rcf-lite 0.26.0 → 0.27.0

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11102.json

@@ -16,7 +16,8 @@
       "when": "the process boots and the discovery client runs its boot-time fetch",
       "then": "the record has fields `authorizeUrl`, `tokenUrl`, `userinfoUrl`, `jwksUri`, `introspectionEndpoint`, `endSessionEndpoint`, and `issuer` populated from the discovery response; a `keycloak.realm_healthy` audit event is emitted carrying `realmSlug='r1'`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-11102-2",
@@ -25,7 +26,12 @@
       "when": "the test-injected clock advances 61 seconds and the discovery endpoint is momentarily made to return a 503 for one request",
       "then": "the refresh attempt is observed against the test-injected httpFetch; a `keycloak.discovery_refused` warning-class audit event is emitted; the realm's health stays `healthy` and the previous endpoint record continues to serve; the next successful refresh emits `keycloak.discovery_refreshed`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1201-security-auth-keycloak-discovery-client",
+        "field": "interfaces.httpFetch.name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-11102-3",
@@ -34,7 +40,8 @@
       "when": "the discovery client's boot fetch completes",
       "then": "the process terminates with error code `KEYCLOAK_DISCOVERY_MISSING_ENDPOINT` naming the realmSlug and the missing field `introspection_endpoint`; no listener is left running; the audit log records one `keycloak.discovery_refused` event carrying realmSlug and reason class `missing-endpoint`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11103.json

@@ -16,7 +16,12 @@
       "when": "the verifier is invoked",
       "then": "the verifier consumes the token successfully; no fresh JWKS fetch is observed against the test-injected httpFetch for the duration of this verification; the audit log records no `keycloak.jwks_refreshed` event",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1201-security-auth-keycloak-discovery-client",
+        "field": "interfaces.httpFetch.name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-11103-2",
@@ -25,7 +30,12 @@
       "when": "the verifier is invoked twice in the same test: once with the realm's fresh JWKS available on the injected httpFetch, once with the httpFetch instrumented to return a JWKS still missing the kid",
       "then": "the first invocation triggers one JWKS refresh (observed on the injected httpFetch), succeeds verification, emits `keycloak.jwks_refreshed`; the second invocation triggers one JWKS refresh, refuses the token with `KEYCLOAK_JWT_KID_UNKNOWN`, emits one `keycloak.jwt_refused` event carrying realmSlug and reason class `kid-unknown`; a third invocation with the same second-token does NOT trigger a further JWKS refresh within the TTL window",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1201-security-auth-keycloak-discovery-client",
+        "field": "interfaces.httpFetch.name"
+      },
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11104.json

@@ -16,7 +16,8 @@
       "when": "the verifier is invoked",
       "then": "the response is a 4xx with body error code `KEYCLOAK_JWT_EXPIRED`; no session cookie is set on the response; the audit log records one `keycloak.jwt_refused` event carrying realmSlug and reason class `expired` and no token value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-11104-2",
@@ -25,7 +26,12 @@
       "when": "the verifier is invoked",
       "then": "the verifier observes one JWKS refresh against the injected httpFetch, then refuses the token with `KEYCLOAK_JWT_SIGNATURE_INVALID`; no session cookie is set; the audit log records one `keycloak.jwt_refused` event carrying realmSlug and reason class `signature`; the reason class is `signature`, not `kid-unknown` (the kid appears in JWKS; the signature under that kid does not verify)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1201-security-auth-keycloak-discovery-client",
+        "field": "interfaces.httpFetch.name"
+      },
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11105.json

@@ -16,7 +16,8 @@
       "when": "the introspection client is invoked on the token",
       "then": "the client issues a POST to the record's `introspection_endpoint` with body `token=<opaque-value>`, `Content-Type: application/x-www-form-urlencoded`, and `Authorization: Basic <base64(clientId:clientSecret)>`; the response body is parsed as JSON; the claim record from the response is returned to the caller; the audit log records one `keycloak.introspection_verified` event carrying realmSlug and no token value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-11105-2",
@@ -25,7 +26,8 @@
       "when": "the introspection client is invoked",
       "then": "the response is a 4xx with body error code `KEYCLOAK_INTROSPECTION_INACTIVE`; no session cookie is set; the audit log records one `keycloak.introspection_refused` event carrying realmSlug and reason class `inactive`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-11105-3",
@@ -34,7 +36,8 @@
       "when": "the introspection client is invoked",
       "then": "the response is a 4xx with body error code `KEYCLOAK_INTROSPECTION_ENDPOINT_ERROR` and a `detail` field naming the status class as `5xx`; no session cookie is set; the audit log records one `keycloak.introspection_refused` event carrying realmSlug and reason class `endpoint-error`; the mechanism does not fall back to a permissive posture",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11106.json

@@ -16,7 +16,12 @@
       "when": "a request carrying the marker is dispatched through the mechanism",
       "then": "the verifier resolves against `r2`'s JWKS, not `r1`'s; the reduced Principal's `provider` field equals `'r2'`; the audit log records one `keycloak.route_decided` event carrying `realmSlug='r2'`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1204-security-auth-keycloak-provider-router",
+        "field": "interfaces.routeFn.name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-11106-2",
@@ -25,7 +30,12 @@
       "when": "a request is dispatched",
       "then": "the response is a 4xx with body error code `KEYCLOAK_REALM_UNKNOWN`; no verifier is invoked against any realm; the audit log records one `keycloak.route_decided` event followed by one `keycloak.jwt_refused` (or equivalent) event with reason class `unknown-realm`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1204-security-auth-keycloak-provider-router",
+        "field": "interfaces.routeFn.name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-11106-3",
@@ -34,7 +44,12 @@
       "when": "a request is dispatched through the mechanism",
       "then": "the mechanism returns the sentinel `notThisIssuer` to its caller (the project's own middleware chain); no JWKS fetch, no introspection call, and no session verification is observed; the audit log records one `keycloak.route_decided` event carrying `realmSlug='notThisIssuer'`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1204-security-auth-keycloak-provider-router",
+        "field": "interfaces.routeFn.name"
+      },
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11107.json

@@ -16,7 +16,8 @@
       "when": "the role adapter is invoked on the verified claim record",
       "then": "the resulting reduced Principal's `roles[]` equals `['admin', 'editor']` in insertion order; no other role source is consulted; no `keycloak.roles_refused` event is emitted",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-11107-2",
@@ -25,7 +26,8 @@
       "when": "the role adapter is invoked",
       "then": "the reduced Principal's `roles[]` equals `[]`; no error class is emitted; the audit log records no `keycloak.roles_refused` event; the mechanism does not decide whether an empty roles set is acceptable - that is the project's authoriser above the Principal",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-11107-3",
@@ -34,7 +36,8 @@
       "when": "the role adapter is invoked",
       "then": "the response is a 4xx with body error code `KEYCLOAK_ROLES_MALFORMED`; the reduced Principal is not produced; the audit log records one `keycloak.roles_refused` event carrying realmSlug and reason class `malformed`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11108.json

@@ -16,7 +16,8 @@
       "when": "the next protected-route request triggers the flow controller's refresh path against the local realm",
       "then": "the flow controller issues a POST to the realm's `token_endpoint` with `grant_type=refresh_token` and `refresh_token=rt-old`; the realm returns a 2xx carrying a new `access_token` and a new `refresh_token=rt-new`; the session record now stores `rt-new` and no other refresh-token value; the pre-refresh `rt-old` is not present in the session record or the audit log",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-11108-2",
@@ -25,7 +26,8 @@
       "when": "the flow controller invokes the refresh path",
       "then": "the flow controller invalidates the session handle, clears the associated refresh-token chain, and emits one structured audit event `keycloak.refresh_invalidated` carrying realmSlug and session-handle-hash and no token value; the next protected-route request with the original cookie is refused as unauthenticated",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-11108-3",
@@ -34,7 +36,8 @@
       "when": "the sign-in from US-11101 completes and the access-token expiry passes on the test-injected clock",
       "then": "the session record's refresh-token slot is empty; the flow controller does not attempt a refresh call; the session's own project-lifetime expiry (per the session-bridge, in opaque-handle mode) is the sole grant duration; a protected-route request past the project-lifetime expiry is refused as unauthenticated",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11109.json

@@ -16,7 +16,8 @@
       "when": "the request is dispatched and the resolved `request.auth` object is inspected for keys",
       "then": "the object contains exactly `principalId`, `provider`, `email`, `roles`, `organisationIds`; no `accessToken`, `idToken`, `refreshToken`, or raw-claims field is present; `principalId` is a stable string starting with the realmSlug followed by a colon",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-11109-2",
@@ -25,7 +26,8 @@
       "when": "the request is dispatched",
       "then": "the mechanism verifies the token, populates the reduced Principal, and does not create a session-record entry (the session-record store's `put` port is not invoked); `request.auth` carries only the fields listed in AC-11109-1; no `Set-Cookie` is emitted by the mechanism on this response",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11110.json

@@ -16,7 +16,8 @@
       "when": "the browser dispatches the sign-out request",
       "then": "the response clears the session cookie (`Set-Cookie` with the cookie name, empty value, `Max-Age=0`, `HttpOnly`, `Secure`, `SameSite=Lax`); the session-record store no longer holds a record for the pre-signout session handle; the next protected-route request replaying the pre-signout cookie value is refused as unauthenticated",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-11110-2",
@@ -25,7 +26,8 @@
       "when": "the sign-out route is invoked",
       "then": "the response status is 302; the `Location` header equals the discovered `end_session_endpoint` with the configured `post_logout_redirect_uri` and, when the id_token is available on the session record, the `id_token_hint` query parameter carrying the raw id_token; the session cookie is cleared on the same response; the session record is deleted",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-11110-3",
@@ -34,7 +36,8 @@
       "when": "the discovery client's boot fetch completes",
       "then": "the process terminates with error code `KEYCLOAK_LOGOUT_NOT_DECLARED` naming the realm slug; no listener is left running; the audit log records one `keycloak.discovery_refused` event carrying realmSlug and reason class `logout-endpoint-missing`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11111.json

@@ -16,7 +16,8 @@
       "when": "the process boots and the discovery client runs its boot-time fetch",
       "then": "the process exits with error code `KEYCLOAK_DISCOVERY_UNREACHABLE` naming the realm slug and the fetch-failure class; no listener is bound; the audit log records one `keycloak.discovery_refused` event with reason class `unreachable`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-11111-2",
@@ -25,7 +26,12 @@
       "when": "the process boots and the retry loop runs against the test-injected clock and retryScheduler",
       "then": "the process is bound on its listener; requests routed to the realm through the provider-router refuse with `KEYCLOAK_REALM_UNAVAILABLE` while the realm is unhealthy; the audit log records `keycloak.realm_unhealthy` at boot and `keycloak.realm_healthy` on the fourth attempt's success; the retryScheduler observes exponential backoff bounded by the 30-second cap",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1201-security-auth-keycloak-discovery-client",
+        "field": "interfaces.retryScheduler.name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-11111-3",
@@ -34,7 +40,12 @@
       "when": "the process boots, then a project-authored admin route invokes `discoveryClient.refresh('r1')` after boot",
       "then": "at boot the realm is `unhealthy` and no refresh loop is running; on the admin-route invocation the discovery client fetches, populates the record, marks the realm `healthy`, and emits `keycloak.realm_healthy`; no `keycloak.discovery_refused` events are emitted for this realm during the standby window before the refresh",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1202-security-auth-keycloak-jwt-verifier",
+        "field": "interfaces.discoveryClient.name"
+      },
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11112.json

@@ -16,7 +16,8 @@
       "when": "`rcf audit coverage --strict` reports the coverage state and the runtime-verify runner is invoked",
       "then": "the coverage report lists the AC as covered by a TC whose latest run outcome is `skipped` with reason `KEYCLOAK_LIVE_REALM_UNREACHABLE`; the pipeline exit code is 0; the audit log records one `keycloak.accountbound_skip` event carrying the AC id and the missing-credential class",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-11112-2",
@@ -25,7 +26,8 @@
       "when": "the operator drives a real browser through the sign-in surface at the live realm",
       "then": "the flow completes; a project session cookie is set with the same shape as AC-11101-3; `request.auth.provider` equals the live realm's declared realmSlug; the project-authored TC for this AC records a `pass` outcome",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11113.json

@@ -16,7 +16,8 @@
       "when": "the harness starts the container as part of a runtime-verify session",
       "then": "the container is running within the timeout; a discovery HTTP GET on `<containerBase>/realms/example/.well-known/openid-configuration` returns 200 with a JSON body carrying the standard OIDC endpoints; the placeholder admin credentials never appear in a committed file or in an audit event; the harness's environment file is listed in the project's `.gitignore` shape and the test verifies the file is not tracked by git",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-11113-2",
@@ -25,7 +26,8 @@
       "when": "the seed file is inspected on disk before application",
       "then": "the realm name equals the placeholder value declared in the asset (or a project-chosen renamed placeholder); the client id is the seed's placeholder value; the client secret is not present in the seed file (the harness sets it after client creation and stores it in the operator's environment file); user credentials are placeholders; every leakage grep the project runs (real domain names, real client secrets, real realm ids, real user emails) against the seed file returns zero",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11114.json

@@ -0,0 +1,72 @@
+{
+  "usId": "security-auth-keycloak-US-11114",
+  "prdId": "PRD-001",
+  "reqId": "security-auth-keycloak-REQ-013",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "A signed-in caller reaches password change, reset and recovery through the realm's account console",
+  "asA": "operator signed in through a Keycloak realm who needs to change their password or set up MFA",
+  "iWant": "the project to send me to the realm's hosted account console for every credential operation",
+  "soThat": "password material never leaves the identity source and I do not need a second credential-management surface on the project",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11114-1",
+      "description": "The discovery client resolves the account console URL for each realm on boot and refuses boot when the URL responds non-2xx to an unauthenticated GET.",
+      "given": "a realm-config record whose `accountConsoleUrl` field names a URL that returns 404 to an unauthenticated GET",
+      "when": "the blueprint boots",
+      "then": "boot fails with stable-coded `KEYCLOAK_ACCOUNT_CONSOLE_UNREACHABLE` naming the realm slug; the audit sink records one `keycloak.account_console_refused` event carrying the realm slug and the observed HTTP status class",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1201-security-auth-keycloak-discovery-client",
+        "field": "responsibilities.accountConsoleUrl"
+      }
+    },
+    {
+      "id": "AC-11114-2",
+      "description": "`getCredentialSelfServiceUrl()` returns the resolved account console URL for the caller's realm.",
+      "given": "a caller whose verified session names `realmSlug=alpha` and a boot-verified realm-config for `alpha` whose account console URL is `https://kc.example/realms/alpha/account`",
+      "when": "a project route calls `getCredentialSelfServiceUrl()` for the caller",
+      "then": "the return value is exactly `https://kc.example/realms/alpha/account`; no other URL is returned; the return value carries no query parameters and no fragment appended by the helper",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-11114-3",
+      "description": "No project route renders a credential-change form of its own.",
+      "given": "the applied blueprint at v1.3.0 and a source-tree scan of the project's contributed pages",
+      "when": "a static scan looks for password-input HTML controls (`type=password`) or MFA-enrolment DOM shapes on any project route",
+      "then": "the scan reports zero credential-input controls owned by the project; every credential moment resolves to a link out to the realm's account console via `getCredentialSelfServiceUrl()`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-11114-4",
+      "description": "An account console URL missing the `/account` path segment or pointing at a different origin than the realm's issuer is refused at boot.",
+      "given": "a realm-config record whose `accountConsoleUrl` is `https://other.example/dashboard` (different origin from the discovered issuer)",
+      "when": "the blueprint boots",
+      "then": "boot fails with stable-coded `KEYCLOAK_ACCOUNT_CONSOLE_MALFORMED` naming the realm slug and the origin mismatch",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-11114-5",
+      "description": "A realm without any credential self-service (an entirely federated realm that carries `accountConsoleUrl: null`) is legal at boot; consumers see the capability as absent for that realm.",
+      "given": "a realm-config for `beta` whose `accountConsoleUrl` is `null` and whose realm setting disables the account console",
+      "when": "the blueprint boots and a caller in `beta` invokes `getCredentialSelfServiceUrl()`",
+      "then": "boot succeeds; `getCredentialSelfServiceUrl()` returns `null` for callers in `beta`; the applied capability set for the project reflects `credentialSelfService` as inactive for `beta`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    }
+  ],
+  "tacIds": [
+    "TAC-1201-security-auth-keycloak-discovery-client"
+  ],
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11115.json

@@ -0,0 +1,88 @@
+{
+  "usId": "security-auth-keycloak-US-11115",
+  "prdId": "PRD-001",
+  "reqId": "security-auth-keycloak-REQ-014",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "A signed-in keycloak caller lists their project sessions, revokes one, and revokes all others",
+  "asA": "operator signed in through a Keycloak realm on two browsers",
+  "iWant": "the account surface to show me every active project session, let me terminate one, and let me terminate every one except the current in a single call",
+  "soThat": "I end a forgotten or stolen session without touching the realm's admin surface",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-11115-1",
+      "description": "A `list()` call from an authenticated caller returns one row per active project session, each row shaped per the interface owned by the local `TAC-1204-security-auth-keycloak-provider-router` `responsibilities.sessionInventory`.",
+      "given": "a caller with two active project sessions S1 (current) and S2 in realm `alpha`",
+      "when": "the current browser calls `sessionInventory.list()`",
+      "then": "the return is exactly two rows shaped per the ownerRef interface, one with `currentSession=true` for S1 and one with `currentSession=false` for S2",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1204-security-auth-keycloak-provider-router",
+        "field": "responsibilities.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-11115-2",
+      "description": "`revoke(sessionId)` on a non-current project session invalidates it in the project session store; a replay from the revoked browser is treated as unauthenticated.",
+      "given": "the two-session setup from AC-11115-1",
+      "when": "the current browser calls `sessionInventory.revoke(\"S2\")` and browser B replays its next protected-route request",
+      "then": "the revoke returns successfully; the session store no longer holds a record for S2; browser B's replay is refused as unauthenticated on the next request; the audit sink records exactly one `keycloak.session_inventory_revoked` event carrying the operation, a session id prefix no longer than eight characters, and the wall-clock timestamp",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1204-security-auth-keycloak-provider-router",
+        "field": "responsibilities.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-11115-3",
+      "description": "`revokeAllExceptCurrent()` invalidates every active project session for the caller other than the one making the call.",
+      "given": "a caller with project sessions S1 (current), S2, S3",
+      "when": "the current browser calls `sessionInventory.revokeAllExceptCurrent()`",
+      "then": "the return value is `2`; a subsequent `list()` returns exactly one row for S1 with `currentSession=true`; replays from S2 or S3 are refused as unauthenticated on their next request",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1204-security-auth-keycloak-provider-router",
+        "field": "responsibilities.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-11115-4",
+      "description": "An unauthenticated call to any `sessionInventory` operation refuses with `SESSION_INVENTORY_UNAUTHENTICATED` and no side effect.",
+      "given": "a request with no verified session",
+      "when": "any of the three operations is invoked",
+      "then": "each call throws `SESSION_INVENTORY_UNAUTHENTICATED`; the project session store's records are unchanged; the audit sink records exactly one `keycloak.session_inventory_unauthenticated` event",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1204-security-auth-keycloak-provider-router",
+        "field": "responsibilities.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-11115-5",
+      "description": "`revoke(sessionId)` against a session id the caller does not own, or a session already invalidated, refuses without a side effect.",
+      "given": "an authenticated caller and a `sessionId` naming a session belonging to a different principal or an already-invalidated session",
+      "when": "the caller calls `sessionInventory.revoke(sessionId)`",
+      "then": "the call throws `SESSION_INVENTORY_UNKNOWN_SESSION`; the session store is unchanged; the audit sink records exactly one `keycloak.session_inventory_unknown_session` event",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1204-security-auth-keycloak-provider-router",
+        "field": "responsibilities.sessionInventory"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-1204-security-auth-keycloak-provider-router"
+  ],
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}