rcf-lite 0.26.0 → 0.27.0

package/blueprints/security-auth-magic-link/CHANGELOG.md

@@ -1,9 +1,25 @@
 # security-auth-magic-link CHANGELOG
 
-## 1.2.0 (visual round T-4, spec 2026-09-06 section 5.4.2, doc-only)
+## 1.2.4
+
+- Closure fix pass (F-2, F-3): rewrites the `README.md` shelf-latest line in neutral customer-facing voice with no spec-provenance label; drops the vendor-implementation naming from the guide narrative and describes the reference container-plus-realm shape generically.
+
+## 1.2.3
+
+- Rewrites `REQ-010.description` to reference `TAC-504-security-auth-magic-link-email-delivery-adapter` `responsibilities.send` rather than restate the `{ ok, providerStatus, providerMessageId, error }` return shape verbatim; the literal remains owned by the delivering TAC.
+
+## 1.2.2 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.2.1 (hardening pass, spec 2026-09-09 section 5.4.2)
+
+- Adds `deliveredBy` on every `must` requirement and `disposition: fixed` on every existing acceptance criterion; adds `ownerRef` on ACs that restate the `isRegistered` interface on `TAC-505`. Extends `REQ-003` with the session-lifetime contract (sliding idle window, absolute lifetime, server-side revocation as the only truthful invalidation). Names the `principalDirectory` capability on `REQ-011`, which already carries its runtime clause through the principal-registry contract. hardening pass (criteria a, b, c on the 2026-09-09 programme). No new contributions.
+
+## 1.2.0 (visual round, spec 2026-09-06 section 5.4.2, doc-only)
 
 - No change to `capabilities[]`; the declaration remains `[principalDirectory]`. The bump records the account-settings suppression behaviour: on a bare-magic-link project the security tab, the sessions tab, the notification-preferences tab (unless `application-notifications-in-app` is applied) and the theme tab (unless `application-spa` is applied) are all suppressed by the account-settings blueprint capability discovery, and only the profile surface renders. This is not a regression; magic-link intentionally does NOT self-declare a credential-self-service surface, a session inventory, or a hosted identity UI (the click-a-link flow is the whole surface). Consumers pair magic-link with a session store (or a logging companion) if they want a sessions surface.
 
-## 1.1.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
+## 1.1.0 (visual round, spec 2026-09-04 section 5.5.2, operator Q2 default)
 
-- Declares `capabilities: [principalDirectory]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round T-5 `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.
+- Declares `capabilities: [principalDirectory]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.

package/blueprints/security-auth-magic-link/README.md

@@ -3,7 +3,7 @@
 The third content blueprint on the rcf-build-lite blueprint mechanism (design brief v2, ratified; Phase 4 of the blueprint programme). Scope: passwordless magic-link sign-in with server-issued opaque cookie sessions, single deployable, pluggable email delivery and pluggable principal registry, targeted at small greenfield rcf-lite projects. Composes with the application-spa blueprint (client half) and the application-api-rest blueprint (server half) by design, contributing one deliberate scope:global conflict on `authModel`.
 
 
-> Latest: **v1.2.0 (doc-only)** (visual round T-4, 2026-09-06). `capabilities: [principalDirectory]`. See [CHANGELOG.md](CHANGELOG.md).
+> Latest: **v1.2.4** (2026-09-10). `capabilities: [principalDirectory]`. See [CHANGELOG.md](CHANGELOG.md).
 
 ## Apply
 

package/blueprints/security-auth-magic-link/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "security-auth-magic-link",
-  "version": "1.2.0",
+  "version": "1.2.4",
   "category": "security",
   "capabilities": [
     "principalDirectory"

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-001.json

@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-21T00:00:00Z",
-  "updatedAt": "2026-08-21T00:00:00Z"
+  "updatedAt": "2026-08-21T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-501-security-auth-magic-link-model"
+  }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-002.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-21T00:00:00Z",
-  "updatedAt": "2026-08-21T00:00:00Z"
+  "updatedAt": "2026-08-21T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-501-security-auth-magic-link-manager",
+    "field": "responsibilities.consume"
+  }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-003.json

@@ -2,7 +2,7 @@
   "reqId": "security-auth-magic-link-REQ-003",
   "prdId": "PRD-001",
   "title": "Sessions are server-issued opaque handles, never signed client-readable claims",
-  "description": "A successful token consumption issues a session by writing a server-side record and returning an opaque handle to the client. The handle is base64url of at least 24 bytes of cryptographically random entropy; it carries no identity claim, no scope claim, no signed payload, and no data the client can decode. Identity, scope, and expiry are looked up server-side from the record on every request. No JWT-shaped token, no self-describing bearer, and no client-decodable envelope is issued on any authenticated code path.",
+  "description": "A successful token consumption issues a session by writing a server-side record and returning an opaque handle to the client. The handle is base64url of at least 24 bytes of cryptographically random entropy; it carries no identity claim, no scope claim, no signed payload, and no data the client can decode. Identity, scope, and expiry are looked up server-side from the record on every request. No JWT-shaped token, no self-describing bearer, and no client-decodable envelope is issued on any authenticated code path. The session-lifetime contract is: a sliding idle window bounded by `sessionIdleTimeoutSeconds` (default 3600, refreshed by every validated request without changing the handle value), a fixed absolute lifetime bounded by `sessionAbsoluteLifetimeSeconds` (default 604800, never refreshed once issued), and server-side revocation as the only truthful invalidation (client-side cookie clearing alone never invalidates). A validated request whose stored `issuedAt + sessionAbsoluteLifetimeSeconds` is in the past is refused as unauthenticated even if the sliding window has not elapsed. Defaults are declared on ADR-504 and overridable per project.",
   "category": "security",
   "domain": "authentication",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-21T00:00:00Z",
-  "updatedAt": "2026-08-21T00:00:00Z"
+  "updatedAt": "2026-08-21T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-502-security-auth-magic-link-session-manager",
+    "field": "responsibilities.handle"
+  }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-004.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-21T00:00:00Z",
-  "updatedAt": "2026-08-21T00:00:00Z"
+  "updatedAt": "2026-08-21T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-503-security-auth-magic-link-login-routes",
+    "field": "responsibilities.SameSite"
+  }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-005.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-21T00:00:00Z",
-  "updatedAt": "2026-08-21T00:00:00Z"
+  "updatedAt": "2026-08-21T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-502-security-auth-magic-link-session-manager",
+    "field": "responsibilities.revokeAllForPrincipal"
+  }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-006.json

@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-21T00:00:00Z",
-  "updatedAt": "2026-08-21T00:00:00Z"
+  "updatedAt": "2026-08-21T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-503-security-auth-magic-link-anti-enumeration-budget"
+  }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-007.json

@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-21T00:00:00Z",
-  "updatedAt": "2026-08-21T00:00:00Z"
+  "updatedAt": "2026-08-21T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-505-security-auth-magic-link-rate-limiting"
+  }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-008.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-21T00:00:00Z",
-  "updatedAt": "2026-08-21T00:00:00Z"
+  "updatedAt": "2026-08-21T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-501-security-auth-magic-link-manager",
+    "field": "responsibilities.store"
+  }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-009.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-21T00:00:00Z",
-  "updatedAt": "2026-08-21T00:00:00Z"
+  "updatedAt": "2026-08-21T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-501-security-auth-magic-link-manager",
+    "field": "responsibilities.onEvent"
+  }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-010.json

@@ -2,7 +2,7 @@
   "reqId": "security-auth-magic-link-REQ-010",
   "prdId": "PRD-001",
   "title": "Email delivery is a pluggable adapter behind a fixed contract",
-  "description": "The blueprint owns a narrow email-delivery-adapter interface with a single send({ to, subject, textBody, htmlBody }) method returning a Promise resolving to a normalised outcome ({ ok, providerStatus, providerMessageId, error }). The project supplies the transport (SMTP, Resend, SES, a stub for tests). The magic-link routes call only the adapter interface; provider-specific fields, credentials, and rate-limit semantics never appear in the routes or the managers. Adapter-send failures are recorded on the event log and swallowed for the response body under the anti-enumeration budget.",
+  "description": "The blueprint owns a narrow email-delivery-adapter interface whose sole auth-facing surface and returned outcome shape are owned by `TAC-504-security-auth-magic-link-email-delivery-adapter` `responsibilities.send`. The project supplies the transport (SMTP, Resend, SES, a stub for tests). The magic-link routes call only the adapter interface; provider-specific fields, credentials, and rate-limit semantics never appear in the routes or the managers. Adapter-send failures are recorded on the event log and swallowed for the response body under the anti-enumeration budget.",
   "category": "technical",
   "domain": "authentication",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-21T00:00:00Z",
-  "updatedAt": "2026-08-21T00:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-504-security-auth-magic-link-email-delivery-adapter",
+    "field": "responsibilities.send"
+  }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-011.json

@@ -2,7 +2,7 @@
   "reqId": "security-auth-magic-link-REQ-011",
   "prdId": "PRD-001",
   "title": "Principal registry is pluggable behind a fixed lookup contract",
-  "description": "The blueprint owns a narrow principal-registry interface with a single isRegistered(email) method returning a Promise resolving to a boolean. The project supplies the registry implementation: a single-address constant for solo-operator deployments, a static allow-list file for small teams, or a database lookup for multi-tenant projects. The magic-link routes call only the registry interface and receive nothing from it except the boolean; principal roles, quotas, and identity metadata are project concerns that layer above this contract, not inside it.",
+  "description": "The blueprint owns a narrow principal-registry interface with a single isRegistered(email) method returning a Promise resolving to a boolean. The project supplies the registry implementation: a single-address constant for solo-operator deployments, a static allow-list file for small teams, or a database lookup for multi-tenant projects. The magic-link routes call only the registry interface and receive nothing from it except the boolean; principal roles, quotas, and identity metadata are project concerns that layer above this contract, not inside it. The pluggable registry's boolean answer is what the blueprint contributes as the `principalDirectory` capability: it is the sole surface the project queries to ask \"does this address correspond to a known principal\", and the applied capability set exposes the token so consumer blueprints can bind against it.",
   "category": "technical",
   "domain": "authentication",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-21T00:00:00Z",
-  "updatedAt": "2026-08-21T00:00:00Z"
+  "updatedAt": "2026-08-21T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-505-security-auth-magic-link-principal-registry",
+    "field": "responsibilities.isRegistered"
+  }
 }

package/blueprints/security-auth-magic-link/contributions/user-stories/security-auth-magic-link-us-3101.json

@@ -16,7 +16,8 @@
       "when": "the page renders",
       "then": "the response body contains an input with type='email' and name='email', and no input with type='password' or autocomplete='current-password'",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3101-2",
@@ -25,7 +26,8 @@
       "when": "the POST /login handler runs",
       "then": "the response status is 200 and the body confirms that a link will arrive if the address is registered, without confirming or denying that this address is registered",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3101-3",
@@ -34,7 +36,8 @@
       "when": "the handler completes",
       "then": "the email-delivery-adapter.send call fires exactly once with a body containing a URL whose path is /login/verify and whose only query parameter carries the token",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3101-4",
@@ -43,7 +46,8 @@
       "when": "GET /login/verify runs",
       "then": "the response is a 302 to the configured post-sign-in route and carries a Set-Cookie header issuing a fresh session handle",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3101-5",
@@ -52,7 +56,8 @@
       "when": "the handler runs",
       "then": "the response status is 401, no Set-Cookie is emitted, and the response body reveals nothing about which failure class the token fell into",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-magic-link/contributions/user-stories/security-auth-magic-link-us-3102.json

@@ -16,7 +16,8 @@
       "when": "GET /login/verify is called again with the same token value",
       "then": "the response status is 401 and no Set-Cookie header is emitted",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3102-2",
@@ -25,7 +26,8 @@
       "when": "GET /login/verify is called with that token",
       "then": "the response status is 401 and no Set-Cookie header is emitted",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3102-3",
@@ -34,7 +36,8 @@
       "when": "the manager records the expiry",
       "then": "the recorded expiresAt is fifteen minutes after the mint clock; when a project supplies expiryMs the recorded expiry matches the override",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3102-4",
@@ -43,7 +46,8 @@
       "when": "GET /login/verify is called with T1",
       "then": "the response status is 401 and no Set-Cookie header is emitted",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-magic-link/contributions/user-stories/security-auth-magic-link-us-3103.json

@@ -16,7 +16,8 @@
       "when": "the handles are inspected",
       "then": "every handle is a base64url string decoding to at least 24 bytes, and no two handles in the batch are equal",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3103-2",
@@ -25,7 +26,8 @@
       "when": "the string is inspected",
       "then": "it contains no dot-separated JWT segments, decodes to random bytes, and reveals no substring matching the principal id, expiry timestamp, or scope value stored in the session record",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3103-3",
@@ -34,7 +36,8 @@
       "when": "response headers and body are scanned for JWT-shaped tokens (three dot-separated base64url segments) or Authorization headers with Bearer prefixes",
       "then": "no such artefact is present outside of a Set-Cookie header carrying the opaque session handle",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-magic-link/contributions/user-stories/security-auth-magic-link-us-3104.json

@@ -16,7 +16,8 @@
       "when": "the Set-Cookie header is parsed",
       "then": "the Secure attribute is present",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3104-2",
@@ -25,7 +26,8 @@
       "when": "the Set-Cookie header is parsed",
       "then": "the HttpOnly attribute is present",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3104-3",
@@ -34,7 +36,8 @@
       "when": "the Set-Cookie header is parsed",
       "then": "the SameSite attribute is present with value Lax",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3104-4",
@@ -43,7 +46,8 @@
       "when": "document.cookie is queried by page script",
       "then": "the returned string contains no substring matching the issued session handle",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-magic-link/contributions/user-stories/security-auth-magic-link-us-3105.json

@@ -16,7 +16,8 @@
       "when": "POST /logout runs",
       "then": "the session record for that handle is deleted from the store, and the response carries a Set-Cookie header clearing the session cookie (Max-Age=0 or an expiry in the past)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3105-2",
@@ -25,7 +26,8 @@
       "when": "a subsequent authenticated request is made using S's handle",
       "then": "the server treats the request as unauthenticated (redirects to /login or returns 401 per the surface's convention) and does not resurrect the session",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3105-3",
@@ -34,7 +36,8 @@
       "when": "revokeAllForPrincipal is invoked with that principal id",
       "then": "the store's session count for that principal drops to zero and every previously issued handle for that principal fails validation on the next request",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-magic-link/contributions/user-stories/security-auth-magic-link-us-3106.json

@@ -16,7 +16,8 @@
       "when": "each response body is captured",
       "then": "every captured body is byte-identical",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3106-2",
@@ -25,7 +26,8 @@
       "when": "each response status is captured",
       "then": "every status is 200",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3106-3",
@@ -34,7 +36,8 @@
       "when": "POST /login is exercised with a registered submission and an unregistered submission over 20 samples each",
       "then": "no observed wall-clock is less than N, and the mean absolute difference between the two sample sets is under 25 milliseconds",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-magic-link/contributions/user-stories/security-auth-magic-link-us-3107.json

@@ -16,7 +16,8 @@
       "when": "the ceiling-plus-one request lands",
       "then": "the response status is 429 and Retry-After is present with a positive integer or a valid HTTP-date at or after request time",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3107-2",
@@ -25,7 +26,8 @@
       "when": "the ceiling-plus-one request lands",
       "then": "the response status is 429 and Retry-After is present",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3107-3",
@@ -34,7 +36,8 @@
       "when": "the 429 response bodies are captured",
       "then": "every captured body is byte-identical",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3107-4",
@@ -43,7 +46,8 @@
       "when": "the effective ceiling is inspected",
       "then": "the ceiling is five requests per minute per client key; when the project supplies rateLimit={ max, timeWindow } the effective ceiling matches the override",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-magic-link/contributions/user-stories/security-auth-magic-link-us-3108.json

@@ -16,7 +16,8 @@
       "when": "a subsequent authenticated request is made using S's handle after the restart",
       "then": "the server authenticates the request, exposes the same principal id on the request context, and does not require a fresh sign-in",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3108-2",
@@ -25,7 +26,8 @@
       "when": "GET /login/verify is called with T after the restart",
       "then": "the response is a 302 to the configured post-sign-in route and carries a Set-Cookie header issuing a fresh session handle",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3108-3",
@@ -34,7 +36,8 @@
       "when": "a subsequent request is made using S's handle after the restart",
       "then": "the server applies the same idle-expiry rule it would have applied with no restart, using the last-seen timestamp recorded before the stop",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-magic-link/contributions/user-stories/security-auth-magic-link-us-3109.json

@@ -16,7 +16,8 @@
       "when": "the log stream is captured",
       "then": "each event class emits exactly one entry per occurrence, with the named minimum fields present and typed as declared",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3109-2",
@@ -25,7 +26,8 @@
       "when": "every emitted entry is scanned",
       "then": "no field contains a substring matching any minted token, any issued session handle, or any configured adapter credential",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3109-3",
@@ -34,7 +36,8 @@
       "when": "the entry is inspected",
       "then": "providerMessageId is present with a non-empty string or the literal 'none', and the recipient email appears only in the principalId field",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-magic-link/contributions/user-stories/security-auth-magic-link-us-3110.json

@@ -16,7 +16,8 @@
       "when": "the outgoing calls to the adapter interface are enumerated",
       "then": "only the declared send method is invoked, with only the declared arguments, and the returned outcome is consumed only via the declared fields",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3110-2",
@@ -25,7 +26,8 @@
       "when": "the response and log stream are captured",
       "then": "the response body and status match a successful send exactly, and exactly one adapterSendFailed entry is emitted with the error string in the outcome field",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3110-3",
@@ -34,7 +36,8 @@
       "when": "POST /login runs against a registered principal",
       "then": "the stub's send is invoked with the declared arguments and its in-memory record contains one call with those arguments",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-magic-link/contributions/user-stories/security-auth-magic-link-us-3111.json

@@ -16,7 +16,12 @@
       "when": "the outgoing calls to the registry interface are enumerated",
       "then": "only isRegistered is invoked, with only the submitted email string, and only the resolved boolean is consumed",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-505-security-auth-magic-link-principal-registry",
+        "field": "interfaces.isRegistered.name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-3111-2",
@@ -25,7 +30,8 @@
       "when": "the two responses are compared",
       "then": "the response bodies are byte-identical, the statuses are equal, and the Content-Type headers are equal",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-3111-3",
@@ -34,7 +40,12 @@
       "when": "isRegistered is called with the configured email, a different email, an empty string, and a malformed value in turn",
       "then": "the resolved boolean is true only for the configured email and false for every other case",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-505-security-auth-magic-link-principal-registry",
+        "field": "interfaces.isRegistered.name"
+      },
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-magic-link/guide/security-auth-magic-link.md

@@ -37,7 +37,7 @@ Do not reach for the security-auth-magic-link blueprint when:
 - The operator population is large enough that magic-link email delivery volume is a first-order operational concern (thousands of sign-ins per hour). At that volume the mint endpoint's rate limits become an operator experience problem, and a session-lived credential (bearer, refresh token) is the more defensible shape.
 - Email delivery cannot be trusted (isolated network, no outbound SMTP, delivery SLA in tens of minutes). The magic-link flow's usability floor is 'the operator sees the link within one minute'; below that floor the flow is worse than a password.
 
-The design brief `w-2026-07-28-029` originally scoped a `keycloak-local` blueprint against WESPA's implementation. The security-auth-magic-link blueprint at v1.0.0 does not include keycloak-local because the container-plus-realm cost is disproportionate for the rcf-lite tier this blueprint targets. The keycloak-local pattern is the natural body of a future `auth-oidc` blueprint aimed at bigger projects; the two blueprints are meant to co-reside in the ecosystem, not to compete, and both would deliberately conflict on `authModel` so the operator picks one per project.
+An earlier design brief originally scoped a `keycloak-local` blueprint against a reference realm-plus-container implementation. The security-auth-magic-link blueprint at v1.0.0 does not include keycloak-local because the container-plus-realm cost is disproportionate for the rcf-lite tier this blueprint targets. The keycloak-local pattern is the natural body of a future `auth-oidc` blueprint aimed at bigger projects; the two blueprints are meant to co-reside in the ecosystem, not to compete, and both would deliberately conflict on `authModel` so the operator picks one per project.
 
 ## What a good outcome looks like