rcf-lite 0.26.0 → 0.27.0

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9102.json

@@ -16,7 +16,8 @@
       "when": "a handler reads `request.auth`",
       "then": "the observed object's own-property keys are the set `{principalId, roles, organisationIds, claims}` with no additional own properties; `principalId` is a non-empty string; `roles` and `organisationIds` are arrays of strings; `claims` is an object carrying the raw Clerk claim bag for the escape-hatch case",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-9102-2",
@@ -25,7 +26,22 @@
       "when": "a scan enumerates every import of `@clerk/*` or the Clerk server SDK equivalent",
       "then": "every match resolves to a file inside the middleware module directory or the session verifier module directory; no other project file imports Clerk directly",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-9102-3",
+      "description": "A source-tree scan finds no project-owned credential-input control (a `type=password` HTML input, an MFA-enrolment DOM shape, a sign-up form owned by the project) on any project route; every sign-in, sign-up, MFA, and account-management moment either mounts a Clerk-hosted component or redirects to a Clerk-hosted route resolved from the `signInStrategy` config record.",
+      "given": "the project source tree after the blueprint's TACs are realised and a project route inventory",
+      "when": "a static scan enumerates every project route and every DOM shape those routes render",
+      "then": "zero credential-input controls are found on project-owned pages; every identity-facing route resolves to a Clerk-hosted mount or a redirect whose target is a Clerk-hosted route; the applied capability set records `hostedIdentityUi` as active for the project",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1001-security-auth-clerk-middleware",
+        "field": "responsibilities.signInStrategy"
+      }
     }
   ],
   "tacIds": [
@@ -34,5 +50,5 @@
     "TAC-1004-security-auth-clerk-claims-mapper"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9103.json

@@ -16,7 +16,8 @@
       "when": "an authenticated request from a signed-in Clerk-development-instance user reaches the route",
       "then": "the middleware runs the handler; the response status is the handler's declared success status (200 for a GET); the response body is what the handler returns",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-9103-2",
@@ -25,7 +26,8 @@
       "when": "a request without a `__session` cookie reaches the route",
       "then": "the response status is 401 (for an API-shaped route) or a 302 redirect to the sign-in surface (for a page-shaped route); the handler is never invoked; the response body carries no principal or session information",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-9103-3",
@@ -34,7 +36,8 @@
       "when": "the request reaches a protected route",
       "then": "the middleware refuses with the same status and shape as AC-9103-2; the handler is never invoked",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9104.json

@@ -16,7 +16,8 @@
       "when": "the handler calls `can(principal, 'article.edit')`",
       "then": "the call returns `true`; a second call `can(principal, 'billing.invoice.void')` (a verb not granted to `editor`) returns `false`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-9104-2",
@@ -25,7 +26,8 @@
       "when": "the handler calls `assert(principal, 'article.edit')` and then `assert(principal, 'billing.invoice.void')`",
       "then": "the first call returns without throwing; the second call throws an `AUTHZ_FORBIDDEN` error whose message contains the string `billing.invoice.void` and whose serialised form contains no role name, no organisation id, and no Clerk claim key or value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-9104-3",
@@ -34,7 +36,8 @@
       "when": "a scan enumerates every reference to `.roles`, `.organisationIds`, or `.claims` on an object whose type resolves to the project's `Principal` shape",
       "then": "every match sits inside the authorisation adapter module (TAC-1002) or the claims-mapper module (TAC-1004); no handler file reads a claim directly",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9105.json

@@ -16,7 +16,8 @@
       "when": "the handler calls `can(principal, 'document.read', { organisationId: 'org-A' })` and then `can(principal, 'document.read', { organisationId: 'org-B' })`",
       "then": "the first call returns `true`; the second call returns `false`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-9105-2",
@@ -25,7 +26,8 @@
       "when": "the handler calls `can(principal, 'document.read', {})` and `can(principal, 'document.read')`",
       "then": "both calls return `true`; no organisation membership check is performed",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9106.json

@@ -16,7 +16,8 @@
       "when": "a page-render probe fetches the page as the signed-in operator and inspects the rendered DOM",
       "then": "the DOM contains the slot's rendered element; a subsequent render as a signed-in operator whose principal returns `false` for the same verb produces a DOM in which the slot is absent (no hidden node, no disabled control, no aria-hidden variant)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-9106-2",
@@ -25,7 +26,8 @@
       "when": "a request bypassing the UI (direct API call) attempts the verb's underlying action",
       "then": "the server-side handler's `assert(principal, 'article.delete')` throws `AUTHZ_FORBIDDEN`; the response status is 403 and no state mutation occurs",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9107.json

@@ -16,7 +16,8 @@
       "when": "a subsequent request replays the same `__session` cookie against a protected route",
       "then": "the middleware treats the request as unauthenticated; the response status is 401 (API) or a redirect (page); the handler is never invoked",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-9107-2",
@@ -25,7 +26,8 @@
       "when": "a request replays that cookie against a protected route",
       "then": "the middleware refuses per AC-9107-1; no cache the middleware or session verifier holds keeps the revoked session alive beyond one revocation-propagation cycle (the verifier's `revocationCheckIntervalMs`, documented in ADR-1005; the value is bounded and stated)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9108.json

@@ -11,12 +11,21 @@
   "acceptanceCriteria": [
     {
       "id": "AC-9108-1",
-      "description": "The project exposes a single `signInStrategy` config record whose shape is `{ primary: string, alternates: string[] }` and whose values are Clerk's currently-documented strategy identifiers.",
+      "description": "The project exposes a single `signInStrategy` config record whose shape is owned by `TAC-1001-security-auth-clerk-middleware.interfaces.config` (the `signInStrategy` record on that interface); asserted here as an oracle: shape `{ primary: string, alternates: string[] }`, values are Clerk's currently-documented strategy identifiers.",
       "given": "the project's configuration surface at boot",
       "when": "the sign-in surface reads its strategy configuration",
       "then": "the surface reads exactly one `signInStrategy` config record; the record's own-property keys are exactly `{primary, alternates}`; `primary` is a non-empty string; `alternates` is an array of strings",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://clerk.com/docs/guides/configure/auth-strategies/sign-up-sign-in-options",
+        "verifiedOn": "2026-09-10"
+      },
+      "ownerRef": {
+        "tacId": "TAC-1001-security-auth-clerk-middleware",
+        "field": "interfaces.config.signInStrategy"
+      }
     },
     {
       "id": "AC-9108-2",
@@ -25,7 +34,8 @@
       "when": "a scan enumerates literal string matches for the strategy identifiers known to Clerk's strategy enumeration at build time",
       "then": "every match resolves to the single config module or to test fixtures; no sign-in surface, no middleware, no handler carries a hard-coded strategy string",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9109.json

@@ -16,7 +16,8 @@
       "when": "a source-tree scan enumerates rate-limit middleware, throttle wrappers, or enumeration-defence checks bound to the sign-in surface",
       "then": "the scan returns zero matches on the sign-in surface; the same scan on other surfaces (a public API, a webhook receiver) is unaffected by this AC",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-9109-2",
@@ -25,7 +26,12 @@
       "when": "the burst is dispatched and the responses are collected",
       "then": "the observed refusal shape (status code, response body error identifier, retry-after header if any) matches Clerk's documented rate-limit response for the strategy; no project-authored refusal shape appears in the burst",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://clerk.com/docs/guides/how-clerk-works/system-limits",
+        "verifiedOn": "2026-09-10"
+      }
     }
   ],
   "tacIds": [

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9110.json

@@ -16,7 +16,8 @@
       "when": "a scan enumerates every call to Clerk's Backend API mutation endpoints",
       "then": "every match resolves to a file under a directory conventionally named `scripts/provisioning/` (or the project's declared equivalent); no match resolves to a request handler, a middleware, or a runtime module served by the project's HTTP surface",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-9110-2",
@@ -25,7 +26,8 @@
       "when": "a scan enumerates every Clerk SDK call the two modules make",
       "then": "every match resolves to a read-shaped operation (session verification, organisation membership lookup); no match resolves to a Clerk mutation endpoint",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9111.json

@@ -16,7 +16,8 @@
       "when": "the harness enumerates test cases and their bound ACs",
       "then": "every TC bound to one of the enumerated ACs above has the `accountBound` marker set; TCs bound to other ACs (source-tree scans, in-process principal-shape assertions, adapter unit-shaped checks) do not carry the marker",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-9111-2",
@@ -25,7 +26,8 @@
       "when": "the run enumerates accountBound TCs",
       "then": "every accountBound TC records outcome `skipped` with reason field equal to `AUTH_CLERK_UNREACHABLE`; the ship gate report flags the skipped set; the run's overall status reflects the skip rather than a pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9112.json

@@ -0,0 +1,102 @@
+{
+  "usId": "security-auth-clerk-US-9112",
+  "prdId": "PRD-001",
+  "reqId": "security-auth-clerk-REQ-010",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "A signed-in caller lists their sessions, revokes one, and revokes all others in one call",
+  "asA": "operator signed in through the project's Clerk-hosted sign-in surface on two browsers at once",
+  "iWant": "the account-settings surface to show me every active session, let me terminate any one of them, and let me terminate every one except the current in one action",
+  "soThat": "I can end a stolen or forgotten session from wherever I am currently signed in, and I do not have to sign in on every device again to clean the list",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9112-1",
+      "description": "A `list()` call from an authenticated caller returns one row per active project session, each row shaped per `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` `SessionRow`.",
+      "given": "a caller signed in on two browsers, browser A holding the active `__session` cookie for session S1 and browser B for session S2",
+      "when": "browser A calls the session verifier's `sessionInventory.list()` interface",
+      "then": "the return value is an array of exactly two rows, one with `sessionId=S1` and `currentSession=true`, one with `sessionId=S2` and `currentSession=false`; each row carries a non-empty `deviceLabel` string and a `lastActive` ISO-8601 timestamp not in the future",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-9112-2",
+      "description": "`revoke(sessionId)` on a non-current session invalidates that session on Clerk's server; a subsequent request from the revoked browser fails verification.",
+      "given": "the two-browser setup from AC-9112-1 and the returned `sessionId=S2` row for browser B",
+      "when": "browser A calls `sessionInventory.revoke(\"S2\")` and then browser B replays a protected-route request carrying its `__session` cookie",
+      "then": "the revoke call returns successfully with no error; browser B's next request is treated as unauthenticated by the middleware within the `revocationCheckIntervalMs` window declared by ADR-1005; the audit sink records one `session_inventory.revoked` event carrying operation, a prefix of the session id, and a wall-clock timestamp, and no field carries the full session id or a cookie value",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-9112-3",
+      "description": "`revokeAllExceptCurrent()` invalidates every active session for the caller other than the one making the call; the caller's own session survives.",
+      "given": "a caller with three active sessions S1 (current), S2, S3",
+      "when": "the caller's browser calls `sessionInventory.revokeAllExceptCurrent()`",
+      "then": "the return value is `2`; a subsequent `list()` from the same browser returns exactly one row for S1 with `currentSession=true`; a replay from S2 or S3 is treated as unauthenticated within the ADR-1005 window",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-9112-4",
+      "description": "An unauthenticated call to any `sessionInventory` operation refuses with `SESSION_INVENTORY_UNAUTHENTICATED` and no side effect.",
+      "given": "a request with no `__session` cookie or a cookie that fails verification",
+      "when": "the caller invokes `sessionInventory.list()`, `sessionInventory.revoke(anySessionId)`, or `sessionInventory.revokeAllExceptCurrent()`",
+      "then": "each call throws `SESSION_INVENTORY_UNAUTHENTICATED`; no Clerk-side state changes for any active session; the audit sink records one `session_inventory.unauthenticated` event and no other",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-9112-5",
+      "description": "`revoke(sessionId)` against a session id the caller does not own, or a session already invalidated, refuses without a side effect.",
+      "given": "an authenticated caller and a `sessionId` value that either belongs to a different principal or names a session that Clerk already revoked",
+      "when": "the caller invokes `sessionInventory.revoke(sessionId)`",
+      "then": "the call throws `SESSION_INVENTORY_UNKNOWN_SESSION` naming the operation class and a prefix of the session id; no Clerk-side session state changes; the audit sink records one `session_inventory.unknown_session` event carrying operation, session id prefix and wall-clock timestamp",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-9112-6",
+      "description": "Every `sessionInventory` operation emits exactly one structured audit event that carries no cookie value and no full session id.",
+      "given": "an authenticated caller making one call each of `list`, `revoke(sessionId)`, and `revokeAllExceptCurrent`",
+      "when": "the three calls run in sequence",
+      "then": "the audit sink records exactly three events, one per call, each carrying `{ operation, sessionIdPrefix, at }`; no event's payload contains the `__session` cookie value, a full session id, or a raw Clerk claim; the `sessionIdPrefix` field is a substring of length no greater than eight characters",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-1003-security-auth-clerk-session-verifier"
+  ],
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9113.json

@@ -0,0 +1,103 @@
+{
+  "usId": "security-auth-clerk-US-9113",
+  "prdId": "PRD-001",
+  "reqId": "security-auth-clerk-REQ-011",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Session verification and sessionInventory operations each emit one structured audit event on the fixed allow-list",
+  "asA": "operator running the runtime-verify suite against the Clerk session verifier and its sessionInventory surface",
+  "iWant": "every verification attempt and every sessionInventory operation to write one structured event carrying only the allow-list fields",
+  "soThat": "the audit stream stays free of cookie material and every refusal has a stable reasonClass a reviewer can gate on",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9113-1",
+      "description": "A completed session verification emits exactly one structured audit event identified by the tuple (`operation=verify`, `outcome=verified`), carrying a session id prefix no longer than eight characters.",
+      "given": "an authenticated request carrying a valid `__session` cookie for a Clerk session S1",
+      "when": "the session verifier verifies the cookie value",
+      "then": "the audit sink records exactly one event whose own-property keys are drawn from `{outcome, operation, reasonClass, sessionIdPrefix, at, principalIdPrefix}` with `outcome=verified` and `operation=verify`; the `__session` cookie value, the full session id, and any raw Clerk claim record are not present in any field; `sessionIdPrefix` is a substring of length no greater than eight characters",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "responsibilities.audit"
+      }
+    },
+    {
+      "id": "AC-9113-2",
+      "description": "A session verification against a `__session` cookie whose Clerk-side expiry has passed emits exactly one audit event identified by the tuple (`operation=verify`, `outcome=refused`) with `reasonClass=expired`; the reasonClass is the single value bound to that input, not one of a set.",
+      "given": "a request carrying a `__session` cookie whose Clerk-side expiry has passed",
+      "when": "the session verifier verifies the cookie value",
+      "then": "the audit sink records exactly one event with `outcome=refused`, `operation=verify`, and `reasonClass=expired`; the event carries `sessionIdPrefix` (no longer than eight characters) and `at`; no cookie value or full session id appears in any field",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "responsibilities.audit"
+      }
+    },
+    {
+      "id": "AC-9113-3",
+      "description": "A sessionInventory operation that first refuses on `unknown_session` and then succeeds on a subsequent call for a valid session id emits exactly one refused event and one verified event, in order; the retry itself is not a distinct event.",
+      "given": "an authenticated caller who first calls `sessionInventory.revoke(unknownSessionId)` and then calls `sessionInventory.revoke(validSessionId)`",
+      "when": "the two calls run in sequence",
+      "then": "the audit sink records exactly two events in order: one with `operation=revoke`, `outcome=refused`, and `reasonClass=unknown_session`, then one with `operation=revoke` and `outcome=verified`; each event carries a `sessionIdPrefix` no longer than eight characters; no full session id or cookie value appears",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "responsibilities.audit"
+      }
+    },
+    {
+      "id": "AC-9113-4",
+      "description": "A sink failure during the emission of a verification audit event does not mask the underlying verification outcome; the mechanism records a `clerk.audit_sink_failed` warning event and the verification outcome is unchanged.",
+      "given": "a valid `__session` cookie and an audit sink whose write throws",
+      "when": "the session verifier emits the completion event",
+      "then": "the verification return value still reports the underlying result unchanged (a verified session does not spuriously become unauthenticated, and a refusal does not spuriously become authenticated); the mechanism records a `clerk.audit_sink_failed` warning event carrying `operation` and a reason-class string; no cookie value or full session id appears",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "responsibilities.audit"
+      }
+    },
+    {
+      "id": "AC-9113-5",
+      "description": "An unauthenticated caller invoking a `sessionInventory.revoke(sessionId)` is refused: the audit sink records exactly one event identified by the tuple (`operation=revoke`, `outcome=refused`) with `reasonClass=unauthenticated`; no session state changes on the provider.",
+      "given": "a request with no verified session",
+      "when": "any `sessionInventory.revoke(sessionId)` is invoked",
+      "then": "the audit sink records exactly one event with `outcome=refused`, `operation=revoke`, and `reasonClass=unauthenticated`; the event carries `at`; no session is created, updated or removed on the provider; no cookie value or full session id appears in any field",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "responsibilities.audit"
+      }
+    },
+    {
+      "id": "AC-9113-6",
+      "description": "Verifying the same valid `__session` cookie twice is idempotent: each verify call emits exactly one audit event identified by the tuple (`operation=verify`, `outcome=verified`); two consecutive verifications produce two events (count is one per verify call, never a deduplicated event).",
+      "given": "a request carrying a valid `__session` cookie for a Clerk session S1, verified once already",
+      "when": "the session verifier verifies the same cookie value a second time",
+      "then": "the audit sink records exactly one additional event with `operation=verify` and `outcome=verified`; the total count of verify events across the two attempts is exactly two; each event's `sessionIdPrefix` is a substring of length no greater than eight characters; the verifier's return value is unchanged between calls",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "responsibilities.audit"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-1003-security-auth-clerk-session-verifier"
+  ],
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z",
+  "description": "Applying agent sets: no project-parameterised values on this story; every AC is `fixed`. AC-set sufficiency (7a inline note per blueprint-authoring.md §7a): the credential scenario class is bound by AC-1 (a valid `__session` cookie is the credential and the event records a bounded `sessionIdPrefix`). The permission scenario class is bound by AC-5 (an unauthenticated caller's `sessionInventory.revoke` refuses with `reasonClass=unauthenticated` and no side effect). Events are named by the tuple (`operation`, `outcome`) per REQ-011's allow-list; the blueprint does not carry a top-level `family` field on clerk audit events."
+}

package/blueprints/security-auth-keycloak/CHANGELOG.md

@@ -1,9 +1,28 @@
 # security-auth-keycloak CHANGELOG
 
-## 1.2.0 (visual round T-4, spec 2026-09-06 section 5.4.2, Baz Q2 default)
+## 1.4.1
 
-- Declares `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory]` on `blueprint.json`. Additive per section 6 of `blueprint-authoring.md`. Consumed at apply time by the visual round T-4 `application-account-settings` blueprint to gate the security surface self-service branch (probe pack check `AC-25105-1`) and the sessions surface (`AC-25106-1`). Keycloak ships a credential self-service surface (password change, MFA management, email change) that a project can bring in-place and it exposes an active-session inventory a terminate action can act on. Keycloak does NOT declare `hostedIdentityUi` because its hosted-UI is realm-scoped and Keycloak deployments typically brand it in place, so the account-settings blueprint does not treat Keycloak as a hosted-UI provider.
+- Closure fix pass (F-8): rewrites the `README.md` shelf-latest line in neutral customer-facing voice with no spec-provenance label.
 
-## 1.1.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
+## 1.4.0
 
-- Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round T-5 `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.
+- Adds `US-11116`, `US-11117`, `US-11118`, `US-11119`, `US-11120` binding stories to the five audit-surface must requirements `REQ-015` (discovery and account-console), `REQ-016` (JWT), `REQ-017` (introspection), `REQ-018` (route and sessionInventory), and `REQ-019` (roles). Each story ships one AC per success, refusal, retry and boundary path on the delivering mechanism, with `ownerRef` at the owning TAC and its audit-emission responsibility. Rewrites `US-11115` `AC-1` to reference the local `TAC-1204-security-auth-keycloak-provider-router` `responsibilities.sessionInventory` and updates the sibling ACs to the same local owner (the interface shape remains owned by `TAC-1003-security-auth-clerk-session-verifier` `interfaces.sessionInventory` and is referenced by that owner id). Rewrites `REQ-005.description` to reference `TAC-1204-security-auth-keycloak-provider-router` `responsibilities.route` rather than restate the `{ realmSlug, verificationMode }` shape verbatim.
+- Closure fixes on the audit stories: extends `TAC-1201` with a named `discoveryAudit` responsibility and repoints `REQ-015.deliveredBy` and every `US-11116` `ownerRef` at it; tightens the refusal oracles on `AC-11116-2`, `AC-11117-2`, and `AC-11118-2` from a category or example to a specific input-to-reasonClass binding; adds an idempotency AC to `US-11116`, `US-11117`, `US-11118`, `US-11119`, `US-11120` naming the event count per repeat call; adds `AC-11118-5` (non-2xx `upstream_error` path), `AC-11119-5` (revoke-one), `AC-11119-6` (revoke-all-except-current) so every named `REQ-018` interaction is independently bound; adds a 7a inline note in each audit story's `description` documenting the credential and permission scenario-class mapping (bound to an AC, or not applicable with the reason).
+- Second closure fix pass: adds explicit credential and permission acceptance criteria on every audit-event story where they were previously carried as prose only. Adds `AC-11116-6` (credential: realm-config `realmSlug` is the credential the discovery fetch is bound to and the event records the realm principal in the `realmSlug` payload field) and `AC-11116-7` (permission: `accountConsoleUrl` origin that differs from the discovered issuer origin is refused with `reasonClass=account_console_malformed`). Adds `AC-11117-6` (permission: `audience_mismatch` binds the audience-scope refusal) and `AC-11117-7` (issuer_mismatch), so every `REQ-016` named refusal reason is bound to a concrete AC. Tightens `AC-11118-3` to name `reasonClass=upstream_error` as the concrete 503-retry oracle and adds `AC-11118-7` (permission: an upstream `401 Unauthorized` on the client credentials is refused with `reasonClass=client_forbidden`). Adds `AC-11120-6` (permission: an absent role-claim path is refused with `reasonClass=roles_absent`). Updates each story's `description` 7a inline note to reference the new ACs and removes every "not applicable" clause the ACs replace.
+
+## 1.3.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.3.0 (hardening pass, spec 2026-09-09 section 5.4.2)
+
+- Adds `REQ-013`/`US-11114` (credentialSelfService: realm-config `accountConsoleUrl`, boot-time verification, `getCredentialSelfServiceUrl` helper), `REQ-014`/`US-11115` (sessionInventory: list, revoke-one, revoke-all-except-current, unauthenticated refusal, unknown-session refusal), and `REQ-015` (cross-cutting audit surface with a fixed field allow-list, token exclusion, and sink-failure posture). Adds a composition clause on `REQ-001` naming `security-auth-oauth2` as the required flow-controller and session-bridge owner. Extends `TAC-1201` with the account-console verification responsibility and `TAC-1204` with the sessionInventory responsibility. Adds `elicits[]` for `bootPosture` (strict/deferred/standby) and `verificationMode` (jwks/introspection) already described in prose. Adds `deliveredBy` on every `must` requirement and `disposition` on every existing acceptance criterion; adds `ownerRef` on ACs that observe interfaces owned by other TACs. Names the `principalDirectory` and `roleModel` capabilities on the requirements that carry their runtime clauses. hardening pass (criteria a, b, c on the 2026-09-09 programme).
+- Review fix pass (PR #188 findings): moves the composition requirement from a REQ-level `requiresAppliedCapabilities` array (a level the apply gate never reads) to a `blueprint.json:requiresAppliedCapabilities` gate on `authorisationCodeFlow` with override `--allow-no-auth-yet` and stable id `security-auth-keycloak-flow-required`; `REQ-001` now points at that manifest gate. Narrows `REQ-015` to the discovery-client and account-console audit families (TAC-1201) and adds four must REQs (`REQ-016` JWT, `REQ-017` introspection, `REQ-018` route + sessionInventory, `REQ-019` roles), each with its own `deliveredBy` and a companion audit responsibility line on the target TAC. Rewrites `US-11115` `AC-1` to reference the `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` `SessionRow` shape rather than restating its fields.
+
+## 1.2.0 (visual round, spec 2026-09-06 section 5.4.2, operator Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory]` on `blueprint.json`. Additive per section 6 of `blueprint-authoring.md`. Consumed at apply time by the visual round `application-account-settings` blueprint to gate the security surface self-service branch (probe pack check `AC-25105-1`) and the sessions surface (`AC-25106-1`). Keycloak ships a credential self-service surface (password change, MFA management, email change) that a project can bring in-place and it exposes an active-session inventory a terminate action can act on. Keycloak does NOT declare `hostedIdentityUi` because its hosted-UI is realm-scoped and Keycloak deployments typically brand it in place, so the account-settings blueprint does not treat Keycloak as a hosted-UI provider.
+
+## 1.1.0 (visual round, spec 2026-09-04 section 5.5.2, operator Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.

package/blueprints/security-auth-keycloak/README.md

@@ -3,7 +3,7 @@
 The twelfth content blueprint on the rcf-build-lite blueprint mechanism, category `security`. A Keycloak-committed sibling to `security-auth-magic-link`, `security-auth-clerk`, and `security-auth-oauth2` on the `authModel` global topic. Identity is delegated to a Keycloak realm the operator runs; the project owns the discovery client, the token verifier (JWKS or introspection per realm), the role adapter, the provider-routing seam, and the optional application session on top. Targeted at rcf-lite projects that have committed to a self-hosted Keycloak realm (or are running one already) and want the Keycloak-shaped decisions the vendor-neutral `security-auth-oauth2` sibling deliberately does not fix.
 
 
-> Latest: **v1.2.0** (visual round T-4, 2026-09-06). `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory]`. See [CHANGELOG.md](CHANGELOG.md).
+> Latest: **v1.4.1** (2026-09-10). `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory]`. See [CHANGELOG.md](CHANGELOG.md).
 
 ## Apply