rodauth-ciba 0.1.0

data/docs/requirements-audit.json

@@ -0,0 +1,3190 @@
+{
+  "title": "CIBA Core 1.0 requirement audit",
+  "as_of": "2026-09-29",
+  "scope_note": "159 catalog rows are an authored decomposition, not an official total. Historical 2026-09-29 initial poll/login_hint-scope snapshot, predating later optional extensions. Judged against primary CIBA Core text and repository implementation at that time; Jev scores are not treated as ground truth.",
+  "status_legend": {
+    "verified": "visible implementation and direct test evidence (not full certification)",
+    "gap": "in-scope mandatory requirement with an identified unverified/absent control",
+    "app_contract": "アプリまたは運用を含む契約。gem単体で合否判定しない",
+    "client_only": "CIBA client duty outside this OP gem",
+    "optional_excluded": "optional capability or intentionally excluded first-version feature",
+    "code_review_only": "コード確認のみ。テストで要件全体を証明していない",
+    "evidence_gap": "実装根拠または直接証拠が不足"
+  },
+  "items": [
+    {
+      "id": "CIBA-001",
+      "section": "4",
+      "label": "CIBA grant識別子",
+      "requirement": "Use urn:openid:params:grant-type:ciba as the CIBA extension grant identifier.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "Specification definition (fixed grant value; no MUST/REQUIRED keyword)",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_discovery_describes_poll_and_keeps_existing_oidc_metadata, test/ciba_configuration_test.rb#test_upstream_jwt_authentication_coexists_with_ciba_and_discovery. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_metadata",
+        "oauth_grant_types_supported",
+        "ciba_client_eligible?",
+        "post_configure"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_discovery_describes_poll_and_keeps_existing_oidc_metadata",
+        "test/ciba_configuration_test.rb#test_upstream_jwt_authentication_coexists_with_ciba_and_discovery"
+      ],
+      "normative_basis": "§4 / CIBA grant識別子: Specification definition (fixed grant value; no MUST/REQUIRED keyword)。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: CIBA grant識別子; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-002",
+      "section": "4",
+      "label": "Discoveryの対応モード",
+      "requirement": "Publish required backchannel_token_delivery_modes_supported as an array of actually supported poll/ping/push modes.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_discovery_describes_poll_and_keeps_existing_oidc_metadata. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_metadata",
+        "oauth_grant_types_supported",
+        "ciba_client_eligible?",
+        "post_configure"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_discovery_describes_poll_and_keeps_existing_oidc_metadata"
+      ],
+      "normative_basis": "§4 / Discoveryの対応モード: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: Discoveryの対応モード; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-003",
+      "section": "4",
+      "label": "Discoveryの開始URL",
+      "requirement": "Publish required backchannel_authentication_endpoint as the actual Backchannel Endpoint URL.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_discovery_describes_poll_and_keeps_existing_oidc_metadata. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_metadata",
+        "oauth_grant_types_supported",
+        "ciba_client_eligible?",
+        "post_configure"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_discovery_describes_poll_and_keeps_existing_oidc_metadata"
+      ],
+      "normative_basis": "§4 / Discoveryの開始URL: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: Discoveryの開始URL; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-004",
+      "section": "4",
+      "label": "署名要求の対応表明",
+      "requirement": "Only advertise backchannel_authentication_request_signing_alg_values_supported when signed requests are supported; omission means unsupported.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "任意（OP may omit; absence says unsupported）",
+      "conditional": true,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_discovery_describes_poll_and_keeps_existing_oidc_metadata. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_metadata",
+        "oauth_grant_types_supported",
+        "ciba_client_eligible?",
+        "post_configure"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_discovery_describes_poll_and_keeps_existing_oidc_metadata"
+      ],
+      "normative_basis": "§4 / 署名要求の対応表明: 任意（OP may omit; absence says unsupported）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: 署名要求の対応表明; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-005",
+      "section": "4",
+      "label": "user_codeの対応表明",
+      "requirement": "Publish user_code support truthfully; absent backchannel_user_code_parameter_supported defaults to false.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "任意（OP may omit; omitted means false）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_discovery_describes_poll_and_keeps_existing_oidc_metadata. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_metadata",
+        "oauth_grant_types_supported",
+        "ciba_client_eligible?",
+        "post_configure"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_discovery_describes_poll_and_keeps_existing_oidc_metadata"
+      ],
+      "normative_basis": "§4 / user_codeの対応表明: 任意（OP may omit; omitted means false）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: user_codeの対応表明; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-006",
+      "section": "4",
+      "label": "Discoveryのgrant_types",
+      "requirement": "Include the CIBA grant in grant_types_supported when supporting poll or ping.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "仕様定義（poll/pingのgrant_types_supported。MUSTという語ではない）",
+      "conditional": true,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_discovery_describes_poll_and_keeps_existing_oidc_metadata. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_metadata",
+        "oauth_grant_types_supported",
+        "ciba_client_eligible?",
+        "post_configure"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_discovery_describes_poll_and_keeps_existing_oidc_metadata"
+      ],
+      "normative_basis": "§4 / Discoveryのgrant_types: 仕様定義（poll/pingのgrant_types_supported。MUSTという語ではない）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: Discoveryのgrant_types; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-007",
+      "section": "4",
+      "label": "認証方式メタデータの共有",
+      "requirement": "Backchannel authentication methods match token_endpoint_auth_methods_supported.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "Specification definition (metadata consistency; no MUST/REQUIRED keyword)",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem + upstream",
+      "audit_status": "verified",
+      "evidence": "Direct test verifies OAuth/OIDC Discovery auth method metadata equality and successful requests for the tested RS256 configuration; this does not establish coverage of every upstream auth method.",
+      "code_refs": [
+        "ciba_metadata",
+        "oauth_grant_types_supported",
+        "ciba_client_eligible?",
+        "post_configure"
+      ],
+      "test_refs": [
+        "test/ciba_security_test.rb#test_discovery_preserves_upstream_authentication_algorithms_for_both_endpoints"
+      ],
+      "normative_basis": "§4 / 認証方式メタデータの共有: Specification definition (metadata consistency; no MUST/REQUIRED keyword)。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: 認証方式メタデータの共有; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-008",
+      "section": "4",
+      "label": "認証署名アルゴリズムの共有",
+      "requirement": "When applicable Backchannel authentication signing algorithms match token_endpoint_auth_signing_alg_values_supported.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "Conditional specification definition (metadata consistency; no MUST/REQUIRED keyword)",
+      "conditional": true,
+      "first_version": "in scope",
+      "responsibility": "gem + upstream",
+      "audit_status": "verified",
+      "evidence": "Direct test verifies metadata equality and tested RS256 configuration only; do not generalize to every algorithm.",
+      "code_refs": [
+        "ciba_metadata",
+        "oauth_grant_types_supported",
+        "ciba_client_eligible?",
+        "post_configure"
+      ],
+      "test_refs": [
+        "test/ciba_security_test.rb#test_discovery_preserves_upstream_authentication_algorithms_for_both_endpoints"
+      ],
+      "normative_basis": "§4 / 認証署名アルゴリズムの共有: Conditional specification definition (metadata consistency; no MUST/REQUIRED keyword)。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: 認証署名アルゴリズムの共有; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-009",
+      "section": "4",
+      "label": "登録済み配送モード",
+      "requirement": "Require a registered single backchannel_token_delivery_mode from poll/ping/push for a CIBA client.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_configuration_test.rb#test_unavailable_or_unsupported_client_metadata_is_rejected. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_metadata",
+        "oauth_grant_types_supported",
+        "ciba_client_eligible?",
+        "post_configure"
+      ],
+      "test_refs": [
+        "test/ciba_configuration_test.rb#test_unavailable_or_unsupported_client_metadata_is_rejected"
+      ],
+      "normative_basis": "§4 / 登録済み配送モード: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: 登録済み配送モード; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-010",
+      "section": "4",
+      "label": "CIBA grantのクライアント登録",
+      "requirement": "Poll/ping clients register the CIBA grant in grant_types; enforce eligibility before accepting their requests.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_configuration_test.rb#test_dcr_rejects_ciba_but_preserves_other_grant_validation, test/ciba_configuration_test.rb#test_unavailable_or_unsupported_client_metadata_is_rejected. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_metadata",
+        "oauth_grant_types_supported",
+        "ciba_client_eligible?",
+        "post_configure"
+      ],
+      "test_refs": [
+        "test/ciba_configuration_test.rb#test_dcr_rejects_ciba_but_preserves_other_grant_validation",
+        "test/ciba_configuration_test.rb#test_unavailable_or_unsupported_client_metadata_is_rejected"
+      ],
+      "normative_basis": "§4 / CIBA grantのクライアント登録: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: CIBA grantのクライアント登録; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-011",
+      "section": "4",
+      "label": "通知URL登録",
+      "requirement": "Ping/push clients register an HTTPS backchannel_client_notification_endpoint.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "条件付き必須（該当機能/条件時 MUST）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "app",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§4 / 通知URL登録: 条件付き必須（該当機能/条件時 MUST）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: 通知URL登録; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-012",
+      "section": "4",
+      "label": "署名要求アルゴリズム登録",
+      "requirement": "Clients intending signed authentication requests register the signature algorithm; omission means unsigned requests.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "条件付き必須（該当機能/条件時 MUST）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§4 / 署名要求アルゴリズム登録: 条件付き必須（該当機能/条件時 MUST）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: 署名要求アルゴリズム登録; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-013",
+      "section": "4",
+      "label": "user_codeクライアント設定",
+      "requirement": "Respect backchannel_user_code_parameter only when OP user_code support is enabled; omitted value defaults false.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "Optional client metadata (OPTIONAL; only applies when OP support is true)",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§4 / user_codeクライアント設定: Optional client metadata (OPTIONAL; only applies when OP support is true)。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: user_codeクライアント設定; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-014",
+      "section": "4",
+      "label": "登録された認証方式",
+      "requirement": "Use each client's registered token_endpoint_auth_method for both Backchannel and Token endpoints.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "Specification definition (registered method; no MUST/REQUIRED keyword)",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem + upstream",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_configuration_test.rb#test_upstream_jwt_authentication_coexists_with_ciba_and_discovery, test/ciba_protocol_test.rb#test_post_client_authentication. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_metadata",
+        "oauth_grant_types_supported",
+        "ciba_client_eligible?",
+        "post_configure"
+      ],
+      "test_refs": [
+        "test/ciba_configuration_test.rb#test_upstream_jwt_authentication_coexists_with_ciba_and_discovery",
+        "test/ciba_protocol_test.rb#test_post_client_authentication"
+      ],
+      "normative_basis": "§4 / 登録された認証方式: Specification definition (registered method; no MUST/REQUIRED keyword)。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: 登録された認証方式; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-015",
+      "section": "4",
+      "label": "pairwise sector算出",
+      "requirement": "For poll/ping pairwise subjects use jwks_uri or sector_identifier_uri instead of redirect_uri to determine sector.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "条件付き必須（該当機能/条件時 MUST）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§4 / pairwise sector算出: 条件付き必須（該当機能/条件時 MUST）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: pairwise sector算出; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-016",
+      "section": "4",
+      "label": "pairwise DCR検証",
+      "requirement": "For pairwise poll/ping dynamic registration validate jwks_uri and its inclusion in an explicit sector_identifier_uri document.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "条件付き必須（該当機能/条件時 MUST）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§4 / pairwise DCR検証: 条件付き必須（該当機能/条件時 MUST）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: pairwise DCR検証; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-017",
+      "section": "4",
+      "label": "pairwise鍵所有証明",
+      "requirement": "For pairwise poll/ping require proof of possession of key material associated with jwks_uri through signed requests or the specified asymmetric client authentication.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "条件付き必須（該当機能/条件時 MUST）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§4 / pairwise鍵所有証明: 条件付き必須（該当機能/条件時 MUST）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: pairwise鍵所有証明; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-018",
+      "section": "4",
+      "label": "push pairwise sector",
+      "requirement": "Use notification endpoint host for push pairwise sector and check membership when explicit sector_identifier_uri is supplied.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4",
+      "normative_strength": "条件付き必須（該当機能/条件時 MUST）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§4 / push pairwise sector: 条件付き必須（該当機能/条件時 MUST）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 4; catalog label: push pairwise sector; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.4"
+    },
+    {
+      "id": "CIBA-019",
+      "section": "5",
+      "label": "poll配送",
+      "requirement": "Make authentication results available through the token endpoint in poll mode.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.5",
+      "normative_strength": "記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_discovery_describes_poll_and_keeps_existing_oidc_metadata, test/ciba_integration_test.rb#test_approved_request_issues_customer_id_token_once. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_metadata",
+        "create_token"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_discovery_describes_poll_and_keeps_existing_oidc_metadata",
+        "test/ciba_integration_test.rb#test_approved_request_issues_customer_id_token_once"
+      ],
+      "normative_basis": "§5 / poll配送: 記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 5; catalog label: poll配送; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.5"
+    },
+    {
+      "id": "CIBA-020",
+      "section": "5",
+      "label": "ping配送",
+      "requirement": "Notify the client then make the result available at the token endpoint in ping mode.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.5",
+      "normative_strength": "記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§5 / ping配送: 記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 5; catalog label: ping配送; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.5"
+    },
+    {
+      "id": "CIBA-021",
+      "section": "5",
+      "label": "push配送",
+      "requirement": "Deliver the complete authentication result directly to the notification endpoint in push mode.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.5",
+      "normative_strength": "記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§5 / push配送: 記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 5; catalog label: push配送; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.5"
+    },
+    {
+      "id": "CIBA-022",
+      "section": "5",
+      "label": "push sender-constrained token",
+      "requirement": "If supporting sender-constrained tokens in push, record Backchannel key material and bind issued tokens to it.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.5",
+      "normative_strength": "任意能力に対する設計指針（lowercase should）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§5 / push sender-constrained token: 任意能力に対する設計指針（lowercase should）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 5; catalog label: push sender-constrained token; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.5"
+    },
+    {
+      "id": "CIBA-023",
+      "section": "7",
+      "label": "開始APIのTLS",
+      "requirement": "Require TLS for Backchannel Authentication Endpoint communication.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_non_tls_and_json_requests_are_rejected. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "validate_ciba_transport!",
+        "validate_ciba_request!",
+        "backchannel_authentication route"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_non_tls_and_json_requests_are_rejected"
+      ],
+      "normative_basis": "§7 / 開始APIのTLS: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7; catalog label: 開始APIのTLS; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7"
+    },
+    {
+      "id": "CIBA-024",
+      "section": "7.1",
+      "label": "開始APIのPOSTとform",
+      "requirement": "Accept authentication requests as HTTP POST application/x-www-form-urlencoded UTF-8 bodies.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_non_tls_and_json_requests_are_rejected, test/ciba_protocol_test.rb#test_rack_inputs_without_rewind_work_on_both_endpoints. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "validate_ciba_transport!",
+        "validate_ciba_request!",
+        "resolve_ciba_login_hint",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_non_tls_and_json_requests_are_rejected",
+        "test/ciba_protocol_test.rb#test_rack_inputs_without_rewind_work_on_both_endpoints"
+      ],
+      "normative_basis": "§7.1 / 開始APIのPOSTとform: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: 開始APIのPOSTとform; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-025",
+      "section": "7.1",
+      "label": "開始APIのクライアント認証",
+      "requirement": "Authenticate the client at Backchannel using its registered authentication method.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem + upstream",
+      "audit_status": "verified",
+      "evidence": "`Schema.create_client_assertions` とCIBA用 assertion validation/one-use trackingを実装。direct regressions: test/ciba_security_test.rb. 既存のCIBA endpoint audience acceptance: test/ciba_configuration_test.rb#test_upstream_jwt_authentication_coexists_with_ciba_and_discovery.",
+      "code_refs": [
+        "CibaSupport::ClientAuthentication#require_oauth_application",
+        "CibaSupport::ClientAuthentication#jwt_assertion",
+        "require_oauth_application (upstream)"
+      ],
+      "test_refs": [
+        "test/ciba_security_test.rb#test_jwt_client_assertion_requires_issuer_expiry_and_jti",
+        "test/ciba_security_test.rb#test_jwt_client_assertion_is_single_use",
+        "test/ciba_security_test.rb#test_malformed_assertions_are_authentication_errors_at_both_ciba_endpoints",
+        "test/ciba_security_test.rb#test_backchannel_ignores_other_grant_parameters_without_bypassing_client_authentication",
+        "test/ciba_security_test.rb#test_assertion_subject_cannot_override_explicit_client_id"
+      ],
+      "normative_basis": "§7.1 / 開始APIのクライアント認証: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: 開始APIのクライアント認証; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-026",
+      "section": "7.1",
+      "label": "JWT audienceのissuer受理",
+      "requirement": "At Backchannel accept OP issuer identifier as the audience of JWT client assertions.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem + upstream",
+      "audit_status": "verified",
+      "evidence": "`Schema.create_client_assertions` とCIBA用 assertion validation/one-use trackingを実装。direct regressions: test/ciba_security_test.rb. 既存のCIBA endpoint audience acceptance: test/ciba_configuration_test.rb#test_upstream_jwt_authentication_coexists_with_ciba_and_discovery.",
+      "code_refs": [
+        "CibaSupport::ClientAuthentication#require_oauth_application",
+        "CibaSupport::ClientAuthentication#jwt_assertion",
+        "require_oauth_application (upstream)"
+      ],
+      "test_refs": [
+        "test/ciba_configuration_test.rb#test_upstream_jwt_authentication_coexists_with_ciba_and_discovery",
+        "test/ciba_security_test.rb#test_assertion_subject_cannot_override_explicit_client_id"
+      ],
+      "normative_basis": "§7.1 / JWT audienceのissuer受理: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: JWT audienceのissuer受理; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-027",
+      "section": "7.1",
+      "label": "JWT audienceのToken URL受理",
+      "requirement": "At Backchannel accept Token Endpoint URL as the audience of JWT client assertions.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem + upstream",
+      "audit_status": "verified",
+      "evidence": "`Schema.create_client_assertions` とCIBA用 assertion validation/one-use trackingを実装。direct regressions: test/ciba_security_test.rb. 既存のCIBA endpoint audience acceptance: test/ciba_configuration_test.rb#test_upstream_jwt_authentication_coexists_with_ciba_and_discovery.",
+      "code_refs": [
+        "CibaSupport::ClientAuthentication#require_oauth_application",
+        "CibaSupport::ClientAuthentication#jwt_assertion",
+        "require_oauth_application (upstream)"
+      ],
+      "test_refs": [
+        "test/ciba_configuration_test.rb#test_upstream_jwt_authentication_coexists_with_ciba_and_discovery",
+        "test/ciba_security_test.rb#test_assertion_subject_cannot_override_explicit_client_id"
+      ],
+      "normative_basis": "§7.1 / JWT audienceのToken URL受理: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: JWT audienceのToken URL受理; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-028",
+      "section": "7.1",
+      "label": "JWT audienceのBackchannel URL受理",
+      "requirement": "At Backchannel accept Backchannel Endpoint URL as the audience of JWT client assertions.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem + upstream",
+      "audit_status": "verified",
+      "evidence": "`Schema.create_client_assertions` とCIBA用 assertion validation/one-use trackingを実装。direct regressions: test/ciba_security_test.rb. 既存のCIBA endpoint audience acceptance: test/ciba_configuration_test.rb#test_upstream_jwt_authentication_coexists_with_ciba_and_discovery.",
+      "code_refs": [
+        "CibaSupport::ClientAuthentication#require_oauth_application",
+        "CibaSupport::ClientAuthentication#jwt_assertion",
+        "require_oauth_application (upstream)"
+      ],
+      "test_refs": [
+        "test/ciba_configuration_test.rb#test_upstream_jwt_authentication_coexists_with_ciba_and_discovery",
+        "test/ciba_security_test.rb#test_assertion_subject_cannot_override_explicit_client_id"
+      ],
+      "normative_basis": "§7.1 / JWT audienceのBackchannel URL受理: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: JWT audienceのBackchannel URL受理; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-029",
+      "section": "7.1",
+      "label": "JWT audienceのissuer推奨",
+      "requirement": "Client should use the OP issuer identifier for JWT assertion audience at Backchannel.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "推奨（SHOULD use OP Issuer as JWT aud）",
+      "conditional": false,
+      "first_version": "client obligation",
+      "responsibility": "client",
+      "audit_status": "client_only",
+      "evidence": "CIBA Clientに対する要求。OP gemの実装率・合否には算入しない。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1 / JWT audienceのissuer推奨: 推奨（SHOULD use OP Issuer as JWT aud）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: JWT audienceのissuer推奨; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-030",
+      "section": "7.1",
+      "label": "scope必須",
+      "requirement": "Require scope in a CIBA authentication request.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters, test/ciba_requirements_test.rb#test_scope_syntax_errors_are_invalid_scope. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "validate_ciba_transport!",
+        "validate_ciba_request!",
+        "resolve_ciba_login_hint",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters",
+        "test/ciba_requirements_test.rb#test_scope_syntax_errors_are_invalid_scope"
+      ],
+      "normative_basis": "§7.1 / scope必須: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: scope必須; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-031",
+      "section": "7.1",
+      "label": "openid scope",
+      "requirement": "Require the openid scope for the OpenID CIBA flow.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "validate_ciba_transport!",
+        "validate_ciba_request!",
+        "resolve_ciba_login_hint",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters"
+      ],
+      "normative_basis": "§7.1 / openid scope: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: openid scope; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-032",
+      "section": "7.1",
+      "label": "追加scope",
+      "requirement": "Allow authorized additional scopes such as profile/email/address/phone without treating openid as the only possible scope.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "任意（other scopes MAY be present）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_expiry_binding_context_and_offline_access. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "validate_ciba_transport!",
+        "validate_ciba_request!",
+        "resolve_ciba_login_hint",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_security_test.rb#test_additional_authorized_scopes_survive_acceptance_and_token_issuance"
+      ],
+      "normative_basis": "§7.1 / 追加scope: 任意（other scopes MAY be present）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: 追加scope; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-033",
+      "section": "7.1",
+      "label": "通知トークン必須条件",
+      "requirement": "Require client_notification_token for ping/push.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "条件付き必須（ping/push登録ならREQUIRED）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1 / 通知トークン必須条件: 条件付き必須（ping/push登録ならREQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: 通知トークン必須条件; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-034",
+      "section": "7.1",
+      "label": "通知トークンの長さと構文",
+      "requirement": "Validate client_notification_token max 1024 characters and bearer credential syntax.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "条件付き必須（ping/push時; MUST NOT exceed 1024 / bearer syntax）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1 / 通知トークンの長さと構文: 条件付き必須（ping/push時; MUST NOT exceed 1024 / bearer syntax）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: 通知トークンの長さと構文; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-035",
+      "section": "7.1",
+      "label": "通知トークンentropy",
+      "requirement": "Client ensures at least 128 bits entropy for client_notification_token, with 160 recommended.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "必須（client MUST ensure entropy; 160 bits is recommended）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "client",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1 / 通知トークンentropy: 必須（client MUST ensure entropy; 160 bits is recommended）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: 通知トークンentropy; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-036",
+      "section": "7.1",
+      "label": "acr_values受理",
+      "requirement": "Accept requested space-separated acr_values and preserve preference order for authentication selection.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "任意（OPTIONAL acr_values; order is preference; OP discretion）",
+      "conditional": false,
+      "first_version": "in scope with app contract",
+      "responsibility": "gem + app",
+      "audit_status": "verified",
+      "evidence": "gemはacr_valuesを順序を保って保存することをテスト。認証方式の選択・実施はアプリの責務。",
+      "code_refs": [
+        "validate_ciba_transport!",
+        "validate_ciba_request!",
+        "resolve_ciba_login_hint",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_expiry_binding_context_and_offline_access"
+      ],
+      "normative_basis": "§7.1 / acr_values受理: 任意（OPTIONAL acr_values; order is preference; OP discretion）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: acr_values受理; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-037",
+      "section": "7.1",
+      "label": "達成したacrの返却",
+      "requirement": "Report the authentication context actually achieved as acr in the ID Token; acr is highly recommended when acr_values was requested.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "強く推奨（highly RECOMMENDED acr claim when requested）",
+      "conditional": true,
+      "first_version": "in scope with app contract",
+      "responsibility": "gem + upstream + app",
+      "audit_status": "verified",
+      "evidence": "アプリが渡したacrを署名済みID Tokenに載せる経路をテスト。実際に達成した認証強度であることはアプリが保証する。",
+      "code_refs": [
+        "validate_ciba_transport!",
+        "validate_ciba_request!",
+        "resolve_ciba_login_hint",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_integration_test.rb#test_approved_request_issues_customer_id_token_once"
+      ],
+      "normative_basis": "§7.1 / 達成したacrの返却: 強く推奨（highly RECOMMENDED acr claim when requested）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: 達成したacrの返却; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-038",
+      "section": "7.1",
+      "label": "login_hint_token",
+      "requirement": "Support user identification via login_hint_token according to deployment-specific token format and validation policy.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "Optional parameter (OPTIONAL)",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1 / login_hint_token: Optional parameter (OPTIONAL)。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: login_hint_token; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-039",
+      "section": "7.1",
+      "label": "id_token_hint",
+      "requirement": "Support user identification using an ID Token previously issued by the OP.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "Optional parameter (OPTIONAL)",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1 / id_token_hint: Optional parameter (OPTIONAL)。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: id_token_hint; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-040",
+      "section": "7.1",
+      "label": "暗号化id_token_hintの復号",
+      "requirement": "Client decrypts an asymmetrically encrypted ID Token before supplying it as id_token_hint.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "条件付き必須（暗号化ID Tokenをhintに使うclientはMUST decrypt）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "client",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1 / 暗号化id_token_hintの復号: 条件付き必須（暗号化ID Tokenをhintに使うclientはMUST decrypt）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: 暗号化id_token_hintの復号; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-041",
+      "section": "7.1",
+      "label": "login_hint",
+      "requirement": "Support a login_hint string as a user identifier without requiring it to be an email address.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "任意（OPTIONAL login_hint）",
+      "conditional": false,
+      "first_version": "in scope with app contract",
+      "responsibility": "gem + app",
+      "audit_status": "verified",
+      "evidence": "gemのstring検証・resolver呼出し・解決不能時の拒否をテスト。識別子の意味とアカウント対応付けはアプリ契約であり、メール形式をgemでは要求しない。",
+      "code_refs": [
+        "validate_ciba_transport!",
+        "validate_ciba_request!",
+        "resolve_ciba_login_hint",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters"
+      ],
+      "normative_basis": "§7.1 / login_hint: 任意（OPTIONAL login_hint）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: login_hint; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-042",
+      "section": "7.1",
+      "label": "binding_messageの受理と引継ぎ",
+      "requirement": "Accept binding_message and make it available for display on both consumption and authentication devices.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "Optional parameter (OPTIONAL)",
+      "conditional": false,
+      "first_version": "in scope with app contract",
+      "responsibility": "gem + app",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_expiry_binding_context_and_offline_access, test/demo_test.rb#test_browser_approval_checks_csrf_and_finishes_request. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "validate_ciba_transport!",
+        "validate_ciba_request!",
+        "resolve_ciba_login_hint",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_expiry_binding_context_and_offline_access",
+        "test/demo_test.rb#test_browser_approval_checks_csrf_and_finishes_request"
+      ],
+      "normative_basis": "§7.1 / binding_messageの受理と引継ぎ: Optional parameter (OPTIONAL)。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: binding_messageの受理と引継ぎ; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-043",
+      "section": "7.1",
+      "label": "binding_messageの関連付け",
+      "requirement": "Client chooses binding_message that lets the end-user correlate the initiating action and authentication device interaction.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "Recommendation (SHOULD)",
+      "conditional": false,
+      "first_version": "client obligation",
+      "responsibility": "client",
+      "audit_status": "client_only",
+      "evidence": "CIBA Clientに対する要求。OP gemの実装率・合否には算入しない。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1 / binding_messageの関連付け: Recommendation (SHOULD)。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: binding_messageの関連付け; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-044",
+      "section": "7.1",
+      "label": "binding_messageの表示適性",
+      "requirement": "Keep binding_message relatively short with a limited set of plain-text characters suitable for display.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "Recommendation (SHOULD)",
+      "conditional": false,
+      "first_version": "in scope with app contract",
+      "responsibility": "gem + app",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_expiry_binding_context_and_offline_access. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "validate_ciba_transport!",
+        "validate_ciba_request!",
+        "resolve_ciba_login_hint",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_expiry_binding_context_and_offline_access"
+      ],
+      "normative_basis": "§7.1 / binding_messageの表示適性: Recommendation (SHOULD)。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: binding_messageの表示適性; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-045",
+      "section": "7.1",
+      "label": "user_code",
+      "requirement": "Support optional user_code validation when the OP/client has enabled it.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "任意（OPTIONAL user_code; lowercase “should only” condition is non-RFC2119）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1 / user_code: 任意（OPTIONAL user_code; lowercase “should only” condition is non-RFC2119）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: user_code; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-046",
+      "section": "7.1",
+      "label": "requested_expiry構文",
+      "requirement": "Accept optional requested_expiry as a positive integer.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "任意（OPTIONAL requested_expiry with positive-integer value）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_expiry_binding_context_and_offline_access. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "validate_ciba_transport!",
+        "validate_ciba_request!",
+        "resolve_ciba_login_hint",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_expiry_binding_context_and_offline_access"
+      ],
+      "normative_basis": "§7.1 / requested_expiry構文: 任意（OPTIONAL requested_expiry with positive-integer value）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: requested_expiry構文; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-047",
+      "section": "7.1",
+      "label": "requested_expiryの採用",
+      "requirement": "OP may use requested_expiry to influence the request lifetime; evaluate the implementation of this optional capability, not a mandatory obligation to honor it exactly.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "任意（server MAY honor; encouraged where useful）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_expiry_binding_context_and_offline_access. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "validate_ciba_transport!",
+        "validate_ciba_request!",
+        "resolve_ciba_login_hint",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_expiry_binding_context_and_offline_access"
+      ],
+      "normative_basis": "§7.1 / requested_expiryの採用: 任意（server MAY honor; encouraged where useful）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: requested_expiryの採用; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-048",
+      "section": "7.1",
+      "label": "hintはちょうど一つ",
+      "requirement": "Require exactly one of login_hint, login_hint_token, id_token_hint in an authentication request.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "validate_ciba_transport!",
+        "validate_ciba_request!",
+        "resolve_ciba_login_hint",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters"
+      ],
+      "normative_basis": "§7.1 / hintはちょうど一つ: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1; catalog label: hintはちょうど一つ; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1"
+    },
+    {
+      "id": "CIBA-049",
+      "section": "7.1.1",
+      "label": "署名要求のJWT形式",
+      "requirement": "Support signed authentication requests carried in the request parameter as a signed JWT containing all authentication parameters.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1",
+      "normative_strength": "条件付き必須（署名付き認証要求を実装する場合）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1.1 / 署名要求のJWT形式: 条件付き必須（署名付き認証要求を実装する場合）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1.1; catalog label: 署名要求のJWT形式; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1"
+    },
+    {
+      "id": "CIBA-050",
+      "section": "7.1.1",
+      "label": "署名要求の非対称署名",
+      "requirement": "Validate asymmetric signature for signed authentication requests.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1",
+      "normative_strength": "条件付き必須（署名付き認証要求を実装する場合）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1.1 / 署名要求の非対称署名: 条件付き必須（署名付き認証要求を実装する場合）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1.1; catalog label: 署名要求の非対称署名; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1"
+    },
+    {
+      "id": "CIBA-051",
+      "section": "7.1.1",
+      "label": "署名要求のaud",
+      "requirement": "Validate signed request aud as the OP issuer.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1",
+      "normative_strength": "条件付き必須（署名付き認証要求を実装する場合）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1.1 / 署名要求のaud: 条件付き必須（署名付き認証要求を実装する場合）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1.1; catalog label: 署名要求のaud; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1"
+    },
+    {
+      "id": "CIBA-052",
+      "section": "7.1.1",
+      "label": "署名要求のiss",
+      "requirement": "Validate signed request iss as the client_id.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1",
+      "normative_strength": "条件付き必須（署名付き認証要求を実装する場合）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1.1 / 署名要求のiss: 条件付き必須（署名付き認証要求を実装する場合）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1.1; catalog label: 署名要求のiss; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1"
+    },
+    {
+      "id": "CIBA-053",
+      "section": "7.1.1",
+      "label": "署名要求のexp",
+      "requirement": "Require and validate exp on signed authentication requests.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1",
+      "normative_strength": "条件付き必須（署名付き認証要求を実装する場合）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1.1 / 署名要求のexp: 条件付き必須（署名付き認証要求を実装する場合）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1.1; catalog label: 署名要求のexp; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1"
+    },
+    {
+      "id": "CIBA-054",
+      "section": "7.1.1",
+      "label": "署名要求のiat",
+      "requirement": "Require and validate iat on signed authentication requests.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1",
+      "normative_strength": "条件付き必須（署名付き認証要求を実装する場合）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1.1 / 署名要求のiat: 条件付き必須（署名付き認証要求を実装する場合）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1.1; catalog label: 署名要求のiat; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1"
+    },
+    {
+      "id": "CIBA-055",
+      "section": "7.1.1",
+      "label": "署名要求のnbf",
+      "requirement": "Require and validate nbf on signed authentication requests.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1",
+      "normative_strength": "条件付き必須（署名付き認証要求を実装する場合）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1.1 / 署名要求のnbf: 条件付き必須（署名付き認証要求を実装する場合）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1.1; catalog label: 署名要求のnbf; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1"
+    },
+    {
+      "id": "CIBA-056",
+      "section": "7.1.1",
+      "label": "署名要求のjti",
+      "requirement": "Require a unique jti on signed authentication requests.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1",
+      "normative_strength": "条件付き必須（署名付き認証要求を実装する場合）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1.1 / 署名要求のjti: 条件付き必須（署名付き認証要求を実装する場合）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1.1; catalog label: 署名要求のjti; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1"
+    },
+    {
+      "id": "CIBA-057",
+      "section": "7.1.1",
+      "label": "署名要求のrequested_expiry型",
+      "requirement": "Accept requested_expiry as either JSON string or number inside signed authentication requests.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1",
+      "normative_strength": "記述的要件（OP must accept either type; source uses lowercase “must”）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1.1 / 署名要求のrequested_expiry型: 記述的要件（OP must accept either type; source uses lowercase “must”）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1.1; catalog label: 署名要求のrequested_expiry型; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1"
+    },
+    {
+      "id": "CIBA-058",
+      "section": "7.1.1",
+      "label": "署名要求の内外混在禁止",
+      "requirement": "Do not allow authentication request parameters outside a signed request JWT; separate client authentication parameters remain outside.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1",
+      "normative_strength": "条件付き必須（署名付き認証要求を実装する場合）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1.1 / 署名要求の内外混在禁止: 条件付き必須（署名付き認証要求を実装する場合）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1.1; catalog label: 署名要求の内外混在禁止; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1"
+    },
+    {
+      "id": "CIBA-059",
+      "section": "7.1.1",
+      "label": "暗号化要求非対応",
+      "requirement": "Do not treat encrypted JWT authentication requests as a supported signed-request format.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1",
+      "normative_strength": "記述的要件（7.1.1 does not state the catalog prohibition as an RFC2119 rule）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1.1 / 暗号化要求非対応: 記述的要件（7.1.1 does not state the catalog prohibition as an RFC2119 rule）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1.1; catalog label: 暗号化要求非対応; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.1"
+    },
+    {
+      "id": "CIBA-060",
+      "section": "7.1.2",
+      "label": "user_codeはOPパスワードと別",
+      "requirement": "If user_code is supported, use a code distinct from the user's OP password.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.2",
+      "normative_strength": "仕様定義（user_codeの秘密値はOPのパスワードとは別）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem + app (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1.2 / user_codeはOPパスワードと別: 仕様定義（user_codeの秘密値はOPのパスワードとは別）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1.2; catalog label: user_codeはOPパスワードと別; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.2"
+    },
+    {
+      "id": "CIBA-061",
+      "section": "7.1.2",
+      "label": "user_codeの例外ポリシー",
+      "requirement": "If user_code is supported, allow policy for clients/users without it as permitted by the specification.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.2",
+      "normative_strength": "任意のポリシー（user_code対応時、例外を許容できる。lowercase may）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem + app (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1.2 / user_codeの例外ポリシー: 任意のポリシー（user_code対応時、例外を許容できる。lowercase may）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1.2; catalog label: user_codeの例外ポリシー; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.2"
+    },
+    {
+      "id": "CIBA-062",
+      "section": "7.1.2",
+      "label": "user_codeの都度入力",
+      "requirement": "Client must not store user_code and requests it for each CIBA flow.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.2",
+      "normative_strength": "必須（client MUST NOT store user_code）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "client",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1.2 / user_codeの都度入力: 必須（client MUST NOT store user_code）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1.2; catalog label: user_codeの都度入力; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.2"
+    },
+    {
+      "id": "CIBA-063",
+      "section": "7.1.2",
+      "label": "user_code変更手段",
+      "requirement": "If user_code is supported, OP should provide a way for users to change it.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.2",
+      "normative_strength": "設計指針（user_code変更手段、lowercase should）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "app",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.1.2 / user_code変更手段: 設計指針（user_code変更手段、lowercase should）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.1.2; catalog label: user_code変更手段; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.1.2"
+    },
+    {
+      "id": "CIBA-064",
+      "section": "7.2",
+      "label": "登録方式による認証検証",
+      "requirement": "Validate client authentication using the registered/configured method before accepting an authentication request.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem + upstream",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_post_client_authentication, test/ciba_security_test.rb#test_jwt_client_assertion_requires_issuer_expiry_and_jti. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "CibaSupport::ClientAuthentication#require_oauth_application",
+        "CibaSupport::ClientAuthentication#jwt_assertion",
+        "require_oauth_application (upstream)"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_post_client_authentication",
+        "test/ciba_security_test.rb#test_jwt_client_assertion_requires_issuer_expiry_and_jti"
+      ],
+      "normative_basis": "§7.2 / 登録方式による認証検証: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.2; catalog label: 登録方式による認証検証; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2"
+    },
+    {
+      "id": "CIBA-065",
+      "section": "7.2",
+      "label": "公開鍵認証の推奨",
+      "requirement": "Support the recommended public-key client authentication alternative to sending shared secrets in requests.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2",
+      "normative_strength": "推奨（RECOMMENDED、Clientによる公開鍵認証の利用）",
+      "conditional": false,
+      "first_version": "client obligation",
+      "responsibility": "client",
+      "audit_status": "client_only",
+      "evidence": "CIBA Clientに対する要求。OP gemの実装率・合否には算入しない。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.2 / 公開鍵認証の推奨: 推奨（RECOMMENDED、Clientによる公開鍵認証の利用）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.2; catalog label: 公開鍵認証の推奨; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2"
+    },
+    {
+      "id": "CIBA-066",
+      "section": "7.2",
+      "label": "署名要求検証",
+      "requirement": "If signed requests are supported, validate JWT signature and all other applicable JWT validity constraints.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2",
+      "normative_strength": "条件付き必須（署名付き要求がある場合。§7.2のMUST validateに含まれる）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.2 / 署名要求検証: 条件付き必須（署名付き要求がある場合。§7.2のMUST validateに含まれる）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.2; catalog label: 署名要求検証; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2"
+    },
+    {
+      "id": "CIBA-067",
+      "section": "7.2",
+      "label": "認証要求パラメータ検証",
+      "requirement": "Validate all authentication request parameters within the supported feature scope.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters, test/ciba_protocol_test.rb#test_expiry_binding_context_and_offline_access, test/ciba_requirements_test.rb#test_scope_syntax_errors_are_invalid_scope. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "backchannel_authentication route",
+        "ciba_request_accepted"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters",
+        "test/ciba_protocol_test.rb#test_expiry_binding_context_and_offline_access",
+        "test/ciba_requirements_test.rb#test_scope_syntax_errors_are_invalid_scope"
+      ],
+      "normative_basis": "§7.2 / 認証要求パラメータ検証: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.2; catalog label: 認証要求パラメータ検証; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2"
+    },
+    {
+      "id": "CIBA-068",
+      "section": "7.2",
+      "label": "複数hintのエラー",
+      "requirement": "Return invalid_request when multiple hints are provided.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": true,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "backchannel_authentication route",
+        "ciba_request_accepted"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters"
+      ],
+      "normative_basis": "§7.2 / 複数hintのエラー: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.2; catalog label: 複数hintのエラー; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2"
+    },
+    {
+      "id": "CIBA-069",
+      "section": "7.2",
+      "label": "hintとユーザーの検証",
+      "requirement": "Process a supported hint to establish its validity and identify an eligible user before request acceptance.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem + app",
+      "audit_status": "verified",
+      "evidence": "無効・未解決hintは拒否し、resolverが返すアカウントの利用可能性を検証する。外部の本人識別方式はアプリ契約。",
+      "code_refs": [
+        "validate_ciba_request!",
+        "resolve_ciba_login_hint",
+        "ciba_account_eligible?"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters"
+      ],
+      "normative_basis": "§7.2 / hintとユーザーの検証: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.2; catalog label: hintとユーザーの検証; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2"
+    },
+    {
+      "id": "CIBA-070",
+      "section": "7.2",
+      "label": "hintポリシーの伝達",
+      "requirement": "Communicate accepted hint types and where applicable issuer/max-age policy to clients.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2",
+      "normative_strength": "記述的要件（hint policy “should be communicated”; validation/information explicitly out of scope）",
+      "conditional": false,
+      "first_version": "in scope with app contract",
+      "responsibility": "gem + app",
+      "audit_status": "app_contract",
+      "evidence": "仕様がOP/client/appの選択・ユーザー提示・業務判断を含む。gemのフックや保存値は契約の境界であり、アプリ動作全体の証拠ではない。",
+      "code_refs": [
+        "backchannel_authentication route",
+        "ciba_request_accepted"
+      ],
+      "test_refs": [],
+      "normative_basis": "§7.2 / hintポリシーの伝達: 記述的要件（hint policy “should be communicated”; validation/information explicitly out of scope）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.2; catalog label: hintポリシーの伝達; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2"
+    },
+    {
+      "id": "CIBA-071",
+      "section": "7.2",
+      "label": "不正または不明hintのエラー",
+      "requirement": "Return an appropriate Authentication Error Response for an invalid hint or unidentified user.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2",
+      "normative_strength": "設計指針（lowercase should。応答コードの意味は§13参照）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "backchannel_authentication route",
+        "ciba_request_accepted"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters"
+      ],
+      "normative_basis": "§7.2 / 不正または不明hintのエラー: 設計指針（lowercase should。応答コードの意味は§13参照）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.2; catalog label: 不正または不明hintのエラー; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2"
+    },
+    {
+      "id": "CIBA-072",
+      "section": "7.2",
+      "label": "必須パラメータ検証",
+      "requirement": "Verify required parameters are present and used according to their requirements.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "backchannel_authentication route",
+        "ciba_request_accepted"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters"
+      ],
+      "normative_basis": "§7.2 / 必須パラメータ検証: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.2; catalog label: 必須パラメータ検証; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2"
+    },
+    {
+      "id": "CIBA-073",
+      "section": "7.2",
+      "label": "未知パラメータの無視",
+      "requirement": "Ignore unrecognized authentication request parameters.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "backchannel_authentication route",
+        "ciba_request_accepted"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters"
+      ],
+      "normative_basis": "§7.2 / 未知パラメータの無視: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.2; catalog label: 未知パラメータの無視; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2"
+    },
+    {
+      "id": "CIBA-074",
+      "section": "7.2",
+      "label": "開始エラーの形式",
+      "requirement": "Return Authentication Error Responses per section 13 when authentication request validation fails.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": true,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "backchannel_authentication route",
+        "ciba_request_accepted"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters"
+      ],
+      "normative_basis": "§7.2 / 開始エラーの形式: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.2; catalog label: 開始エラーの形式; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.2"
+    },
+    {
+      "id": "CIBA-075",
+      "section": "7.3",
+      "label": "受付成功HTTP 200",
+      "requirement": "Return HTTP 200 acknowledgement after validating and accepting an authentication request.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3",
+      "normative_strength": "応答定義（成功時HTTP 200、MUSTという語ではない）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "json_response_success (upstream)",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters"
+      ],
+      "normative_basis": "§7.3 / 受付成功HTTP 200: 応答定義（成功時HTTP 200、MUSTという語ではない）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.3; catalog label: 受付成功HTTP 200; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3"
+    },
+    {
+      "id": "CIBA-076",
+      "section": "7.3",
+      "label": "auth_req_id必須と一意性",
+      "requirement": "Return a unique auth_req_id in the acknowledgement.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_requirements_test.rb#test_auth_req_id_has_required_entropy_and_restricted_characters. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "backchannel_authentication route",
+        "validate_ciba_request!"
+      ],
+      "test_refs": [
+        "test/ciba_requirements_test.rb#test_auth_req_id_has_required_entropy_and_restricted_characters"
+      ],
+      "normative_basis": "§7.3 / auth_req_id必須と一意性: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.3; catalog label: auth_req_id必須と一意性; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3"
+    },
+    {
+      "id": "CIBA-077",
+      "section": "7.3",
+      "label": "auth_req_id entropy",
+      "requirement": "Generate auth_req_id with at least 128 bits entropy, preferably at least 160 bits.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "code_review_only",
+      "evidence": "乱数生成はSecureRandomの32bytesに依存するため256bitの入力。テストは長さ・文字集合・少数サンプルの相違のみで、entropyそのものの統計的証明ではない。",
+      "code_refs": [
+        "SecureRandom.urlsafe_base64(32) in backchannel_authentication route"
+      ],
+      "test_refs": [
+        "test/ciba_requirements_test.rb#test_auth_req_id_has_required_entropy_and_restricted_characters"
+      ],
+      "normative_basis": "§7.3 / auth_req_id entropy: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.3; catalog label: auth_req_id entropy; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3"
+    },
+    {
+      "id": "CIBA-078",
+      "section": "7.3",
+      "label": "auth_req_id文字集合",
+      "requirement": "Restrict auth_req_id to A-Z a-z 0-9 dot hyphen underscore.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_requirements_test.rb#test_auth_req_id_has_required_entropy_and_restricted_characters. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "backchannel_authentication route",
+        "validate_ciba_request!"
+      ],
+      "test_refs": [
+        "test/ciba_requirements_test.rb#test_auth_req_id_has_required_entropy_and_restricted_characters"
+      ],
+      "normative_basis": "§7.3 / auth_req_id文字集合: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.3; catalog label: auth_req_id文字集合; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3"
+    },
+    {
+      "id": "CIBA-079",
+      "section": "7.3",
+      "label": "auth_req_idのopaque扱い",
+      "requirement": "Client treats auth_req_id as opaque.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3",
+      "normative_strength": "必須（Client MUST treat auth_req_id as opaque）",
+      "conditional": false,
+      "first_version": "client obligation",
+      "responsibility": "client",
+      "audit_status": "client_only",
+      "evidence": "CIBA Clientに対する要求。OP gemの実装率・合否には算入しない。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.3 / auth_req_idのopaque扱い: 必須（Client MUST treat auth_req_id as opaque）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.3; catalog label: auth_req_idのopaque扱い; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3"
+    },
+    {
+      "id": "CIBA-080",
+      "section": "7.3",
+      "label": "expires_in",
+      "requirement": "Return expires_in as a positive integer JSON number measuring request lifetime in seconds from receipt.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_requirements_test.rb#test_requested_expiry_expires_at_the_exact_boundary. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "backchannel_authentication route",
+        "validate_ciba_request!"
+      ],
+      "test_refs": [
+        "test/ciba_requirements_test.rb#test_requested_expiry_expires_at_the_exact_boundary"
+      ],
+      "normative_basis": "§7.3 / expires_in: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.3; catalog label: expires_in; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3"
+    },
+    {
+      "id": "CIBA-081",
+      "section": "7.3",
+      "label": "interval",
+      "requirement": "If provided for poll/ping, return interval as a positive integer JSON number in seconds.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3",
+      "normative_strength": "任意（interval is OPTIONAL; if supplied, positive integer; client MUST wait; default rule separate ID 82）",
+      "conditional": true,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "原仕様の義務主体はCIBA Client。OP gemにクライアント実装は含まれず、合否対象にしない。",
+      "code_refs": [
+        "backchannel_authentication route",
+        "validate_ciba_request!"
+      ],
+      "test_refs": [
+        "test/ciba_security_test.rb#test_additional_authorized_scopes_survive_acceptance_and_token_issuance"
+      ],
+      "normative_basis": "§7.3 / interval: 任意（interval is OPTIONAL; if supplied, positive integer; client MUST wait; default rule separate ID 82）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.3; catalog label: interval; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3"
+    },
+    {
+      "id": "CIBA-082",
+      "section": "7.3",
+      "label": "interval既定値",
+      "requirement": "Client uses five seconds when interval is omitted.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3",
+      "normative_strength": "必須（client MUST use 5-second default when interval omitted）",
+      "conditional": true,
+      "first_version": "client obligation",
+      "responsibility": "client",
+      "audit_status": "client_only",
+      "evidence": "CIBA Clientに対する要求。OP gemの実装率・合否には算入しない。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.3 / interval既定値: 必須（client MUST use 5-second default when interval omitted）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.3; catalog label: interval既定値; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3"
+    },
+    {
+      "id": "CIBA-083",
+      "section": "7.3",
+      "label": "未知応答パラメータ",
+      "requirement": "Client ignores unrecognized acknowledgement response parameters.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "client obligation",
+      "responsibility": "client",
+      "audit_status": "client_only",
+      "evidence": "CIBA Clientに対する要求。OP gemの実装率・合否には算入しない。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.3 / 未知応答パラメータ: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.3; catalog label: 未知応答パラメータ; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.3"
+    },
+    {
+      "id": "CIBA-084",
+      "section": "7.4",
+      "label": "受付応答の必須項目確認",
+      "requirement": "Client validates required acknowledgement parameters on HTTP 200.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.4",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "client obligation",
+      "responsibility": "client",
+      "audit_status": "client_only",
+      "evidence": "CIBA Clientに対する要求。OP gemの実装率・合否には算入しない。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.4 / 受付応答の必須項目確認: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.4; catalog label: 受付応答の必須項目確認; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.4"
+    },
+    {
+      "id": "CIBA-085",
+      "section": "7.4",
+      "label": "auth_req_id保持",
+      "requirement": "Client retains auth_req_id for subsequent polling or callback validation.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.4",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "client obligation",
+      "responsibility": "client",
+      "audit_status": "client_only",
+      "evidence": "CIBA Clientに対する要求。OP gemの実装率・合否には算入しない。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.4 / auth_req_id保持: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.4; catalog label: auth_req_id保持; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.4"
+    },
+    {
+      "id": "CIBA-086",
+      "section": "7.4",
+      "label": "クライアント期限管理",
+      "requirement": "Client should retain expiry for cleanup of requests awaiting callback.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.4",
+      "normative_strength": "設計指針（期限保存、lowercase should）",
+      "conditional": false,
+      "first_version": "client obligation",
+      "responsibility": "client",
+      "audit_status": "client_only",
+      "evidence": "CIBA Clientに対する要求。OP gemの実装率・合否には算入しない。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§7.4 / クライアント期限管理: 設計指針（期限保存、lowercase should）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 7.4; catalog label: クライアント期限管理; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.7.4"
+    },
+    {
+      "id": "CIBA-087",
+      "section": "8",
+      "label": "認証チャネルとacrの選択",
+      "requirement": "OP identifies user and chooses an authentication channel considering acr_values; evaluate gem/application responsibility separately.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.8",
+      "normative_strength": "記述的要件（§8 places user/channel/acr selection in OP process; catalog added an evaluation abstraction）",
+      "conditional": false,
+      "first_version": "in scope with app contract",
+      "responsibility": "gem + app",
+      "audit_status": "app_contract",
+      "evidence": "仕様がOP/client/appの選択・ユーザー提示・業務判断を含む。gemのフックや保存値は契約の境界であり、アプリ動作全体の証拠ではない。",
+      "code_refs": [
+        "create_token",
+        "id_token_claims"
+      ],
+      "test_refs": [],
+      "normative_basis": "§8 / 認証チャネルとacrの選択: 記述的要件（§8 places user/channel/acr selection in OP process; catalog added an evaluation abstraction）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 8; catalog label: 認証チャネルとacrの選択; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.8"
+    },
+    {
+      "id": "CIBA-088",
+      "section": "8",
+      "label": "認証後の承認取得",
+      "requirement": "Before successful token issuance, obtain the authenticated end-user's authorization decision per OIDC Core 3.1.2.4.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.8",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope with app contract",
+      "responsibility": "gem + app",
+      "audit_status": "app_contract",
+      "evidence": "gemはRuby APIの承認済み状態を発行条件にする。本人確認・承認権限・意思決定の真正性はアプリが保証するため、gemのテストだけではこの要求の達成を主張しない。",
+      "code_refs": [
+        "approve_ciba_request",
+        "ciba_complete",
+        "create_token"
+      ],
+      "test_refs": [],
+      "normative_basis": "§8 / 認証後の承認取得: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 8; catalog label: 認証後の承認取得; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.8"
+    },
+    {
+      "id": "CIBA-089",
+      "section": "10",
+      "label": "登録モード以外へ配送しない",
+      "requirement": "Deliver authentication result only through the client's single registered delivery mode.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_configuration_test.rb#test_unavailable_or_unsupported_client_metadata_is_rejected. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "create_token",
+        "validate_token_params"
+      ],
+      "test_refs": [
+        "test/ciba_configuration_test.rb#test_unavailable_or_unsupported_client_metadata_is_rejected"
+      ],
+      "normative_basis": "§10 / 登録モード以外へ配送しない: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10; catalog label: 登録モード以外へ配送しない; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10"
+    },
+    {
+      "id": "CIBA-090",
+      "section": "10.1",
+      "label": "Token Endpoint認証",
+      "requirement": "Require registered client authentication for CIBA token requests.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem + upstream",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_integration_test.rb#test_client_authentication_is_required_at_both_endpoints. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "CibaSupport::ClientAuthentication#require_oauth_application",
+        "CibaSupport::ClientAuthentication#jwt_assertion",
+        "require_oauth_application (upstream)"
+      ],
+      "test_refs": [
+        "test/ciba_integration_test.rb#test_client_authentication_is_required_at_both_endpoints"
+      ],
+      "normative_basis": "§10.1 / Token Endpoint認証: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.1; catalog label: Token Endpoint認証; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1"
+    },
+    {
+      "id": "CIBA-091",
+      "section": "10.1",
+      "label": "クライアントpoll間隔",
+      "requirement": "Client must not poll more frequently than the OP's minimum interval.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "client obligation",
+      "responsibility": "client",
+      "audit_status": "client_only",
+      "evidence": "CIBA Clientに対する要求。OP gemの実装率・合否には算入しない。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.1 / クライアントpoll間隔: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.1; catalog label: クライアントpoll間隔; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1"
+    },
+    {
+      "id": "CIBA-092",
+      "section": "10.1",
+      "label": "long polling",
+      "requirement": "Optionally support long polling with a recommended timeout of 30 seconds.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1",
+      "normative_strength": "任意（long polling、lowercase may。30秒は参照仕様の推奨）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.1 / long polling: 任意（long polling、lowercase may。30秒は参照仕様の推奨）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.1; catalog label: long polling; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1"
+    },
+    {
+      "id": "CIBA-093",
+      "section": "10.1",
+      "label": "OP応答時間",
+      "requirement": "OP should not take more than 30 seconds to respond to polling requests.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1",
+      "normative_strength": "推奨（OP should not take more than 30 seconds; source lowercase should）",
+      "conditional": false,
+      "first_version": "in scope with app contract",
+      "responsibility": "gem + deployment",
+      "audit_status": "app_contract",
+      "evidence": "HTTPサーバー・DB・アプリフックを含む応答時間は運用設定に依存する。gemは30秒の全経路deadlineを実装していない。",
+      "code_refs": [
+        "ciba_http"
+      ],
+      "test_refs": [],
+      "normative_basis": "§10.1 / OP応答時間: 推奨（OP should not take more than 30 seconds; source lowercase should）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.1; catalog label: OP応答時間; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1"
+    },
+    {
+      "id": "CIBA-094",
+      "section": "10.1",
+      "label": "重複poll禁止",
+      "requirement": "Client must not send overlapping requests using the same auth_req_id.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "client obligation",
+      "responsibility": "client",
+      "audit_status": "client_only",
+      "evidence": "CIBA Clientに対する要求。OP gemの実装率・合否には算入しない。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.1 / 重複poll禁止: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.1; catalog label: 重複poll禁止; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1"
+    },
+    {
+      "id": "CIBA-095",
+      "section": "10.1",
+      "label": "503とRetry-After",
+      "requirement": "OP may return HTTP 503 with Retry-After under load; evaluate this optional behavior.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1",
+      "normative_strength": "任意（OP MAY return 503 / Retry-After under stated condition）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "DBロックタイムアウトを503/Retry-Afterへ変換しrollbackする経路を検証。汎用の負荷制限・長時間負荷試験を意味しない。",
+      "code_refs": [
+        "ciba_http"
+      ],
+      "test_refs": [
+        "test/ciba_security_test.rb#test_lock_timeout_returns_503_with_retry_after_and_rolls_back"
+      ],
+      "normative_basis": "§10.1 / 503とRetry-After: 任意（OP MAY return 503 / Retry-After under stated condition）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.1; catalog label: 503とRetry-After; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1"
+    },
+    {
+      "id": "CIBA-096",
+      "section": "10.1",
+      "label": "Retry-After遵守",
+      "requirement": "Client should respect Retry-After before retrying a token request.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1",
+      "normative_strength": "推奨（client should respect Retry-After; lowercase should）",
+      "conditional": false,
+      "first_version": "client obligation",
+      "responsibility": "client",
+      "audit_status": "client_only",
+      "evidence": "CIBA Clientに対する要求。OP gemの実装率・合否には算入しない。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.1 / Retry-After遵守: 推奨（client should respect Retry-After; lowercase should）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.1; catalog label: Retry-After遵守; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1"
+    },
+    {
+      "id": "CIBA-097",
+      "section": "10.1",
+      "label": "pingクライアントのpoll許容",
+      "requirement": "Treat a ping client that polls the token endpoint as a poll client.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1",
+      "normative_strength": "条件付き必須（§10.1、ping clientがpollした場合はMUST treat as poll）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.1 / pingクライアントのpoll許容: 条件付き必須（§10.1、ping clientがpollした場合はMUST treat as poll）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.1; catalog label: pingクライアントのpoll許容; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1"
+    },
+    {
+      "id": "CIBA-098",
+      "section": "10.1",
+      "label": "Token POST form",
+      "requirement": "Accept CIBA token requests as HTTP POST form-urlencoded UTF-8 bodies.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem + upstream",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_rack_inputs_without_rewind_work_on_both_endpoints. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "validate_token_params",
+        "create_token"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_rack_inputs_without_rewind_work_on_both_endpoints"
+      ],
+      "normative_basis": "§10.1 / Token POST form: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.1; catalog label: Token POST form; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1"
+    },
+    {
+      "id": "CIBA-099",
+      "section": "10.1",
+      "label": "Token grant_type必須",
+      "requirement": "Require exact CIBA grant_type in token requests.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem + upstream",
+      "audit_status": "verified",
+      "evidence": "Direct test verifies missing/empty required token fields return JSON invalid_request with no-store headers and no error_uri. See code_refs for validation/response implementation.",
+      "code_refs": [
+        "validate_token_params",
+        "create_token"
+      ],
+      "test_refs": [
+        "test/ciba_security_test.rb#test_ciba_token_required_parameters_and_error_response_contract"
+      ],
+      "normative_basis": "§10.1 / Token grant_type必須: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.1; catalog label: Token grant_type必須; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1"
+    },
+    {
+      "id": "CIBA-100",
+      "section": "10.1",
+      "label": "Token auth_req_id必須",
+      "requirement": "Require auth_req_id in token requests.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "Direct test verifies missing/empty required token fields return JSON invalid_request with no-store headers and no error_uri. See code_refs for validation/response implementation.",
+      "code_refs": [
+        "validate_token_params",
+        "create_token"
+      ],
+      "test_refs": [
+        "test/ciba_security_test.rb#test_ciba_token_required_parameters_and_error_response_contract"
+      ],
+      "normative_basis": "§10.1 / Token auth_req_id必須: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.1; catalog label: Token auth_req_id必須; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1"
+    },
+    {
+      "id": "CIBA-101",
+      "section": "10.1",
+      "label": "auth_req_idのクライアント束縛",
+      "requirement": "Verify auth_req_id was issued to the authenticated requesting client; reject mismatch.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_integration_test.rb#test_other_identity_client_and_expiry_cannot_issue. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "validate_token_params",
+        "create_token"
+      ],
+      "test_refs": [
+        "test/ciba_integration_test.rb#test_other_identity_client_and_expiry_cannot_issue"
+      ],
+      "normative_basis": "§10.1 / auth_req_idのクライアント束縛: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.1; catalog label: auth_req_idのクライアント束縛; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1"
+    },
+    {
+      "id": "CIBA-102",
+      "section": "10.1.1",
+      "label": "成功Token応答",
+      "requirement": "After customer authentication and authorization, return the successful token response specified by OIDC Core 3.1.3.3 (access_token, token_type, id_token and applicable lifetime fields).",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1.1",
+      "normative_strength": "応答定義（成功応答はOIDC Core §3.1.3.3を参照）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem + upstream",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_integration_test.rb#test_approved_request_issues_customer_id_token_once. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "create_token",
+        "id_token_claims"
+      ],
+      "test_refs": [
+        "test/ciba_integration_test.rb#test_approved_request_issues_customer_id_token_once"
+      ],
+      "normative_basis": "§10.1.1 / 成功Token応答: 応答定義（成功応答はOIDC Core §3.1.3.3を参照）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.1.1; catalog label: 成功Token応答; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1.1"
+    },
+    {
+      "id": "CIBA-103",
+      "section": "10.1.1",
+      "label": "成功後の一回限り消費",
+      "requirement": "Invalidate auth_req_id after a successful redemption, including concurrent requests.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1.1",
+      "normative_strength": "応答定義（成功引換え後はauth_req_idが無効。MUSTという語ではない）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_integration_test.rb#test_approved_request_issues_customer_id_token_once, test/ciba_integration_test.rb#test_concurrent_polls_issue_one_grant. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "create_token",
+        "id_token_claims"
+      ],
+      "test_refs": [
+        "test/ciba_integration_test.rb#test_approved_request_issues_customer_id_token_once",
+        "test/ciba_integration_test.rb#test_concurrent_polls_issue_one_grant"
+      ],
+      "normative_basis": "§10.1.1 / 成功後の一回限り消費: 応答定義（成功引換え後はauth_req_idが無効。MUSTという語ではない）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.1.1; catalog label: 成功後の一回限り消費; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1.1"
+    },
+    {
+      "id": "CIBA-104",
+      "section": "10.1.1",
+      "label": "認証承認前のToken禁止",
+      "requirement": "Return a token error instead of tokens when customer authentication/authorization has not succeeded.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1.1",
+      "normative_strength": "応答定義（未認証・未承認時はerror、lowercase must）",
+      "conditional": true,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_integration_test.rb#test_pending_poll_updates_survive_json_halt, test/ciba_protocol_test.rb#test_denial_and_expired_completion. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "create_token",
+        "id_token_claims"
+      ],
+      "test_refs": [
+        "test/ciba_integration_test.rb#test_pending_poll_updates_survive_json_halt",
+        "test/ciba_protocol_test.rb#test_denial_and_expired_completion"
+      ],
+      "normative_basis": "§10.1.1 / 認証承認前のToken禁止: 応答定義（未認証・未承認時はerror、lowercase must）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.1.1; catalog label: 認証承認前のToken禁止; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.1.1"
+    },
+    {
+      "id": "CIBA-105",
+      "section": "10.2",
+      "label": "ping HTTP POST",
+      "requirement": "After successful or failed authentication send ping callback as HTTP POST to the registered notification endpoint.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2",
+      "normative_strength": "記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.2 / ping HTTP POST: 記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.2; catalog label: ping HTTP POST; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2"
+    },
+    {
+      "id": "CIBA-106",
+      "section": "10.2",
+      "label": "ping bearer認証",
+      "requirement": "Send client_notification_token as Authorization Bearer in ping callbacks.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2",
+      "normative_strength": "配送形式の定義（ping対応時。MUSTという語ではない）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.2 / ping bearer認証: 配送形式の定義（ping対応時。MUSTという語ではない）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.2; catalog label: ping bearer認証; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2"
+    },
+    {
+      "id": "CIBA-107",
+      "section": "10.2",
+      "label": "ping payload",
+      "requirement": "Send only auth_req_id as the ping JSON body.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2",
+      "normative_strength": "配送形式の定義（ping対応時。MUSTという語ではない）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.2 / ping payload: 配送形式の定義（ping対応時。MUSTという語ではない）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.2; catalog label: ping payload; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2"
+    },
+    {
+      "id": "CIBA-108",
+      "section": "10.2",
+      "label": "pingクライアント検証",
+      "requirement": "Client verifies notification token and its association with auth_req_id; invalid bearer should yield HTTP 401.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "client",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.2 / pingクライアント検証: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.2; catalog label: pingクライアント検証; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2"
+    },
+    {
+      "id": "CIBA-109",
+      "section": "10.2",
+      "label": "ping応答処理",
+      "requirement": "Accept callback HTTP 204 and also HTTP 200, ignoring response bodies.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2",
+      "normative_strength": "推奨（client endpoint SHOULD respond 204; OP SHOULD accept 200 and ignore body）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem + client (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.2 / ping応答処理: 推奨（client endpoint SHOULD respond 204; OP SHOULD accept 200 and ignore body）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.2; catalog label: ping応答処理; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2"
+    },
+    {
+      "id": "CIBA-110",
+      "section": "10.2",
+      "label": "pingリダイレクト禁止",
+      "requirement": "OP must not follow ping callback redirects.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2",
+      "normative_strength": "条件付き必須（該当機能/条件時 MUST）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.2 / pingリダイレクト禁止: 条件付き必須（該当機能/条件時 MUST）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.2; catalog label: pingリダイレクト禁止; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2"
+    },
+    {
+      "id": "CIBA-111",
+      "section": "10.2",
+      "label": "ping後の取得",
+      "requirement": "After verifying notification, client retrieves tokens at token endpoint.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2",
+      "normative_strength": "フローの説明（通知検証後にclient can retrieve、MUSTという語ではない）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "client",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.2 / ping後の取得: フローの説明（通知検証後にclient can retrieve、MUSTという語ではない）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.2; catalog label: ping後の取得; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.2"
+    },
+    {
+      "id": "CIBA-112",
+      "section": "9",
+      "label": "通知Endpoint TLS",
+      "requirement": "Require HTTPS notification URLs and TLS communication for ping/push.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.9",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem + client (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§9 / 通知Endpoint TLS: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 9; catalog label: 通知Endpoint TLS; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.9"
+    },
+    {
+      "id": "CIBA-113",
+      "section": "9",
+      "label": "通知Endpoint bearer認証",
+      "requirement": "Authenticate notification requests using the client's client_notification_token.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.9",
+      "normative_strength": "配送認証の定義（lowercase must）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem + client (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§9 / 通知Endpoint bearer認証: 配送認証の定義（lowercase must）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 9; catalog label: 通知Endpoint bearer認証; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.9"
+    },
+    {
+      "id": "CIBA-114",
+      "section": "10.3.1",
+      "label": "push成功payload",
+      "requirement": "Send ID Token/access token/optional refresh token/auth_req_id as JSON to registered notification endpoint after authorization.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1",
+      "normative_strength": "記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.3.1 / push成功payload: 記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.3.1; catalog label: push成功payload; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1"
+    },
+    {
+      "id": "CIBA-115",
+      "section": "10.3.1",
+      "label": "push at_hash",
+      "requirement": "Include access-token hash at_hash in push ID Token.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.3.1 / push at_hash: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.3.1; catalog label: push at_hash; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1"
+    },
+    {
+      "id": "CIBA-116",
+      "section": "10.3.1",
+      "label": "push auth_req_id claim",
+      "requirement": "Include urn:openid:params:jwt:claim:auth_req_id in push ID Token.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.3.1 / push auth_req_id claim: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.3.1; catalog label: push auth_req_id claim; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1"
+    },
+    {
+      "id": "CIBA-117",
+      "section": "10.3.1",
+      "label": "push rt_hash",
+      "requirement": "When pushing refresh token, include urn:openid:params:jwt:claim:rt_hash calculated like at_hash.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.3.1 / push rt_hash: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.3.1; catalog label: push rt_hash; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1"
+    },
+    {
+      "id": "CIBA-118",
+      "section": "10.3.1",
+      "label": "push受信検証",
+      "requirement": "Client validates bearer token, ID Token and correspondence of auth_req_id/access-token hash/refresh-token hash.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "client",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.3.1 / push受信検証: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.3.1; catalog label: push受信検証; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1"
+    },
+    {
+      "id": "CIBA-119",
+      "section": "10.3.1",
+      "label": "push応答処理",
+      "requirement": "OP accepts HTTP 204 and HTTP 200 callback responses and ignores their bodies.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1",
+      "normative_strength": "推奨（client endpoint SHOULD respond 204; OP SHOULD accept 200 and ignore body）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.3.1 / push応答処理: 推奨（client endpoint SHOULD respond 204; OP SHOULD accept 200 and ignore body）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.3.1; catalog label: push応答処理; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1"
+    },
+    {
+      "id": "CIBA-120",
+      "section": "10.3.1",
+      "label": "pushリダイレクト禁止",
+      "requirement": "OP must not follow push callback redirects.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.3.1 / pushリダイレクト禁止: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.3.1; catalog label: pushリダイレクト禁止; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1"
+    },
+    {
+      "id": "CIBA-121",
+      "section": "10.3.1",
+      "label": "push未知パラメータ",
+      "requirement": "Client ignores unrecognized push request parameters.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "client",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§10.3.1 / push未知パラメータ: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 10.3.1; catalog label: push未知パラメータ; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.10.3.1"
+    },
+    {
+      "id": "CIBA-122",
+      "section": "11",
+      "label": "Tokenエラー形式",
+      "requirement": "Return invalid/unauthorized token request errors according to OIDC Core 3.1.3.4 and RFC6749 5.2.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11",
+      "normative_strength": "必須（invalid/unauthorized errors must follow referenced OIDC/OAuth format; triggered by invalid request）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "Direct test verifies missing/empty required token fields return JSON invalid_request with no-store headers and no error_uri. See code_refs for validation/response implementation.",
+      "code_refs": [
+        "create_token",
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_security_test.rb#test_ciba_token_required_parameters_and_error_response_contract"
+      ],
+      "normative_basis": "§11 / Tokenエラー形式: 必須（invalid/unauthorized errors must follow referenced OIDC/OAuth format; triggered by invalid request）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 11; catalog label: Tokenエラー形式; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11"
+    },
+    {
+      "id": "CIBA-123",
+      "section": "11",
+      "label": "authorization_pending",
+      "requirement": "Return authorization_pending while authentication/authorization is pending.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11",
+      "normative_strength": "必須（pending response state; normative error semantics）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_integration_test.rb#test_pending_poll_updates_survive_json_halt. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "create_token",
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_integration_test.rb#test_pending_poll_updates_survive_json_halt"
+      ],
+      "normative_basis": "§11 / authorization_pending: 必須（pending response state; normative error semantics）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 11; catalog label: authorization_pending; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11"
+    },
+    {
+      "id": "CIBA-124",
+      "section": "11",
+      "label": "slow_down",
+      "requirement": "For too-fast pending polling return slow_down and increase interval by at least five seconds for subsequent requests.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11",
+      "normative_strength": "条件付き必須（slow_down応答なら interval MUST increase by >=5 seconds）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_integration_test.rb#test_pending_poll_updates_survive_json_halt, test/ciba_lifecycle_test.rb#test_concurrent_pending_polls_both_receive_retryable_results. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "create_token",
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_integration_test.rb#test_pending_poll_updates_survive_json_halt",
+        "test/ciba_lifecycle_test.rb#test_concurrent_pending_polls_both_receive_retryable_results"
+      ],
+      "normative_basis": "§11 / slow_down: 条件付き必須（slow_down応答なら interval MUST increase by >=5 seconds）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 11; catalog label: slow_down; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11"
+    },
+    {
+      "id": "CIBA-125",
+      "section": "11",
+      "label": "expired_token",
+      "requirement": "Return expired_token when auth_req_id has expired.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11",
+      "normative_strength": "エラー定義（§11 poll/pingのexpired_token。§12 pushの送信任意とは別）",
+      "conditional": true,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_integration_test.rb#test_other_identity_client_and_expiry_cannot_issue. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "create_token",
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_integration_test.rb#test_other_identity_client_and_expiry_cannot_issue"
+      ],
+      "normative_basis": "§11 / expired_token: エラー定義（§11 poll/pingのexpired_token。§12 pushの送信任意とは別）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 11; catalog label: expired_token; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11"
+    },
+    {
+      "id": "CIBA-126",
+      "section": "11",
+      "label": "access_denied",
+      "requirement": "Return access_denied when end-user denied authorization.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": true,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_denial_and_expired_completion. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "create_token",
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_denial_and_expired_completion"
+      ],
+      "normative_basis": "§11 / access_denied: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 11; catalog label: access_denied; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11"
+    },
+    {
+      "id": "CIBA-127",
+      "section": "11",
+      "label": "invalid_grant",
+      "requirement": "Return invalid_grant for invalid auth_req_id or one issued to a different client.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_integration_test.rb#test_other_identity_client_and_expiry_cannot_issue. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "create_token",
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_integration_test.rb#test_other_identity_client_and_expiry_cannot_issue"
+      ],
+      "normative_basis": "§11 / invalid_grant: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 11; catalog label: invalid_grant; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11"
+    },
+    {
+      "id": "CIBA-128",
+      "section": "11",
+      "label": "繰返し過剰pollの拒否",
+      "requirement": "OP may return invalid_request for continued too-fast polling; evaluate optional capability.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11",
+      "normative_strength": "任意（OP MAY send invalid_request on continued too-fast polling）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§11 / 繰返し過剰pollの拒否: 任意（OP MAY send invalid_request on continued too-fast polling）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 11; catalog label: 繰返し過剰pollの拒否; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11"
+    },
+    {
+      "id": "CIBA-129",
+      "section": "11",
+      "label": "invalid_request後の停止",
+      "requirement": "Client must stop requesting the same auth_req_id after invalid_request.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11",
+      "normative_strength": "必須（client MUST stop same auth_req_id after invalid_request）",
+      "conditional": false,
+      "first_version": "client obligation",
+      "responsibility": "client",
+      "audit_status": "client_only",
+      "evidence": "CIBA Clientに対する要求。OP gemの実装率・合否には算入しない。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§11 / invalid_request後の停止: 必須（client MUST stop same auth_req_id after invalid_request）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 11; catalog label: invalid_request後の停止; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11"
+    },
+    {
+      "id": "CIBA-130",
+      "section": "11",
+      "label": "pushクライアントのToken拒否",
+      "requirement": "Reject CIBA token requests by a client configured for push with unauthorized_client.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11",
+      "normative_strength": "条件付き必須（push client MUST NOT token endpoint call; unauthorized_client required）",
+      "conditional": true,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "push登録のclientがToken EndpointでCIBA grantを要求するとunauthorized_clientとなり、トークンを発行しない。push配送自体の対応を意味しない。",
+      "code_refs": [
+        "validate_token_params",
+        "ciba_client_eligible?"
+      ],
+      "test_refs": [
+        "test/ciba_security_test.rb#test_push_client_cannot_redeem_ciba_at_token_endpoint"
+      ],
+      "normative_basis": "§11 / pushクライアントのToken拒否: 条件付き必須（push client MUST NOT token endpoint call; unauthorized_client required）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 11; catalog label: pushクライアントのToken拒否; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.11"
+    },
+    {
+      "id": "CIBA-131",
+      "section": "12",
+      "label": "pushエラーJSON",
+      "requirement": "Deliver push errors as application/json with required error and auth_req_id.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.12",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§12 / pushエラーJSON: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 12; catalog label: pushエラーJSON; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.12"
+    },
+    {
+      "id": "CIBA-132",
+      "section": "12",
+      "label": "push error_description文字集合",
+      "requirement": "If push error_description is supplied, limit it to the specified ASCII character ranges.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.12",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§12 / push error_description文字集合: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 12; catalog label: push error_description文字集合; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.12"
+    },
+    {
+      "id": "CIBA-133",
+      "section": "12",
+      "label": "push access_denied",
+      "requirement": "Deliver access_denied push error when end-user refuses authorization.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.12",
+      "normative_strength": "記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§12 / push access_denied: 記述的要件（該当節にMUST/SHOULD/MAYの規範語なし）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 12; catalog label: push access_denied; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.12"
+    },
+    {
+      "id": "CIBA-134",
+      "section": "12",
+      "label": "push expired_token",
+      "requirement": "Optionally deliver expired_token push error when authentication request expires.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.12",
+      "normative_strength": "任意（OP not required to send expired_token push error）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§12 / push expired_token: 任意（OP not required to send expired_token push error）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 12; catalog label: push expired_token; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.12"
+    },
+    {
+      "id": "CIBA-135",
+      "section": "12",
+      "label": "push transaction_failed",
+      "requirement": "Deliver transaction_failed for unexpected unsuccessful push transactions.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.12",
+      "normative_strength": "任意のエラー通知（push transaction_failedを利用できる。全失敗への送信義務ではない）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§12 / push transaction_failed: 任意のエラー通知（push transaction_failedを利用できる。全失敗への送信義務ではない）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 12; catalog label: push transaction_failed; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.12"
+    },
+    {
+      "id": "CIBA-136",
+      "section": "13",
+      "label": "開始エラーJSON",
+      "requirement": "Return authentication errors with application/json and a required ASCII error code.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13",
+      "normative_strength": "必須（MUST / REQUIRED）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters"
+      ],
+      "normative_basis": "§13 / 開始エラーJSON: 必須（MUST / REQUIRED）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 13; catalog label: 開始エラーJSON; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13"
+    },
+    {
+      "id": "CIBA-137",
+      "section": "13",
+      "label": "error_description文字集合",
+      "requirement": "If authentication error_description is emitted, enforce the specified ASCII ranges.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13",
+      "normative_strength": "条件付き必須（任意のerror_descriptionを出す場合のMUST NOT文字制約）",
+      "conditional": true,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "`response_error_params` suppresses an error_description that violates the specification ASCII character set. Direct test: test/ciba_requirements_test.rb#test_authentication_error_description_is_ascii_when_customized.",
+      "code_refs": [
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_requirements_test.rb#test_authentication_error_description_keeps_allowed_ascii_and_omits_unsafe_text"
+      ],
+      "normative_basis": "§13 / error_description文字集合: 条件付き必須（任意のerror_descriptionを出す場合のMUST NOT文字制約）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 13; catalog label: error_description文字集合; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13"
+    },
+    {
+      "id": "CIBA-138",
+      "section": "13",
+      "label": "error_uri文字集合",
+      "requirement": "If error_uri is emitted, enforce URI-reference syntax and specified ASCII ranges.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13",
+      "normative_strength": "条件付き必須（任意のerror_uriを出す場合のMUST構文制約）",
+      "conditional": true,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "標準実装は任意のerror_uriを出力しない。Backchannelエラーに存在しないことを確認。任意URIの検証機能を提供するという意味ではない。",
+      "code_refs": [
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_requirements_test.rb#test_authentication_error_description_keeps_allowed_ascii_and_omits_unsafe_text"
+      ],
+      "normative_basis": "§13 / error_uri文字集合: 条件付き必須（任意のerror_uriを出す場合のMUST構文制約）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 13; catalog label: error_uri文字集合; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13"
+    },
+    {
+      "id": "CIBA-139",
+      "section": "13",
+      "label": "400 invalid_request",
+      "requirement": "Use HTTP 400 invalid_request for missing/invalid/repeated parameters and multiple hints.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13",
+      "normative_strength": "エラー応答の定義（該当する失敗とHTTP status/codeの対応）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_duplicate_parameters_are_rejected, test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_duplicate_parameters_are_rejected",
+        "test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters"
+      ],
+      "normative_basis": "§13 / 400 invalid_request: エラー応答の定義（該当する失敗とHTTP status/codeの対応）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 13; catalog label: 400 invalid_request; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13"
+    },
+    {
+      "id": "CIBA-140",
+      "section": "13",
+      "label": "400 invalid_scope",
+      "requirement": "Use HTTP 400 invalid_scope for malformed, unknown or invalid scope.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13",
+      "normative_strength": "エラー応答の定義（該当する失敗とHTTP status/codeの対応）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_requirements_test.rb#test_scope_syntax_errors_are_invalid_scope. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_requirements_test.rb#test_scope_syntax_errors_are_invalid_scope"
+      ],
+      "normative_basis": "§13 / 400 invalid_scope: エラー応答の定義（該当する失敗とHTTP status/codeの対応）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 13; catalog label: 400 invalid_scope; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13"
+    },
+    {
+      "id": "CIBA-141",
+      "section": "13",
+      "label": "400 expired_login_hint_token",
+      "requirement": "Use HTTP 400 expired_login_hint_token for an expired login_hint_token when supported.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13",
+      "normative_strength": "条件付き必須（supported login_hint_token expired case; otherwise feature optional）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§13 / 400 expired_login_hint_token: 条件付き必須（supported login_hint_token expired case; otherwise feature optional）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 13; catalog label: 400 expired_login_hint_token; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13"
+    },
+    {
+      "id": "CIBA-142",
+      "section": "13",
+      "label": "400 unknown_user_id",
+      "requirement": "Use HTTP 400 unknown_user_id when supported hints cannot identify the intended user.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13",
+      "normative_strength": "エラー応答の定義（該当する失敗とHTTP status/codeの対応）",
+      "conditional": true,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_request_validation_and_unknown_parameters"
+      ],
+      "normative_basis": "§13 / 400 unknown_user_id: エラー応答の定義（該当する失敗とHTTP status/codeの対応）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 13; catalog label: 400 unknown_user_id; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13"
+    },
+    {
+      "id": "CIBA-143",
+      "section": "13",
+      "label": "400 unauthorized_client",
+      "requirement": "Use HTTP 400 unauthorized_client when a client is not allowed to use CIBA.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13",
+      "normative_strength": "エラー応答の定義（該当する失敗とHTTP status/codeの対応）",
+      "conditional": true,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_configuration_test.rb#test_unavailable_or_unsupported_client_metadata_is_rejected. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_configuration_test.rb#test_unavailable_or_unsupported_client_metadata_is_rejected"
+      ],
+      "normative_basis": "§13 / 400 unauthorized_client: エラー応答の定義（該当する失敗とHTTP status/codeの対応）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 13; catalog label: 400 unauthorized_client; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13"
+    },
+    {
+      "id": "CIBA-144",
+      "section": "13",
+      "label": "400 missing_user_code",
+      "requirement": "Use HTTP 400 missing_user_code when required user_code is absent.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13",
+      "normative_strength": "条件付き必須（if user_code is required and absent）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§13 / 400 missing_user_code: 条件付き必須（if user_code is required and absent）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 13; catalog label: 400 missing_user_code; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13"
+    },
+    {
+      "id": "CIBA-145",
+      "section": "13",
+      "label": "400 invalid_user_code",
+      "requirement": "Use HTTP 400 invalid_user_code for invalid supplied user_code when supported.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13",
+      "normative_strength": "条件付き必須（if user_code supplied and invalid, where supported）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§13 / 400 invalid_user_code: 条件付き必須（if user_code supplied and invalid, where supported）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 13; catalog label: 400 invalid_user_code; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13"
+    },
+    {
+      "id": "CIBA-146",
+      "section": "13",
+      "label": "400 invalid_binding_message",
+      "requirement": "Use HTTP 400 invalid_binding_message for an unacceptable binding message.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13",
+      "normative_strength": "エラー応答の定義（該当する失敗とHTTP status/codeの対応）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_protocol_test.rb#test_expiry_binding_context_and_offline_access. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_protocol_test.rb#test_expiry_binding_context_and_offline_access"
+      ],
+      "normative_basis": "§13 / 400 invalid_binding_message: エラー応答の定義（該当する失敗とHTTP status/codeの対応）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 13; catalog label: 400 invalid_binding_message; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13"
+    },
+    {
+      "id": "CIBA-147",
+      "section": "13",
+      "label": "401 invalid_client",
+      "requirement": "Use HTTP 401 invalid_client for failed, absent or unsupported client authentication.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13",
+      "normative_strength": "エラー応答の定義（該当する失敗とHTTP status/codeの対応）",
+      "conditional": false,
+      "first_version": "in scope",
+      "responsibility": "gem",
+      "audit_status": "verified",
+      "evidence": "直接テストでこの挙動を確認: test/ciba_requirements_test.rb#test_authentication_errors_use_invalid_client_and_http_401. 実装根拠はJSONのcode_refs。",
+      "code_refs": [
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [
+        "test/ciba_requirements_test.rb#test_authentication_errors_use_invalid_client_and_http_401"
+      ],
+      "normative_basis": "§13 / 401 invalid_client: エラー応答の定義（該当する失敗とHTTP status/codeの対応）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 13; catalog label: 401 invalid_client; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13"
+    },
+    {
+      "id": "CIBA-148",
+      "section": "13",
+      "label": "403 access_denied",
+      "requirement": "When OP/resource-owner policy denies an authentication request before user interaction, return HTTP 403 access_denied.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13",
+      "normative_strength": "条件付き必須（when OP/resource-owner pre-interaction policy denies）",
+      "conditional": true,
+      "first_version": "in scope with app contract",
+      "responsibility": "gem + app",
+      "audit_status": "app_contract",
+      "evidence": "仕様がOP/client/appの選択・ユーザー提示・業務判断を含む。gemのフックや保存値は契約の境界であり、アプリ動作全体の証拠ではない。",
+      "code_refs": [
+        "ciba_http",
+        "ciba_error"
+      ],
+      "test_refs": [],
+      "normative_basis": "§13 / 403 access_denied: 条件付き必須（when OP/resource-owner pre-interaction policy denies）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 13; catalog label: 403 access_denied; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.13"
+    },
+    {
+      "id": "CIBA-149",
+      "section": "14",
+      "label": "login_hint_token署名",
+      "requirement": "When supporting login_hint_token, it should be digitally signed by its issuer.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14",
+      "normative_strength": "Recommendation (SHOULD)",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§14 / login_hint_token署名: Recommendation (SHOULD)。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 14; catalog label: login_hint_token署名; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14"
+    },
+    {
+      "id": "CIBA-150",
+      "section": "14",
+      "label": "通知URLの管理権限",
+      "requirement": "OP should ensure registered notification endpoint is under the client's administrative authority.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14",
+      "normative_strength": "Recommendation (SHOULD)",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "app",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§14 / 通知URLの管理権限: Recommendation (SHOULD)。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 14; catalog label: 通知URLの管理権限; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14"
+    },
+    {
+      "id": "CIBA-151",
+      "section": "14",
+      "label": "期限切れid_token_hint許容",
+      "requirement": "When supporting id_token_hint, accept expired ID Tokens for a reasonable period under the specified contextual validation policy.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14",
+      "normative_strength": "任意（id_token_hint optional; text accept-expired policy is SHOULD within support）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§14 / 期限切れid_token_hint許容: 任意（id_token_hint optional; text accept-expired policy is SHOULD within support）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 14; catalog label: 期限切れid_token_hint許容; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14"
+    },
+    {
+      "id": "CIBA-152",
+      "section": "14",
+      "label": "id_token_hintのissuerとaudience",
+      "requirement": "When supporting id_token_hint, verify OP issuer and that presenting client is listed in audience.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14",
+      "normative_strength": "Guidance (lowercase should in source; not RFC2119 SHOULD)",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§14 / id_token_hintのissuerとaudience: Guidance (lowercase should in source; not RFC2119 SHOULD)。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 14; catalog label: id_token_hintのissuerとaudience; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14"
+    },
+    {
+      "id": "CIBA-153",
+      "section": "14",
+      "label": "id_token_hint署名",
+      "requirement": "When supporting id_token_hint, verify signature subject to the key rotation/pairwise alternatives discussed in section 14.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14",
+      "normative_strength": "Guidance (lowercase should in source; not RFC2119 SHOULD)",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§14 / id_token_hint署名: Guidance (lowercase should in source; not RFC2119 SHOULD)。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 14; catalog label: id_token_hint署名; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14"
+    },
+    {
+      "id": "CIBA-154",
+      "section": "14",
+      "label": "push Endpoint保護",
+      "requirement": "For push, secure notification endpoint and its registration and consider sender-constrained tokens.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14",
+      "normative_strength": "記述的要件（security considerations say secure endpoint / consider binding; catalog groups considerations）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "app",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§14 / push Endpoint保護: 記述的要件（security considerations say secure endpoint / consider binding; catalog groups considerations）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 14; catalog label: push Endpoint保護; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14"
+    },
+    {
+      "id": "CIBA-155",
+      "section": "14",
+      "label": "業務コンテキストの追加",
+      "requirement": "Additional RP session context metadata may be conveyed by deployment-specific means; CIBA specifies no mandatory transport for it.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14",
+      "normative_strength": "参考情報（deployment-specific metadata may be conveyed; no CIBA transport requirement）",
+      "conditional": false,
+      "first_version": "in scope with app contract",
+      "responsibility": "app",
+      "audit_status": "app_contract",
+      "evidence": "仕様がOP/client/appの選択・ユーザー提示・業務判断を含む。gemのフックや保存値は契約の境界であり、アプリ動作全体の証拠ではない。",
+      "code_refs": [
+        "resolve_ciba_login_hint",
+        "ciba_account_eligible?"
+      ],
+      "test_refs": [],
+      "normative_basis": "§14 / 業務コンテキストの追加: 参考情報（deployment-specific metadata may be conveyed; no CIBA transport requirement）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 14; catalog label: 業務コンテキストの追加; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.14"
+    },
+    {
+      "id": "CIBA-156",
+      "section": "15",
+      "label": "プライバシー配慮識別子",
+      "requirement": "Permit alternatives to global static identifiers; evaluate gem ability to use an app-defined privacy-preserving login_hint and boundaries of unsupported hint tokens.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.15",
+      "normative_strength": "参考情報（privacy considerations, no explicit MUST/SHOULD in cataloged behavior）",
+      "conditional": false,
+      "first_version": "in scope with app contract",
+      "responsibility": "app",
+      "audit_status": "app_contract",
+      "evidence": "仕様がOP/client/appの選択・ユーザー提示・業務判断を含む。gemのフックや保存値は契約の境界であり、アプリ動作全体の証拠ではない。",
+      "code_refs": [
+        "resolve_ciba_login_hint"
+      ],
+      "test_refs": [],
+      "normative_basis": "§15 / プライバシー配慮識別子: 参考情報（privacy considerations, no explicit MUST/SHOULD in cataloged behavior）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 15; catalog label: プライバシー配慮識別子; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.15"
+    },
+    {
+      "id": "CIBA-157",
+      "section": "15",
+      "label": "pairwise ID Token hint",
+      "requirement": "Support the described privacy option of using a previously issued pairwise ID Token without personal data as id_token_hint.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.15",
+      "normative_strength": "参考情報（privacy option descriptive, not an OP mandate）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§15 / pairwise ID Token hint: 参考情報（privacy option descriptive, not an OP mandate）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 15; catalog label: pairwise ID Token hint; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.15"
+    },
+    {
+      "id": "CIBA-158",
+      "section": "15",
+      "label": "一回限り識別子hint token",
+      "requirement": "Support the described optional AD-to-CD single-use identifier carried in login_hint_token.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.15",
+      "normative_strength": "参考情報（optional scenario/example）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§15 / 一回限り識別子hint token: 参考情報（optional scenario/example）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 15; catalog label: 一回限り識別子hint token; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.15"
+    },
+    {
+      "id": "CIBA-159",
+      "section": "15",
+      "label": "Discovery Service hint token",
+      "requirement": "Support the described optional discovery-service encrypted login_hint_token flow.",
+      "source": "https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.15",
+      "normative_strength": "参考情報（possible ecosystem scenario, no protocol conformance requirement）",
+      "conditional": true,
+      "first_version": "excluded",
+      "responsibility": "gem (excluded capability)",
+      "audit_status": "optional_excluded",
+      "evidence": "適用条件となる機能を初版では提供しない。非対応の表明・入口拒否は別の適用内要件で確認する。",
+      "code_refs": [],
+      "test_refs": [],
+      "normative_basis": "§15 / Discovery Service hint token: 参考情報（possible ecosystem scenario, no protocol conformance requirement）。評価対象の意味はrequirement、適用範囲はfirst_versionを参照。",
+      "source_clause_locator": "CIBA Core section 15; catalog label: Discovery Service hint token; source: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0.html#rfc.section.15"
+    }
+  ],
+  "additional_cross_spec_findings": [
+    {
+      "id": "OIDC-CIBA-AUTH-1",
+      "source": "OpenID Connect Core 1.0 §9 (JWT client authentication); RFC 7523 §3 (assertion profile)",
+      "normative_strength": "OIDC Core §9 requires iss, sub, aud, exp, jti and single-use assertion handling; RFC 7523 by itself leaves replay prevention MAY, but does not relax the OIDC profile requirement.",
+      "first_version": "in_scope",
+      "responsibility": "gem / upstream authentication integration",
+      "audit_status": "verified",
+      "finding": "OIDC Core 1.0 section 9 requires iss, sub, aud, exp, jti and single-use assertions for this profile. Implementation validates claims and tracks consumed assertion identifiers; direct negative/replay/concurrency tests cover the checks. RFC 7523 replay MAY does not relax the OIDC profile requirement.",
+      "test_refs": [
+        "test/ciba_security_test.rb#test_jwt_client_assertion_requires_issuer_expiry_and_jti",
+        "test/ciba_security_test.rb#test_jwt_assertion_replay_is_blocked_between_start_and_poll",
+        "test/ciba_security_test.rb#test_jwt_assertion_replay_is_blocked_across_other_flows_for_the_same_client",
+        "test/ciba_security_test.rb#test_client_assertion_unique_constraint_rejects_concurrent_replay",
+        "test/ciba_security_test.rb#test_assertion_subject_cannot_override_explicit_client_id"
+      ]
+    },
+    {
+      "id": "OAUTH-SCOPE",
+      "source": "https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1",
+      "audit_status": "verified",
+      "finding": "要求scopeと許可scopeが異なる場合のscope返却を修正。CIBA token responseに実効scopeを含める。",
+      "test_refs": [
+        "test/ciba_security_test.rb#test_reduced_scope_is_reported_when_offline_access_is_not_granted"
+      ]
+    }
+  ]
+}