rcf-lite 0.26.0 → 0.27.0

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10109.json

@@ -16,7 +16,8 @@
       "when": "a browser dispatches `GET /auth/sign-in?provider=<second-id>` and completes the round-trip",
       "then": "the resulting session's `request.auth.provider` equals the second provider's `id`; `principalId` is derived under the second provider's slug and does not collide with any principalId issued against the first provider even when the underlying `sub` claim value is identical; the flow controller's request log records the redirect and the token exchange against the second provider's URLs, not the first",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10109-2",
@@ -25,7 +26,8 @@
       "when": "a browser dispatches `GET /auth/sign-in?provider=nonexistent-id`",
       "then": "the response is a 4xx with body error code `OAUTH2_PROVIDER_UNKNOWN`; no `Location` header pointing at an authorise endpoint is emitted; no pending-flow record is written",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10110.json

@@ -16,7 +16,8 @@
       "when": "`rcf audit coverage --strict` reports the coverage state and the runtime-verify runner is invoked",
       "then": "the coverage report lists the AC as covered by a TC whose latest run outcome is `skipped` with reason `OAUTH2_LIVE_PROVIDER_UNREACHABLE`; the pipeline exit code is 0; the audit log records one `oauth2.accountbound_skip` event carrying the AC id and the missing-credential class",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10110-2",
@@ -25,7 +26,8 @@
       "when": "the operator drives a real browser through the sign-in surface at the live provider",
       "then": "the flow completes; a project session cookie is set with the same shape as AC-10101-3; `request.auth.provider` equals the live provider's declared id; the project-authored TC for this AC records a `pass` outcome",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10111.json

@@ -16,7 +16,22 @@
       "when": "the flow controller initiates any step of the authorisation-code + PKCE flow against the configured provider (mint redirect, exchange code, verify id_token, invoke userinfo, mint sign-out redirect)",
       "then": "every URL, credential, scope list, redirect target, and provider-kind determination the flow controller reads comes from the record's declared fields (`authorizeUrl`, `tokenUrl`, `userinfoUrl`, `issuer`, `jwksUri`, `clientId`, `clientSecret`, `scopes`, `redirectUri`, `providerKind`, `endSessionEndpoint`); a source-tree scan of the flow-controller module records zero string-literal branches keyed on a provider `id` value (no `provider.id === 'google'`, no vendor-name switch); a boot with a record missing any REQ-002-mandated field refuses with the stable-coded error class named on TAC-1102's responsibilities and no server process is left listening",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-10111-2",
+      "description": "The provider adapter's boot-time validator refuses a provider-config record that is missing any `REQ-002`-mandated field with a stable-coded error class on `TAC-1102-security-auth-oauth2-provider-adapter` `responsibilities.validate`, and no server process is left listening; the refusal is emitted as one structured event and the flow controller is not initialised.",
+      "given": "a project provider-config module carrying a record whose `authorizeUrl` field is absent (or any other REQ-002-mandated field is absent), and the provider adapter loaded at boot per TAC-1102",
+      "when": "the blueprint boots and the validator inspects the record",
+      "then": "boot fails with the stable-coded error class named on `TAC-1102-security-auth-oauth2-provider-adapter` `responsibilities.validate` (identifying the missing field and the offending record); no server process remains listening; the flow-controller module is not initialised; the refusal is emitted as one structured event whose payload names the missing field but does not carry the record's `clientSecret` value or any substring of it",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1102-security-auth-oauth2-provider-adapter",
+        "field": "responsibilities.validate"
+      }
     }
   ],
   "tacIds": [
@@ -24,5 +39,5 @@
     "TAC-1102-security-auth-oauth2-provider-adapter"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10112.json

@@ -0,0 +1,82 @@
+{
+  "usId": "security-auth-oauth2-US-10112",
+  "prdId": "PRD-001",
+  "reqId": "security-auth-oauth2-REQ-011",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The reduced Principal carries the roles the provider record declares, and the union is refused on a malformed claim",
+  "asA": "operator signing in through an OAuth2 provider whose token exchange returns roles at a project-declared claim path",
+  "iWant": "the session-bridge to read the roles the provider record names and put them on `request.auth.roles`",
+  "soThat": "project routes gate on roles without reading raw provider claims",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10112-1",
+      "description": "When the provider record declares `roleSources: [\"realm_access.roles\"]` and the verified id_token carries `realm_access.roles = [\"admin\",\"auditor\"]`, the reduced Principal's `roles` array is the set `{\"admin\",\"auditor\"}`.",
+      "given": "a provider record with `roleSources: [\"realm_access.roles\"]` and a verified id_token whose `realm_access.roles` is `[\"admin\",\"auditor\",\"admin\"]`",
+      "when": "the session-bridge reduces the identity",
+      "then": "`request.auth.roles` is a two-element array whose set membership is `{\"admin\",\"auditor\"}`; the array ordering is not asserted but the set is; the audit sink records one `oauth2.roles_mapped` event carrying the count `2` and no role values",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-10112-2",
+      "description": "When `roleSources` names multiple paths, the reduced `roles` is the union.",
+      "given": "a provider record with `roleSources: [\"realm_access.roles\",\"resource_access.web.roles\"]` and a verified id_token whose `realm_access.roles = [\"a\"]` and `resource_access.web.roles = [\"b\",\"a\"]`",
+      "when": "the session-bridge reduces the identity",
+      "then": "`request.auth.roles` has set membership `{\"a\",\"b\"}`; each string appears exactly once",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-10112-3",
+      "description": "A `roleSources` path resolving to a value that is not a string and not an array of strings refuses the session issue with `OAUTH2_ROLES_MALFORMED`.",
+      "given": "a provider record with `roleSources: [\"realm_access.roles\"]` and a verified id_token whose `realm_access.roles` is the JSON object `{\"admin\": true}`",
+      "when": "the session-bridge reduces the identity",
+      "then": "the bridge throws `OAUTH2_ROLES_MALFORMED` naming the provider id and the offending path; no session cookie is issued; the audit sink records one `oauth2.roles_refused` event carrying the reason class and no claim values",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-10112-4",
+      "description": "A provider record with an empty or absent `roleSources` produces a Principal with an empty `roles` array; no error.",
+      "given": "a provider record whose `roleSources` field is `[]` (or absent) and a verified id_token that carries a `realm_access.roles` field the provider does not name",
+      "when": "the session-bridge reduces the identity",
+      "then": "`request.auth.roles` is `[]`; the session cookie is issued normally; no `oauth2.roles_refused` event fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-10112-5",
+      "description": "An `enrichPrincipal` hook, when configured, receives the Principal after `roles[]` is populated and its return value replaces the Principal on `request.auth`.",
+      "given": "a provider record with `roleSources: [\"realm_access.roles\"]` and a project-authored `enrichPrincipal(p) => ({ ...p, roles: [...p.roles, \"audit-viewer\"] })` hook",
+      "when": "the session-bridge reduces the identity of a caller whose `realm_access.roles` is `[\"admin\"]`",
+      "then": "`request.auth.roles` has set membership `{\"admin\",\"audit-viewer\"}`; the hook is invoked exactly once per session issue",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+        "field": "interfaces.enrichPrincipal.name"
+      }
+    },
+    {
+      "id": "AC-10112-6",
+      "description": "Project routes never observe a raw provider claim; every role decision reads the reduced Principal.",
+      "given": "the applied blueprint at v1.3.0 and a source-tree scan of the project's contributed routes",
+      "when": "a static scan looks for reads of `id_token`, `userinfo`, or raw provider-claim shape from any project route",
+      "then": "the scan reports zero raw-claim reads outside the flow-controller and session-bridge modules; every route's role-check reads `request.auth.roles`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    }
+  ],
+  "tacIds": [
+    "TAC-1103-security-auth-oauth2-session-bridge"
+  ],
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10113.json

@@ -0,0 +1,68 @@
+{
+  "usId": "security-auth-oauth2-US-10113",
+  "prdId": "PRD-001",
+  "reqId": "security-auth-oauth2-REQ-012",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "A signed-in caller reaches account, password and recovery through the provider's self-service surface",
+  "asA": "operator signed in through an OAuth2 provider who wants to change their password or set up MFA",
+  "iWant": "the project to send me to the provider's hosted account surface rather than owning a credential-change form",
+  "soThat": "credential material never leaves the identity source",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10113-1",
+      "description": "A provider record with `credentialSelfService: true` and no `accountUrl` refuses at boot.",
+      "given": "a provider record whose `credentialSelfService` is `true` and whose `accountUrl` is absent",
+      "when": "the provider adapter runs its boot-time validation",
+      "then": "boot refuses with stable-coded `OAUTH2_ACCOUNT_URL_MISSING` naming the provider id; the audit sink records one `oauth2.account_url_missing` event",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-10113-2",
+      "description": "`getCredentialSelfServiceUrl(principal)` returns the resolved provider `accountUrl` for the caller's provider. Applying-agent responsibility: The applying agent sets each provider record's `accountUrl` value against the provider's documented self-service origin. The AC binds the shape; the value belongs to the applied project.",
+      "given": "a caller signed in through provider `google` and a provider record for `google` whose `accountUrl` is `https://myaccount.google.com`",
+      "when": "a project route calls `getCredentialSelfServiceUrl(request.auth)`",
+      "then": "the return value is exactly `https://myaccount.google.com`; the helper appends no query parameters, no fragment, and no additional path segment",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-10113-3",
+      "description": "A provider record whose `accountUrl` origin does not match the provider's documented sign-in origin is refused at boot. Applying-agent responsibility: The origin-check compares against the provider record's documented self-service origin; the applying agent sets the expected origin for each provider they configure.",
+      "given": "a provider record for `google` whose `accountUrl` is `https://example.com/account`",
+      "when": "the provider adapter runs its boot-time validation",
+      "then": "boot refuses with stable-coded `OAUTH2_ACCOUNT_URL_ORIGIN` naming the provider id and the observed origin; the record is not loaded",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-10113-4",
+      "description": "A provider that offers no self-service surface carries `accountUrl: null` and `credentialSelfService: false`; the applied capability set reflects `credentialSelfService` as absent for callers signed in through that provider.",
+      "given": "a provider record whose `accountUrl` is `null` and whose `credentialSelfService` is `false`",
+      "when": "a caller signed in through that provider invokes `getCredentialSelfServiceUrl`",
+      "then": "the helper returns `null`; the applied capability set does not report `credentialSelfService` as active for that caller's provider",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-10113-5",
+      "description": "No project route renders a credential-change form of its own.",
+      "given": "the applied blueprint at v1.3.0 and a source-tree scan of the project's contributed pages",
+      "when": "a static scan looks for `type=password` inputs or MFA-enrolment DOM shapes owned by the project",
+      "then": "the scan reports zero credential-input controls owned by the project; every credential moment resolves to a link out through `getCredentialSelfServiceUrl`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    }
+  ],
+  "tacIds": [
+    "TAC-1102-security-auth-oauth2-provider-adapter"
+  ],
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10114.json

@@ -0,0 +1,88 @@
+{
+  "usId": "security-auth-oauth2-US-10114",
+  "prdId": "PRD-001",
+  "reqId": "security-auth-oauth2-REQ-013",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "A signed-in oauth2 caller lists their project sessions, revokes one, and revokes all others",
+  "asA": "operator signed in through an OAuth2 provider on two browsers",
+  "iWant": "to list every active project session, terminate any one of them, and terminate every one except the current in a single call",
+  "soThat": "I end a stolen or forgotten session without touching the provider's admin surface",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10114-1",
+      "description": "A `list()` call from an authenticated caller returns one row per active project session, each row shaped per the interface owned by the local `TAC-1103-security-auth-oauth2-session-bridge` `responsibilities.sessionInventory`.",
+      "given": "a caller with two active project sessions S1 (current) and S2, both issued through provider `google`",
+      "when": "the current browser calls `sessionInventory.list()`",
+      "then": "the return is exactly two rows shaped per the ownerRef interface, one with `currentSession=true` for S1 and one with `currentSession=false` for S2",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+        "field": "responsibilities.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-10114-2",
+      "description": "`revoke(sessionId)` on a non-current session invalidates it in the session-record store; a replay from the revoked browser is treated as unauthenticated.",
+      "given": "the two-session setup from AC-10114-1",
+      "when": "the current browser calls `sessionInventory.revoke(\"S2\")` and browser B replays its next request",
+      "then": "the revoke returns successfully; the session-record store no longer holds a record for S2; browser B is refused as unauthenticated on the next request; the audit sink records exactly one `oauth2.session_inventory_revoked` event with `{ operation, sessionIdPrefix, at }` and no other cookie- or token-carrying field",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+        "field": "responsibilities.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-10114-3",
+      "description": "`revokeAllExceptCurrent()` invalidates every active project session for the caller other than the current one; the refresh-token chain for each revoked session is cleared alongside per REQ-007.",
+      "given": "a caller with sessions S1 (current), S2, S3 and stored refresh-token chains for each",
+      "when": "the current browser calls `sessionInventory.revokeAllExceptCurrent()`",
+      "then": "the return value is `2`; a subsequent `list()` returns exactly one row for S1; the refresh-token store no longer holds chains for S2 or S3",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+        "field": "responsibilities.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-10114-4",
+      "description": "An unauthenticated call to any `sessionInventory` operation refuses with `SESSION_INVENTORY_UNAUTHENTICATED` and no side effect.",
+      "given": "a request with no verified session cookie",
+      "when": "any of the three operations is invoked",
+      "then": "each call throws `SESSION_INVENTORY_UNAUTHENTICATED`; the session-record store is unchanged; the audit sink records exactly one `oauth2.session_inventory_unauthenticated` event",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+        "field": "responsibilities.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-10114-5",
+      "description": "`revoke(sessionId)` against a session id the caller does not own, or a session already invalidated, refuses without a side effect.",
+      "given": "an authenticated caller and a `sessionId` naming a session belonging to a different principal or already invalidated",
+      "when": "the caller calls `sessionInventory.revoke(sessionId)`",
+      "then": "the call throws `SESSION_INVENTORY_UNKNOWN_SESSION`; the session-record store is unchanged; the audit sink records exactly one `oauth2.session_inventory_unknown_session` event",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+        "field": "responsibilities.sessionInventory"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-1103-security-auth-oauth2-session-bridge"
+  ],
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/security-secrets-management/CHANGELOG.md

@@ -1,10 +1,22 @@
 # security-secrets-management changelog
 
+## 1.1.2
+
+- Rewrites `REQ-002.description` to reference `TAC-901-security-secrets-management-manager-client` `responsibilities.get` and the sibling responsibilities on the same TAC rather than restate the `get(name)` signature verbatim; the literal remains owned by the delivering TAC.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 (hardening pass, spec 2026-09-09 section 5.4.2)
+
+- Adds `elicits[]` for `environmentSet` (string; the ordered environment list) and `uiOutcome` (enum: `integrate`, `admin-spa`, `none`) already described in prose on `REQ-007` and `REQ-010`. Promotes `REQ-010` to `must` priority (an apply-time choice is not a should) and names each option value explicitly on its description. Narrows `REQ-003` to code-side enforcement of the least-privilege slice, naming SOPS's inability to issue vendor-side per-process credentials and the supersede-via-ADR path for vendors that carry the property. Adds an explicit exception clause to `REQ-005` for the ephemeral `.env` reflection under `REQ-006`, constraining its location, `.gitignore` requirement, and file mode. Adds `deliveredBy` on every `must` requirement and `disposition: fixed` on every existing acceptance criterion. Names the `secretsProvider` capability on `REQ-002`, which already carries the vendor-agnostic-manager runtime clause. hardening pass (criteria a, b, c on the 2026-09-09 programme).
+
 ## 1.0.1 - 2026-09-06
 
-Additive minor: declares `capabilities: ["secretsProvider"]` on `blueprint.json` so consumer blueprints can gate composition on an applied secrets-management surface via the T-5 capability mechanism. No REQ / US / TAC / ADR contribution changes; the `secretRef` opaque-string contract, the elicited-parameters shape, and the shipped secretsSource semantics are unchanged. First consumer at v1.0.1: `object-storage-s3` v1.0.0 declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` so `rcf define blueprint add object-storage-s3` on a project that has not applied security-secrets-management exits 3 with the stable message id on stderr; the override records a note on `source.notes` for later reconciliation.
+Additive minor: declares `capabilities: ["secretsProvider"]` on `blueprint.json` so consumer blueprints can gate composition on an applied secrets-management surface via the capability mechanism. No REQ / US / TAC / ADR contribution changes; the `secretRef` opaque-string contract, the elicited-parameters shape, and the shipped secretsSource semantics are unchanged. First consumer at v1.0.1: `object-storage-s3` v1.0.0 declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` so `rcf define blueprint add object-storage-s3` on a project that has not applied security-secrets-management exits 3 with the stable message id on stderr; the override records a note on `source.notes` for later reconciliation.
 
-Landed via infra round 5 T-2 (spec section 5.2, Baz decision 6) folded into PR #157 per HQ ruling on the runner-gap find; same-PR minor pattern as round-4 T-4 auth minors.
+Landed via infra round 5 (spec section 5.2, platform decision 6) folded into PR #157 per shelf ruling on the runner-gap find; same-PR minor pattern as round-4 auth minors.
 
 ## 1.0.0 - 2026-08-31
 

package/blueprints/security-secrets-management/blueprint.json

@@ -1,34 +1,136 @@
 {
   "slug": "security-secrets-management",
-  "version": "1.0.1",
+  "version": "1.1.2",
   "category": "security",
-  "capabilities": ["secretsProvider"],
+  "capabilities": [
+    "secretsProvider"
+  ],
   "contributions": [
-    { "id": "security-secrets-management-REQ-001", "kind": "req", "path": "requirements/security-secrets-management-req-001.json" },
-    { "id": "security-secrets-management-REQ-002", "kind": "req", "path": "requirements/security-secrets-management-req-002.json" },
-    { "id": "security-secrets-management-REQ-003", "kind": "req", "path": "requirements/security-secrets-management-req-003.json" },
-    { "id": "security-secrets-management-REQ-004", "kind": "req", "path": "requirements/security-secrets-management-req-004.json" },
-    { "id": "security-secrets-management-REQ-005", "kind": "req", "path": "requirements/security-secrets-management-req-005.json" },
-    { "id": "security-secrets-management-REQ-006", "kind": "req", "path": "requirements/security-secrets-management-req-006.json" },
-    { "id": "security-secrets-management-REQ-007", "kind": "req", "path": "requirements/security-secrets-management-req-007.json" },
-    { "id": "security-secrets-management-REQ-008", "kind": "req", "path": "requirements/security-secrets-management-req-008.json" },
-    { "id": "security-secrets-management-REQ-009", "kind": "req", "path": "requirements/security-secrets-management-req-009.json" },
-    { "id": "security-secrets-management-REQ-010", "kind": "req", "path": "requirements/security-secrets-management-req-010.json" },
-    { "id": "security-secrets-management-US-8101", "kind": "us", "path": "user-stories/security-secrets-management-us-8101.json" },
-    { "id": "security-secrets-management-US-8102", "kind": "us", "path": "user-stories/security-secrets-management-us-8102.json" },
-    { "id": "security-secrets-management-US-8103", "kind": "us", "path": "user-stories/security-secrets-management-us-8103.json" },
-    { "id": "security-secrets-management-US-8104", "kind": "us", "path": "user-stories/security-secrets-management-us-8104.json" },
-    { "id": "security-secrets-management-US-8105", "kind": "us", "path": "user-stories/security-secrets-management-us-8105.json" },
-    { "id": "security-secrets-management-US-8106", "kind": "us", "path": "user-stories/security-secrets-management-us-8106.json" },
-    { "id": "security-secrets-management-US-8107", "kind": "us", "path": "user-stories/security-secrets-management-us-8107.json" },
-    { "id": "security-secrets-management-US-8108", "kind": "us", "path": "user-stories/security-secrets-management-us-8108.json" },
-    { "id": "security-secrets-management-US-8109", "kind": "us", "path": "user-stories/security-secrets-management-us-8109.json" },
-    { "id": "security-secrets-management-US-8110", "kind": "us", "path": "user-stories/security-secrets-management-us-8110.json" },
-    { "id": "TAC-901-security-secrets-management-manager-client", "kind": "tac", "path": "tacs/tac-901-security-secrets-management-manager-client.json" },
-    { "id": "TAC-902-security-secrets-management-manifest", "kind": "tac", "path": "tacs/tac-902-security-secrets-management-manifest.json" },
-    { "id": "TAC-903-security-secrets-management-env-reflector", "kind": "tac", "path": "tacs/tac-903-security-secrets-management-env-reflector.json" },
-    { "id": "TAC-904-security-secrets-management-rotation-gate", "kind": "tac", "path": "tacs/tac-904-security-secrets-management-rotation-gate.json" },
-    { "id": "TAC-905-security-secrets-management-agent-cli", "kind": "tac", "path": "tacs/tac-905-security-secrets-management-agent-cli.json" },
+    {
+      "id": "security-secrets-management-REQ-001",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-001.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-002",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-002.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-003",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-003.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-004",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-004.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-005",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-005.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-006",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-006.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-007",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-007.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-008",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-008.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-009",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-009.json"
+    },
+    {
+      "id": "security-secrets-management-REQ-010",
+      "kind": "req",
+      "path": "requirements/security-secrets-management-req-010.json"
+    },
+    {
+      "id": "security-secrets-management-US-8101",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8101.json"
+    },
+    {
+      "id": "security-secrets-management-US-8102",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8102.json"
+    },
+    {
+      "id": "security-secrets-management-US-8103",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8103.json"
+    },
+    {
+      "id": "security-secrets-management-US-8104",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8104.json"
+    },
+    {
+      "id": "security-secrets-management-US-8105",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8105.json"
+    },
+    {
+      "id": "security-secrets-management-US-8106",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8106.json"
+    },
+    {
+      "id": "security-secrets-management-US-8107",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8107.json"
+    },
+    {
+      "id": "security-secrets-management-US-8108",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8108.json"
+    },
+    {
+      "id": "security-secrets-management-US-8109",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8109.json"
+    },
+    {
+      "id": "security-secrets-management-US-8110",
+      "kind": "us",
+      "path": "user-stories/security-secrets-management-us-8110.json"
+    },
+    {
+      "id": "TAC-901-security-secrets-management-manager-client",
+      "kind": "tac",
+      "path": "tacs/tac-901-security-secrets-management-manager-client.json"
+    },
+    {
+      "id": "TAC-902-security-secrets-management-manifest",
+      "kind": "tac",
+      "path": "tacs/tac-902-security-secrets-management-manifest.json"
+    },
+    {
+      "id": "TAC-903-security-secrets-management-env-reflector",
+      "kind": "tac",
+      "path": "tacs/tac-903-security-secrets-management-env-reflector.json"
+    },
+    {
+      "id": "TAC-904-security-secrets-management-rotation-gate",
+      "kind": "tac",
+      "path": "tacs/tac-904-security-secrets-management-rotation-gate.json"
+    },
+    {
+      "id": "TAC-905-security-secrets-management-agent-cli",
+      "kind": "tac",
+      "path": "tacs/tac-905-security-secrets-management-agent-cli.json"
+    },
     {
       "id": "ADR-901-security-secrets-management-secrets-source",
       "kind": "adr",
@@ -36,9 +138,44 @@
       "scope": "global",
       "topic": "secretsSource"
     },
-    { "id": "ADR-902-security-secrets-management-default-vendor", "kind": "adr", "path": "adrs/adr-902-security-secrets-management-default-vendor.json" },
-    { "id": "ADR-903-security-secrets-management-agent-access-discipline", "kind": "adr", "path": "adrs/adr-903-security-secrets-management-agent-access-discipline.json" },
-    { "id": "ADR-904-security-secrets-management-dotenv-reflection", "kind": "adr", "path": "adrs/adr-904-security-secrets-management-dotenv-reflection.json" },
-    { "id": "ADR-905-security-secrets-management-rotation-and-audit", "kind": "adr", "path": "adrs/adr-905-security-secrets-management-rotation-and-audit.json" }
+    {
+      "id": "ADR-902-security-secrets-management-default-vendor",
+      "kind": "adr",
+      "path": "adrs/adr-902-security-secrets-management-default-vendor.json"
+    },
+    {
+      "id": "ADR-903-security-secrets-management-agent-access-discipline",
+      "kind": "adr",
+      "path": "adrs/adr-903-security-secrets-management-agent-access-discipline.json"
+    },
+    {
+      "id": "ADR-904-security-secrets-management-dotenv-reflection",
+      "kind": "adr",
+      "path": "adrs/adr-904-security-secrets-management-dotenv-reflection.json"
+    },
+    {
+      "id": "ADR-905-security-secrets-management-rotation-and-audit",
+      "kind": "adr",
+      "path": "adrs/adr-905-security-secrets-management-rotation-and-audit.json"
+    }
+  ],
+  "elicits": [
+    {
+      "id": "environment-set",
+      "prompt": "Which environments does this project run in? Provide the ordered list (for example dev, ci, live). This becomes the manifest header and every `secrets.yaml` entry's `paths` object must key its per-environment path against this list exactly.",
+      "kind": "string",
+      "default": "dev,ci,live"
+    },
+    {
+      "id": "ui-outcome",
+      "prompt": "How should the Secrets Management operator surface be delivered on this project?",
+      "kind": "enum",
+      "default": "none",
+      "options": [
+        "integrate",
+        "admin-spa",
+        "none"
+      ]
+    }
   ]
 }

package/blueprints/security-secrets-management/contributions/requirements/security-secrets-management-req-001.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-902-security-secrets-management-manifest",
+    "field": "responsibilities.manifest"
+  }
 }

package/blueprints/security-secrets-management/contributions/requirements/security-secrets-management-req-002.json

@@ -2,7 +2,7 @@
   "reqId": "security-secrets-management-REQ-002",
   "prdId": "PRD-001",
   "title": "Secrets are read through one vendor-agnostic manager client interface",
-  "description": "The project imports a single Secrets Manager client that exposes the named verbs `get(name)`, `getRequired(name)`, `list()`, and `refresh()`. `get` returns the current value or null; `getRequired` throws a stable-coded error on absence; `list` returns the manifest-declared name set for this process; `refresh` re-reads every secret this process is authorised for. The client is the sole importer of the vendor binding on the boundary; no other module reaches for the vendor SDK, an environment variable, or a config file directly. The default vendor is named in ADR-902; the interface itself does not depend on which vendor is behind it.",
+  "description": "The project imports a single Secrets Manager client whose named-verb surface is owned by `TAC-901-security-secrets-management-manager-client` `responsibilities.get` and the sibling responsibilities on the same TAC (the read-by-name verb, the required-absent throw verb, the manifest-declared name enumeration, and the reauthorised re-read). The client is the sole importer of the vendor binding on the boundary; no other module reaches for the vendor SDK, an environment variable, or a config file directly. The default vendor is named in ADR-902; the interface itself does not depend on which vendor is behind it. The Secrets Manager client is what the blueprint contributes as the `secretsProvider` capability: it is the sole surface the project uses to read a secret value at runtime, and the applied capability set exposes the token so consumer blueprints (the auth blueprints, the delivery blueprints) can bind against it rather than accessing the vendor SDK directly.",
   "category": "functional",
   "domain": "security",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-901-security-secrets-management-manager-client",
+    "field": "responsibilities.vendorAdapter"
+  }
 }

package/blueprints/security-secrets-management/contributions/requirements/security-secrets-management-req-003.json

@@ -2,7 +2,7 @@
   "reqId": "security-secrets-management-REQ-003",
   "prdId": "PRD-001",
   "title": "Each process reads only the secrets its manifest slice declares (least-privilege)",
-  "description": "Each deployable in the project declares an explicit slice of the manifest it needs (by logical name). At boot the Secrets Manager client materialises credentials for exactly that slice and refuses to serve any other name for the lifetime of the process. A `get('X')` call for a name outside the declared slice throws a stable-coded refusal, even when `X` is a legal manifest entry for a different deployable. Vendor-side access policies are configured to grant this process's credentials read on exactly the declared slice and no other paths; the code-side refusal and the vendor-side deny are both required and both belong to the least-privilege posture.",
+  "description": "Each deployable in the project declares an explicit slice of the manifest it needs (by logical name). At boot the Secrets Manager client materialises credentials for exactly that slice and refuses to serve any other name for the lifetime of the process. A `get('X')` call for a name outside the declared slice throws a stable-coded refusal, even when `X` is a legal manifest entry for a different deployable. Vendor-side access policies are configured to grant this process's credentials read on exactly the declared slice and no other paths; the code-side refusal and the vendor-side deny are both required and both belong to the least-privilege posture. The least-privilege contract is enforced on the code side by the Secrets Manager client (which refuses `get` for any name outside the deployable's declared slice); vendor-side path-scoped credentialling is a per-vendor property. The default SOPS-with-age vendor cannot issue per-process path-scoped credentials, and access under it relies on the age key's file-system-level access; a project that requires vendor-side per-process denial supersedes ADR-902 with a vendor adapter (for example HashiCorp Vault or a cloud KMS) that carries the property.",
   "category": "nonFunctional",
   "domain": "security",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-901-security-secrets-management-manager-client",
+    "field": "responsibilities.slice"
+  }
 }

package/blueprints/security-secrets-management/contributions/requirements/security-secrets-management-req-004.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-901-security-secrets-management-manager-client",
+    "field": "responsibilities.audit"
+  }
 }