rcf-lite 0.21.0 → 0.23.0

package/blueprints/security-auth-clerk/blueprint.json

@@ -1,33 +1,134 @@
 {
   "slug": "security-auth-clerk",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "category": "security",
-  "capabilities": ["principalDirectory", "roleModel"],
+  "capabilities": [
+    "principalDirectory",
+    "roleModel",
+    "sessionInventory",
+    "hostedIdentityUi"
+  ],
   "contributions": [
-    { "id": "security-auth-clerk-REQ-001", "kind": "req", "path": "requirements/security-auth-clerk-req-001.json" },
-    { "id": "security-auth-clerk-REQ-002", "kind": "req", "path": "requirements/security-auth-clerk-req-002.json" },
-    { "id": "security-auth-clerk-REQ-003", "kind": "req", "path": "requirements/security-auth-clerk-req-003.json" },
-    { "id": "security-auth-clerk-REQ-004", "kind": "req", "path": "requirements/security-auth-clerk-req-004.json" },
-    { "id": "security-auth-clerk-REQ-005", "kind": "req", "path": "requirements/security-auth-clerk-req-005.json" },
-    { "id": "security-auth-clerk-REQ-006", "kind": "req", "path": "requirements/security-auth-clerk-req-006.json" },
-    { "id": "security-auth-clerk-REQ-007", "kind": "req", "path": "requirements/security-auth-clerk-req-007.json" },
-    { "id": "security-auth-clerk-REQ-008", "kind": "req", "path": "requirements/security-auth-clerk-req-008.json" },
-    { "id": "security-auth-clerk-REQ-009", "kind": "req", "path": "requirements/security-auth-clerk-req-009.json" },
-    { "id": "security-auth-clerk-US-9101", "kind": "us", "path": "user-stories/security-auth-clerk-us-9101.json" },
-    { "id": "security-auth-clerk-US-9102", "kind": "us", "path": "user-stories/security-auth-clerk-us-9102.json" },
-    { "id": "security-auth-clerk-US-9103", "kind": "us", "path": "user-stories/security-auth-clerk-us-9103.json" },
-    { "id": "security-auth-clerk-US-9104", "kind": "us", "path": "user-stories/security-auth-clerk-us-9104.json" },
-    { "id": "security-auth-clerk-US-9105", "kind": "us", "path": "user-stories/security-auth-clerk-us-9105.json" },
-    { "id": "security-auth-clerk-US-9106", "kind": "us", "path": "user-stories/security-auth-clerk-us-9106.json" },
-    { "id": "security-auth-clerk-US-9107", "kind": "us", "path": "user-stories/security-auth-clerk-us-9107.json" },
-    { "id": "security-auth-clerk-US-9108", "kind": "us", "path": "user-stories/security-auth-clerk-us-9108.json" },
-    { "id": "security-auth-clerk-US-9109", "kind": "us", "path": "user-stories/security-auth-clerk-us-9109.json" },
-    { "id": "security-auth-clerk-US-9110", "kind": "us", "path": "user-stories/security-auth-clerk-us-9110.json" },
-    { "id": "security-auth-clerk-US-9111", "kind": "us", "path": "user-stories/security-auth-clerk-us-9111.json" },
-    { "id": "TAC-1001-security-auth-clerk-middleware", "kind": "tac", "path": "tacs/tac-1001-security-auth-clerk-middleware.json" },
-    { "id": "TAC-1002-security-auth-clerk-authorisation-adapter", "kind": "tac", "path": "tacs/tac-1002-security-auth-clerk-authorisation-adapter.json" },
-    { "id": "TAC-1003-security-auth-clerk-session-verifier", "kind": "tac", "path": "tacs/tac-1003-security-auth-clerk-session-verifier.json" },
-    { "id": "TAC-1004-security-auth-clerk-claims-mapper", "kind": "tac", "path": "tacs/tac-1004-security-auth-clerk-claims-mapper.json" },
+    {
+      "id": "security-auth-clerk-REQ-001",
+      "kind": "req",
+      "path": "requirements/security-auth-clerk-req-001.json"
+    },
+    {
+      "id": "security-auth-clerk-REQ-002",
+      "kind": "req",
+      "path": "requirements/security-auth-clerk-req-002.json"
+    },
+    {
+      "id": "security-auth-clerk-REQ-003",
+      "kind": "req",
+      "path": "requirements/security-auth-clerk-req-003.json"
+    },
+    {
+      "id": "security-auth-clerk-REQ-004",
+      "kind": "req",
+      "path": "requirements/security-auth-clerk-req-004.json"
+    },
+    {
+      "id": "security-auth-clerk-REQ-005",
+      "kind": "req",
+      "path": "requirements/security-auth-clerk-req-005.json"
+    },
+    {
+      "id": "security-auth-clerk-REQ-006",
+      "kind": "req",
+      "path": "requirements/security-auth-clerk-req-006.json"
+    },
+    {
+      "id": "security-auth-clerk-REQ-007",
+      "kind": "req",
+      "path": "requirements/security-auth-clerk-req-007.json"
+    },
+    {
+      "id": "security-auth-clerk-REQ-008",
+      "kind": "req",
+      "path": "requirements/security-auth-clerk-req-008.json"
+    },
+    {
+      "id": "security-auth-clerk-REQ-009",
+      "kind": "req",
+      "path": "requirements/security-auth-clerk-req-009.json"
+    },
+    {
+      "id": "security-auth-clerk-US-9101",
+      "kind": "us",
+      "path": "user-stories/security-auth-clerk-us-9101.json"
+    },
+    {
+      "id": "security-auth-clerk-US-9102",
+      "kind": "us",
+      "path": "user-stories/security-auth-clerk-us-9102.json"
+    },
+    {
+      "id": "security-auth-clerk-US-9103",
+      "kind": "us",
+      "path": "user-stories/security-auth-clerk-us-9103.json"
+    },
+    {
+      "id": "security-auth-clerk-US-9104",
+      "kind": "us",
+      "path": "user-stories/security-auth-clerk-us-9104.json"
+    },
+    {
+      "id": "security-auth-clerk-US-9105",
+      "kind": "us",
+      "path": "user-stories/security-auth-clerk-us-9105.json"
+    },
+    {
+      "id": "security-auth-clerk-US-9106",
+      "kind": "us",
+      "path": "user-stories/security-auth-clerk-us-9106.json"
+    },
+    {
+      "id": "security-auth-clerk-US-9107",
+      "kind": "us",
+      "path": "user-stories/security-auth-clerk-us-9107.json"
+    },
+    {
+      "id": "security-auth-clerk-US-9108",
+      "kind": "us",
+      "path": "user-stories/security-auth-clerk-us-9108.json"
+    },
+    {
+      "id": "security-auth-clerk-US-9109",
+      "kind": "us",
+      "path": "user-stories/security-auth-clerk-us-9109.json"
+    },
+    {
+      "id": "security-auth-clerk-US-9110",
+      "kind": "us",
+      "path": "user-stories/security-auth-clerk-us-9110.json"
+    },
+    {
+      "id": "security-auth-clerk-US-9111",
+      "kind": "us",
+      "path": "user-stories/security-auth-clerk-us-9111.json"
+    },
+    {
+      "id": "TAC-1001-security-auth-clerk-middleware",
+      "kind": "tac",
+      "path": "tacs/tac-1001-security-auth-clerk-middleware.json"
+    },
+    {
+      "id": "TAC-1002-security-auth-clerk-authorisation-adapter",
+      "kind": "tac",
+      "path": "tacs/tac-1002-security-auth-clerk-authorisation-adapter.json"
+    },
+    {
+      "id": "TAC-1003-security-auth-clerk-session-verifier",
+      "kind": "tac",
+      "path": "tacs/tac-1003-security-auth-clerk-session-verifier.json"
+    },
+    {
+      "id": "TAC-1004-security-auth-clerk-claims-mapper",
+      "kind": "tac",
+      "path": "tacs/tac-1004-security-auth-clerk-claims-mapper.json"
+    },
     {
       "id": "ADR-1001-security-auth-clerk-auth-model",
       "kind": "adr",
@@ -35,9 +136,25 @@
       "scope": "global",
       "topic": "authModel"
     },
-    { "id": "ADR-1002-security-auth-clerk-middleware-boundary", "kind": "adr", "path": "adrs/adr-1002-security-auth-clerk-middleware-boundary.json" },
-    { "id": "ADR-1003-security-auth-clerk-authorisation-adapter-contract", "kind": "adr", "path": "adrs/adr-1003-security-auth-clerk-authorisation-adapter-contract.json" },
-    { "id": "ADR-1004-security-auth-clerk-claims-mapping-discipline", "kind": "adr", "path": "adrs/adr-1004-security-auth-clerk-claims-mapping-discipline.json" },
-    { "id": "ADR-1005-security-auth-clerk-session-lifecycle", "kind": "adr", "path": "adrs/adr-1005-security-auth-clerk-session-lifecycle.json" }
+    {
+      "id": "ADR-1002-security-auth-clerk-middleware-boundary",
+      "kind": "adr",
+      "path": "adrs/adr-1002-security-auth-clerk-middleware-boundary.json"
+    },
+    {
+      "id": "ADR-1003-security-auth-clerk-authorisation-adapter-contract",
+      "kind": "adr",
+      "path": "adrs/adr-1003-security-auth-clerk-authorisation-adapter-contract.json"
+    },
+    {
+      "id": "ADR-1004-security-auth-clerk-claims-mapping-discipline",
+      "kind": "adr",
+      "path": "adrs/adr-1004-security-auth-clerk-claims-mapping-discipline.json"
+    },
+    {
+      "id": "ADR-1005-security-auth-clerk-session-lifecycle",
+      "kind": "adr",
+      "path": "adrs/adr-1005-security-auth-clerk-session-lifecycle.json"
+    }
   ]
 }

package/blueprints/security-auth-clerk/docs/topics.md

@@ -28,7 +28,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
 | observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
-| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
 | security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
 | security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
@@ -40,6 +40,15 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
 | application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 
 US 9101-9110 sit at the LOW end of the 9101-9899 band on purpose. A project-side story that mechanically derives from a security-auth-clerk REQ id into the number `9110` would collide against security-auth-clerk-US-9110 in this package; the band leaves headroom at the HIGH end (US 9181-9899) so a project's own stories anchored to security-auth-clerk REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/security-auth-keycloak/CHANGELOG.md

@@ -1,5 +1,9 @@
 # security-auth-keycloak CHANGELOG
 
+## 1.2.0 (visual round T-4, spec 2026-09-06 section 5.4.2, Baz Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory]` on `blueprint.json`. Additive per section 6 of `blueprint-authoring.md`. Consumed at apply time by the visual round T-4 `application-account-settings` blueprint to gate the security surface self-service branch (probe pack check `AC-25105-1`) and the sessions surface (`AC-25106-1`). Keycloak ships a credential self-service surface (password change, MFA management, email change) that a project can bring in-place and it exposes an active-session inventory a terminate action can act on. Keycloak does NOT declare `hostedIdentityUi` because its hosted-UI is realm-scoped and Keycloak deployments typically brand it in place, so the account-settings blueprint does not treat Keycloak as a hosted-UI provider.
+
 ## 1.1.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
 
 - Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round T-5 `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.

package/blueprints/security-auth-keycloak/README.md

@@ -2,6 +2,9 @@
 
 The twelfth content blueprint on the rcf-build-lite blueprint mechanism, category `security`. A Keycloak-committed sibling to `security-auth-magic-link`, `security-auth-clerk`, and `security-auth-oauth2` on the `authModel` global topic. Identity is delegated to a Keycloak realm the operator runs; the project owns the discovery client, the token verifier (JWKS or introspection per realm), the role adapter, the provider-routing seam, and the optional application session on top. Targeted at rcf-lite projects that have committed to a self-hosted Keycloak realm (or are running one already) and want the Keycloak-shaped decisions the vendor-neutral `security-auth-oauth2` sibling deliberately does not fix.
 
+
+> Latest: **v1.2.0** (visual round T-4, 2026-09-06). `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory]`. See [CHANGELOG.md](CHANGELOG.md).
+
 ## Apply
 
 ```

package/blueprints/security-auth-keycloak/blueprint.json

@@ -1,39 +1,164 @@
 {
   "slug": "security-auth-keycloak",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "category": "security",
-  "capabilities": ["principalDirectory", "roleModel"],
+  "capabilities": [
+    "principalDirectory",
+    "roleModel",
+    "credentialSelfService",
+    "sessionInventory"
+  ],
   "contributions": [
-    { "id": "security-auth-keycloak-REQ-001", "kind": "req", "path": "requirements/security-auth-keycloak-req-001.json" },
-    { "id": "security-auth-keycloak-REQ-002", "kind": "req", "path": "requirements/security-auth-keycloak-req-002.json" },
-    { "id": "security-auth-keycloak-REQ-003", "kind": "req", "path": "requirements/security-auth-keycloak-req-003.json" },
-    { "id": "security-auth-keycloak-REQ-004", "kind": "req", "path": "requirements/security-auth-keycloak-req-004.json" },
-    { "id": "security-auth-keycloak-REQ-005", "kind": "req", "path": "requirements/security-auth-keycloak-req-005.json" },
-    { "id": "security-auth-keycloak-REQ-006", "kind": "req", "path": "requirements/security-auth-keycloak-req-006.json" },
-    { "id": "security-auth-keycloak-REQ-007", "kind": "req", "path": "requirements/security-auth-keycloak-req-007.json" },
-    { "id": "security-auth-keycloak-REQ-008", "kind": "req", "path": "requirements/security-auth-keycloak-req-008.json" },
-    { "id": "security-auth-keycloak-REQ-009", "kind": "req", "path": "requirements/security-auth-keycloak-req-009.json" },
-    { "id": "security-auth-keycloak-REQ-010", "kind": "req", "path": "requirements/security-auth-keycloak-req-010.json" },
-    { "id": "security-auth-keycloak-REQ-011", "kind": "req", "path": "requirements/security-auth-keycloak-req-011.json" },
-    { "id": "security-auth-keycloak-REQ-012", "kind": "req", "path": "requirements/security-auth-keycloak-req-012.json" },
-    { "id": "security-auth-keycloak-US-11101", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11101.json" },
-    { "id": "security-auth-keycloak-US-11102", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11102.json" },
-    { "id": "security-auth-keycloak-US-11103", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11103.json" },
-    { "id": "security-auth-keycloak-US-11104", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11104.json" },
-    { "id": "security-auth-keycloak-US-11105", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11105.json" },
-    { "id": "security-auth-keycloak-US-11106", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11106.json" },
-    { "id": "security-auth-keycloak-US-11107", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11107.json" },
-    { "id": "security-auth-keycloak-US-11108", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11108.json" },
-    { "id": "security-auth-keycloak-US-11109", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11109.json" },
-    { "id": "security-auth-keycloak-US-11110", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11110.json" },
-    { "id": "security-auth-keycloak-US-11111", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11111.json" },
-    { "id": "security-auth-keycloak-US-11112", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11112.json" },
-    { "id": "security-auth-keycloak-US-11113", "kind": "us", "path": "user-stories/security-auth-keycloak-us-11113.json" },
-    { "id": "TAC-1201-security-auth-keycloak-discovery-client", "kind": "tac", "path": "tacs/tac-1201-security-auth-keycloak-discovery-client.json" },
-    { "id": "TAC-1202-security-auth-keycloak-jwt-verifier", "kind": "tac", "path": "tacs/tac-1202-security-auth-keycloak-jwt-verifier.json" },
-    { "id": "TAC-1203-security-auth-keycloak-introspection-client", "kind": "tac", "path": "tacs/tac-1203-security-auth-keycloak-introspection-client.json" },
-    { "id": "TAC-1204-security-auth-keycloak-provider-router", "kind": "tac", "path": "tacs/tac-1204-security-auth-keycloak-provider-router.json" },
-    { "id": "TAC-1205-security-auth-keycloak-role-adapter", "kind": "tac", "path": "tacs/tac-1205-security-auth-keycloak-role-adapter.json" },
+    {
+      "id": "security-auth-keycloak-REQ-001",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-001.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-002",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-002.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-003",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-003.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-004",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-004.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-005",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-005.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-006",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-006.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-007",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-007.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-008",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-008.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-009",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-009.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-010",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-010.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-011",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-011.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-012",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-012.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11101",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11101.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11102",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11102.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11103",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11103.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11104",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11104.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11105",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11105.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11106",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11106.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11107",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11107.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11108",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11108.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11109",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11109.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11110",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11110.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11111",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11111.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11112",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11112.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11113",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11113.json"
+    },
+    {
+      "id": "TAC-1201-security-auth-keycloak-discovery-client",
+      "kind": "tac",
+      "path": "tacs/tac-1201-security-auth-keycloak-discovery-client.json"
+    },
+    {
+      "id": "TAC-1202-security-auth-keycloak-jwt-verifier",
+      "kind": "tac",
+      "path": "tacs/tac-1202-security-auth-keycloak-jwt-verifier.json"
+    },
+    {
+      "id": "TAC-1203-security-auth-keycloak-introspection-client",
+      "kind": "tac",
+      "path": "tacs/tac-1203-security-auth-keycloak-introspection-client.json"
+    },
+    {
+      "id": "TAC-1204-security-auth-keycloak-provider-router",
+      "kind": "tac",
+      "path": "tacs/tac-1204-security-auth-keycloak-provider-router.json"
+    },
+    {
+      "id": "TAC-1205-security-auth-keycloak-role-adapter",
+      "kind": "tac",
+      "path": "tacs/tac-1205-security-auth-keycloak-role-adapter.json"
+    },
     {
       "id": "ADR-1201-security-auth-keycloak-auth-model",
       "kind": "adr",
@@ -41,10 +166,30 @@
       "scope": "global",
       "topic": "authModel"
     },
-    { "id": "ADR-1202-security-auth-keycloak-verification-mode-choice", "kind": "adr", "path": "adrs/adr-1202-security-auth-keycloak-verification-mode-choice.json" },
-    { "id": "ADR-1203-security-auth-keycloak-provider-routing-seam", "kind": "adr", "path": "adrs/adr-1203-security-auth-keycloak-provider-routing-seam.json" },
-    { "id": "ADR-1204-security-auth-keycloak-session-vs-token-contract", "kind": "adr", "path": "adrs/adr-1204-security-auth-keycloak-session-vs-token-contract.json" },
-    { "id": "ADR-1205-security-auth-keycloak-jwks-rotation-cache-lifetime", "kind": "adr", "path": "adrs/adr-1205-security-auth-keycloak-jwks-rotation-cache-lifetime.json" },
-    { "id": "ADR-1206-security-auth-keycloak-refresh-and-sign-out-posture", "kind": "adr", "path": "adrs/adr-1206-security-auth-keycloak-refresh-and-sign-out-posture.json" }
+    {
+      "id": "ADR-1202-security-auth-keycloak-verification-mode-choice",
+      "kind": "adr",
+      "path": "adrs/adr-1202-security-auth-keycloak-verification-mode-choice.json"
+    },
+    {
+      "id": "ADR-1203-security-auth-keycloak-provider-routing-seam",
+      "kind": "adr",
+      "path": "adrs/adr-1203-security-auth-keycloak-provider-routing-seam.json"
+    },
+    {
+      "id": "ADR-1204-security-auth-keycloak-session-vs-token-contract",
+      "kind": "adr",
+      "path": "adrs/adr-1204-security-auth-keycloak-session-vs-token-contract.json"
+    },
+    {
+      "id": "ADR-1205-security-auth-keycloak-jwks-rotation-cache-lifetime",
+      "kind": "adr",
+      "path": "adrs/adr-1205-security-auth-keycloak-jwks-rotation-cache-lifetime.json"
+    },
+    {
+      "id": "ADR-1206-security-auth-keycloak-refresh-and-sign-out-posture",
+      "kind": "adr",
+      "path": "adrs/adr-1206-security-auth-keycloak-refresh-and-sign-out-posture.json"
+    }
   ]
 }

package/blueprints/security-auth-keycloak/docs/topics.md

@@ -39,7 +39,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
 | observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
-| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
 | security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
 | security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
@@ -51,6 +51,15 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
 | application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
+| jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 
 US 11101-11113 sit at the LOW end of the 11101-11899 band on purpose. A project-side story that mechanically derives from a security-auth-keycloak REQ id into the number `11113` would collide against security-auth-keycloak-US-11113 in this package; the band leaves headroom at the HIGH end (US 11181-11899) so a project's own stories anchored to security-auth-keycloak REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/security-auth-magic-link/CHANGELOG.md

@@ -1,5 +1,9 @@
 # security-auth-magic-link CHANGELOG
 
+## 1.2.0 (visual round T-4, spec 2026-09-06 section 5.4.2, doc-only)
+
+- No change to `capabilities[]`; the declaration remains `[principalDirectory]`. The bump records the account-settings suppression behaviour: on a bare-magic-link project the security tab, the sessions tab, the notification-preferences tab (unless `application-notifications-in-app` is applied) and the theme tab (unless `application-spa` is applied) are all suppressed by the account-settings blueprint capability discovery, and only the profile surface renders. This is not a regression; magic-link intentionally does NOT self-declare a credential-self-service surface, a session inventory, or a hosted identity UI (the click-a-link flow is the whole surface). Consumers pair magic-link with a session store (or a logging companion) if they want a sessions surface.
+
 ## 1.1.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
 
 - Declares `capabilities: [principalDirectory]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round T-5 `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.

package/blueprints/security-auth-magic-link/README.md

@@ -2,6 +2,9 @@
 
 The third content blueprint on the rcf-build-lite blueprint mechanism (design brief v2, ratified; Phase 4 of the blueprint programme). Scope: passwordless magic-link sign-in with server-issued opaque cookie sessions, single deployable, pluggable email delivery and pluggable principal registry, targeted at small greenfield rcf-lite projects. Composes with the application-spa blueprint (client half) and the application-api-rest blueprint (server half) by design, contributing one deliberate scope:global conflict on `authModel`.
 
+
+> Latest: **v1.2.0 (doc-only)** (visual round T-4, 2026-09-06). `capabilities: [principalDirectory]`. See [CHANGELOG.md](CHANGELOG.md).
+
 ## Apply
 
 ```