rcf-lite 0.20.0 → 0.22.0

package/blueprints/security-auth-keycloak/blueprint.json

@@ -1,38 +1,164 @@
 {
   "slug": "security-auth-keycloak",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "category": "security",
+  "capabilities": [
+    "principalDirectory",
+    "roleModel",
+    "credentialSelfService",
+    "sessionInventory"
+  ],
   "contributions": [
-    { "id": "security-auth-keycloak-REQ-001", "kind": "req", "path": "requirements/security-auth-keycloak-req-001.json" },
-    { "id": "security-auth-keycloak-REQ-002", "kind": "req", "path": "requirements/security-auth-keycloak-req-002.json" },
-    { "id": "security-auth-keycloak-REQ-003", "kind": "req", "path": "requirements/security-auth-keycloak-req-003.json" },
-    { "id": "security-auth-keycloak-REQ-004", "kind": "req", "path": "requirements/security-auth-keycloak-req-004.json" },
-    { "id": "security-auth-keycloak-REQ-005", "kind": "req", "path": "requirements/security-auth-keycloak-req-005.json" },
-    { "id": "security-auth-keycloak-REQ-006", "kind": "req", "path": "requirements/security-auth-keycloak-req-006.json" },
-    { "id": "security-auth-keycloak-REQ-007", "kind": "req", "path": "requirements/security-auth-keycloak-req-007.json" },
-    { "id": "security-auth-keycloak-REQ-008", "kind": "req", "path": "requirements/security-auth-keycloak-req-008.json" },
-    { "id": "security-auth-keycloak-REQ-009", "kind": "req", "path": "requirements/security-auth-keycloak-req-009.json" },
-    { "id": "security-auth-keycloak-REQ-010", "kind": "req", "path": "requirements/security-auth-keycloak-req-010.json" },
-    { "id": "security-auth-keycloak-REQ-011", "kind": "req", "path": "requirements/security-auth-keycloak-req-011.json" },
-    { "id": "security-auth-keycloak-REQ-012", "kind": "req", "path": "requirements/security-auth-keycloak-req-012.json" },
-    { "id": "security-auth-keycloak-US-11101", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11101.json" },
-    { "id": "security-auth-keycloak-US-11102", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11102.json" },
-    { "id": "security-auth-keycloak-US-11103", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11103.json" },
-    { "id": "security-auth-keycloak-US-11104", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11104.json" },
-    { "id": "security-auth-keycloak-US-11105", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11105.json" },
-    { "id": "security-auth-keycloak-US-11106", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11106.json" },
-    { "id": "security-auth-keycloak-US-11107", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11107.json" },
-    { "id": "security-auth-keycloak-US-11108", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11108.json" },
-    { "id": "security-auth-keycloak-US-11109", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11109.json" },
-    { "id": "security-auth-keycloak-US-11110", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11110.json" },
-    { "id": "security-auth-keycloak-US-11111", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11111.json" },
-    { "id": "security-auth-keycloak-US-11112", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11112.json" },
-    { "id": "security-auth-keycloak-US-11113", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11113.json" },
-    { "id": "TAC-1201-security-auth-keycloak-discovery-client", "kind": "tac", "path": "tacs/tac-1201-security-auth-keycloak-discovery-client.json" },
-    { "id": "TAC-1202-security-auth-keycloak-jwt-verifier", "kind": "tac", "path": "tacs/tac-1202-security-auth-keycloak-jwt-verifier.json" },
-    { "id": "TAC-1203-security-auth-keycloak-introspection-client", "kind": "tac", "path": "tacs/tac-1203-security-auth-keycloak-introspection-client.json" },
-    { "id": "TAC-1204-security-auth-keycloak-provider-router", "kind": "tac", "path": "tacs/tac-1204-security-auth-keycloak-provider-router.json" },
-    { "id": "TAC-1205-security-auth-keycloak-role-adapter", "kind": "tac", "path": "tacs/tac-1205-security-auth-keycloak-role-adapter.json" },
+    {
+      "id": "security-auth-keycloak-REQ-001",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-001.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-002",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-002.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-003",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-003.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-004",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-004.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-005",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-005.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-006",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-006.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-007",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-007.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-008",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-008.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-009",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-009.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-010",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-010.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-011",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-011.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-012",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-012.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11101",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11101.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11102",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11102.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11103",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11103.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11104",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11104.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11105",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11105.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11106",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11106.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11107",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11107.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11108",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11108.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11109",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11109.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11110",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11110.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11111",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11111.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11112",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11112.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11113",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11113.json"
+    },
+    {
+      "id": "TAC-1201-security-auth-keycloak-discovery-client",
+      "kind": "tac",
+      "path": "tacs/tac-1201-security-auth-keycloak-discovery-client.json"
+    },
+    {
+      "id": "TAC-1202-security-auth-keycloak-jwt-verifier",
+      "kind": "tac",
+      "path": "tacs/tac-1202-security-auth-keycloak-jwt-verifier.json"
+    },
+    {
+      "id": "TAC-1203-security-auth-keycloak-introspection-client",
+      "kind": "tac",
+      "path": "tacs/tac-1203-security-auth-keycloak-introspection-client.json"
+    },
+    {
+      "id": "TAC-1204-security-auth-keycloak-provider-router",
+      "kind": "tac",
+      "path": "tacs/tac-1204-security-auth-keycloak-provider-router.json"
+    },
+    {
+      "id": "TAC-1205-security-auth-keycloak-role-adapter",
+      "kind": "tac",
+      "path": "tacs/tac-1205-security-auth-keycloak-role-adapter.json"
+    },
     {
       "id": "ADR-1201-security-auth-keycloak-auth-model",
       "kind": "adr",
@@ -40,10 +166,30 @@
       "scope": "global",
       "topic": "authModel"
     },
-    { "id": "ADR-1202-security-auth-keycloak-verification-mode-choice", "kind": "adr", "path": "adrs/adr-1202-security-auth-keycloak-verification-mode-choice.json" },
-    { "id": "ADR-1203-security-auth-keycloak-provider-routing-seam", "kind": "adr", "path": "adrs/adr-1203-security-auth-keycloak-provider-routing-seam.json" },
-    { "id": "ADR-1204-security-auth-keycloak-session-vs-token-contract", "kind": "adr", "path": "adrs/adr-1204-security-auth-keycloak-session-vs-token-contract.json" },
-    { "id": "ADR-1205-security-auth-keycloak-jwks-rotation-cache-lifetime", "kind": "adr", "path": "adrs/adr-1205-security-auth-keycloak-jwks-rotation-cache-lifetime.json" },
-    { "id": "ADR-1206-security-auth-keycloak-refresh-and-sign-out-posture", "kind": "adr", "path": "adrs/adr-1206-security-auth-keycloak-refresh-and-sign-out-posture.json" }
+    {
+      "id": "ADR-1202-security-auth-keycloak-verification-mode-choice",
+      "kind": "adr",
+      "path": "adrs/adr-1202-security-auth-keycloak-verification-mode-choice.json"
+    },
+    {
+      "id": "ADR-1203-security-auth-keycloak-provider-routing-seam",
+      "kind": "adr",
+      "path": "adrs/adr-1203-security-auth-keycloak-provider-routing-seam.json"
+    },
+    {
+      "id": "ADR-1204-security-auth-keycloak-session-vs-token-contract",
+      "kind": "adr",
+      "path": "adrs/adr-1204-security-auth-keycloak-session-vs-token-contract.json"
+    },
+    {
+      "id": "ADR-1205-security-auth-keycloak-jwks-rotation-cache-lifetime",
+      "kind": "adr",
+      "path": "adrs/adr-1205-security-auth-keycloak-jwks-rotation-cache-lifetime.json"
+    },
+    {
+      "id": "ADR-1206-security-auth-keycloak-refresh-and-sign-out-posture",
+      "kind": "adr",
+      "path": "adrs/adr-1206-security-auth-keycloak-refresh-and-sign-out-posture.json"
+    }
   ]
 }

package/blueprints/security-auth-keycloak/docs/topics.md

@@ -39,13 +39,25 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
 | observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
-| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
 | security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
 | security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
 | deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.0.0 | `deploymentTarget` |
 | persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 
 US 11101-11113 sit at the LOW end of the 11101-11899 band on purpose. A project-side story that mechanically derives from a security-auth-keycloak REQ id into the number `11113` would collide against security-auth-keycloak-US-11113 in this package; the band leaves headroom at the HIGH end (US 11181-11899) so a project's own stories anchored to security-auth-keycloak REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/security-auth-magic-link/CHANGELOG.md

@@ -0,0 +1,9 @@
+# security-auth-magic-link CHANGELOG
+
+## 1.2.0 (visual round T-4, spec 2026-09-06 section 5.4.2, doc-only)
+
+- No change to `capabilities[]`; the declaration remains `[principalDirectory]`. The bump records the account-settings suppression behaviour: on a bare-magic-link project the security tab, the sessions tab, the notification-preferences tab (unless `application-notifications-in-app` is applied) and the theme tab (unless `application-spa` is applied) are all suppressed by the account-settings blueprint capability discovery, and only the profile surface renders. This is not a regression; magic-link intentionally does NOT self-declare a credential-self-service surface, a session inventory, or a hosted identity UI (the click-a-link flow is the whole surface). Consumers pair magic-link with a session store (or a logging companion) if they want a sessions surface.
+
+## 1.1.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
+
+- Declares `capabilities: [principalDirectory]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round T-5 `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.

package/blueprints/security-auth-magic-link/README.md

@@ -2,6 +2,9 @@
 
 The third content blueprint on the rcf-build-lite blueprint mechanism (design brief v2, ratified; Phase 4 of the blueprint programme). Scope: passwordless magic-link sign-in with server-issued opaque cookie sessions, single deployable, pluggable email delivery and pluggable principal registry, targeted at small greenfield rcf-lite projects. Composes with the application-spa blueprint (client half) and the application-api-rest blueprint (server half) by design, contributing one deliberate scope:global conflict on `authModel`.
 
+
+> Latest: **v1.2.0 (doc-only)** (visual round T-4, 2026-09-06). `capabilities: [principalDirectory]`. See [CHANGELOG.md](CHANGELOG.md).
+
 ## Apply
 
 ```

package/blueprints/security-auth-magic-link/blueprint.json

@@ -1,35 +1,146 @@
 {
   "slug": "security-auth-magic-link",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "category": "security",
+  "capabilities": [
+    "principalDirectory"
+  ],
   "contributions": [
-    { "id": "security-auth-magic-link-REQ-001", "kind": "req", "path": "requirements/security-auth-magic-link-req-001.json" },
-    { "id": "security-auth-magic-link-REQ-002", "kind": "req", "path": "requirements/security-auth-magic-link-req-002.json" },
-    { "id": "security-auth-magic-link-REQ-003", "kind": "req", "path": "requirements/security-auth-magic-link-req-003.json" },
-    { "id": "security-auth-magic-link-REQ-004", "kind": "req", "path": "requirements/security-auth-magic-link-req-004.json" },
-    { "id": "security-auth-magic-link-REQ-005", "kind": "req", "path": "requirements/security-auth-magic-link-req-005.json" },
-    { "id": "security-auth-magic-link-REQ-006", "kind": "req", "path": "requirements/security-auth-magic-link-req-006.json" },
-    { "id": "security-auth-magic-link-REQ-007", "kind": "req", "path": "requirements/security-auth-magic-link-req-007.json" },
-    { "id": "security-auth-magic-link-REQ-008", "kind": "req", "path": "requirements/security-auth-magic-link-req-008.json" },
-    { "id": "security-auth-magic-link-REQ-009", "kind": "req", "path": "requirements/security-auth-magic-link-req-009.json" },
-    { "id": "security-auth-magic-link-REQ-010", "kind": "req", "path": "requirements/security-auth-magic-link-req-010.json" },
-    { "id": "security-auth-magic-link-REQ-011", "kind": "req", "path": "requirements/security-auth-magic-link-req-011.json" },
-    { "id": "security-auth-magic-link-US-3101", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3101.json" },
-    { "id": "security-auth-magic-link-US-3102", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3102.json" },
-    { "id": "security-auth-magic-link-US-3103", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3103.json" },
-    { "id": "security-auth-magic-link-US-3104", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3104.json" },
-    { "id": "security-auth-magic-link-US-3105", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3105.json" },
-    { "id": "security-auth-magic-link-US-3106", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3106.json" },
-    { "id": "security-auth-magic-link-US-3107", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3107.json" },
-    { "id": "security-auth-magic-link-US-3108", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3108.json" },
-    { "id": "security-auth-magic-link-US-3109", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3109.json" },
-    { "id": "security-auth-magic-link-US-3110", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3110.json" },
-    { "id": "security-auth-magic-link-US-3111", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3111.json" },
-    { "id": "TAC-501-security-auth-magic-link-manager", "kind": "tac", "path": "tacs/tac-501-security-auth-magic-link-manager.json" },
-    { "id": "TAC-502-security-auth-magic-link-session-manager", "kind": "tac", "path": "tacs/tac-502-security-auth-magic-link-session-manager.json" },
-    { "id": "TAC-503-security-auth-magic-link-login-routes", "kind": "tac", "path": "tacs/tac-503-security-auth-magic-link-login-routes.json" },
-    { "id": "TAC-504-security-auth-magic-link-email-delivery-adapter", "kind": "tac", "path": "tacs/tac-504-security-auth-magic-link-email-delivery-adapter.json" },
-    { "id": "TAC-505-security-auth-magic-link-principal-registry", "kind": "tac", "path": "tacs/tac-505-security-auth-magic-link-principal-registry.json" },
+    {
+      "id": "security-auth-magic-link-REQ-001",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-001.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-002",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-002.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-003",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-003.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-004",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-004.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-005",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-005.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-006",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-006.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-007",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-007.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-008",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-008.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-009",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-009.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-010",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-010.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-011",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-011.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3101",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3101.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3102",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3102.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3103",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3103.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3104",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3104.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3105",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3105.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3106",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3106.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3107",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3107.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3108",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3108.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3109",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3109.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3110",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3110.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3111",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3111.json"
+    },
+    {
+      "id": "TAC-501-security-auth-magic-link-manager",
+      "kind": "tac",
+      "path": "tacs/tac-501-security-auth-magic-link-manager.json"
+    },
+    {
+      "id": "TAC-502-security-auth-magic-link-session-manager",
+      "kind": "tac",
+      "path": "tacs/tac-502-security-auth-magic-link-session-manager.json"
+    },
+    {
+      "id": "TAC-503-security-auth-magic-link-login-routes",
+      "kind": "tac",
+      "path": "tacs/tac-503-security-auth-magic-link-login-routes.json"
+    },
+    {
+      "id": "TAC-504-security-auth-magic-link-email-delivery-adapter",
+      "kind": "tac",
+      "path": "tacs/tac-504-security-auth-magic-link-email-delivery-adapter.json"
+    },
+    {
+      "id": "TAC-505-security-auth-magic-link-principal-registry",
+      "kind": "tac",
+      "path": "tacs/tac-505-security-auth-magic-link-principal-registry.json"
+    },
     {
       "id": "ADR-501-security-auth-magic-link-model",
       "kind": "adr",
@@ -37,9 +148,25 @@
       "scope": "global",
       "topic": "authModel"
     },
-    { "id": "ADR-502-security-auth-magic-link-token-secrecy", "kind": "adr", "path": "adrs/adr-502-security-auth-magic-link-token-secrecy.json" },
-    { "id": "ADR-503-security-auth-magic-link-anti-enumeration-budget", "kind": "adr", "path": "adrs/adr-503-security-auth-magic-link-anti-enumeration-budget.json" },
-    { "id": "ADR-504-security-auth-magic-link-session-lifecycle", "kind": "adr", "path": "adrs/adr-504-security-auth-magic-link-session-lifecycle.json" },
-    { "id": "ADR-505-security-auth-magic-link-rate-limiting", "kind": "adr", "path": "adrs/adr-505-security-auth-magic-link-rate-limiting.json" }
+    {
+      "id": "ADR-502-security-auth-magic-link-token-secrecy",
+      "kind": "adr",
+      "path": "adrs/adr-502-security-auth-magic-link-token-secrecy.json"
+    },
+    {
+      "id": "ADR-503-security-auth-magic-link-anti-enumeration-budget",
+      "kind": "adr",
+      "path": "adrs/adr-503-security-auth-magic-link-anti-enumeration-budget.json"
+    },
+    {
+      "id": "ADR-504-security-auth-magic-link-session-lifecycle",
+      "kind": "adr",
+      "path": "adrs/adr-504-security-auth-magic-link-session-lifecycle.json"
+    },
+    {
+      "id": "ADR-505-security-auth-magic-link-rate-limiting",
+      "kind": "adr",
+      "path": "adrs/adr-505-security-auth-magic-link-rate-limiting.json"
+    }
   ]
 }

package/blueprints/security-auth-magic-link/docs/topics.md

@@ -28,13 +28,25 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
 | observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
-| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
 | security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
 | security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
 | deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.0.0 | `deploymentTarget` |
 | persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 
 US 3101-3111 sit at the LOW end of the 3101-3899 band on purpose. A project-side story that mechanically derives from `security-auth-magic-link-REQ-011` into the number `3111` would collide against security-auth-magic-link-US-3111 in this package; the band leaves headroom at the HIGH end (US 3181-3899) so a project's own stories anchored to security-auth-magic-link REQs can allocate without conflict.
 

package/blueprints/security-auth-oauth2/CHANGELOG.md

@@ -0,0 +1,9 @@
+# security-auth-oauth2 CHANGELOG
+
+## 1.2.0 (visual round T-4, spec 2026-09-06 section 5.4.2, Baz Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory, hostedIdentityUi]` on `blueprint.json`. Additive per section 6 of `blueprint-authoring.md`. Consumed at apply time by the visual round T-4 `application-account-settings` blueprint to gate the security surface across both self-service and hosted-link-out branches (`AC-25105-1`) and the sessions surface (`AC-25106-1`). The three added capabilities are provider-conditional per spec section 5.4.2 vendor variation note: an OAuth2 provider (Auth0, Cognito, Azure AD, Okta) that ships a hosted account portal supplies `hostedIdentityUi`; a provider that exposes an account-management endpoint supplies `credentialSelfService`; a provider that exposes a session inventory endpoint supplies `sessionInventory`. A project on an OAuth2 provider without one of these surfaces sets the corresponding capability to false via a project-scoped ADR override; the account-settings blueprint suppresses the surface accordingly.
+
+## 1.1.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round T-5 `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.

package/blueprints/security-auth-oauth2/README.md

@@ -2,6 +2,9 @@
 
 The eleventh content blueprint on the rcf-build-lite blueprint mechanism, category `security`. A vendor-neutral sibling to `security-auth-magic-link` and `security-auth-clerk` on the `authModel` global topic: identity is delegated to any OAuth2-compatible IdP the project selects (Google, GitHub, Microsoft, Okta, Auth0, a corporate ADFS-fronted OIDC, a self-hosted `node-oidc-provider`) through a fixed provider-abstraction contract. The project owns the flow controller (authorisation-code + PKCE state machine), the provider adapter (pluggable record validation and JWKS fetch), the session-bridge (opaque-handle project session, no provider tokens in the browser), and an optional provider selector. Targeted at small greenfield rcf-lite projects that want delegated identity without vendor commitment; larger deployments supersede vendor-neutral posture with a vendor-committed sibling (`security-auth-clerk`, `security-auth-keycloak` when it ships) or with a project-level ADR.
 
+
+> Latest: **v1.2.0** (visual round T-4, 2026-09-06). `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory, hostedIdentityUi]`. See [CHANGELOG.md](CHANGELOG.md).
+
 ## Apply
 
 ```