rcf-lite 0.26.0 → 0.27.0

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38109.json

@@ -13,12 +13,67 @@
       "id": "AC-composeHost-logDriverClassification",
       "description": "Every service in the applied compose.yaml declares a logging: driver: block whose driver value matches the elicited log driver (default journald). The compose-config-lint probe asserts (a) every service declares logging: driver, (b) the value is one of journald or loki, and (c) SIMULATE_UNCLASSIFIED_LOG_DRIVER=true sets a disallowed driver and the probe FAILS naming the service and the disallowed value.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-38109-2",
+      "description": "F-8 journald marker: with log-driver=journald on the throwaway server, the probe writes a marker line via a service's stdout (a unique UUID substring), then runs `journalctl CONTAINER_NAME=<name> -o cat` on the host and asserts the marker substring appears in the output within a bounded 30 seconds. Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped: true and aggregates to pass.",
+      "given": "a fixture with log-driver=journald and CI_HAS_HETZNER_ACCOUNT=true",
+      "when": "the probe writes the marker and greps journalctl",
+      "then": "the marker appears in the journalctl output within 30 seconds; the probe passes",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+        "field": "responsibilities.logDriver"
+      },
+      "vendorCitation": {
+        "url": "https://www.freedesktop.org/software/systemd/man/journalctl.html",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38109-3",
+      "description": "F-8 loki marker: with log-driver=loki and the applied Loki endpoint set, the probe writes a marker (UUID substring) via a service's stdout, then HTTP GETs the Loki push-query API at the elicited endpoint and asserts the marker appears in the response within a bounded 30 seconds. Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped: true and aggregates to pass.",
+      "given": "a fixture with log-driver=loki, a Loki endpoint and CI_HAS_HETZNER_ACCOUNT=true",
+      "when": "the probe writes the marker and queries the Loki API",
+      "then": "the marker appears in the Loki API response within 30 seconds; the probe passes",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+        "field": "responsibilities.logDriver"
+      },
+      "vendorCitation": {
+        "url": "https://grafana.com/docs/loki/latest/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38109-4",
+      "description": "Missing logging block: SIMULATE_MISSING_LOG_DRIVER=true removes the logging: block from a service. The compose-config-lint FAILS naming the service; every service must declare a logging: driver block per REQ-006.",
+      "given": "a fixture with SIMULATE_MISSING_LOG_DRIVER=true",
+      "when": "the lint runs",
+      "then": "the lint FAILS naming the service with no logging driver",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+        "field": "responsibilities.logDriver"
+      },
+      "vendorCitation": {
+        "url": "https://docs.docker.com/reference/compose-file/services/#logging",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3903-platform-docker-compose-host-healthcheck-lint"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38110.json

@@ -0,0 +1,92 @@
+{
+  "usId": "platform-docker-compose-host-US-38110",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-007",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Docker Engine installs from the elicited apt channel: the observable repository source matches",
+  "asA": "operator installing the container host on a fresh Ubuntu 24.04 or Debian 12 baseline",
+  "iWant": "the shipped installer script to resolve the elicited docker-engine-channel answer into the apt sources entry actually written to the host, and to refuse any other value with a named error kind",
+  "soThat": "a project verifying against test can trust the installed engine is on the pre-release channel; a project on stable can trust it is on the stable channel",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-38110-1",
+      "description": "With docker-engine-channel=stable, the installer writes an apt sources entry pointing at the vendor stable pool; the observable file at /etc/apt/sources.list.d/docker.list carries the \"stable\" pool component; dpkg -s docker-ce reports a version from the stable pool. With docker-engine-channel=test, the same file carries the \"test\" component and dpkg -s reports a version from the test pool.",
+      "given": "a fresh Ubuntu 24.04 baseline with no prior docker-ce install",
+      "when": "the installer script runs against the elicited channel",
+      "then": "the apt sources file carries the elicited pool component and the installed docker-ce matches",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.docker.com/engine/install/ubuntu/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38110-2",
+      "description": "The installer refuses any elicited docker-engine-channel value outside {stable, test} with a stable error kind DOCKER_ENGINE_CHANNEL_UNSUPPORTED naming the offered value and lists the accepted options in the message. No apt sources entry is written on refusal.",
+      "given": "a docker-engine-channel elicit answer set to \"nightly\" (or any other unrecognised value)",
+      "when": "the installer script runs",
+      "then": "the installer refuses with DOCKER_ENGINE_CHANNEL_UNSUPPORTED and no apt sources entry lands",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-38110-3",
+      "description": "Sources file content probe: after the installer script runs on the fixture VM, a shell probe reads /etc/apt/sources.list.d/docker.list and asserts (a) the file exists, (b) the URI resolves to https://download.docker.com/linux/ubuntu (or /linux/debian) matching the OS, and (c) the pool component equals the elicited docker-engine-channel answer (\"stable\" or \"test\"). SIMULATE_STALE_SOURCES=true writes an incorrect pool value and the probe FAILS naming the observed and expected components.",
+      "given": "a fresh VM after the installer runs with docker-engine-channel=stable",
+      "when": "the probe reads the sources file",
+      "then": "the file exists, the URI matches, and the pool component equals \"stable\"",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+        "field": "responsibilities.aptSources"
+      },
+      "vendorCitation": {
+        "url": "https://docs.docker.com/engine/install/ubuntu/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38110-4",
+      "description": "Keyring probe: /etc/apt/keyrings/docker.gpg exists after the installer runs (the Docker Engine install steps place the keyring here per the Ubuntu install doc). SIMULATE_MISSING_KEYRING=true removes the file and the installer refuses on the next apt-get update with a stable error kind DOCKER_ENGINE_KEYRING_MISSING.",
+      "given": "a fresh VM after the installer runs",
+      "when": "the probe reads /etc/apt/keyrings/docker.gpg",
+      "then": "the file exists; SIMULATE_MISSING_KEYRING=true removes it and the installer refuses with DOCKER_ENGINE_KEYRING_MISSING",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+        "field": "responsibilities.aptSources"
+      },
+      "vendorCitation": {
+        "url": "https://docs.docker.com/engine/install/ubuntu/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38110-5",
+      "description": "Idempotent install: running the installer script twice on the same VM does NOT duplicate the sources entry (a subsequent grep of /etc/apt/sources.list.d/docker.list finds exactly one URI line), does NOT re-add the keyring, and returns exit 0 on the second run. The installer detects the existing install and short-circuits (docker-ce is up to date).",
+      "given": "a fresh VM after the installer has already run once",
+      "when": "the installer script runs a second time",
+      "then": "the sources file has exactly one URI line; the keyring is unchanged; the second run exits 0",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+        "field": "responsibilities.aptSources"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-3901-platform-docker-compose-host-compose-layout"
+  ],
+  "createdAt": "2026-09-09T20:25:00.000Z",
+  "updatedAt": "2026-09-09T22:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/docs/topics.md

@@ -61,11 +61,11 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 
 US 38101-38109 sit at the LOW end of the 38101-38899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a platform-docker-compose-host REQ id into the number 38109 would collide against the shipped US-38109; band headroom (38110-38899) leaves that space.
 
-Platform-docker-compose-host suffixes for this blueprint use the 3901-3904 block, continuing the widening pattern (deploy-hetzner-server 3801-3804 for the T-1 sibling).
+Platform-docker-compose-host suffixes for this blueprint use the 3901-3904 block, continuing the widening pattern (deploy-hetzner-server 3801-3804 for the host sibling).
 
 ## Cross-references
 
-- `deploy-hetzner-server` (v1.0.0): consumed via `capabilities: [cloudHost]`; this blueprint composes on the Hetzner cloudHost T-1 provisions.
+- `deploy-hetzner-server` (v1.0.0): consumed via `capabilities: [cloudHost]`; this blueprint composes on the Hetzner cloudHost that blueprint provisions.
 - `security-secrets-management` (v1.0.1): the compose secrets file source resolves through the applied secrets facade when the secrets blueprint is applied; the guide names a file-based fallback path when it is not.
-- Round-7 T-3 `edge-cloudflare-tunnel`: composes on `capabilities: [containerHost]`; runs cloudflared as a compose service in this stack.
+- Round-7 `edge-cloudflare-tunnel`: composes on `capabilities: [containerHost]`; runs cloudflared as a compose service in this stack.
 - `observability-logging`: elicited log-driver wires the applied logging companion's endpoint (journald by default, loki opt-in).

package/blueprints/platform-docker-compose-host/guide/platform-docker-compose-host.md

@@ -1,6 +1,6 @@
 # Guide: platform-docker-compose-host v1.0.0
 
-Round-7 T-2 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`. Applies on top of `deploy-hetzner-server` (or any future `cloudHost` provider) and mints `containerHost` for downstream consumers.
+Applies on top of `deploy-hetzner-server` (or any future `cloudHost` provider) and mints `containerHost` for downstream consumers.
 
 ## What this blueprint gives you
 
@@ -24,11 +24,11 @@ A docker compose stack as your application runtime on a Linux VM. The compose fi
 
 The `reverse-proxy` elicit is the one you will hit first. The defaults:
 
-- **`caddy` (default per Baz decision 19).** Matches the estate baseline (dev-01 and ops-01 both run Caddy). Small config file, automatic HTTPS in production, `docker compose exec caddy caddy reload` picks up changes instantly. Reach for it whenever you do not have a strong project-side reason for something else. See the Caddy docs at https://caddyserver.com/docs/.
+- **`caddy` (the shipped default).** Matches a common Linux-host baseline where the target hosts already run Caddy. Small config file, automatic HTTPS in production, `docker compose exec caddy caddy reload` picks up changes instantly. Reach for it whenever you do not have a strong project-side reason for something else. See the Caddy docs at https://caddyserver.com/docs/.
 - **`traefik` (alternative).** Reach for it when your project wants docker-label auto-discovery (each service declares its hostname/route via labels in `compose.yaml` and Traefik configures itself). Trade-off: your routing is spread across many service blocks rather than one Caddyfile. See the Traefik docs at https://doc.traefik.io/traefik/.
-- **`none` (alternative).** Reach for it when the project is fronted only by the round-7 tunnel (`edge-cloudflare-tunnel` v1.0.0). The connector terminates at the CF edge and forwards to a service on the internal `web-net` network; no reverse proxy is needed inside compose. The lint refuses to add a `caddy/Caddyfile` when `reverse-proxy` is `none`.
+- **`none` (alternative).** Reach for it when the project is fronted only by the `edge-cloudflare-tunnel` sibling (v1.0.0). The connector terminates at the CF edge and forwards to a service on the internal `web-net` network; no reverse proxy is needed inside compose. The lint refuses to add a `caddy/Caddyfile` when `reverse-proxy` is `none`.
 
-The Coolify note (ADR-3903 body): "reject; it shadows what the blueprints contract and adds its own DB and UI as a second source of state". Baz decision 20, verbatim. A `platform-coolify-host` sibling mints on operator demand later; it is not part of round 7.
+The Coolify note (ADR-3903 body): "reject; it shadows what the blueprints contract and adds its own DB and UI as a second source of state". Recorded as a platform decision. A `platform-coolify-host` sibling may mint on operator demand later.
 
 ## Healthcheck contract
 
@@ -50,7 +50,7 @@ When `security-secrets-management` is applied, the source path resolves through
 
 The `log-driver` elicit (ADR-3904):
 
-- **`journald` (default).** Matches the Debian 12 and Ubuntu 24.04 baseline the T-1 cloud-init sets up on the throwaway server. `journalctl -u docker.service` and `journalctl CONTAINER_NAME=<name>` reach the same stream you would see in `docker logs`.
+- **`journald` (default).** Matches the Debian 12 and Ubuntu 24.04 baseline the deploy-hetzner-server cloud-init sets up on the throwaway server. `journalctl -u docker.service` and `journalctl CONTAINER_NAME=<name>` reach the same stream you would see in `docker logs`.
 - **`loki` (opt-in).** Reach for it when the applying project runs Grafana. The compose logging block wires each service through the Grafana Loki docker plugin; the observability-logging companion supplies the loki endpoint.
 
 The compose-config-lint refuses on any driver value outside the two. The lint fires before `docker compose up` runs.
@@ -85,7 +85,7 @@ Real-account probes require `CI_HAS_HETZNER_ACCOUNT=true` plus `HCLOUD_TOKEN`; w
 
 ## Applying to your project
 
-Once T-1 (`deploy-hetzner-server`) has provisioned a `cloudHost`:
+Once `deploy-hetzner-server` has provisioned a `cloudHost`:
 
 ```
 rcf apply platform-docker-compose-host

package/blueprints/security-auth-clerk/CHANGELOG.md

@@ -1,9 +1,29 @@
 # security-auth-clerk CHANGELOG
 
-## 1.3.0 (visual round T-4, spec 2026-09-06 section 5.4.2, Baz Q2 default)
+## 1.5.1
 
-- Declares `capabilities: [principalDirectory, roleModel, sessionInventory, hostedIdentityUi]` on `blueprint.json`. Additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump). Consumed at apply time by the visual round T-4 `application-account-settings` blueprint to gate the sessions surface (probe pack check `AC-25106-1`) and the security surface hosted-UI branch (`AC-25105-1`). Clerk exposes an inventory of active sessions with device labels and a terminate action, and hosts identity screens (sign-in, sign-up, account, security) that a link-out or embed can consume.
+- Adds `vendorCitation` on `AC-9108-1` (`{ url, verifiedOn }` pointing at the Clerk sign-up-and-sign-in-options guide) and on `AC-9109-2` (pointing at the Clerk system-limits page): closes F-4 and F-5. Both ACs rest on Clerk-documented facts; the citations record the exact page and the ISO-8601 verification date so a reviewer can retrace the fact without following prose leads.
+- Closure fix pass (F-6): rewrites the `README.md` shelf-latest line in neutral customer-facing voice with no spec-provenance label.
+- Owner rule on `signInStrategy`: repoints `REQ-005.description` to reference `TAC-1001-security-auth-clerk-middleware.interfaces.config` as the owner of the record shape; `AC-9108-1` keeps the literal `{ primary: string, alternates: string[] }` as an oracle and gains an `ownerRef` at the same field.
 
-## 1.2.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
+## 1.5.0
 
-- Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round T-5 `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.
+- Extends `REQ-001.description` with a one-line runtime clause naming the `hostedIdentityUi` capability verbatim (Clerk-hosted sign-in, sign-up, MFA, and account-management surfaces; no project route renders a credential-input control of its own). Adds `AC-9102-3` to `US-9102` binding a fixed source-tree-scan observation against `TAC-1001-security-auth-clerk-middleware` `responsibilities.signInStrategy`. Adds `US-9113` binding `REQ-011` (audit surface) with four ACs covering the success, refusal, retry and boundary paths of the verification and sessionInventory audit-event contract, each `ownerRef` pointing at `TAC-1003-security-auth-clerk-session-verifier` `responsibilities.audit`. Rewrites `REQ-003.description` to reference `TAC-1001-security-auth-clerk-middleware` `responsibilities.verify` rather than restate the `{ authenticated, principal?, reason? }` shape verbatim, and moves the REQ's `deliveredBy` from the shape ADR to the owning TAC.
+- Closure fixes: repoints `REQ-001.deliveredBy` from `TAC-1004-security-auth-clerk-claims-mapper.responsibilities.reduceClaims` to `TAC-1001-security-auth-clerk-middleware.responsibilities.signInStrategy`, the responsibility that carries the `hostedIdentityUi` mount behaviour (the field `AC-9102-3` observes); strengthens the TAC-1001 `signInStrategy` responsibility text to name the `hostedIdentityUi` capability verbatim. Tightens `AC-9113-1` and `AC-9113-2` to name each event by its (`operation`, `outcome`) tuple and binds the refusal case to `reasonClass=expired` for an expired `__session` cookie input (dropping the example set). Adds `AC-9113-5` (permission: unauthenticated `sessionInventory.revoke` refused with `reasonClass=unauthenticated`, no side effect) and `AC-9113-6` (idempotency: two verifications of the same valid cookie emit two events, count is one per verify call). Adds a 7a inline note in the story's `description` documenting the credential and permission scenario-class mapping.
+
+## 1.4.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.4.0 (hardening pass, spec 2026-09-09 section 5.4.2)
+
+- Adds `REQ-010` and `US-9112` for the `sessionInventory` capability contract (list, revoke-one, revoke-all-except-current, unauthenticated refusal, unknown-session refusal, one structured audit event per operation) and extends `TAC-1003` with the `sessionInventory` interface. Adds `REQ-011` (verification and inventory audit surface with a fixed field allow-list and prefix boundary). Reconciles the Principal shape in `REQ-001` to the four-field record already asserted by the ACs and TAC-1004. Adds `deliveredBy` on every `must` requirement and `disposition: fixed` on every existing acceptance criterion; adds `ownerRef` on ACs that observe the `sessionInventory` interface. Names the `principalDirectory`, `roleModel`, and `hostedIdentityUi` capabilities on the requirements that already carry their runtime clauses. hardening pass (criteria a, b, c on the 2026-09-09 programme).
+- Review fix pass (PR #188 findings): softens `US-9112` `AC-1` to reference the `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` `SessionRow` shape rather than restating its fields (clerk owns the shape, and the reference form keeps every consumer AC single-owner).
+
+## 1.3.0 (visual round, spec 2026-09-06 section 5.4.2, operator Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel, sessionInventory, hostedIdentityUi]` on `blueprint.json`. Additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump). Consumed at apply time by the visual round `application-account-settings` blueprint to gate the sessions surface (probe pack check `AC-25106-1`) and the security surface hosted-UI branch (`AC-25105-1`). Clerk exposes an inventory of active sessions with device labels and a terminate action, and hosts identity screens (sign-in, sign-up, account, security) that a link-out or embed can consume.
+
+## 1.2.0 (visual round, spec 2026-09-04 section 5.5.2, operator Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.

package/blueprints/security-auth-clerk/README.md

@@ -3,7 +3,7 @@
 The tenth content blueprint on the rcf-build-lite blueprint mechanism, category `security`. A Clerk-committed sibling to `security-auth-magic-link` on the `authModel` global topic: Clerk hosts the identity surface (users, sessions, sign-in UX, credential storage, MFA, account recovery); the project owns a framework-agnostic middleware boundary, a session verifier confined to one module, a Clerk-claim-to-project-verb authorisation adapter, and a reduced principal shape the rest of the codebase reasons against. Targeted at small greenfield rcf-lite projects that want hosted identity without building the user-and-session surface themselves; larger deployments supersede the vendor by superseding ADR-1001 with a project-level ADR and swapping the middleware and verifier adapters.
 
 
-> Latest: **v1.3.0** (visual round T-4, 2026-09-06). `capabilities: [principalDirectory, roleModel, sessionInventory, hostedIdentityUi]`. See [CHANGELOG.md](CHANGELOG.md).
+> Latest: **v1.5.1** (2026-09-10). `capabilities: [principalDirectory, roleModel, sessionInventory, hostedIdentityUi]`. See [CHANGELOG.md](CHANGELOG.md).
 
 ## Apply
 

package/blueprints/security-auth-clerk/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "security-auth-clerk",
-  "version": "1.3.0",
+  "version": "1.5.1",
   "category": "security",
   "capabilities": [
     "principalDirectory",
@@ -155,6 +155,26 @@
       "id": "ADR-1005-security-auth-clerk-session-lifecycle",
       "kind": "adr",
       "path": "adrs/adr-1005-security-auth-clerk-session-lifecycle.json"
+    },
+    {
+      "id": "security-auth-clerk-REQ-010",
+      "kind": "req",
+      "path": "requirements/security-auth-clerk-req-010.json"
+    },
+    {
+      "id": "security-auth-clerk-US-9112",
+      "kind": "us",
+      "path": "user-stories/security-auth-clerk-us-9112.json"
+    },
+    {
+      "id": "security-auth-clerk-REQ-011",
+      "kind": "req",
+      "path": "requirements/security-auth-clerk-req-011.json"
+    },
+    {
+      "id": "security-auth-clerk-US-9113",
+      "kind": "us",
+      "path": "user-stories/security-auth-clerk-us-9113.json"
     }
   ]
 }

package/blueprints/security-auth-clerk/contributions/requirements/security-auth-clerk-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "security-auth-clerk-REQ-001",
   "prdId": "PRD-001",
   "title": "Clerk owns the identity surface; the project reads a resolved principal",
-  "description": "The project's authentication model delegates the identity surface (users, sessions, sign-in UX, credential storage, MFA, account recovery) to Clerk. The project does not own a user table, does not mint or store credentials, and does not implement the sign-in UI beyond mounting a Clerk-hosted component or route. What the project owns is the reduction of a verified Clerk session into a stable in-process principal shape (a `principalId` string, a `roles` string array, an `organisationIds` string array) that the rest of the project reasons against. Any code path that needs to know who the current caller is reads that resolved principal; no code path calls Clerk directly outside the middleware and session-verifier boundary.",
+  "description": "The project's authentication model delegates the identity surface (users, sessions, sign-in UX, credential storage, MFA, account recovery) to Clerk. The project does not own a user table, does not mint or store credentials, and does not implement the sign-in UI beyond mounting a Clerk-hosted component or route. What the project owns is the reduction of a verified Clerk session into a stable in-process principal shape (`principalId` string, `roles` string array, `organisationIds` string array, and a `claims` bag holding the raw Clerk claim record as an escape hatch, accessed only through the authorisation adapter and the claims mapper per ADR-1004) that the rest of the project reasons against. Any code path that needs to know who the current caller is reads that resolved principal; no code path calls Clerk directly outside the middleware and session-verifier boundary. The reduced Principal is what the blueprint contributes as the `principalDirectory` capability: no other read-side surface on the project answers \"who is the caller\"; every project code path that reasons about identity reasons against the fields on this Principal, and the applied capability set exposes the token so consumer blueprints (application-account-settings and its peers) can bind against it. The blueprint contributes the `hostedIdentityUi` capability: the sign-in, sign-up, MFA, and account-management surfaces are Clerk-hosted routes or Clerk-hosted components mounted by the project, and no project route renders a credential-input control of its own; the applied capability set exposes the `hostedIdentityUi` token so consumer blueprints can gate on it.",
   "category": "functional",
   "domain": "authentication",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1001-security-auth-clerk-middleware",
+    "field": "responsibilities.signInStrategy"
+  }
 }

package/blueprints/security-auth-clerk/contributions/requirements/security-auth-clerk-req-002.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1001-security-auth-clerk-middleware",
+    "field": "responsibilities.__session"
+  }
 }

package/blueprints/security-auth-clerk/contributions/requirements/security-auth-clerk-req-003.json

@@ -2,7 +2,7 @@
   "reqId": "security-auth-clerk-REQ-003",
   "prdId": "PRD-001",
   "title": "Framework-agnostic middleware boundary contract",
-  "description": "The project integrates Clerk on the server through a middleware boundary whose shape is fixed by the blueprint and whose framework is not. The boundary is a function of the form `verify(request) -> { authenticated: boolean, principal?: Principal, reason?: string }` where `Principal` is the reduced shape from REQ-001. Framework-specific adapters (an Express request handler, a Fastify hook, a Node HTTP wrapper, a Cloudflare Workers fetch handler) are project-authored thin wrappers that delegate to the same underlying verifier; the blueprint does not mandate Express and does not mandate any single HTTP framework, only the shape of the boundary. A request that fails verification is denied at the boundary; a request that passes carries the principal onto the request object under a fixed field name (`request.auth`) for downstream handlers to read.",
+  "description": "The project integrates Clerk on the server through a middleware boundary whose shape is fixed by the blueprint and whose framework is not. The boundary signature and its return shape are owned by `TAC-1001-security-auth-clerk-middleware` `responsibilities.verify`; framework-specific adapters (an Express request handler, a Fastify hook, a Node HTTP wrapper, a Cloudflare Workers fetch handler) are project-authored thin wrappers that delegate to the same underlying verifier. The blueprint does not mandate Express and does not mandate any single HTTP framework, only the shape of the boundary. A request that fails verification is denied at the boundary; a request that passes carries the principal onto the request object under a fixed field name (`request.auth`) for downstream handlers to read.",
   "category": "technical",
   "domain": "authentication",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1001-security-auth-clerk-middleware",
+    "field": "responsibilities.verify"
+  }
 }

package/blueprints/security-auth-clerk/contributions/requirements/security-auth-clerk-req-004.json

@@ -2,7 +2,7 @@
   "reqId": "security-auth-clerk-REQ-004",
   "prdId": "PRD-001",
   "title": "Authorisation adapter maps Clerk claims onto project verbs",
-  "description": "The project's authorisation layer does not consume Clerk claim shapes directly. A single Authorisation Adapter module owns the mapping from a verified principal (roles array, organisation ids array, arbitrary claim bag from the Clerk session) onto the set of project-defined verbs the caller is allowed to perform. The adapter's surface is `can(principal, verb, subject?) -> boolean` and `assert(principal, verb, subject?) -> void | throw`. Verbs are project-defined strings (`article.edit`, `admin.dashboard.view`, `billing.invoice.void`); the adapter's mapping table is project-authored and read from a single module the rest of the project imports. No downstream code path checks `principal.roles.includes('admin')` or `principal.organisationIds.includes('X')` directly; every check goes through `can` or `assert`.",
+  "description": "The project's authorisation layer does not consume Clerk claim shapes directly. A single Authorisation Adapter module owns the mapping from a verified principal (roles array, organisation ids array, arbitrary claim bag from the Clerk session) onto the set of project-defined verbs the caller is allowed to perform. The adapter's surface is `can(principal, verb, subject?) -> boolean` and `assert(principal, verb, subject?) -> void | throw`. Verbs are project-defined strings (`article.edit`, `admin.dashboard.view`, `billing.invoice.void`); the adapter's mapping table is project-authored and read from a single module the rest of the project imports. No downstream code path checks `principal.roles.includes('admin')` or `principal.organisationIds.includes('X')` directly; every check goes through `can` or `assert`. The `roles` string array on the reduced Principal is the sole role vocabulary the project reads; the authorisation adapter is the mechanism by which the blueprint contributes the `roleModel` capability into the applied capability set (a consumer that gates on `roleModel` gets project verbs answered by `can(principal, verb)` against the mapping table, never by direct Clerk claim access).",
   "category": "technical",
   "domain": "authorisation",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1002-security-auth-clerk-authorisation-adapter",
+    "field": "responsibilities.mappingTable"
+  }
 }

package/blueprints/security-auth-clerk/contributions/requirements/security-auth-clerk-req-005.json

@@ -2,7 +2,7 @@
   "reqId": "security-auth-clerk-REQ-005",
   "prdId": "PRD-001",
   "title": "Sign-in strategy is a fixed-shape config surface",
-  "description": "Clerk supports multiple sign-in strategies (email link, email code, password, phone code, OAuth via named providers, SAML). The project's Clerk instance is configured to enable one or more of them; the blueprint fixes the SHAPE of that configuration on the project side as a single `signInStrategy` config record (`{ primary: string, alternates: string[] }`) rather than fixing the CHOICE. The values in the record are Clerk's currently-documented strategy identifiers (as printed by the Clerk dashboard or the Clerk SDK's strategy enumeration at the project's build time). The project's sign-in surface reads the config record and does not hard-code any strategy string; changing the enabled strategy set is a config edit and a Clerk-dashboard change, not a codebase change.",
+  "description": "Clerk supports multiple sign-in strategies (email link, email code, password, phone code, OAuth via named providers, SAML). The project's Clerk instance is configured to enable one or more of them; the blueprint fixes the SHAPE of that configuration on the project side as a single `signInStrategy` config record owned by `TAC-1001-security-auth-clerk-middleware.interfaces.config` (the field is the `signInStrategy` record on that interface) rather than fixing the CHOICE. The values in the record are Clerk's currently-documented strategy identifiers (as printed by the Clerk dashboard or the Clerk SDK's strategy enumeration at the project's build time). The project's sign-in surface reads the config record and does not hard-code any strategy string; changing the enabled strategy set is a config edit and a Clerk-dashboard change, not a codebase change. Because Clerk hosts every sign-in, sign-up, and MFA UI surface, the blueprint contributes the `hostedIdentityUi` capability: no project route renders a credential-input form of its own; the project route mounts the Clerk-hosted component or redirects to the Clerk-hosted route named by the `signInStrategy` record.",
   "category": "functional",
   "domain": "authentication",
   "priority": "should",
@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1001-security-auth-clerk-auth-model"
+  }
 }

package/blueprints/security-auth-clerk/contributions/requirements/security-auth-clerk-req-006.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+    "field": "responsibilities.revocation"
+  }
 }

package/blueprints/security-auth-clerk/contributions/requirements/security-auth-clerk-req-007.json

@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1001-security-auth-clerk-auth-model"
+  }
 }

package/blueprints/security-auth-clerk/contributions/requirements/security-auth-clerk-req-008.json

@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1001-security-auth-clerk-auth-model"
+  }
 }

package/blueprints/security-auth-clerk/contributions/requirements/security-auth-clerk-req-009.json

@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1001-security-auth-clerk-auth-model"
+  }
 }

package/blueprints/security-auth-clerk/contributions/requirements/security-auth-clerk-req-010.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "security-auth-clerk-REQ-010",
+  "prdId": "PRD-001",
+  "title": "The caller's active sessions are enumerable, revocable one at a time, and revocable in bulk-except-current",
+  "description": "The blueprint contributes the `sessionInventory` capability through the session verifier: an authenticated caller can list their active Clerk sessions, revoke one non-current session by id, and revoke every active session except the one being used to make the call. Each list row carries `{ sessionId, deviceLabel, lastActive, currentSession }`; the current session is the one whose id matches the caller's active `__session` cookie. Every operation refuses an unauthenticated caller with a stable-coded `SESSION_INVENTORY_UNAUTHENTICATED` error and no side effect. A revoke against an unknown or already-revoked session id refuses with `SESSION_INVENTORY_UNKNOWN_SESSION` and no side effect. Every operation emits one structured audit event carrying operation, session id prefix and wall-clock timestamp; no field carries a cookie value or a full session id. The consumer contract in `application-account-settings` TAC-2604 reads this interface verbatim.",
+  "category": "functional",
+  "domain": "authentication",
+  "priority": "must",
+  "rationale": "The capability declaration on `blueprint.json:capabilities[]` promises consumer blueprints a session-management surface the applying agent can bind against. Without a REQ describing list, revoke-one and revoke-all-except-current, a consumer that gates on `sessionInventory` will render an inventory screen against a contract the provider blueprint never wrote down, and no chain link will fail when the surface returns empty or the revoke is a no-op.",
+  "tags": [
+    "blueprint:security-auth-clerk",
+    "category:10-session-inventory"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+    "field": "interfaces.sessionInventory"
+  }
+}

package/blueprints/security-auth-clerk/contributions/requirements/security-auth-clerk-req-011.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "security-auth-clerk-REQ-011",
+  "prdId": "PRD-001",
+  "title": "Every session verification and every sessionInventory operation produces one structured audit event on an allow-list of fields",
+  "description": "The session verifier emits exactly one structured audit event per verification attempt (success or refusal) and per `sessionInventory` operation. Each event carries fields drawn from a fixed allow-list: `outcome`, `operation`, `reasonClass`, `sessionIdPrefix`, `at`, `principalIdPrefix?`. No event may carry the `__session` cookie value, the full session id, a raw Clerk claim, or a substring of any of the above. The `sessionIdPrefix` field is a substring of length no greater than eight characters. Every event is written to the audit sink synchronously with the verification result; a sink failure logs a `clerk.audit_sink_failed` warning event and never causes the verification to succeed spuriously. The blueprint's data-retention boundary is: audit events survive process restart when the sink is durable, and are treated as retained per the project's wider observability policy; the blueprint does not itself expire them.",
+  "category": "nonFunctional",
+  "domain": "observability",
+  "priority": "must",
+  "rationale": "The audit-surface responsibilities on TAC-1003 (verification events and sessionInventory events) are only observable if a REQ names the allow-list, the prefix boundary, and the sink-failure posture. Without a REQ, a reviewer cannot decide whether an event that carries an unexpected field violates the blueprint's contract.",
+  "tags": [
+    "blueprint:security-auth-clerk",
+    "category:11-audit-surface"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+    "field": "responsibilities.audit"
+  }
+}

package/blueprints/security-auth-clerk/contributions/tacs/tac-1001-security-auth-clerk-middleware.json

@@ -11,7 +11,7 @@
     "Attach `request.auth` on the request object when verification succeeds; do not attach it on failure (AC-9101-2, AC-9102-1).",
     "Refuse requests on failed verification with a status appropriate to the route class (401 for API-shaped, redirect for page-shaped) as declared by the wiring shim; the handler must not be invoked (AC-9103-2, AC-9103-3, AC-9107-1).",
     "Read the `__session` cookie by name from the request; do not accept credentials from any other transport under the blueprint's default (AC-9101-1, AC-9101-3).",
-    "Read the `signInStrategy` config record from the project's config module for any sign-in surface that requires it; hold no hard-coded strategy string (AC-9108-1, AC-9108-2).",
+    "Read the `signInStrategy` config record from the project's config module for any sign-in surface that requires it, and mount the corresponding Clerk-hosted sign-in, sign-up, MFA and account-management surfaces (or redirect to them) as the project's only identity UI so no project route renders a credential-input control of its own; hold no hard-coded strategy string; contributes the `hostedIdentityUi` capability token (AC-9102-3, AC-9108-1, AC-9108-2).",
     "Confine the import of Clerk's server SDK to this module and to the session verifier (TAC-1003); other project code imports the middleware, not the SDK (AC-9102-2)."
   ],
   "internalStructure": "One stateless factory function producing the `verify` closure over an injected session verifier and an injected claims mapper. Framework shims (an `expressMiddleware()` wrapper, a `fastifyPlugin()` wrapper, a `workersHandler()` wrapper) are one-file adapters colocated with this TAC's module directory; each delegates to the same `verify`. The wrapper for a given framework is enabled by the project's boot code choosing one; the blueprint does not mandate the choice.",
@@ -33,10 +33,20 @@
     }
   ],
   "dependencies": [
-    { "name": "Clerk session verifier", "kind": "tac", "tacId": "TAC-1003-security-auth-clerk-session-verifier", "description": "The session-verification surface the middleware delegates cookie verification to." },
-    { "name": "Clerk claims mapper", "kind": "tac", "tacId": "TAC-1004-security-auth-clerk-claims-mapper", "description": "The reduction from raw Clerk claims onto the project's Principal shape." }
+    {
+      "name": "Clerk session verifier",
+      "kind": "tac",
+      "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+      "description": "The session-verification surface the middleware delegates cookie verification to."
+    },
+    {
+      "name": "Clerk claims mapper",
+      "kind": "tac",
+      "tacId": "TAC-1004-security-auth-clerk-claims-mapper",
+      "description": "The reduction from raw Clerk claims onto the project's Principal shape."
+    }
   ],
   "tradeoffs": "Fixing the shape and the boundary while leaving the framework open costs the project one thin shim per HTTP framework it uses. Projects on a single framework carry one shim and pay nothing; projects that host multiple runtimes (an Express main app plus a Workers edge function) carry two shims but share the verifier and the mapper. That is intentional: the seam that absorbs framework variation is the shim, not the middleware.",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/security-auth-clerk/contributions/tacs/tac-1003-security-auth-clerk-session-verifier.json

@@ -11,7 +11,8 @@
     "Reject tampered cookies (signature mismatch, malformed shape, unknown session id) without a cached-hit shortcut; every rejection contributes an audit event carrying the failure class and no cookie value (AC-9101-3).",
     "Honour Clerk-side revocation within the `revocationCheckIntervalMs` window declared by ADR-1005; a session revoked more than `revocationCheckIntervalMs` ago must not verify (AC-9107-2).",
     "Emit an audit event on every verification attempt (success and failure) with fields `{ outcome, reasonClass?, sessionIdPrefix, at }`; no field carries the cookie value, no field carries a full session id, no field carries a raw claim (AC-9101-3).",
-    "Confine the import of Clerk's server SDK to this module and the middleware wiring (TAC-1001); do not export the SDK's internal types across the module boundary (AC-9102-2)."
+    "Confine the import of Clerk's server SDK to this module and the middleware wiring (TAC-1001); do not export the SDK's internal types across the module boundary (AC-9102-2).",
+    "Expose `sessionInventory` for the authenticated caller: `list()` returns the caller's active Clerk sessions each as `{ sessionId, deviceLabel, lastActive, currentSession }`; `revoke(sessionId)` invalidates one non-current session on Clerk's server; `revokeAllExceptCurrent()` invalidates every other active session for the caller. Refuse every call from an unauthenticated caller with a stable-coded `SESSION_INVENTORY_UNAUTHENTICATED` error; refuse a `revoke` of a session already gone with `SESSION_INVENTORY_UNKNOWN_SESSION` without a side effect; every operation emits one structured audit event carrying `{ operation, sessionIdPrefix, at }` with no cookie value and no full session id (AC-9112-1, AC-9112-2, AC-9112-3, AC-9112-4, AC-9112-5)."
   ],
   "internalStructure": "One stateless class over an injected Clerk SDK client and an injected audit sink. The verifier is instantiated once at process boot with the Clerk publishable and secret keys read from the project's secrets manifest under placeholder-named entries (`CLERK_PUBLISHABLE_KEY`, `CLERK_SECRET_KEY`). The revocation check is either the Clerk SDK's native revocation-aware verify (preferred when the SDK exposes it at the project's build time) or a bounded-freshness cache the verifier maintains itself; ADR-1005 documents which shape the default vendor default expects.",
   "interfaces": [
@@ -29,6 +30,11 @@
       "name": "clock",
       "kind": "clock",
       "description": "Injectable clock returning the current instant; used for revocation-window bounding and for the audit event's `at` field."
+    },
+    {
+      "name": "sessionInventory",
+      "kind": "query",
+      "description": "sessionInventory({ callerPrincipal }) -> { list() -> SessionRow[], revoke(sessionId) -> void, revokeAllExceptCurrent() -> number }. SessionRow shape: { sessionId, deviceLabel, lastActive (ISO-8601), currentSession }. The consumer contract in application-account-settings TAC-2604 reads this interface verbatim; do not restate the shape from another blueprint."
     }
   ],
   "dependencies": [],

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9101.json

@@ -16,7 +16,8 @@
       "when": "the browser inspects the cookie jar for the project's top-level domain immediately after the sign-in redirect completes",
       "then": "a cookie named `__session` is present with `HttpOnly`, `Secure`, and `SameSite=Lax` flags set; no other cookie carries the session credential",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-9101-2",
@@ -25,7 +26,8 @@
       "when": "the request is dispatched to the route",
       "then": "the middleware attaches a `request.auth` object carrying `principalId`, `roles`, and `organisationIds`; the route handler observes `request.auth.principalId` as a non-empty string that matches the Clerk-issued user id for the signed-in operator",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-9101-3",
@@ -34,7 +36,8 @@
       "when": "the request reaches the middleware",
       "then": "the middleware treats the request as unauthenticated; no `request.auth` object is attached; the verifier's audit log records one verification-failure event carrying the failure class and no cookie value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [