -p:NuGetAuditMode=all
exit 0 after reapplying the published patch; all 22 projects restored

<checksum-verified OSV-Scanner 2.6.0> scan source --no-resolve --config .github/osv-scanner.toml <four affected lockfiles>
old locks: exit 1; regenerated locks: exit 0, No issues found

bash -e <actual security-scan.yml ordinary scan step>, WRITE_SARIF=false
exit 0; all 60 ordinary inputs, No issues found, ordinary=0

python3 -m unittest tests.test_osv_lockfile_coverage tests.test_wsl_retrieval.RetiredRunnerTests -v
exit 0; 65 tests / 14.577 seconds

python3 scripts/validate.py
exit 0; 71 components / 11920 hashed files / 4 profiles / 240 receipts

python3 scripts/evidence_manifest.py --check
exit 0; 11920 registered files

git diff --check
exit 0

All heavy local commands, including restore, scanner invocations, suites, full validation, gitleaks and push hooks, run under systemd-run --user --scope -p CPUWeight=idle --quiet --. Scratch, SDK, native package caches and source checkout are task-owned under /var/tmp. A missing ICU prerequisite was supplied through a task-local distribution package prefix; SDK globalization, host packages and global configuration were not changed.

Decision record

The supported NuGet source input belongs in the LEAN patch: a lock-only version edit would disagree with Messaging's project graph and could revert on the next forced evaluation. One direct Xml version floor is sufficient because Xml 10.0.13 requires Pkcs 10.0.13. It propagates through Messaging to Launcher, Report and Tests. Only those four locks change, with native content hashes, dependency edges and the direct/project dependency metadata written by NuGet. No unrelated package version changes.

No dedicated LEAN lock-resolution test was found under this repository's tests/ or scripts/. The existing engine replay recipe's native full-solution locked restore is the compatibility check used here. This PR does not claim another build, backtest, strategy result, broker connection or entitlement check. The original September resolution receipt, its historical hashes and its original backtest result remain retained; the active guide distinguishes this maintenance graph from that historical run.

This is the prerequisite landing fix for #1097 and other PRs blocked by the scanner. Gates remain enforced; those PRs need fresh CI after this bump lands. Required osv-scanner job 115556275354 and security workflow run 38472902496 both completed SUCCESS on this PR at exact head 3b72f189075c42ecbae364ddfd5fe7eb94e2ab49. The complete hosted log reports the metadata guards passing, all 60 ordinary inputs scanned, No issues found and OSV primary exit code: ordinary=0. The job API supplied no per-step array; success is established by the job conclusion plus its actual execution log, without inventing per-step metadata. Hosted log SHA-256: b059c9bc8c12e62d03b995a24c0f04615bb66cb0086f1b0edc6b9b1537433ba7. Other validation workflows and reviews remain separate; the CC lands this prerequisite first.

Follow-ups

The CC's disposition (a), relayed at 2026-10-13 22:16Z, defers these two local-review P2s. They remain outstanding; this body update does not add a source commit.

• P2 — Pinned correction provenance. At the next LEAN dependency or guide maintenance, cite the pinned upstream mechanism that makes the Xml 10.0.13 source-level version floor effective, together with the exact Xml 10.0.13 package's Pkcs 10.0.13 dependency. Carry those primary-source references into the active guide, including the relevant source location or retained package-metadata digest. Current native restore and package evidence remain distinct from that deferred guide citation.
• P2 — Source-level floor regression. At the next LEAN patch or lock-generation maintenance, add a regression that fails when the Xml 10.0.13 source-level floor is removed or lowered, even when the checked-in locks still contain the fixed versions. Exercise the source input and native locked-restore behavior; the current scanner before/after control establishes vulnerability removal and does not supply this missing floor regression.

Host evidence

Not applicable; no evidence/hosts/ changes. No credential file, broker account, paper STOP, live order, subscription or model call is involved.

Checklist

• Lock files were generated by pinned vendor restore, never hand-edited.
• The published source input and full locked graph restore successfully.
• The five advisory IDs come only from the requested scanner CI logs.
• No scanner ignore, severity threshold, input reduction, warning suppression or required-gate bypass.
• SDK/engine pins, existing action pins, token permissions and account boundaries preserved.
• No paid surface or credential/configuration change; peer-owned files and worktrees preserved.