rcf-lite 0.26.0 → 0.27.0

package/blueprints/security-auth-oauth2/CHANGELOG.md

@@ -1,9 +1,26 @@
 # security-auth-oauth2 CHANGELOG
 
-## 1.2.0 (visual round T-4, spec 2026-09-06 section 5.4.2, Baz Q2 default)
+## 1.3.3
 
-- Declares `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory, hostedIdentityUi]` on `blueprint.json`. Additive per section 6 of `blueprint-authoring.md`. Consumed at apply time by the visual round T-4 `application-account-settings` blueprint to gate the security surface across both self-service and hosted-link-out branches (`AC-25105-1`) and the sessions surface (`AC-25106-1`). The three added capabilities are provider-conditional per spec section 5.4.2 vendor variation note: an OAuth2 provider (Auth0, Cognito, Azure AD, Okta) that ships a hosted account portal supplies `hostedIdentityUi`; a provider that exposes an account-management endpoint supplies `credentialSelfService`; a provider that exposes a session inventory endpoint supplies `sessionInventory`. A project on an OAuth2 provider without one of these surfaces sets the corresponding capability to false via a project-scoped ADR override; the account-settings blueprint suppresses the surface accordingly.
+- Closure fix pass (F-4): rewrites the `README.md` shelf-latest line in neutral customer-facing voice with no spec-provenance label.
 
-## 1.1.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
+## 1.3.2
 
-- Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round T-5 `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.
+- Adds `AC-10111-2` to `US-10111` binding a fixed refusal path on the owning mechanism (`TAC-1102-security-auth-oauth2-provider-adapter` `responsibilities.validate`); the boot-time validator refuses a provider-config record missing any REQ-002-mandated field with a stable-coded error class and no server process is left listening. Rewrites `AC-10114-1.description` to reference the local `TAC-1103-security-auth-oauth2-session-bridge` `responsibilities.sessionInventory` (the interface shape remains owned by `TAC-1003-security-auth-clerk-session-verifier` `interfaces.sessionInventory` and is referenced by that owner id) and moves the sibling ACs' `ownerRef` to the same local owner. Rewrites `REQ-011.description` to reference `TAC-1103-security-auth-oauth2-session-bridge` `interfaces.enrichPrincipal` rather than restate the `enrichPrincipal(principal)` signature verbatim.
+
+## 1.3.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.3.0 (hardening pass, spec 2026-09-09 section 5.4.2)
+
+- Adds `REQ-011`/`US-10112` (roleModel: provider-record `roleSources[]`, malformed-claim refusal, enrichPrincipal hook), `REQ-012`/`US-10113` (credentialSelfService: provider-record `accountUrl`, boot-time validation, `getCredentialSelfServiceUrl` helper), `REQ-013`/`US-10114` (sessionInventory: list, revoke-one, revoke-all-except-current, unauthenticated refusal, unknown-session refusal). Extends `TAC-1102` with the `accountUrl` validation responsibility and `TAC-1103` with the roles-population and sessionInventory responsibilities. Adds `deliveredBy` on every `must` requirement and `disposition` on every existing acceptance criterion; adds `ownerRef` on ACs that observe the shared `sessionInventory` interface at owner id `TAC-1003-security-auth-clerk-session-verifier`. Names the `principalDirectory` and `hostedIdentityUi` capabilities on the requirements that carry their runtime clauses. Fixes the pass-1 `OAuth2-only` casing drift on `REQ-008` against `TAC-1102`'s canonical `oauth2-only`. hardening pass (criteria a, b, c on the 2026-09-09 programme).
+- Review fix pass (PR #188 findings): adds `authorisationCodeFlow` to `capabilities[]` and names the token verbatim in `REQ-001` with story references (`US-10101` plus refusal siblings), so a machine-readable composition token backs the flow that keycloak now gates on; rewrites `US-10114` `AC-1` to reference the `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` `SessionRow` shape rather than restating its fields.
+
+## 1.2.0 (visual round, spec 2026-09-06 section 5.4.2, operator Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory, hostedIdentityUi]` on `blueprint.json`. Additive per section 6 of `blueprint-authoring.md`. Consumed at apply time by the visual round `application-account-settings` blueprint to gate the security surface across both self-service and hosted-link-out branches (`AC-25105-1`) and the sessions surface (`AC-25106-1`). The three added capabilities are provider-conditional per spec section 5.4.2 vendor variation note: an OAuth2 provider (Auth0, Cognito, Azure AD, Okta) that ships a hosted account portal supplies `hostedIdentityUi`; a provider that exposes an account-management endpoint supplies `credentialSelfService`; a provider that exposes a session inventory endpoint supplies `sessionInventory`. A project on an OAuth2 provider without one of these surfaces sets the corresponding capability to false via a project-scoped ADR override; the account-settings blueprint suppresses the surface accordingly.
+
+## 1.1.0 (visual round, spec 2026-09-04 section 5.5.2, operator Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.

package/blueprints/security-auth-oauth2/README.md

@@ -3,7 +3,7 @@
 The eleventh content blueprint on the rcf-build-lite blueprint mechanism, category `security`. A vendor-neutral sibling to `security-auth-magic-link` and `security-auth-clerk` on the `authModel` global topic: identity is delegated to any OAuth2-compatible IdP the project selects (Google, GitHub, Microsoft, Okta, Auth0, a corporate ADFS-fronted OIDC, a self-hosted `node-oidc-provider`) through a fixed provider-abstraction contract. The project owns the flow controller (authorisation-code + PKCE state machine), the provider adapter (pluggable record validation and JWKS fetch), the session-bridge (opaque-handle project session, no provider tokens in the browser), and an optional provider selector. Targeted at small greenfield rcf-lite projects that want delegated identity without vendor commitment; larger deployments supersede vendor-neutral posture with a vendor-committed sibling (`security-auth-clerk`, `security-auth-keycloak` when it ships) or with a project-level ADR.
 
 
-> Latest: **v1.2.0** (visual round T-4, 2026-09-06). `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory, hostedIdentityUi]`. See [CHANGELOG.md](CHANGELOG.md).
+> Latest: **v1.3.3** (2026-09-10). `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory, hostedIdentityUi, authorisationCodeFlow]`. See [CHANGELOG.md](CHANGELOG.md).
 
 ## Apply
 

package/blueprints/security-auth-oauth2/blueprint.json

@@ -1,13 +1,14 @@
 {
   "slug": "security-auth-oauth2",
-  "version": "1.2.0",
+  "version": "1.3.3",
   "category": "security",
   "capabilities": [
     "principalDirectory",
     "roleModel",
     "credentialSelfService",
     "sessionInventory",
-    "hostedIdentityUi"
+    "hostedIdentityUi",
+    "authorisationCodeFlow"
   ],
   "contributions": [
     {
@@ -166,6 +167,36 @@
       "id": "ADR-1106-security-auth-oauth2-multi-provider-routing",
       "kind": "adr",
       "path": "adrs/adr-1106-security-auth-oauth2-multi-provider-routing.json"
+    },
+    {
+      "id": "security-auth-oauth2-REQ-011",
+      "kind": "req",
+      "path": "requirements/security-auth-oauth2-req-011.json"
+    },
+    {
+      "id": "security-auth-oauth2-US-10112",
+      "kind": "us",
+      "path": "user-stories/security-auth-oauth2-us-10112.json"
+    },
+    {
+      "id": "security-auth-oauth2-REQ-012",
+      "kind": "req",
+      "path": "requirements/security-auth-oauth2-req-012.json"
+    },
+    {
+      "id": "security-auth-oauth2-US-10113",
+      "kind": "us",
+      "path": "user-stories/security-auth-oauth2-us-10113.json"
+    },
+    {
+      "id": "security-auth-oauth2-REQ-013",
+      "kind": "req",
+      "path": "requirements/security-auth-oauth2-req-013.json"
+    },
+    {
+      "id": "security-auth-oauth2-US-10114",
+      "kind": "us",
+      "path": "user-stories/security-auth-oauth2-us-10114.json"
     }
   ]
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "security-auth-oauth2-REQ-001",
   "prdId": "PRD-001",
   "title": "Authorisation-code flow with PKCE is the sole delegated-identity flow",
-  "description": "The project's authentication model is delegated identity via OAuth2 authorisation-code flow (RFC 6749 section 4.1) hardened with Proof Key for Code Exchange (RFC 7636). The implicit flow, the resource-owner password credentials flow, and the client credentials flow are refused at the flow-controller boundary. The `response_type` on the authorisation request is fixed to `code`; the token exchange is a back-channel POST that presents the `code_verifier`. The mechanism is vendor-neutral: any provider that speaks authorisation-code + PKCE plugs in through the provider-abstraction contract; no provider name appears in the flow controller's code path.",
+  "description": "The project's authentication model is delegated identity via OAuth2 authorisation-code flow (RFC 6749 section 4.1) hardened with Proof Key for Code Exchange (RFC 7636). This blueprint publishes the flow to consumers under the capability token `authorisationCodeFlow` (declared on `blueprint.json:capabilities[]`); a superseding blueprint that owns the flow and the session-bridge declares the same token to remain composable with keycloak and its siblings. The implicit flow, the resource-owner password credentials flow, and the client credentials flow are refused at the flow-controller boundary. The `response_type` on the authorisation request is fixed to `code`; the token exchange is a back-channel POST that presents the `code_verifier`. The mechanism is vendor-neutral: any provider that speaks authorisation-code + PKCE plugs in through the provider-abstraction contract; no provider name appears in the flow controller's code path. The redirect to the provider's `authorizeUrl` is the mechanism by which the blueprint contributes the `hostedIdentityUi` capability: no project route renders a credential-input form of its own; the browser lives at the provider's hosted sign-in surface for every credential moment, and the project sees only the callback plus the code exchange. Runtime behaviour is asserted by `US-10101` and its refusal-path siblings (`US-10102`, `US-10103`, `US-10104`).",
   "category": "functional",
   "domain": "authentication",
   "priority": "must",
@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1101-security-auth-oauth2-auth-model"
+  }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-002.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1102-security-auth-oauth2-provider-adapter",
+    "field": "responsibilities.providerConfig"
+  }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-003.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1101-security-auth-oauth2-flow-controller",
+    "field": "responsibilities.state"
+  }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-004.json

@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1103-security-auth-oauth2-pkce-discipline"
+  }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-005.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1101-security-auth-oauth2-flow-controller",
+    "field": "responsibilities.id_token"
+  }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-006.json

@@ -2,7 +2,7 @@
   "reqId": "security-auth-oauth2-REQ-006",
   "prdId": "PRD-001",
   "title": "Session issue after code exchange goes through one bridge",
-  "description": "After a successful token exchange (and id_token verification for OIDC providers), the flow controller passes the resolved identity to the session-bridge (TAC-1103). The bridge translates the provider identity into a reduced `Principal` shape: `principalId` (a stable in-process id derived from the provider's `sub` claim under an OIDC provider, or the provider's userinfo `id` field under an `oauth2-only` provider, joined to the provider's `id` slug so two providers cannot collide on the same underlying sub), `provider` (the provider `id`), `email` (if the provider returned one), `roles` (an empty array by default; a project-authored bridge extension may enrich), `organisationIds` (empty by default; project-authored bridge extension may enrich). The bridge then issues a project session (opaque-handle cookie is the reference shape; the storage seam is delegated). No downstream code path reasons about the provider's raw claim shape, provider tokens, or refresh material; only the reduced `Principal` and the session handle cross the bridge outward.",
+  "description": "After a successful token exchange (and id_token verification for OIDC providers), the flow controller passes the resolved identity to the session-bridge (TAC-1103). The bridge translates the provider identity into a reduced `Principal` shape: `principalId` (a stable in-process id derived from the provider's `sub` claim under an OIDC provider, or the provider's userinfo `id` field under an `oauth2-only` provider, joined to the provider's `id` slug so two providers cannot collide on the same underlying sub), `provider` (the provider `id`), `email` (if the provider returned one), `roles` (an empty array by default; a project-authored bridge extension may enrich), `organisationIds` (empty by default; project-authored bridge extension may enrich). The bridge then issues a project session (opaque-handle cookie is the reference shape; the storage seam is delegated). No downstream code path reasons about the provider's raw claim shape, provider tokens, or refresh material; only the reduced `Principal` and the session handle cross the bridge outward. The reduced `Principal` from the session-bridge is what the blueprint contributes as the `principalDirectory` capability: no other read-side surface on the project answers \"who is the caller\"; every project code path that reasons about identity reasons against the fields on this Principal, and the applied capability set exposes the token so consumer blueprints can bind against it.",
   "category": "functional",
   "domain": "authentication",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+    "field": "responsibilities.sessionRecordStore"
+  }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-007.json

@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1105-security-auth-oauth2-refresh-token-posture"
+  }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-008.json

@@ -2,7 +2,7 @@
   "reqId": "security-auth-oauth2-REQ-008",
   "prdId": "PRD-001",
   "title": "Sign-out invalidates the project session; provider-side sign-out is a project option",
-  "description": "The blueprint mandates one sign-out shape: a project route (`POST /auth/sign-out` in the reference wiring) that invalidates the project session handle server-side and clears the session cookie on the response. Every subsequent request presenting the cleared cookie or the invalidated handle is treated as unauthenticated. Provider-side sign-out (RP-Initiated Logout, RFC-drafted for OIDC; provider-specific for OAuth2-only providers) is a project-authored option NOT mandated by the blueprint: a project that wants a downstream provider session cleared on sign-out sets `providerLogout: 'redirect'` on the provider record, and the flow controller emits a redirect to the provider's declared `endSessionEndpoint` after clearing the project session. A provider whose declaration omits `endSessionEndpoint` and whose record is set to `providerLogout: 'redirect'` is refused at boot with `OAUTH2_LOGOUT_NOT_DECLARED`.",
+  "description": "The blueprint mandates one sign-out shape: a project route (`POST /auth/sign-out` in the reference wiring) that invalidates the project session handle server-side and clears the session cookie on the response. Every subsequent request presenting the cleared cookie or the invalidated handle is treated as unauthenticated. Provider-side sign-out (RP-Initiated Logout, RFC-drafted for OIDC; provider-specific for oauth2-only providers) is a project-authored option NOT mandated by the blueprint: a project that wants a downstream provider session cleared on sign-out sets `providerLogout: 'redirect'` on the provider record, and the flow controller emits a redirect to the provider's declared `endSessionEndpoint` after clearing the project session. A provider whose declaration omits `endSessionEndpoint` and whose record is set to `providerLogout: 'redirect'` is refused at boot with `OAUTH2_LOGOUT_NOT_DECLARED`.",
   "category": "functional",
   "domain": "authentication",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1101-security-auth-oauth2-flow-controller",
+    "field": "responsibilities.endSessionEndpoint"
+  }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-009.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1104-security-auth-oauth2-provider-selector",
+    "field": "responsibilities.providerConfig"
+  }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-010.json

@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1101-security-auth-oauth2-auth-model"
+  }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-011.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "security-auth-oauth2-REQ-011",
+  "prdId": "PRD-001",
+  "title": "Role sources and role mapping are declared per provider; the reduced Principal carries the resulting roles array",
+  "description": "The blueprint contributes the `roleModel` capability by naming the provider-record `roleSources[]` field (an ordered list of claim paths the session-bridge reads: for example `[\"realm_access.roles\", \"resource_access.<clientId>.roles\", \"groups\"]`) and an optional project-authored principal-enrichment hook whose signature is owned by `TAC-1103-security-auth-oauth2-session-bridge` `interfaces.enrichPrincipal`. The session-bridge walks each `roleSources[]` path against the verified claim record (id_token for OIDC providers, userinfo for oauth2-only providers) and populates `roles[]` with the union of the string values found; a path that resolves to a non-string non-array-of-strings shape is refused with `OAUTH2_ROLES_MALFORMED` and the session is not issued. The blueprint mandates that authorisation decisions above the middleware read `principal.roles[]` and never a raw provider claim; project routes that need role-based gating do so through a project-authored predicate that takes the reduced Principal.",
+  "category": "functional",
+  "domain": "authorisation",
+  "priority": "must",
+  "rationale": "A capability declaration for `roleModel` on a blueprint whose default behaviour is an empty roles array leaves consumers to gate on a token the provider blueprint never wrote a contract for. Naming `roleSources[]` and the malformed-claim refusal is what turns the token into an apply-time observable.",
+  "tags": [
+    "blueprint:security-auth-oauth2",
+    "category:11-role-model"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+    "field": "responsibilities.roles"
+  }
+}

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-012.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "security-auth-oauth2-REQ-012",
+  "prdId": "PRD-001",
+  "title": "Password change, reset, recovery and account management are delegated to the provider's self-service surface",
+  "description": "The blueprint contributes the `credentialSelfService` capability by resolving and exposing the provider record's `accountUrl` field (a URL the provider documents for account, password and recovery self-service; for example Google's https://myaccount.google.com, GitHub's https://github.com/settings/security). The provider adapter verifies at boot that every enabled provider record carries `accountUrl` as an absolute https URL under the provider's documented origin (or an explicit `null` when the provider offers no self-service surface); a provider that declares `credentialSelfService` support without an `accountUrl` is refused with `OAUTH2_ACCOUNT_URL_MISSING`. The project exposes `getCredentialSelfServiceUrl(principal)` that returns the resolved URL for the principal's provider; a project page linking to self-service reads that helper rather than hard-coding a URL. No project route renders a credential-change form of its own.",
+  "category": "functional",
+  "domain": "authentication",
+  "priority": "must",
+  "rationale": "A capability declaration for `credentialSelfService` on an OAuth2/OIDC blueprint whose sign-in is already delegated makes little sense unless the account-management surface is also delegated by contract; naming the `accountUrl` field and the boot-time verification is what turns the capability into a bind-able surface.",
+  "tags": [
+    "blueprint:security-auth-oauth2",
+    "category:12-credential-self-service"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1102-security-auth-oauth2-provider-adapter",
+    "field": "responsibilities.accountUrl"
+  }
+}

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-013.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "security-auth-oauth2-REQ-013",
+  "prdId": "PRD-001",
+  "title": "The caller's active project sessions are enumerable, revocable one at a time, and revocable in bulk-except-current",
+  "description": "The blueprint contributes the `sessionInventory` capability against its own opaque-handle session store (the session-record store contributed by the composed persistence blueprint, or the reference in-memory store for the small-project shape). An authenticated caller can list their active project sessions, revoke one non-current session by id, and revoke every active session except the one making the call. Each list row carries `{ sessionId, deviceLabel, lastActive, currentSession }`; the interface shape is inherited by reference from `security-auth-clerk` `TAC-1003` `interfaces.sessionInventory` and is not restated on oauth2. Every operation refuses an unauthenticated caller with `SESSION_INVENTORY_UNAUTHENTICATED`; every operation emits one structured audit event carrying operation, session id prefix and wall-clock timestamp; no field carries a full session id, a cookie value, or a provider token.",
+  "category": "functional",
+  "domain": "authentication",
+  "priority": "must",
+  "rationale": "A capability declaration without a REQ backing the surface leaves consumers to bind against a contract oauth2 never wrote down. The cross-blueprint reference keeps the interface shape single-owner (clerk's TAC-1003) while letting each auth blueprint fulfil the capability against its own session store.",
+  "tags": [
+    "blueprint:security-auth-oauth2",
+    "category:13-session-inventory"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+    "field": "responsibilities.sessionInventory"
+  }
+}

package/blueprints/security-auth-oauth2/contributions/tacs/tac-1102-security-auth-oauth2-provider-adapter.json

@@ -11,7 +11,8 @@
     "Refuse boot on a malformed record with a stable-coded error naming the provider id and the missing or invalid field; audit event `oauth2.provider_config_refused` carries provider id and reason class (AC-10108-3).",
     "Expose `resolve(providerId) -> record | absent`; return `absent` for an unknown id and let the flow controller emit OAUTH2_PROVIDER_UNKNOWN (AC-10109-2).",
     "Expose `fetchJwks(providerId) -> { keys[] }` with a cache keyed by provider id whose TTL is `jwksCacheTtlSeconds` (default 900); refresh on cache miss or on a verifier hint that a key is unknown (AC-10105-1, AC-10105-2).",
-    "Never expose `clientSecret` on the client-tier record form; the client-tier record carries a redacted placeholder and the server-tier record carries the real value (REQ-002)."
+    "Never expose `clientSecret` on the client-tier record form; the client-tier record carries a redacted placeholder and the server-tier record carries the real value (REQ-002).",
+    "Validate each enabled provider record's `accountUrl` at boot: an absolute https URL under the provider's documented self-service origin, or an explicit `null` when the provider carries `credentialSelfService: false`; refuse with `OAUTH2_ACCOUNT_URL_MISSING` on a `credentialSelfService: true` record lacking `accountUrl`, or `OAUTH2_ACCOUNT_URL_ORIGIN` on an origin mismatch (AC-10113-1, AC-10113-3, AC-10113-4)."
   ],
   "internalStructure": "One factory function producing an adapter closure over an injected `providerConfig` module (a plain data record set) and an injected `httpFetch` port (the process's HTTP client, either the platform's `fetch` or an injected mock in tests). The JWKS cache is a Map keyed by provider id whose value is `{ keys[], fetchedAt }`; TTL eviction is on read. The validator is a pure function invoked once at boot per record.",
   "interfaces": [

package/blueprints/security-auth-oauth2/contributions/tacs/tac-1103-security-auth-oauth2-session-bridge.json

@@ -12,7 +12,9 @@
     "Issue an opaque-handle session cookie: mint a cryptographically random handle, store the session record `{ handle, principal, providerId, accessToken, idToken, refreshToken?, issuedAt, expiresAt }` in the session-record store, and emit `Set-Cookie` with `HttpOnly`, `Secure`, `SameSite=Lax` (AC-10101-3, AC-10106-1).",
     "Verify a presented handle at the middleware boundary: lookup, expiry check, tampered-value refusal, populate `request.auth` on success, refuse otherwise; do not renew a tampered cookie (AC-10106-1, AC-10106-2).",
     "Invalidate on sign-out: delete the session record, clear the associated refresh-token chain, emit the cookie-clear header (AC-10108-1).",
-    "Delegate the session-record store to a project-authored implementation (in-memory for the reference wiring; SQLite for `persistence-data-sqlite`-composed projects; D1 for `persistence-data-d1`-composed projects); do not embed a store implementation (REQ-006)."
+    "Delegate the session-record store to a project-authored implementation (in-memory for the reference wiring; SQLite for `persistence-data-sqlite`-composed projects; D1 for `persistence-data-d1`-composed projects); do not embed a store implementation (REQ-006).",
+    "Populate `roles[]` on the reduced Principal by walking each path named on the provider record's `roleSources[]` against the verified claim record; take the union of the resulting string values; refuse with `OAUTH2_ROLES_MALFORMED` when a named path resolves to a value that is neither string nor array-of-strings (AC-10112-1, AC-10112-2, AC-10112-3, AC-10112-4).",
+    "Expose `sessionInventory` against the session-record store (list, revoke-one, revoke-all-except-current); the interface shape is owned by `TAC-1003-security-auth-clerk-session-verifier` `interfaces.sessionInventory` and referenced by that owner id; a revoke clears the associated refresh-token chain per REQ-007 (AC-10114-1, AC-10114-2, AC-10114-3, AC-10114-4, AC-10114-5)."
   ],
   "internalStructure": "One factory function producing an issue/verify/invalidate closure over an injected `sessionRecordStore`, an injected `refreshTokenStore` (shared with the flow controller), an injected `randomBytes` port for handle minting, an injected clock, and an injected `enrichPrincipal` hook (or a no-op default). The session-record shape is a plain object; the store's on-disk shape is the project's concern.",
   "interfaces": [
@@ -43,7 +45,12 @@
     }
   ],
   "dependencies": [
-    { "name": "OAuth2 flow controller", "kind": "tac", "tacId": "TAC-1101-security-auth-oauth2-flow-controller", "description": "The bridge is invoked by the controller at the end of a successful callback; the bridge does not initiate flows." }
+    {
+      "name": "OAuth2 flow controller",
+      "kind": "tac",
+      "tacId": "TAC-1101-security-auth-oauth2-flow-controller",
+      "description": "The bridge is invoked by the controller at the end of a successful callback; the bridge does not initiate flows."
+    }
   ],
   "tradeoffs": "Deriving `principalId` from `{provider.id, subject}` prevents accidental cross-provider identity merging; the trade is that a project that wants such merging must author an explicit identity-merge policy in its enrichPrincipal hook. Storing provider tokens on the server-side session record rather than the browser cookie carries a small per-session storage cost and buys the project one code path for revocation on sign-out and refresh-token reuse; the tokens never appear in a place the browser can leak them. Exposing an `enrichPrincipal` hook without prescribing a role-source lets a project reach for its own claim-mapping vocabulary without the blueprint committing to one.",
   "createdAt": "2026-08-30T00:00:00Z",

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10101.json

@@ -16,7 +16,8 @@
       "when": "the request is dispatched and the response is inspected",
       "then": "the response is a 302 to the provider's declared `authorizeUrl`; the location query carries `response_type=code`, `code_challenge` (matches `^[A-Za-z0-9_-]{43,128}$`), `code_challenge_method=S256`, a `state` value distinct from any previously observed value in the test's collector; no `access_type=implicit` or `response_type=token` is present",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10101-2",
@@ -25,7 +26,8 @@
       "when": "the browser follows the provider's redirect back to the project's callback route",
       "then": "the flow controller issues a POST to the provider's `tokenUrl` whose body carries `grant_type=authorization_code`, the returned `code`, `client_id`, `code_verifier` (matching the pending-flow record), and `redirect_uri`; the response is a 2xx with `access_token`; for an OIDC provider the response additionally carries an `id_token`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10101-3",
@@ -34,7 +36,8 @@
       "when": "the browser inspects the response cookie jar",
       "then": "a session cookie declared by the project's session-cookie name (per config) is set with `Secure`, `HttpOnly`, and `SameSite=Lax`; the cookie value does not equal the access token, the id_token, or any refresh token returned by the provider; the value matches the opaque-handle shape declared by the session-bridge",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10102.json

@@ -16,7 +16,8 @@
       "when": "the request reaches the flow controller",
       "then": "the response is a 4xx with body error code `OAUTH2_STATE_UNKNOWN`; the mock provider's `tokenUrl` records zero request attempts for this state value; no session cookie is set on the response",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10102-2",
@@ -25,7 +26,8 @@
       "when": "a subsequent callback request is dispatched with the same `state=s1` value",
       "then": "the response is a 4xx with body error code `OAUTH2_STATE_ALREADY_CONSUMED`; the mock provider's `tokenUrl` records zero new request attempts for this state; no session cookie is set on the response",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10102-3",
@@ -34,7 +36,8 @@
       "when": "the callback for `s2` is dispatched",
       "then": "the response is a 4xx with body error code `OAUTH2_STATE_EXPIRED`; the pending-flow record has been evicted from the store; no session cookie is set on the response",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10103.json

@@ -16,7 +16,8 @@
       "when": "the flow controller's outbound token-exchange request is inspected before it leaves the process",
       "then": "the request body contains a `code_verifier` field whose value equals the verifier stored on the pending-flow record for the state; the request body carries no `code_challenge_method` field (verifier is presented, method is provider-remembered from authorise)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10103-2",
@@ -25,7 +26,8 @@
       "when": "the callback reaches the flow controller",
       "then": "the response is a 4xx with body error code `OAUTH2_TOKEN_EXCHANGE_FAILED` naming the provider response class as `invalid_grant`; no session cookie is set on the response; the pending-flow record for this state has been evicted",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10104.json

@@ -16,7 +16,8 @@
       "when": "the callback reaches the flow controller",
       "then": "the response is a 4xx with body error code `OAUTH2_TOKEN_EXCHANGE_FAILED` naming the provider response class as `invalid_grant`; no session cookie is set on the response",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10104-2",
@@ -25,7 +26,8 @@
       "when": "a subsequent callback request is dispatched with `state=s3&code=c3`",
       "then": "the response is a 4xx with body error code `OAUTH2_STATE_ALREADY_CONSUMED`; the mock provider's `tokenUrl` records zero new request attempts for this state; no session cookie is set on the response",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10105.json

@@ -16,7 +16,8 @@
       "when": "the flow controller invokes its verifier module on the returned id_token",
       "then": "the verifier returns `{ valid: true, claims: { iss, aud, sub, exp, nonce } }`; the flow proceeds to session issue; the audit log records one `oauth2.id_token_verified` event carrying provider id and no token value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10105-2",
@@ -25,7 +26,8 @@
       "when": "the callback reaches the flow controller",
       "then": "the response is a 4xx with body error code `OAUTH2_ID_TOKEN_SIGNATURE_INVALID`; no session cookie is set; the audit log records one `oauth2.id_token_refused` event carrying provider id, reason class `signature`, and no token value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10105-3",
@@ -34,7 +36,8 @@
       "when": "the callback reaches the flow controller",
       "then": "the response is a 4xx with body error code `OAUTH2_ID_TOKEN_ISSUER_MISMATCH`; no session cookie is set; the audit log records one `oauth2.id_token_refused` event carrying provider id, reason class `issuer`, and no token value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10105-4",
@@ -43,7 +46,8 @@
       "when": "the callback reaches the flow controller",
       "then": "the response is a 4xx with body error code `OAUTH2_MISSING_ID_TOKEN`; no session cookie is set; the audit log records one `oauth2.id_token_refused` event carrying provider id, reason class `missing`, and no token value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10106.json

@@ -16,7 +16,8 @@
       "when": "the request is dispatched",
       "then": "the middleware attaches `request.auth` carrying `principalId`, `provider`, `email` (if the provider returned one), `roles` (empty array by default), and `organisationIds` (empty array by default); `principalId` is a stable string derived from `{ provider.id, sub }` (OIDC) or `{ provider.id, userinfo.id }` (oauth2-only)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10106-2",
@@ -25,7 +26,8 @@
       "when": "a request is dispatched with no session cookie, then with a cookie whose value has been tampered by a single byte",
       "then": "the middleware treats each request as unauthenticated; the route handler is not invoked; the response is a 4xx (or a redirect to the sign-in route, per the wiring shim's declared class); no `request.auth` is attached in either case",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10106-3",
@@ -34,7 +36,8 @@
       "when": "the request is dispatched and the resolved `request.auth` object is inspected for keys",
       "then": "the object contains only the fields named in AC-10106-1; no `accessToken`, `idToken`, `refreshToken`, or provider-raw-claims field is exposed",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10107.json

@@ -16,7 +16,8 @@
       "when": "the next protected-route request triggers the flow controller's refresh path",
       "then": "the flow controller issues a POST to the provider's `tokenUrl` with `grant_type=refresh_token` and `refresh_token=rt-old`; the provider returns a new `access_token` and new `refresh_token=rt-new`; the session record now stores `rt-new` and no other refresh-token value; the pre-refresh `rt-old` is not present in the session record or the audit log",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10107-2",
@@ -25,7 +26,8 @@
       "when": "the test injects a refresh call presenting `rt-old` at the flow controller",
       "then": "the flow controller invalidates the session handle, clears every stored refresh token that shares the same chain root, and emits one structured audit event `oauth2.refresh_token_reuse` carrying the provider id, the session-handle hash, and the detection timestamp; the event carries no token value; the next protected-route request with the original cookie is refused as unauthenticated",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10107-3",
@@ -34,7 +36,8 @@
       "when": "the sign-in completes and the session record is inspected",
       "then": "the session record's refresh-token slot is empty; the flow controller does not attempt a refresh call on any subsequent request against this session; the session's own project-lifetime expiry (per the session-bridge) is the sole grant duration",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10108.json

@@ -16,7 +16,8 @@
       "when": "the browser dispatches the sign-out request",
       "then": "the response clears the session cookie (`Set-Cookie` with the cookie name, empty value, `Max-Age=0`, `HttpOnly`, `Secure`, `SameSite=Lax`); the session-record store no longer holds a record for the pre-signout session handle; the next protected-route request from this browser is refused as unauthenticated even if the browser replays the pre-signout cookie value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10108-2",
@@ -25,7 +26,8 @@
       "when": "the sign-out route is invoked",
       "then": "the response status is 302; the `Location` header equals the declared `endSessionEndpoint` (with the configured `post_logout_redirect_uri` and, for OIDC providers, the `id_token_hint` query parameter as the raw id_token stored on the session record); the session cookie is cleared on the same response",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10108-3",
@@ -34,7 +36,8 @@
       "when": "the flow controller's provider validator runs at boot",
       "then": "the boot terminates with error code `OAUTH2_LOGOUT_NOT_DECLARED` naming the provider id; no server process is left listening; the audit log records one `oauth2.provider_config_refused` event carrying the provider id and reason class `logout-endpoint-missing`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [