rodauth-ciba 0.1.0

data/docs/requirements-audit.md

@@ -0,0 +1,175 @@
+# CIBA Core 1.0 要件監査（2026-09-29の初期範囲）
+
+これは初期の poll/login_hint 構成の監査スナップショットです。その後に実装した任意機能や現在のテスト環境を表すものではありません。[現行の対応表](protocol-coverage.md)と[整合化計画](alignment-roadmap.md)を参照してください。拡張後の再監査は[現行差分](requirements-audit-current.md)で進行中です。全規範要件の確認は未完了です。
+
+2026-09-29。Jev評価用カタログの159評価単位を、初版の適用範囲・責務・コードとテストの証拠で再分類した。159は仕様の公式要件数ではなく、参照先OIDC/RFCを含む全規範文の網羅性を保証しない。点数・確率は合否根拠にしない。
+
+初版: poll / login_hint / public subject / static registration。署名付き認証要求、user_code、ping/push、その他hint、pairwiseは適用外。JWT client authenticationは署名付き認証要求とは別。
+
+`verified`は記載テストで対象挙動を確認、`code_review_only`はコード根拠のみ、`app_contract`は導入アプリ・運用を含む契約、`client_only`はClientの責務、`optional_excluded`は機能の適用条件が初版で成立しない項目。完全適合やすべての設定での動作保証ではない。規範強度はMUSTの有無だけでなく、パラメータ・応答の定義と適用条件を含めて読む。
+
+判定集計: app_contract: 7, client_only: 13, code_review_only: 1, optional_excluded: 70, verified: 68。
+
+詳細な要件文・条件・証拠の限界は[JSON](requirements-audit.json)、再現した問題と検証環境は[セキュリティレビュー](security-review.md)。この監査時点のテストはRuby 4.0.6 / SQLiteで、PostgreSQL/MySQLはDocker権限制約により未検証だった。その後の実行結果は[release validation](release-validation.md)に記録する。
+
+| ID / 対象 | 規範強度 | 初版 / 責務 | 判定 | テスト / コード | 原仕様 |
+|---|---|---|---|---|---|
+| CIBA-001 CIBA grant識別子 | Specification definition (fixed grant value; no MUST/REQUIRED keyword) | in scope / gem | verified | [test_discovery_describes_poll_and_keeps_existing_oidc_metadata](../test/ciba_protocol_test.rb), [test_upstream_jwt_authentication_coexists_with_ciba_and_discovery](../test/ciba_configuration_test.rb) | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-002 Discoveryの対応モード | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_discovery_describes_poll_and_keeps_existing_oidc_metadata](../test/ciba_protocol_test.rb) | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-003 Discoveryの開始URL | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_discovery_describes_poll_and_keeps_existing_oidc_metadata](../test/ciba_protocol_test.rb) | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-004 署名要求の対応表明 | 任意（OP may omit; absence says unsupported） | in scope / gem | verified | [test_discovery_describes_poll_and_keeps_existing_oidc_metadata](../test/ciba_protocol_test.rb) | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-005 user_codeの対応表明 | 任意（OP may omit; omitted means false） | in scope / gem | verified | [test_discovery_describes_poll_and_keeps_existing_oidc_metadata](../test/ciba_protocol_test.rb) | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-006 Discoveryのgrant_types | 仕様定義（poll/pingのgrant_types_supported。MUSTという語ではない） | in scope / gem | verified | [test_discovery_describes_poll_and_keeps_existing_oidc_metadata](../test/ciba_protocol_test.rb) | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-007 認証方式メタデータの共有 | Specification definition (metadata consistency; no MUST/REQUIRED keyword) | in scope / gem + upstream | verified | [test_discovery_preserves_upstream_authentication_algorithms_for_both_endpoints](../test/ciba_security_test.rb) | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-008 認証署名アルゴリズムの共有 | Conditional specification definition (metadata consistency; no MUST/REQUIRED keyword) | in scope / gem + upstream | verified | [test_discovery_preserves_upstream_authentication_algorithms_for_both_endpoints](../test/ciba_security_test.rb) | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-009 登録済み配送モード | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_unavailable_or_unsupported_client_metadata_is_rejected](../test/ciba_configuration_test.rb) | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-010 CIBA grantのクライアント登録 | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_dcr_rejects_ciba_but_preserves_other_grant_validation](../test/ciba_configuration_test.rb), [test_unavailable_or_unsupported_client_metadata_is_rejected](../test/ciba_configuration_test.rb) | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-011 通知URL登録 | 条件付き必須（該当機能/条件時 MUST） | excluded / app | optional_excluded | — | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-012 署名要求アルゴリズム登録 | 条件付き必須（該当機能/条件時 MUST） | excluded / gem (excluded capability) | optional_excluded | — | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-013 user_codeクライアント設定 | Optional client metadata (OPTIONAL; only applies when OP support is true) | excluded / gem (excluded capability) | optional_excluded | — | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-014 登録された認証方式 | Specification definition (registered method; no MUST/REQUIRED keyword) | in scope / gem + upstream | verified | [test_upstream_jwt_authentication_coexists_with_ciba_and_discovery](../test/ciba_configuration_test.rb), [test_post_client_authentication](../test/ciba_protocol_test.rb) | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-015 pairwise sector算出 | 条件付き必須（該当機能/条件時 MUST） | excluded / gem (excluded capability) | optional_excluded | — | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-016 pairwise DCR検証 | 条件付き必須（該当機能/条件時 MUST） | excluded / gem (excluded capability) | optional_excluded | — | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-017 pairwise鍵所有証明 | 条件付き必須（該当機能/条件時 MUST） | excluded / gem (excluded capability) | optional_excluded | — | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-018 push pairwise sector | 条件付き必須（該当機能/条件時 MUST） | excluded / gem (excluded capability) | optional_excluded | — | [§4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4) |
+| CIBA-019 poll配送 | 記述的要件（該当節にMUST/SHOULD/MAYの規範語なし） | in scope / gem | verified | [test_discovery_describes_poll_and_keeps_existing_oidc_metadata](../test/ciba_protocol_test.rb), [test_approved_request_issues_customer_id_token_once](../test/ciba_integration_test.rb) | [§5](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.5) |
+| CIBA-020 ping配送 | 記述的要件（該当節にMUST/SHOULD/MAYの規範語なし） | excluded / gem (excluded capability) | optional_excluded | — | [§5](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.5) |
+| CIBA-021 push配送 | 記述的要件（該当節にMUST/SHOULD/MAYの規範語なし） | excluded / gem (excluded capability) | optional_excluded | — | [§5](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.5) |
+| CIBA-022 push sender-constrained token | 任意能力に対する設計指針（lowercase should） | excluded / gem (excluded capability) | optional_excluded | — | [§5](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.5) |
+| CIBA-023 開始APIのTLS | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_non_tls_and_json_requests_are_rejected](../test/ciba_protocol_test.rb) | [§7](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7) |
+| CIBA-024 開始APIのPOSTとform | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_non_tls_and_json_requests_are_rejected](../test/ciba_protocol_test.rb), [test_rack_inputs_without_rewind_work_on_both_endpoints](../test/ciba_protocol_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-025 開始APIのクライアント認証 | 必須（MUST / REQUIRED） | in scope / gem + upstream | verified | [test_jwt_client_assertion_requires_issuer_expiry_and_jti](../test/ciba_security_test.rb), [test_jwt_client_assertion_is_single_use](../test/ciba_security_test.rb), [test_malformed_assertions_are_authentication_errors_at_both_ciba_endpoints](../test/ciba_security_test.rb), [test_backchannel_ignores_other_grant_parameters_without_bypassing_client_authentication](../test/ciba_security_test.rb), [test_assertion_subject_cannot_override_explicit_client_id](../test/ciba_security_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-026 JWT audienceのissuer受理 | 必須（MUST / REQUIRED） | in scope / gem + upstream | verified | [test_upstream_jwt_authentication_coexists_with_ciba_and_discovery](../test/ciba_configuration_test.rb), [test_assertion_subject_cannot_override_explicit_client_id](../test/ciba_security_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-027 JWT audienceのToken URL受理 | 必須（MUST / REQUIRED） | in scope / gem + upstream | verified | [test_upstream_jwt_authentication_coexists_with_ciba_and_discovery](../test/ciba_configuration_test.rb), [test_assertion_subject_cannot_override_explicit_client_id](../test/ciba_security_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-028 JWT audienceのBackchannel URL受理 | 必須（MUST / REQUIRED） | in scope / gem + upstream | verified | [test_upstream_jwt_authentication_coexists_with_ciba_and_discovery](../test/ciba_configuration_test.rb), [test_assertion_subject_cannot_override_explicit_client_id](../test/ciba_security_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-029 JWT audienceのissuer推奨 | 推奨（SHOULD use OP Issuer as JWT aud） | client obligation / client | client_only | — | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-030 scope必須 | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_request_validation_and_unknown_parameters](../test/ciba_protocol_test.rb), [test_scope_syntax_errors_are_invalid_scope](../test/ciba_requirements_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-031 openid scope | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_request_validation_and_unknown_parameters](../test/ciba_protocol_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-032 追加scope | 任意（other scopes MAY be present） | in scope / gem | verified | [test_additional_authorized_scopes_survive_acceptance_and_token_issuance](../test/ciba_security_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-033 通知トークン必須条件 | 条件付き必須（ping/push登録ならREQUIRED） | excluded / gem (excluded capability) | optional_excluded | — | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-034 通知トークンの長さと構文 | 条件付き必須（ping/push時; MUST NOT exceed 1024 / bearer syntax） | excluded / gem (excluded capability) | optional_excluded | — | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-035 通知トークンentropy | 必須（client MUST ensure entropy; 160 bits is recommended） | excluded / client | optional_excluded | — | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-036 acr_values受理 | 任意（OPTIONAL acr_values; order is preference; OP discretion） | in scope with app contract / gem + app | verified | [test_expiry_binding_context_and_offline_access](../test/ciba_protocol_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-037 達成したacrの返却 | 強く推奨（highly RECOMMENDED acr claim when requested） | in scope with app contract / gem + upstream + app | verified | [test_approved_request_issues_customer_id_token_once](../test/ciba_integration_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-038 login_hint_token | Optional parameter (OPTIONAL) | excluded / gem (excluded capability) | optional_excluded | — | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-039 id_token_hint | Optional parameter (OPTIONAL) | excluded / gem (excluded capability) | optional_excluded | — | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-040 暗号化id_token_hintの復号 | 条件付き必須（暗号化ID Tokenをhintに使うclientはMUST decrypt） | excluded / client | optional_excluded | — | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-041 login_hint | 任意（OPTIONAL login_hint） | in scope with app contract / gem + app | verified | [test_request_validation_and_unknown_parameters](../test/ciba_protocol_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-042 binding_messageの受理と引継ぎ | Optional parameter (OPTIONAL) | in scope with app contract / gem + app | verified | [test_expiry_binding_context_and_offline_access](../test/ciba_protocol_test.rb), [test_browser_approval_checks_csrf_and_finishes_request](../test/demo_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-043 binding_messageの関連付け | Recommendation (SHOULD) | client obligation / client | client_only | — | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-044 binding_messageの表示適性 | Recommendation (SHOULD) | in scope with app contract / gem + app | verified | [test_expiry_binding_context_and_offline_access](../test/ciba_protocol_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-045 user_code | 任意（OPTIONAL user_code; lowercase “should only” condition is non-RFC2119） | excluded / gem (excluded capability) | optional_excluded | — | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-046 requested_expiry構文 | 任意（OPTIONAL requested_expiry with positive-integer value） | in scope / gem | verified | [test_expiry_binding_context_and_offline_access](../test/ciba_protocol_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-047 requested_expiryの採用 | 任意（server MAY honor; encouraged where useful） | in scope / gem | verified | [test_expiry_binding_context_and_offline_access](../test/ciba_protocol_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-048 hintはちょうど一つ | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_request_validation_and_unknown_parameters](../test/ciba_protocol_test.rb) | [§7.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1) |
+| CIBA-049 署名要求のJWT形式 | 条件付き必須（署名付き認証要求を実装する場合） | excluded / gem (excluded capability) | optional_excluded | — | [§7.1.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1) |
+| CIBA-050 署名要求の非対称署名 | 条件付き必須（署名付き認証要求を実装する場合） | excluded / gem (excluded capability) | optional_excluded | — | [§7.1.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1) |
+| CIBA-051 署名要求のaud | 条件付き必須（署名付き認証要求を実装する場合） | excluded / gem (excluded capability) | optional_excluded | — | [§7.1.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1) |
+| CIBA-052 署名要求のiss | 条件付き必須（署名付き認証要求を実装する場合） | excluded / gem (excluded capability) | optional_excluded | — | [§7.1.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1) |
+| CIBA-053 署名要求のexp | 条件付き必須（署名付き認証要求を実装する場合） | excluded / gem (excluded capability) | optional_excluded | — | [§7.1.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1) |
+| CIBA-054 署名要求のiat | 条件付き必須（署名付き認証要求を実装する場合） | excluded / gem (excluded capability) | optional_excluded | — | [§7.1.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1) |
+| CIBA-055 署名要求のnbf | 条件付き必須（署名付き認証要求を実装する場合） | excluded / gem (excluded capability) | optional_excluded | — | [§7.1.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1) |
+| CIBA-056 署名要求のjti | 条件付き必須（署名付き認証要求を実装する場合） | excluded / gem (excluded capability) | optional_excluded | — | [§7.1.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1) |
+| CIBA-057 署名要求のrequested_expiry型 | 記述的要件（OP must accept either type; source uses lowercase “must”） | excluded / gem (excluded capability) | optional_excluded | — | [§7.1.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1) |
+| CIBA-058 署名要求の内外混在禁止 | 条件付き必須（署名付き認証要求を実装する場合） | excluded / gem (excluded capability) | optional_excluded | — | [§7.1.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1) |
+| CIBA-059 暗号化要求非対応 | 記述的要件（7.1.1 does not state the catalog prohibition as an RFC2119 rule） | excluded / gem (excluded capability) | optional_excluded | — | [§7.1.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1) |
+| CIBA-060 user_codeはOPパスワードと別 | 仕様定義（user_codeの秘密値はOPのパスワードとは別） | excluded / gem + app (excluded capability) | optional_excluded | — | [§7.1.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.2) |
+| CIBA-061 user_codeの例外ポリシー | 任意のポリシー（user_code対応時、例外を許容できる。lowercase may） | excluded / gem + app (excluded capability) | optional_excluded | — | [§7.1.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.2) |
+| CIBA-062 user_codeの都度入力 | 必須（client MUST NOT store user_code） | excluded / client | optional_excluded | — | [§7.1.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.2) |
+| CIBA-063 user_code変更手段 | 設計指針（user_code変更手段、lowercase should） | excluded / app | optional_excluded | — | [§7.1.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.2) |
+| CIBA-064 登録方式による認証検証 | 必須（MUST / REQUIRED） | in scope / gem + upstream | verified | [test_post_client_authentication](../test/ciba_protocol_test.rb), [test_jwt_client_assertion_requires_issuer_expiry_and_jti](../test/ciba_security_test.rb) | [§7.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2) |
+| CIBA-065 公開鍵認証の推奨 | 推奨（RECOMMENDED、Clientによる公開鍵認証の利用） | client obligation / client | client_only | — | [§7.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2) |
+| CIBA-066 署名要求検証 | 条件付き必須（署名付き要求がある場合。§7.2のMUST validateに含まれる） | excluded / gem | optional_excluded | — | [§7.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2) |
+| CIBA-067 認証要求パラメータ検証 | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_request_validation_and_unknown_parameters](../test/ciba_protocol_test.rb), [test_expiry_binding_context_and_offline_access](../test/ciba_protocol_test.rb), [test_scope_syntax_errors_are_invalid_scope](../test/ciba_requirements_test.rb) | [§7.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2) |
+| CIBA-068 複数hintのエラー | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_request_validation_and_unknown_parameters](../test/ciba_protocol_test.rb) | [§7.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2) |
+| CIBA-069 hintとユーザーの検証 | 必須（MUST / REQUIRED） | in scope / gem + app | verified | [test_request_validation_and_unknown_parameters](../test/ciba_protocol_test.rb) | [§7.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2) |
+| CIBA-070 hintポリシーの伝達 | 記述的要件（hint policy “should be communicated”; validation/information explicitly out of scope） | in scope with app contract / gem + app | app_contract | code: backchannel_authentication route, ciba_request_accepted | [§7.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2) |
+| CIBA-071 不正または不明hintのエラー | 設計指針（lowercase should。応答コードの意味は§13参照） | in scope / gem | verified | [test_request_validation_and_unknown_parameters](../test/ciba_protocol_test.rb) | [§7.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2) |
+| CIBA-072 必須パラメータ検証 | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_request_validation_and_unknown_parameters](../test/ciba_protocol_test.rb) | [§7.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2) |
+| CIBA-073 未知パラメータの無視 | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_request_validation_and_unknown_parameters](../test/ciba_protocol_test.rb) | [§7.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2) |
+| CIBA-074 開始エラーの形式 | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_request_validation_and_unknown_parameters](../test/ciba_protocol_test.rb) | [§7.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2) |
+| CIBA-075 受付成功HTTP 200 | 応答定義（成功時HTTP 200、MUSTという語ではない） | in scope / gem | verified | [test_request_validation_and_unknown_parameters](../test/ciba_protocol_test.rb) | [§7.3](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3) |
+| CIBA-076 auth_req_id必須と一意性 | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_auth_req_id_has_required_entropy_and_restricted_characters](../test/ciba_requirements_test.rb) | [§7.3](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3) |
+| CIBA-077 auth_req_id entropy | 必須（MUST / REQUIRED） | in scope / gem | code_review_only | [test_auth_req_id_has_required_entropy_and_restricted_characters](../test/ciba_requirements_test.rb) | [§7.3](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3) |
+| CIBA-078 auth_req_id文字集合 | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_auth_req_id_has_required_entropy_and_restricted_characters](../test/ciba_requirements_test.rb) | [§7.3](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3) |
+| CIBA-079 auth_req_idのopaque扱い | 必須（Client MUST treat auth_req_id as opaque） | client obligation / client | client_only | — | [§7.3](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3) |
+| CIBA-080 expires_in | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_requested_expiry_expires_at_the_exact_boundary](../test/ciba_requirements_test.rb) | [§7.3](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3) |
+| CIBA-081 interval | 任意（interval is OPTIONAL; if supplied, positive integer; client MUST wait; default rule separate ID 82） | in scope / gem | verified | [test_additional_authorized_scopes_survive_acceptance_and_token_issuance](../test/ciba_security_test.rb) | [§7.3](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3) |
+| CIBA-082 interval既定値 | 必須（client MUST use 5-second default when interval omitted） | client obligation / client | client_only | — | [§7.3](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3) |
+| CIBA-083 未知応答パラメータ | 必須（MUST / REQUIRED） | client obligation / client | client_only | — | [§7.3](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3) |
+| CIBA-084 受付応答の必須項目確認 | 必須（MUST / REQUIRED） | client obligation / client | client_only | — | [§7.4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.4) |
+| CIBA-085 auth_req_id保持 | 必須（MUST / REQUIRED） | client obligation / client | client_only | — | [§7.4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.4) |
+| CIBA-086 クライアント期限管理 | 設計指針（期限保存、lowercase should） | client obligation / client | client_only | — | [§7.4](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.4) |
+| CIBA-087 認証チャネルとacrの選択 | 記述的要件（§8 places user/channel/acr selection in OP process; catalog added an evaluation abstraction） | in scope with app contract / gem + app | app_contract | code: create_token, id_token_claims | [§8](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.8) |
+| CIBA-088 認証後の承認取得 | 必須（MUST / REQUIRED） | in scope with app contract / gem + app | app_contract | code: approve_ciba_request, ciba_complete, create_token | [§8](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.8) |
+| CIBA-089 登録モード以外へ配送しない | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_unavailable_or_unsupported_client_metadata_is_rejected](../test/ciba_configuration_test.rb) | [§10](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10) |
+| CIBA-090 Token Endpoint認証 | 必須（MUST / REQUIRED） | in scope / gem + upstream | verified | [test_client_authentication_is_required_at_both_endpoints](../test/ciba_integration_test.rb) | [§10.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1) |
+| CIBA-091 クライアントpoll間隔 | 必須（MUST / REQUIRED） | client obligation / client | client_only | — | [§10.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1) |
+| CIBA-092 long polling | 任意（long polling、lowercase may。30秒は参照仕様の推奨） | excluded / gem | optional_excluded | — | [§10.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1) |
+| CIBA-093 OP応答時間 | 推奨（OP should not take more than 30 seconds; source lowercase should） | in scope with app contract / gem + deployment | app_contract | code: ciba_http | [§10.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1) |
+| CIBA-094 重複poll禁止 | 必須（MUST / REQUIRED） | client obligation / client | client_only | — | [§10.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1) |
+| CIBA-095 503とRetry-After | 任意（OP MAY return 503 / Retry-After under stated condition） | in scope / gem | verified | [test_lock_timeout_returns_503_with_retry_after_and_rolls_back](../test/ciba_security_test.rb) | [§10.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1) |
+| CIBA-096 Retry-After遵守 | 推奨（client should respect Retry-After; lowercase should） | client obligation / client | client_only | — | [§10.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1) |
+| CIBA-097 pingクライアントのpoll許容 | 条件付き必須（§10.1、ping clientがpollした場合はMUST treat as poll） | excluded / gem | optional_excluded | — | [§10.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1) |
+| CIBA-098 Token POST form | 必須（MUST / REQUIRED） | in scope / gem + upstream | verified | [test_rack_inputs_without_rewind_work_on_both_endpoints](../test/ciba_protocol_test.rb) | [§10.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1) |
+| CIBA-099 Token grant_type必須 | 必須（MUST / REQUIRED） | in scope / gem + upstream | verified | [test_ciba_token_required_parameters_and_error_response_contract](../test/ciba_security_test.rb) | [§10.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1) |
+| CIBA-100 Token auth_req_id必須 | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_ciba_token_required_parameters_and_error_response_contract](../test/ciba_security_test.rb) | [§10.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1) |
+| CIBA-101 auth_req_idのクライアント束縛 | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_other_identity_client_and_expiry_cannot_issue](../test/ciba_integration_test.rb) | [§10.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1) |
+| CIBA-102 成功Token応答 | 応答定義（成功応答はOIDC Core §3.1.3.3を参照） | in scope / gem + upstream | verified | [test_approved_request_issues_customer_id_token_once](../test/ciba_integration_test.rb) | [§10.1.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1.1) |
+| CIBA-103 成功後の一回限り消費 | 応答定義（成功引換え後はauth_req_idが無効。MUSTという語ではない） | in scope / gem | verified | [test_approved_request_issues_customer_id_token_once](../test/ciba_integration_test.rb), [test_concurrent_polls_issue_one_grant](../test/ciba_integration_test.rb) | [§10.1.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1.1) |
+| CIBA-104 認証承認前のToken禁止 | 応答定義（未認証・未承認時はerror、lowercase must） | in scope / gem | verified | [test_pending_poll_updates_survive_json_halt](../test/ciba_integration_test.rb), [test_denial_and_expired_completion](../test/ciba_protocol_test.rb) | [§10.1.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1.1) |
+| CIBA-105 ping HTTP POST | 記述的要件（該当節にMUST/SHOULD/MAYの規範語なし） | excluded / gem (excluded capability) | optional_excluded | — | [§10.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2) |
+| CIBA-106 ping bearer認証 | 配送形式の定義（ping対応時。MUSTという語ではない） | excluded / gem (excluded capability) | optional_excluded | — | [§10.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2) |
+| CIBA-107 ping payload | 配送形式の定義（ping対応時。MUSTという語ではない） | excluded / gem (excluded capability) | optional_excluded | — | [§10.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2) |
+| CIBA-108 pingクライアント検証 | 必須（MUST / REQUIRED） | excluded / client | optional_excluded | — | [§10.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2) |
+| CIBA-109 ping応答処理 | 推奨（client endpoint SHOULD respond 204; OP SHOULD accept 200 and ignore body） | excluded / gem + client (excluded capability) | optional_excluded | — | [§10.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2) |
+| CIBA-110 pingリダイレクト禁止 | 条件付き必須（該当機能/条件時 MUST） | excluded / gem (excluded capability) | optional_excluded | — | [§10.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2) |
+| CIBA-111 ping後の取得 | フローの説明（通知検証後にclient can retrieve、MUSTという語ではない） | excluded / client | optional_excluded | — | [§10.2](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2) |
+| CIBA-112 通知Endpoint TLS | 必須（MUST / REQUIRED） | excluded / gem + client (excluded capability) | optional_excluded | — | [§9](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.9) |
+| CIBA-113 通知Endpoint bearer認証 | 配送認証の定義（lowercase must） | excluded / gem + client (excluded capability) | optional_excluded | — | [§9](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.9) |
+| CIBA-114 push成功payload | 記述的要件（該当節にMUST/SHOULD/MAYの規範語なし） | excluded / gem (excluded capability) | optional_excluded | — | [§10.3.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1) |
+| CIBA-115 push at_hash | 必須（MUST / REQUIRED） | excluded / gem (excluded capability) | optional_excluded | — | [§10.3.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1) |
+| CIBA-116 push auth_req_id claim | 必須（MUST / REQUIRED） | excluded / gem (excluded capability) | optional_excluded | — | [§10.3.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1) |
+| CIBA-117 push rt_hash | 必須（MUST / REQUIRED） | excluded / gem (excluded capability) | optional_excluded | — | [§10.3.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1) |
+| CIBA-118 push受信検証 | 必須（MUST / REQUIRED） | excluded / client | optional_excluded | — | [§10.3.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1) |
+| CIBA-119 push応答処理 | 推奨（client endpoint SHOULD respond 204; OP SHOULD accept 200 and ignore body） | excluded / gem (excluded capability) | optional_excluded | — | [§10.3.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1) |
+| CIBA-120 pushリダイレクト禁止 | 必須（MUST / REQUIRED） | excluded / gem (excluded capability) | optional_excluded | — | [§10.3.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1) |
+| CIBA-121 push未知パラメータ | 必須（MUST / REQUIRED） | excluded / client | optional_excluded | — | [§10.3.1](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1) |
+| CIBA-122 Tokenエラー形式 | 必須（invalid/unauthorized errors must follow referenced OIDC/OAuth format; triggered by invalid request） | in scope / gem | verified | [test_ciba_token_required_parameters_and_error_response_contract](../test/ciba_security_test.rb) | [§11](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11) |
+| CIBA-123 authorization_pending | 必須（pending response state; normative error semantics） | in scope / gem | verified | [test_pending_poll_updates_survive_json_halt](../test/ciba_integration_test.rb) | [§11](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11) |
+| CIBA-124 slow_down | 条件付き必須（slow_down応答なら interval MUST increase by >=5 seconds） | in scope / gem | verified | [test_pending_poll_updates_survive_json_halt](../test/ciba_integration_test.rb), [test_concurrent_pending_polls_both_receive_retryable_results](../test/ciba_lifecycle_test.rb) | [§11](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11) |
+| CIBA-125 expired_token | エラー定義（§11 poll/pingのexpired_token。§12 pushの送信任意とは別） | in scope / gem | verified | [test_other_identity_client_and_expiry_cannot_issue](../test/ciba_integration_test.rb) | [§11](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11) |
+| CIBA-126 access_denied | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_denial_and_expired_completion](../test/ciba_protocol_test.rb) | [§11](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11) |
+| CIBA-127 invalid_grant | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_other_identity_client_and_expiry_cannot_issue](../test/ciba_integration_test.rb) | [§11](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11) |
+| CIBA-128 繰返し過剰pollの拒否 | 任意（OP MAY send invalid_request on continued too-fast polling） | excluded / gem (excluded capability) | optional_excluded | — | [§11](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11) |
+| CIBA-129 invalid_request後の停止 | 必須（client MUST stop same auth_req_id after invalid_request） | client obligation / client | client_only | — | [§11](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11) |
+| CIBA-130 pushクライアントのToken拒否 | 条件付き必須（push client MUST NOT token endpoint call; unauthorized_client required） | in scope / gem | verified | [test_push_client_cannot_redeem_ciba_at_token_endpoint](../test/ciba_security_test.rb) | [§11](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11) |
+| CIBA-131 pushエラーJSON | 必須（MUST / REQUIRED） | excluded / gem (excluded capability) | optional_excluded | — | [§12](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.12) |
+| CIBA-132 push error_description文字集合 | 必須（MUST / REQUIRED） | excluded / gem (excluded capability) | optional_excluded | — | [§12](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.12) |
+| CIBA-133 push access_denied | 記述的要件（該当節にMUST/SHOULD/MAYの規範語なし） | excluded / gem (excluded capability) | optional_excluded | — | [§12](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.12) |
+| CIBA-134 push expired_token | 任意（OP not required to send expired_token push error） | excluded / gem (excluded capability) | optional_excluded | — | [§12](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.12) |
+| CIBA-135 push transaction_failed | 任意のエラー通知（push transaction_failedを利用できる。全失敗への送信義務ではない） | excluded / gem (excluded capability) | optional_excluded | — | [§12](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.12) |
+| CIBA-136 開始エラーJSON | 必須（MUST / REQUIRED） | in scope / gem | verified | [test_request_validation_and_unknown_parameters](../test/ciba_protocol_test.rb) | [§13](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13) |
+| CIBA-137 error_description文字集合 | 条件付き必須（任意のerror_descriptionを出す場合のMUST NOT文字制約） | in scope / gem | verified | [test_authentication_error_description_keeps_allowed_ascii_and_omits_unsafe_text](../test/ciba_requirements_test.rb) | [§13](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13) |
+| CIBA-138 error_uri文字集合 | 条件付き必須（任意のerror_uriを出す場合のMUST構文制約） | in scope / gem | verified | [test_authentication_error_description_keeps_allowed_ascii_and_omits_unsafe_text](../test/ciba_requirements_test.rb) | [§13](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13) |
+| CIBA-139 400 invalid_request | エラー応答の定義（該当する失敗とHTTP status/codeの対応） | in scope / gem | verified | [test_duplicate_parameters_are_rejected](../test/ciba_protocol_test.rb), [test_request_validation_and_unknown_parameters](../test/ciba_protocol_test.rb) | [§13](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13) |
+| CIBA-140 400 invalid_scope | エラー応答の定義（該当する失敗とHTTP status/codeの対応） | in scope / gem | verified | [test_scope_syntax_errors_are_invalid_scope](../test/ciba_requirements_test.rb) | [§13](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13) |
+| CIBA-141 400 expired_login_hint_token | 条件付き必須（supported login_hint_token expired case; otherwise feature optional） | excluded / gem (excluded capability) | optional_excluded | — | [§13](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13) |
+| CIBA-142 400 unknown_user_id | エラー応答の定義（該当する失敗とHTTP status/codeの対応） | in scope / gem | verified | [test_request_validation_and_unknown_parameters](../test/ciba_protocol_test.rb) | [§13](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13) |
+| CIBA-143 400 unauthorized_client | エラー応答の定義（該当する失敗とHTTP status/codeの対応） | in scope / gem | verified | [test_unavailable_or_unsupported_client_metadata_is_rejected](../test/ciba_configuration_test.rb) | [§13](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13) |
+| CIBA-144 400 missing_user_code | 条件付き必須（if user_code is required and absent） | excluded / gem (excluded capability) | optional_excluded | — | [§13](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13) |
+| CIBA-145 400 invalid_user_code | 条件付き必須（if user_code supplied and invalid, where supported） | excluded / gem (excluded capability) | optional_excluded | — | [§13](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13) |
+| CIBA-146 400 invalid_binding_message | エラー応答の定義（該当する失敗とHTTP status/codeの対応） | in scope / gem | verified | [test_expiry_binding_context_and_offline_access](../test/ciba_protocol_test.rb) | [§13](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13) |
+| CIBA-147 401 invalid_client | エラー応答の定義（該当する失敗とHTTP status/codeの対応） | in scope / gem | verified | [test_authentication_errors_use_invalid_client_and_http_401](../test/ciba_requirements_test.rb) | [§13](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13) |
+| CIBA-148 403 access_denied | 条件付き必須（when OP/resource-owner pre-interaction policy denies） | in scope with app contract / gem + app | app_contract | code: ciba_http, ciba_error | [§13](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13) |
+| CIBA-149 login_hint_token署名 | Recommendation (SHOULD) | excluded / gem (excluded capability) | optional_excluded | — | [§14](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14) |
+| CIBA-150 通知URLの管理権限 | Recommendation (SHOULD) | excluded / app | optional_excluded | — | [§14](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14) |
+| CIBA-151 期限切れid_token_hint許容 | 任意（id_token_hint optional; text accept-expired policy is SHOULD within support） | excluded / gem (excluded capability) | optional_excluded | — | [§14](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14) |
+| CIBA-152 id_token_hintのissuerとaudience | Guidance (lowercase should in source; not RFC2119 SHOULD) | excluded / gem (excluded capability) | optional_excluded | — | [§14](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14) |
+| CIBA-153 id_token_hint署名 | Guidance (lowercase should in source; not RFC2119 SHOULD) | excluded / gem (excluded capability) | optional_excluded | — | [§14](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14) |
+| CIBA-154 push Endpoint保護 | 記述的要件（security considerations say secure endpoint / consider binding; catalog groups considerations） | excluded / app | optional_excluded | — | [§14](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14) |
+| CIBA-155 業務コンテキストの追加 | 参考情報（deployment-specific metadata may be conveyed; no CIBA transport requirement） | in scope with app contract / app | app_contract | code: resolve_ciba_login_hint, ciba_account_eligible? | [§14](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14) |
+| CIBA-156 プライバシー配慮識別子 | 参考情報（privacy considerations, no explicit MUST/SHOULD in cataloged behavior） | in scope with app contract / app | app_contract | code: resolve_ciba_login_hint | [§15](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.15) |
+| CIBA-157 pairwise ID Token hint | 参考情報（privacy option descriptive, not an OP mandate） | excluded / gem (excluded capability) | optional_excluded | — | [§15](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.15) |
+| CIBA-158 一回限り識別子hint token | 参考情報（optional scenario/example） | excluded / gem (excluded capability) | optional_excluded | — | [§15](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.15) |
+| CIBA-159 Discovery Service hint token | 参考情報（possible ecosystem scenario, no protocol conformance requirement） | excluded / gem (excluded capability) | optional_excluded | — | [§15](https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.15) |

data/docs/research/access-token-revocation-reference.md

@@ -0,0 +1,81 @@
+# Access-token revocation reference boundary
+
+2026-09-30。`oidc-provider 9.12.2`、Node24.21.0、固定 image の実 HTTP OP で確認。
+テストは `test/reference/full-op/lifecycle.mjs`、[ログ](../validation/node-refresh-reference.txt)。
+
+## 実測した既定動作
+
+| 提示する token | 関連 access/refresh token | 保存 Grant | 旧 CIBA 要求 |
+|---|---|---|---|
+| opaque access token | 無効化 | 保持 | 無効化 |
+| refresh token | 無効化 | 削除 | 無効化 |
+| structured JWT | `unsupported_token_type` で拒否 | 保持 | 変更しない |
+
+opaque AT は `token_type_hint` 省略、access_token、refresh_token、未知値のいずれでも検索される。
+別 confidential client の live token 取消しは400 invalid_request、正当な client の成功は空bodyの200。
+取消し後の再送は別 client でも200となる。兄弟ATの introspection は active=false、元のrefreshは invalid_grant。
+
+旧 CIBA 要求の再引換えは invalid_grant だが、保持した Grant を取り消さない。
+アプリが別の新しい CIBA 要求を作り、その Grant を backchannelResult に明示的に渡すと新しい発行が可能。
+保持 Grant が自動的に新要求を承認するわけではない。
+
+根拠コードは `lib/actions/revocation.js`、`lib/helpers/revoke.js`、
+`lib/helpers/defaults.js#revokeGrantPolicy`。最後の policy が AccessToken による revocation の場合だけ false を返す。
+単に revoke helper の呼出しを見て「Grant 自体も常に失効する」と推測した前の説明は誤りだった。
+
+## gem の残件
+
+gem の `revoke_ciba_grant` は保存承認の revoked_at を設定するため、AT取消しにそのまま流用すると参照の既定動作と異なる。
+最初の namespace 専用 revocation 接続は refresh token のみだった。現在は下記の opaque AT 接続まで実装した。
+
+実装では、保存承認を残したまま、その時点の関連 token と要求を無効化する処理が必要。
+refresh を残して AT だけ取り消す実装では次の更新で再発行できてしまい、旧 CIBA 要求を残すと再引換えが保持 Grant を取り消してしまう。
+同時更新・取消し・新しい完了の扱いと DB ロック順序を合わせて検証する。
+調査時点では refresh source/request を先にロックしてから Grant をロックしていたため、取消しで逆順にまとめて削除する変更は deadlock の危険があった。
+
+JWT の識別だけで既存の他 OAuth token の挙動まで変えない境界も必要。
+今回確認した structured JWT は参照 OP が実発行した resource JWT であり、gem 側で未検証 JWT を信用して承認を取り消してよい根拠ではない。
+
+## ロック順序の前提整備
+
+Grant を識別する非locking read の後、Grant、source の順にロックし、source を再読込するよう変更した。
+対象は CIBA token 取得、refresh 更新、refresh-token revocation。保存 Grant を指定した completion も Grant を先にロックする。
+completion 内で新規作成する Grant は同じ transaction の未公開行なので、他の処理が先にその Grant を取得する経路はない。
+
+pending 要求が最初の read と source lock の間に Grant に結び付いた場合、逆順の追加ロックは取らず、serialization retry と同じ503 temporarily_unavailableへ進む。
+scope・account/client・承認状態などの既存検証は locking read 後にも実行する。
+
+PostgreSQL/MySQL の別接続で Grant を保持し、refresh が Grant lock に進む直前で待機させても、その接続が refresh source をロックできることを確認した。
+これは旧順序の「refresh が source を保持したまま Grant を待つ」競合を対象とする試験で、任意のアプリ hook まで deadlock が起きないという保証ではない。
+SQLite は writer を先に直列化するため、その行ロック専用試験だけ skip。
+
+3 DBの全suiteは各201 tests、failure/errorなし。PostgreSQL/MySQLは1899 assertions・skipなし、SQLiteは1898 assertions・上記1 skip。
+[ログ](../validation/grant-lock-order-matrix.txt)。この段階ではAT取消しの token 識別・関連artifact削除自体はまだ未接続だった。
+
+## Opaque AT 接続
+
+保存済み OAuth token 行の hash（hash保存無効時はtoken列）と type=CIBA で識別する。hint を識別根拠には使わない。
+取消し要求も常に client 認証を使い、browser session の権限を使わない。未認証の識別readは経路選択のみで、取消し判断はtransaction内の再読込・client照合後に行う。
+
+Grant→token の順でロックし、有効な token の所有clientを確認してから、そのGrantの旧CIBA要求とrefresh sourceを削除、関連access tokenを論理取消しする。
+Grant自体は変更しない。短寿命要求の削除によりping deliveryもFK cascadeで消える。
+after_revokeフックが失敗すれば削除と論理取消しは全てrollbackする。
+
+保存している取消し済みopaque行は再送識別に使い、空200を返す。旧形式で行を外部cleanupした後の未知opaque tokenはCIBA由来と識別できず上流経路へ戻る。
+新規発行は下記namespaceでこの不足を解消した。他のOAuth flowを一律に変えないため、旧形式までnodeの未知token応答と完全に同じにはしていない。
+
+3 DB全suite各205 tests、failure/errorなし（SQLiteのみ行ロック試験1 skip）。[ログ](../validation/access-revocation-matrix.txt)。
+Grantの保持と新要求での明示利用、旧要求再引換えが保持Grantを取り消さないこと、関連refresh・兄弟ATの失効、hint各種、別client、update競合、hook rollbackを確認した。
+
+## 発行形式と拒否の境界
+
+新しいopaque CIBA ATは`ciba_at_`を付け、元のOAuth generatorの乱数を使う。通常OAuth生成は変えない。
+unknown/cleanup済みでもこのnamespaceなら、client認証後に空200。namespace自体は所有権や取消し対象の根拠にはせず、保存tokenが存在するときは従来どおりclientと有効性を検証する。
+
+新しいCIBA JWTはclaims機能の有無によらず既存のprivate token_id claimを付ける。resource markerを持つ旧JWTも拒否経路で識別できる。
+未検証claimはclient認証と拒否検証への経路選択のみ。OPの設定済み鍵・許可された署名方式・issuer・at+jwt型を検証してからunsupported_token_typeを返す。
+期限切れも拒否対象なので、この分類専用verifierでは時刻claimを認可条件にしない。通常のJWT decoderやtoken消費の検証は緩めない。
+偽造署名、別issuer、ID Token型、alg=noneはinvalid_requestで拒否し、承認を変更しない。
+
+nodeの「headerがJWTなら署名によらず拒否」とは適用範囲が異なる。関係のないOAuth JWTとmarkerのない旧CIBA JWTを一律変更しない境界として明示する。
+新JWTのUserInfoは保存発行行へ結び付くため、行削除後は401。旧marker無しJWTの試験は実際の旧wire formatを署名して再現し、別発行の明示claimを借用しない既存動作を確認した。

data/docs/research/alignment-partial-triage.md

@@ -0,0 +1,50 @@
+# Remaining partial audit findings
+
+Current reconciliation: CIBA-072 has a mandatory-input inventory and direct
+presence/selection evidence ([inventory](required-parameter-inventory.md));
+CIBA-067 is also reconciled against the [supported parser inventory](request-parameter-inventory.md).
+Both are protocol_boundary_verified. The current overlay has103 verified rows
+and5 partial rows. The table below retains the earlier investigation history.
+
+The159-row catalog has been classified, not declared conformant. Its22 partial
+rows overlap; they do not represent22 independent missing features. This review
+retains all IDs and separates reference differences from limitations shared by
+both implementations. Other workstreams in alignment-roadmap.md remain in scope.
+
+| IDs | Classification | Next evidence/action |
+|---|---|---|
+| 007, 008, 014, 025, 064 | Authentication coverage | The twelve configured RS/PS/ES/HS assertion algorithms now pass at both endpoints in reference/gem, with three-DB issuance evidence; CIBA-008 is resolved for that configuration. Legacy method-URN registration was found unusable and is now rejected for CIBA, with three-DB evidence; the shared metadata now removes that unusable URN without changing upstream authentication dispatch. Edwards client assertions now have initial inline verification, explicit independent algorithm configuration and registration/Discovery support. Reference accepts both names; gem rejects wrong keys/claims/replay and passes the three-DB regression subset. Remote HTTP keys, forced-expiry rotation/failure, ordinary code-grant coexistence, installed inline-key authentication and full Ruby3.3/3.4 suites now pass. Installed HTTPS Edwards authentication and unrelated RSA client scope now pass. CIBA-014/025/064 are verified for configured methods; CIBA-007 is also resolved by matching OAuth/OIDC method lists with the legacy URN removed. Do not invent an unbounded Cartesian product of all extensions. |
+| 013 | Configuration adaptation | Node always advertises user-code support and requires its application verifier; gem makes it opt-in and rejects clients requiring a disabled feature. Compare enabled configurations; do not remove the verifier gate just to align defaults. |
+| 017 | Verified reference-supported proof | Private-key JWT and self-signed TLS proof both have evidence. Signed-request-only proof is rejected by both. No missing reference feature is established by this row. |
+| 050 | Confirmed feature gap | Initial Ed25519/EdDSA request verification, OKP import, exact algorithm/curve checks, wrong-key rejection and registration are implemented. Cross-library fixed vectors, actual HTTP remote keys and installed-artifact issuance now pass; CIBA-050 is protocol_boundary_verified for the configured algorithms. HTTPS Edwards rotation remains a broader integration case. Both names pass the pinned reference HTTP test. |
+| 054 | Resolved NumericDate alignment | Reference HTTP accepts fractional dates and future iat. Gem now accepts them while checking finite numeric values, valid exp/nbf and required claims; three-DB signature regressions pass. |
+| 056 | Resolved request-jti alignment | Reference and gem accept empty strings, reject null/non-string values and create fresh pending requests on reuse without inheriting approval. Client uniqueness remains a client duty; authentication-assertion replay checks remain separate. |
+| 066 | Verified configured signature boundary | Eleven algorithms including Edwards, key/claim negative cases and independent vectors are now verified; current three-DB signature/pairwise audit passes. Custom profiles and production key custody remain application responsibilities. |
+| 067, 072 | Aggregate validation rows | Combined signed-request/ping/user-code dispatch now has a missing/empty inner-field regression: valid unsigned outer values cannot supply scope, hint, notification token or required user code; rejection precedes persistence/device dispatch ([2 tests / 44 assertions](../validation/signed-ping-required-fields.txt)). Claims/resources/RAR and request_context signed-value isolation have separate tests. This does not prove every extension combination; retain partial classification until the supported parameter inventory and individual row limits are reconciled. These aggregate IDs must not generate duplicate features. |
+| 080 | Shared timing limitation | Both start lifetime after resolution and can acknowledge after expiry if dispatch takes too long. Measured; no reference behavior change required. |
+| 089 | Delivery concurrency coverage | Resolved for measured management overlap: reference forwards saved credentials to the current registered endpoint on retry. Gem now follows that design; mode changes to poll reject retries and in-flight sends retain their selected destination. Three-DB ping tests and reference HTTP/TLS evidence cover this boundary. |
+| 093 | Explicit application contract | Neither arbitrary app hooks nor database waits have a proven hard30-second bound. State deployment timeout responsibility; do not imply current fast tests establish a service-level guarantee. |
+| 109 | Bounded transport adaptation | Resolved: ping now closes after status headers without reading/draining the body. Real TCP, reference TLS and installed TLS tests pass; CIBA-109 is protocol_boundary_verified. Key/sector reads remain bounded. |
+| 124 | Deliberate throttling adaptation | Gem enforces advertised interval/slow_down; node delegates polling policy to the app. Existing plan explicitly retains this difference pending contrary interoperability evidence. |
+| 138 | Conditional output absent | The gem does not emit error_uri in tested errors. Do not add a URI output feature merely to validate it; document custom overrides as application responsibility. |
+| 147 | Resolved error mapping | Gem now matches measured reference: missing identity400 invalid_request without challenge, wrong Basic401 invalid_client with challenge. Scoped to backchannel/CIBA grant; JWT/mTLS and ordinary-flow regressions pass on three DBs. |
+| 151 | Shared policy/deployment limit | Expired hints with retained trusted keys are accepted by default in both. Deployment hint-retention policy remains outside OP transport proof. |
+| 153 | Verified hint signature boundary | Edwards issuance/JWKS/hints and RSA-recipient encrypted output now have independent and installed evidence. CIBA HMAC issuance/hints now use the client secret, with request-local Basic/POST retrieval and a callback for other methods. Three-DB tests and independent jose verification pass. DCR secret lengths, installed issuance/refresh/hints and backend secret replacement now pass, with full Ruby3.3/3.4 regression evidence. CIBA-153 is protocol_boundary_verified; arbitrary deployment rotation policies are not inferred. Encrypted input hints are rejected by both. |
+
+## Edwards signature evidence
+
+The existing reference algorithm fixture now runs eleven algorithms: nine RS/PS/ES
+variants plus Ed25519 and EdDSA. Each passes with its registered key and rejects a
+different key over real HTTP in the pinned Node24/provider9.12.2 environment.
+[Execution](../validation/node-signed-edwards.txt).
+
+At the initial comparison the gem excluded these algorithms. A subsequent
+CIBA-local OpenSSL adapter now supports both for Ed25519 keys. The installed Ruby OpenSSL supports generating ED25519 keys, but that
+alone does not establish portable JWK import or JWT verification support.
+[ruby-jwt documentation](https://github.com/jwt/ruby-jwt) identifies EdDSA as an
+extension; [jwt-eddsa](https://github.com/jwt/ruby-jwt-eddsa) documents its separate
+algorithm/JWK integration. The implementation choice must be verified against
+the supported Rubies, the gem's CIBA-scoped behavior and the two distinct JOSE
+algorithm names; globally enabling an algorithm is not sufficient evidence.
+Current implementation and limits are tracked in docs/signed-requests.md; no
+global JWT algorithm support is inferred from the CIBA-local adapter.

data/docs/research/claims-reference-contract.md

@@ -0,0 +1,33 @@
+# Explicit claims: reference behavior and implementation contract
+
+2026-09-30. The complete node-oidc-provider 9.12.2 harness now enables `features.claimsParameter` and declares email/email_verified as supported claims. This is opt-in: the reference source defaults claimsParameter to disabled. All scenarios use `scope=openid`, so they isolate explicit claim consent from implicit scope-derived disclosure.
+
+## Observed over HTTP
+
+| Request | Saved Grant | ID Token email | UserInfo email |
+|---|---|---|---|
+| ID Token email | No allowed claims | Absent | Absent |
+| ID Token email | email allowed | Present | Absent |
+| ID Token email | email allowed and rejected | Absent | Absent |
+| UserInfo email | email allowed | Absent | Present |
+| No email request | email allowed | Absent | Absent |
+
+Each scenario also supplies an expanded claims parameter at the Token Endpoint. It cannot broaden the saved request. The account callback returns both email and email_verified unconditionally; the final response must still exclude unrequested/unapproved data. Tests verify ID Token signatures, the target-specific callback mask and HTTP UserInfo responses. Invalid JSON, array containers and boolean claim specifications are rejected with invalid_request. [Executable harness](../../test/reference/full-op/lifecycle.mjs), [Node24.21.0 log](../validation/node-full-op-lts.txt).
+
+Initially the allowed-email case returned no email because the fixture had not declared it as a supported OP claim. Correcting the fixture established a fourth input to the filter: request, consent, rejection and OP-supported claims. This was not a provider defect.
+
+## What the gem must preserve
+
+[OIDC Core §5.5](https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter) separates requested claims by response target and supports individual claim request objects. These objects are not themselves consent. The tests above cover null-valued individual requests; they do not prove enforcement of essential, value/values, localized claims, acr requirements or aggregated/distributed claims.
+
+The next implementation should be an explicit capability with a migration/activation gate, retaining current scope-only behavior when disabled. Store requested claims on the request separately from allowed and rejected claim names on consent. Persist the effective target-specific claim selection on issued OAuth rows so later UserInfo calls use the approved projection. Do not infer approval from request JSON or let poll parameters replace it.
+
+Use the existing node-shaped result boundary and reload saved consent at completion and issuance. Required identity/protocol claims must remain protected from arbitrary app-supplied values. Snapshot APIs need defensive handling of nested JSON. Existing rows must not acquire new explicit permissions after migration. Enable only after all workers can enforce the new fields.
+
+## Upstream integration constraint
+
+rodauth-oauth 1.7.0 `generate_id_token` reads the OAuth row's claims column and passes target-specific entries to `fill_with_account_claims`. Its UserInfo route independently reloads that row, adds the UserInfo entries and calls the same claim provider. Therefore filtering only during ID Token generation would leave a second disclosure path unprotected.
+
+The upstream helper also expands scope-derived claims. An explicit rejection must suppress the rejected claim in both acquisition and output, even when a scope otherwise permits it. Do not implement this as merely adding a claims column or copying all requested claims into the upstream row. Tests must additionally cover rejected claims combined with scopes, custom account providers and CIBA isolation from other grant flows before the capability is considered complete.
+
+Follow-up: the gem now implements an optional [explicit-claims capability](../claims.md) and regression tests for these five cases, rejection overriding scopes and exact-token UserInfo isolation. Essential/value/values policy and aggregated/distributed claims remain outside its automatic enforcement; this is not full claims parity.