rcf-lite 0.26.0 → 0.28.0

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9111.json

@@ -16,7 +16,8 @@
       "when": "the harness enumerates test cases and their bound ACs",
       "then": "every TC bound to one of the enumerated ACs above has the `accountBound` marker set; TCs bound to other ACs (source-tree scans, in-process principal-shape assertions, adapter unit-shaped checks) do not carry the marker",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-9111-2",
@@ -25,7 +26,8 @@
       "when": "the run enumerates accountBound TCs",
       "then": "every accountBound TC records outcome `skipped` with reason field equal to `AUTH_CLERK_UNREACHABLE`; the ship gate report flags the skipped set; the run's overall status reflects the skip rather than a pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9112.json

@@ -0,0 +1,102 @@
+{
+  "usId": "security-auth-clerk-US-9112",
+  "prdId": "PRD-001",
+  "reqId": "security-auth-clerk-REQ-010",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "A signed-in caller lists their sessions, revokes one, and revokes all others in one call",
+  "asA": "operator signed in through the project's Clerk-hosted sign-in surface on two browsers at once",
+  "iWant": "the account-settings surface to show me every active session, let me terminate any one of them, and let me terminate every one except the current in one action",
+  "soThat": "I can end a stolen or forgotten session from wherever I am currently signed in, and I do not have to sign in on every device again to clean the list",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9112-1",
+      "description": "A `list()` call from an authenticated caller returns one row per active project session, each row shaped per `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` `SessionRow`.",
+      "given": "a caller signed in on two browsers, browser A holding the active `__session` cookie for session S1 and browser B for session S2",
+      "when": "browser A calls the session verifier's `sessionInventory.list()` interface",
+      "then": "the return value is an array of exactly two rows, one with `sessionId=S1` and `currentSession=true`, one with `sessionId=S2` and `currentSession=false`; each row carries a non-empty `deviceLabel` string and a `lastActive` ISO-8601 timestamp not in the future",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-9112-2",
+      "description": "`revoke(sessionId)` on a non-current session invalidates that session on Clerk's server; a subsequent request from the revoked browser fails verification.",
+      "given": "the two-browser setup from AC-9112-1 and the returned `sessionId=S2` row for browser B",
+      "when": "browser A calls `sessionInventory.revoke(\"S2\")` and then browser B replays a protected-route request carrying its `__session` cookie",
+      "then": "the revoke call returns successfully with no error; browser B's next request is treated as unauthenticated by the middleware within the `revocationCheckIntervalMs` window declared by ADR-1005; the audit sink records one `session_inventory.revoked` event carrying operation, a prefix of the session id, and a wall-clock timestamp, and no field carries the full session id or a cookie value",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-9112-3",
+      "description": "`revokeAllExceptCurrent()` invalidates every active session for the caller other than the one making the call; the caller's own session survives.",
+      "given": "a caller with three active sessions S1 (current), S2, S3",
+      "when": "the caller's browser calls `sessionInventory.revokeAllExceptCurrent()`",
+      "then": "the return value is `2`; a subsequent `list()` from the same browser returns exactly one row for S1 with `currentSession=true`; a replay from S2 or S3 is treated as unauthenticated within the ADR-1005 window",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-9112-4",
+      "description": "An unauthenticated call to any `sessionInventory` operation refuses with `SESSION_INVENTORY_UNAUTHENTICATED` and no side effect.",
+      "given": "a request with no `__session` cookie or a cookie that fails verification",
+      "when": "the caller invokes `sessionInventory.list()`, `sessionInventory.revoke(anySessionId)`, or `sessionInventory.revokeAllExceptCurrent()`",
+      "then": "each call throws `SESSION_INVENTORY_UNAUTHENTICATED`; no Clerk-side state changes for any active session; the audit sink records one `session_inventory.unauthenticated` event and no other",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-9112-5",
+      "description": "`revoke(sessionId)` against a session id the caller does not own, or a session already invalidated, refuses without a side effect.",
+      "given": "an authenticated caller and a `sessionId` value that either belongs to a different principal or names a session that Clerk already revoked",
+      "when": "the caller invokes `sessionInventory.revoke(sessionId)`",
+      "then": "the call throws `SESSION_INVENTORY_UNKNOWN_SESSION` naming the operation class and a prefix of the session id; no Clerk-side session state changes; the audit sink records one `session_inventory.unknown_session` event carrying operation, session id prefix and wall-clock timestamp",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-9112-6",
+      "description": "Every `sessionInventory` operation emits exactly one structured audit event that carries no cookie value and no full session id.",
+      "given": "an authenticated caller making one call each of `list`, `revoke(sessionId)`, and `revokeAllExceptCurrent`",
+      "when": "the three calls run in sequence",
+      "then": "the audit sink records exactly three events, one per call, each carrying `{ operation, sessionIdPrefix, at }`; no event's payload contains the `__session` cookie value, a full session id, or a raw Clerk claim; the `sessionIdPrefix` field is a substring of length no greater than eight characters",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-1003-security-auth-clerk-session-verifier"
+  ],
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/blueprints/security-auth-clerk/contributions/user-stories/security-auth-clerk-us-9113.json

@@ -0,0 +1,103 @@
+{
+  "usId": "security-auth-clerk-US-9113",
+  "prdId": "PRD-001",
+  "reqId": "security-auth-clerk-REQ-011",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Session verification and sessionInventory operations each emit one structured audit event on the fixed allow-list",
+  "asA": "operator running the runtime-verify suite against the Clerk session verifier and its sessionInventory surface",
+  "iWant": "every verification attempt and every sessionInventory operation to write one structured event carrying only the allow-list fields",
+  "soThat": "the audit stream stays free of cookie material and every refusal has a stable reasonClass a reviewer can gate on",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-9113-1",
+      "description": "A completed session verification emits exactly one structured audit event identified by the tuple (`operation=verify`, `outcome=verified`), carrying a session id prefix no longer than eight characters.",
+      "given": "an authenticated request carrying a valid `__session` cookie for a Clerk session S1",
+      "when": "the session verifier verifies the cookie value",
+      "then": "the audit sink records exactly one event whose own-property keys are drawn from `{outcome, operation, reasonClass, sessionIdPrefix, at, principalIdPrefix}` with `outcome=verified` and `operation=verify`; the `__session` cookie value, the full session id, and any raw Clerk claim record are not present in any field; `sessionIdPrefix` is a substring of length no greater than eight characters",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "responsibilities.audit"
+      }
+    },
+    {
+      "id": "AC-9113-2",
+      "description": "A session verification against a `__session` cookie whose Clerk-side expiry has passed emits exactly one audit event identified by the tuple (`operation=verify`, `outcome=refused`) with `reasonClass=expired`; the reasonClass is the single value bound to that input, not one of a set.",
+      "given": "a request carrying a `__session` cookie whose Clerk-side expiry has passed",
+      "when": "the session verifier verifies the cookie value",
+      "then": "the audit sink records exactly one event with `outcome=refused`, `operation=verify`, and `reasonClass=expired`; the event carries `sessionIdPrefix` (no longer than eight characters) and `at`; no cookie value or full session id appears in any field",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "responsibilities.audit"
+      }
+    },
+    {
+      "id": "AC-9113-3",
+      "description": "A sessionInventory operation that first refuses on `unknown_session` and then succeeds on a subsequent call for a valid session id emits exactly one refused event and one verified event, in order; the retry itself is not a distinct event.",
+      "given": "an authenticated caller who first calls `sessionInventory.revoke(unknownSessionId)` and then calls `sessionInventory.revoke(validSessionId)`",
+      "when": "the two calls run in sequence",
+      "then": "the audit sink records exactly two events in order: one with `operation=revoke`, `outcome=refused`, and `reasonClass=unknown_session`, then one with `operation=revoke` and `outcome=verified`; each event carries a `sessionIdPrefix` no longer than eight characters; no full session id or cookie value appears",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "responsibilities.audit"
+      }
+    },
+    {
+      "id": "AC-9113-4",
+      "description": "A sink failure during the emission of a verification audit event does not mask the underlying verification outcome; the mechanism records a `clerk.audit_sink_failed` warning event and the verification outcome is unchanged.",
+      "given": "a valid `__session` cookie and an audit sink whose write throws",
+      "when": "the session verifier emits the completion event",
+      "then": "the verification return value still reports the underlying result unchanged (a verified session does not spuriously become unauthenticated, and a refusal does not spuriously become authenticated); the mechanism records a `clerk.audit_sink_failed` warning event carrying `operation` and a reason-class string; no cookie value or full session id appears",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "responsibilities.audit"
+      }
+    },
+    {
+      "id": "AC-9113-5",
+      "description": "An unauthenticated caller invoking a `sessionInventory.revoke(sessionId)` is refused: the audit sink records exactly one event identified by the tuple (`operation=revoke`, `outcome=refused`) with `reasonClass=unauthenticated`; no session state changes on the provider.",
+      "given": "a request with no verified session",
+      "when": "any `sessionInventory.revoke(sessionId)` is invoked",
+      "then": "the audit sink records exactly one event with `outcome=refused`, `operation=revoke`, and `reasonClass=unauthenticated`; the event carries `at`; no session is created, updated or removed on the provider; no cookie value or full session id appears in any field",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "responsibilities.audit"
+      }
+    },
+    {
+      "id": "AC-9113-6",
+      "description": "Verifying the same valid `__session` cookie twice is idempotent: each verify call emits exactly one audit event identified by the tuple (`operation=verify`, `outcome=verified`); two consecutive verifications produce two events (count is one per verify call, never a deduplicated event).",
+      "given": "a request carrying a valid `__session` cookie for a Clerk session S1, verified once already",
+      "when": "the session verifier verifies the same cookie value a second time",
+      "then": "the audit sink records exactly one additional event with `operation=verify` and `outcome=verified`; the total count of verify events across the two attempts is exactly two; each event's `sessionIdPrefix` is a substring of length no greater than eight characters; the verifier's return value is unchanged between calls",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "responsibilities.audit"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-1003-security-auth-clerk-session-verifier"
+  ],
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z",
+  "description": "Applying agent sets: no project-parameterised values on this story; every AC is `fixed`. AC-set sufficiency (7a inline note per blueprint-authoring.md §7a): the credential scenario class is bound by AC-1 (a valid `__session` cookie is the credential and the event records a bounded `sessionIdPrefix`). The permission scenario class is bound by AC-5 (an unauthenticated caller's `sessionInventory.revoke` refuses with `reasonClass=unauthenticated` and no side effect). Events are named by the tuple (`operation`, `outcome`) per REQ-011's allow-list; the blueprint does not carry a top-level `family` field on clerk audit events."
+}

package/blueprints/security-auth-clerk/docs/topics.md

@@ -14,7 +14,7 @@ Rules for new topics (inherited from the application-spa, application-api-rest,
 
 ## Id number bands (registry bootstrap)
 
-AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is ratified policy (2026-08-19); this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
+AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is policy; this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
 
 This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
 
@@ -59,8 +59,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 9101-9110 sit at the LOW end of the 9101-9899 band on purpose. A project-side story that mechanically derives from a security-auth-clerk REQ id into the number `9110` would collide against security-auth-clerk-US-9110 in this package; the band leaves headroom at the HIGH end (US 9181-9899) so a project's own stories anchored to security-auth-clerk REQs can allocate without conflict. The watchpost run4 lesson applies here too.
-
+US 9101-9110 sit at the LOW end of the 9101-9899 band on purpose. A project-side story that mechanically derives from a security-auth-clerk REQ id into the number `9110` would collide against security-auth-clerk-US-9110 in this package; the band leaves headroom at the HIGH end (US 9181-9899) so a project's own stories anchored to security-auth-clerk REQs can allocate without conflict.
 ADR and TAC suffixes for this blueprint widen to four digits (1001-1099) because the three-digit space fills at 9xx (security-secrets-management). Sibling round-2 auth blueprints (security-auth-oauth2, security-auth-keycloak) will continue the widening at 1101-1199 and 1201-1299 respectively; the shipped shelf has not carried four-digit suffixes before this blueprint, so the fallback rule on this PR's cover note applies if the rcf-schemas grammar refuses that shape.
 
 ## Shared expectations for future composing blueprints

package/blueprints/security-auth-keycloak/CHANGELOG.md

@@ -1,9 +1,39 @@
 # security-auth-keycloak CHANGELOG
 
-## 1.2.0 (visual round T-4, spec 2026-09-06 section 5.4.2, Baz Q2 default)
+## 1.4.4 - 2026-09-11
 
-- Declares `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory]` on `blueprint.json`. Additive per section 6 of `blueprint-authoring.md`. Consumed at apply time by the visual round T-4 `application-account-settings` blueprint to gate the security surface self-service branch (probe pack check `AC-25105-1`) and the sessions surface (`AC-25106-1`). Keycloak ships a credential self-service surface (password change, MFA management, email change) that a project can bring in-place and it exposes an active-session inventory a terminate action can act on. Keycloak does NOT declare `hostedIdentityUi` because its hosted-UI is realm-scoped and Keycloak deployments typically brand it in place, so the account-settings blueprint does not treat Keycloak as a hosted-UI provider.
+- Criterion-e probe pack refinement: every conformance-only result row now records `anchorAcId: null` alongside a `limitation` that opens with a shipped AC id from the blueprint's user stories (introspection `REQ-004` rows move to `AC-11105-1`; JWT `REQ-003` row moves to `AC-11104-2`; role-adapter `REQ-006` row moves to `AC-11107-3`). The retained live-branch anchor on `real-account-realm-round-trip` (`AC-11112-2`) is unchanged and honest-skips on `CI_HAS_KEYCLOAK_ACCOUNT`; when skipped the row records `engine: keycloak`, not `engine: skip:...`. Detail strings on de-claimed rows describe only what was observed at the fixture-parser or fixture-verifier surface and no longer claim a REQ or AC as observed end to end. The anatomy helper enforces conformance-only rows to satisfy `anchorAcId === null`, requires limitations to open with an `AC-<n>-<n>` id that resolves to a shipped acceptance criterion on the blueprint's user stories (REQ-prefixed anchors are refused and fabricated ids are rejected), and does not count pre-delete presence as an absence observation on the inventory-diff shape.
 
-## 1.1.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
+## 1.4.3 - 2026-09-11
 
-- Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round T-5 `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.
+- Every conformance-only anchor on the criterion-e probe pack is de-claimed to `conformanceOnly` with a limitation naming the shipped AC that is observable only in the integration harness follow-up; the retained live-branch anchor on `real-account-realm-round-trip` (`AC-11112-2`) is preserved and honest-skips on `CI_HAS_KEYCLOAK_ACCOUNT`. `discovery-shape`, `jwt-verifier-shape`, `introspection-shape` and `role-adapter-shape` rows keep their fixture-layer observations under the same shape.
+
+## 1.4.2 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering the four declared capabilities: `discovery-shape` (principalDirectory; OIDC discovery URL derivation and validator), `jwt-verifier-shape` (credentialSelfService; node:crypto RS256 sign+verify with alg/exp/iss/signature-tamper refusal paths on throwaway keys), `introspection-shape` (sessionInventory; RFC 7662 request/response shape), `role-adapter-shape` (roleModel; realm+resource-access role mapper). `real-account-realm-round-trip` (LIVE) honest-skips on `CI_HAS_KEYCLOAK_ACCOUNT` because this estate does not expose a Keycloak client to shelf probes. Fixture at `packages/rcf-lite/test/fixtures/security-auth-keycloak/` declares every env var the pack reads; anatomy test pins pack shape, fixture manifest and the account-bound skip contract.
+- Iteration on the probe pack labelled every local-fixture row `engine: fixture`, redacted the placeholder client secret out of the introspection body evidence, and settled `aggregate([])` / null-result normalisation to `detail: 'no checks ran'` exactly. `real-account-realm-round-trip` honest-skips on `CI_HAS_KEYCLOAK_ACCOUNT`; when skipped the record's `engine.kind` remains `keycloak`. Slug reads AMBER on criterion e.
+
+## 1.4.1
+
+## 1.4.0
+
+- Adds `US-11116`, `US-11117`, `US-11118`, `US-11119`, `US-11120` binding stories to the five audit-surface must requirements `REQ-015` (discovery and account-console), `REQ-016` (JWT), `REQ-017` (introspection), `REQ-018` (route and sessionInventory), and `REQ-019` (roles). Each story ships one AC per success, refusal, retry and boundary path on the delivering mechanism, with `ownerRef` at the owning TAC and its audit-emission responsibility. Rewrites `US-11115` `AC-1` to reference the local `TAC-1204-security-auth-keycloak-provider-router` `responsibilities.sessionInventory` and updates the sibling ACs to the same local owner (the interface shape remains owned by `TAC-1003-security-auth-clerk-session-verifier` `interfaces.sessionInventory` and is referenced by that owner id). Rewrites `REQ-005.description` to reference `TAC-1204-security-auth-keycloak-provider-router` `responsibilities.route` rather than restate the `{ realmSlug, verificationMode }` shape verbatim.
+- On the audit stories: extends `TAC-1201` with a named `discoveryAudit` responsibility and repoints `REQ-015.deliveredBy` and every `US-11116` `ownerRef` at it; tightens the refusal oracles on `AC-11116-2`, `AC-11117-2`, and `AC-11118-2` from a category or example to a specific input-to-reasonClass binding; adds an idempotency AC to `US-11116`, `US-11117`, `US-11118`, `US-11119`, `US-11120` naming the event count per repeat call; adds `AC-11118-5` (non-2xx `upstream_error` path), `AC-11119-5` (revoke-one), `AC-11119-6` (revoke-all-except-current) so every named `REQ-018` interaction is independently bound; adds a 7a inline note in each audit story's `description` documenting the credential and permission scenario-class mapping (bound to an AC, or not applicable with the reason).
+- Adds explicit credential and permission acceptance criteria on every audit-event story where they were previously carried as prose only. Adds `AC-11116-6` (credential: realm-config `realmSlug` is the credential the discovery fetch is bound to and the event records the realm principal in the `realmSlug` payload field) and `AC-11116-7` (permission: `accountConsoleUrl` origin that differs from the discovered issuer origin is refused with `reasonClass=account_console_malformed`). Adds `AC-11117-6` (permission: `audience_mismatch` binds the audience-scope refusal) and `AC-11117-7` (issuer_mismatch), so every `REQ-016` named refusal reason is bound to a concrete AC. Tightens `AC-11118-3` to name `reasonClass=upstream_error` as the concrete 503-retry oracle and adds `AC-11118-7` (permission: an upstream `401 Unauthorized` on the client credentials is refused with `reasonClass=client_forbidden`). Adds `AC-11120-6` (permission: an absent role-claim path is refused with `reasonClass=roles_absent`). Updates each story's `description` 7a inline note to reference the new ACs and removes every "not applicable" clause the ACs replace.
+
+## 1.3.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.3.0 (2026-09-09)
+
+- Adds `REQ-013`/`US-11114` (credentialSelfService: realm-config `accountConsoleUrl`, boot-time verification, `getCredentialSelfServiceUrl` helper), `REQ-014`/`US-11115` (sessionInventory: list, revoke-one, revoke-all-except-current, unauthenticated refusal, unknown-session refusal), and `REQ-015` (cross-cutting audit surface with a fixed field allow-list, token exclusion, and sink-failure posture). Adds a composition clause on `REQ-001` naming `security-auth-oauth2` as the required flow-controller and session-bridge owner. Extends `TAC-1201` with the account-console verification responsibility and `TAC-1204` with the sessionInventory responsibility. Adds `elicits[]` for `bootPosture` (strict/deferred/standby) and `verificationMode` (jwks/introspection) already described in prose. Adds `deliveredBy` on every `must` requirement and `disposition` on every existing acceptance criterion; adds `ownerRef` on ACs that observe interfaces owned by other TACs. Names the `principalDirectory` and `roleModel` capabilities on the requirements that carry their runtime clauses.
+- Moves the composition requirement from a REQ-level `requiresAppliedCapabilities` array (a level the apply gate never reads) to a `blueprint.json:requiresAppliedCapabilities` gate on `authorisationCodeFlow` with override `--allow-no-auth-yet` and stable id `security-auth-keycloak-flow-required`; `REQ-001` now points at that manifest gate. Narrows `REQ-015` to the discovery-client and account-console audit families (TAC-1201) and adds four must REQs (`REQ-016` JWT, `REQ-017` introspection, `REQ-018` route + sessionInventory, `REQ-019` roles), each with its own `deliveredBy` and a companion audit responsibility line on the target TAC. Rewrites `US-11115` `AC-1` to reference the `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` `SessionRow` shape rather than restating its fields.
+
+## 1.2.0 (visual round, spec 2026-09-06 section 5.4.2, operator Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory]` on `blueprint.json`. Additive per section 6 of `blueprint-authoring.md`. Consumed at apply time by the visual round `application-account-settings` blueprint to gate the security surface self-service branch (probe pack check `AC-25105-1`) and the sessions surface (`AC-25106-1`). Keycloak ships a credential self-service surface (password change, MFA management, email change) that a project can bring in-place and it exposes an active-session inventory a terminate action can act on. Keycloak does NOT declare `hostedIdentityUi` because its hosted-UI is realm-scoped and Keycloak deployments typically brand it in place, so the account-settings blueprint does not treat Keycloak as a hosted-UI provider.
+
+## 1.1.0 (visual round, spec 2026-09-04 section 5.5.2, operator Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.

package/blueprints/security-auth-keycloak/README.md

@@ -3,7 +3,7 @@
 The twelfth content blueprint on the rcf-build-lite blueprint mechanism, category `security`. A Keycloak-committed sibling to `security-auth-magic-link`, `security-auth-clerk`, and `security-auth-oauth2` on the `authModel` global topic. Identity is delegated to a Keycloak realm the operator runs; the project owns the discovery client, the token verifier (JWKS or introspection per realm), the role adapter, the provider-routing seam, and the optional application session on top. Targeted at rcf-lite projects that have committed to a self-hosted Keycloak realm (or are running one already) and want the Keycloak-shaped decisions the vendor-neutral `security-auth-oauth2` sibling deliberately does not fix.
 
 
-> Latest: **v1.2.0** (visual round T-4, 2026-09-06). `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory]`. See [CHANGELOG.md](CHANGELOG.md).
+> Latest: **v1.4.1** (2026-09-10). `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory]`. See [CHANGELOG.md](CHANGELOG.md).
 
 ## Apply
 
@@ -33,9 +33,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the Keycloak realm as identity source, the OIDC discovery contract, the JWKS-with-rotation-cache verification path, the RFC 7662 introspection path, the provider-routing seam, the Keycloak client-roles / realm-roles claim shape, the refresh-and-sign-out posture inherited from the realm, the session-vs-token separation, the local-first stand-up shape, the fail-safe boot postures, the runtime-verify posture with accountBound cloud smokes); the implementing agent derives the HOW-tasks (FBS) in the host project.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the Keycloak realm as identity source, the OIDC discovery contract, the JWKS-with-rotation-cache verification path, the RFC 7662 introspection path, the provider-routing seam, the Keycloak client-roles / realm-roles claim shape, the refresh-and-sign-out posture inherited from the realm, the session-vs-token separation, the local-first stand-up shape, the fail-safe boot postures, the runtime-verify posture with accountBound cloud smokes); the implementing agent derives the HOW-tasks (FBS) in the host project.
 
 Deliberately not contributed: the OAuth2 authorisation-code flow controller itself (a project either draws it from the sibling `security-auth-oauth2` blueprint or authors one above this blueprint's five TACs; the Keycloak-committed decisions here bind the flow controller's provider adapter to a Keycloak realm and no more); a specific HTTP framework adapter (the middleware wiring is framework-agnostic; framework adapters are a project responsibility); a specific session-record store (opaque-handle mode injects it; in-memory is the reference default; a persistence-composed project points at a table); MFA specifics (Keycloak owns MFA at the realm surface); real realm data (a placeholder `example` realm name is the shape; no lifted config); any specific second identity provider (the provider-routing seam is generic; the blueprint does not name a second issuer, per the ratified reshape ruling).
 

package/blueprints/security-auth-keycloak/blueprint.json

@@ -1,7 +1,14 @@
 {
   "slug": "security-auth-keycloak",
-  "version": "1.2.0",
+  "version": "1.4.4",
   "category": "security",
+  "requiresAppliedCapabilities": {
+    "capabilities": [
+      "authorisationCodeFlow"
+    ],
+    "allowSkipFlag": "allow-no-auth-yet",
+    "refusalMessageId": "security-auth-keycloak-flow-required"
+  },
   "capabilities": [
     "principalDirectory",
     "roleModel",
@@ -190,6 +197,100 @@
       "id": "ADR-1206-security-auth-keycloak-refresh-and-sign-out-posture",
       "kind": "adr",
       "path": "adrs/adr-1206-security-auth-keycloak-refresh-and-sign-out-posture.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-013",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-013.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11114",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11114.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-014",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-014.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11115",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11115.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-015",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-015.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-016",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-016.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-017",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-017.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-018",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-018.json"
+    },
+    {
+      "id": "security-auth-keycloak-REQ-019",
+      "kind": "req",
+      "path": "requirements/security-auth-keycloak-req-019.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11116",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11116.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11117",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11117.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11118",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11118.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11119",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11119.json"
+    },
+    {
+      "id": "security-auth-keycloak-US-11120",
+      "kind": "us",
+      "path": "user-stories/security-auth-keycloak-us-11120.json"
     }
-  ]
+  ],
+  "elicits": [
+    {
+      "id": "boot-posture",
+      "prompt": "How should the blueprint behave when a realm's OIDC discovery is not reachable at boot?",
+      "kind": "enum",
+      "default": "strict",
+      "options": [
+        "strict",
+        "deferred",
+        "standby"
+      ]
+    },
+    {
+      "id": "verification-mode",
+      "prompt": "How should the blueprint verify tokens for a given realm?",
+      "kind": "enum",
+      "default": "jwks",
+      "options": [
+        "jwks",
+        "introspection"
+      ]
+    }
+  ],
+  "updatedAt": "2026-09-11T15:37:12.000Z"
 }

package/blueprints/security-auth-keycloak/contributions/probes/discovery-shape.mjs

@@ -0,0 +1,68 @@
+// OIDC discovery-URL derivation and document-shape probe for
+// security-auth-keycloak. Conformance-only. Every row records
+// anchorAcId=null with a limitation naming the shipped AC whose
+// boot-time fetch/population/refusal property the fixture discovery
+// client does not observe. The integration harness follow-up is
+// the surface where the AC-level properties become observable.
+//
+// capability: principalDirectory. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-keycloak', 'src');
+
+export const anchorAcId = null;
+export const capability = 'principalDirectory';
+export const accountBound = false;
+
+const LIM_URL = 'security-auth-keycloak-AC-11102-1: probe checks URL derivation and doc-shape refusal only; the AC states the boot-time discovery fetch fills a cache read at request time, which needs a real Keycloak realm and boot lifecycle (auth integration harness follow-up).';
+const LIM_REFUSAL = 'security-auth-keycloak-AC-11102-3: probe checks validator refusal only; the AC states the boot itself refuses when the discovery document is malformed, which needs the boot lifecycle (auth integration harness follow-up).';
+
+export default async function runProbe() {
+  const { buildDiscoveryUrl, validateDiscoveryDocument } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'discovery-client.mjs')).href);
+  const results = [];
+
+  const built = buildDiscoveryUrl({ baseUrl: 'https://keycloak.example.com/', realm: 'example-realm' });
+  const expected = 'https://keycloak.example.com/realms/example-realm/.well-known/openid-configuration';
+  results.push(deClaim({
+    capability,
+    verdict: built.ok && built.discoveryUrl === expected ? 'pass' : 'fail',
+    detail: `discovery URL construction (well-formed input): ok=${built.ok} url=${built.discoveryUrl}`,
+    evidence: { input: { baseUrl: 'https://keycloak.example.com/', realm: 'example-realm' }, adapterReturn: built },
+  }, { ac: 'security-auth-keycloak-AC-11102-1', limitation: LIM_URL }));
+
+  const insecure = buildDiscoveryUrl({ baseUrl: 'http://insecure.example.com', realm: 'example-realm' });
+  results.push(deClaim({
+    capability,
+    verdict: !insecure.ok && /must be https/.test(insecure.error) ? 'pass' : 'fail',
+    detail: `insecure baseUrl refusal: ok=${insecure.ok} error=${JSON.stringify(insecure.error)}`,
+    evidence: { adapterReturn: insecure },
+  }, { ac: 'security-auth-keycloak-AC-11102-1', limitation: LIM_URL }));
+
+  const missing = validateDiscoveryDocument({ issuer: 'x', authorization_endpoint: 'x' });
+  results.push(deClaim({
+    capability,
+    verdict: !missing.ok && /missing required fields/.test(missing.error) ? 'pass' : 'fail',
+    detail: `doc-shape missing-fields refusal: ok=${missing.ok} error=${JSON.stringify(missing.error)}`,
+    evidence: { validatorReturn: missing },
+  }, { ac: 'security-auth-keycloak-AC-11102-3', limitation: LIM_REFUSAL }));
+
+  const good = validateDiscoveryDocument({
+    issuer: 'https://kc.example.com/realms/dev',
+    authorization_endpoint: 'https://kc.example.com/realms/dev/protocol/openid-connect/auth',
+    token_endpoint: 'https://kc.example.com/realms/dev/protocol/openid-connect/token',
+    jwks_uri: 'https://kc.example.com/realms/dev/protocol/openid-connect/certs',
+  });
+  results.push(deClaim({
+    capability,
+    verdict: good.ok ? 'pass' : 'fail',
+    detail: `well-formed doc passes validation: ok=${good.ok} endpoints=${JSON.stringify(good.endpoints || good.error)}`,
+    evidence: { validatorReturn: good },
+  }, { ac: 'security-auth-keycloak-AC-11102-1', limitation: LIM_URL }));
+
+  return { results, extra: {} };
+}

package/blueprints/security-auth-keycloak/contributions/probes/introspection-shape.mjs

@@ -0,0 +1,88 @@
+// RFC 7662 introspection request/response shape probe for
+// security-auth-keycloak. Conformance-only. Every row records
+// anchorAcId=null with a limitation naming the shipped AC whose
+// HTTP introspection round-trip the fixture parser observation does
+// not exercise. The integration harness follow-up is the surface
+// where the AC-level properties become observable.
+//
+// capability: sessionInventory. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-keycloak', 'src');
+
+export const anchorAcId = null;
+export const capability = 'sessionInventory';
+export const accountBound = false;
+
+const LIM_REQ = 'security-auth-keycloak-AC-11105-1: probe builds an introspection form body against the fixture parser; the AC states the client issues a real POST to the introspection endpoint with HTTP Basic authentication and consumes the JSON body, which requires observing the deployed client through the integration harness follow-up.';
+const LIM_PARSE = 'security-auth-keycloak-AC-11105-1: probe parses a fabricated introspection object; the AC states an opaque token round-trips through the introspection endpoint, needs the integration harness (the auth integration harness follow-up).';
+const LIM_INACTIVE = 'security-auth-keycloak-AC-11105-2: probe observes fixture parser only; the AC requires the client-layer refusal (4xx + KEYCLOAK_INTROSPECTION_INACTIVE + no cookie + audit event), needs the integration harness (the auth integration harness follow-up).';
+const LIM_MALFORMED = 'security-auth-keycloak-AC-11105-3: probe parses a malformed shape locally; the AC states the endpoint returns a non-2xx response with KEYCLOAK_INTROSPECTION_ENDPOINT_ERROR, needs the integration harness (the auth integration harness follow-up).';
+
+export default async function runProbe() {
+  const { buildIntrospectionForm, parseIntrospectionResponse } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'introspection-client.mjs')).href);
+  const results = [];
+
+  function redactedBody(req) {
+    if (!req || !req.body) return req;
+    const params = new URLSearchParams(req.body);
+    const keys = [...params.keys()].sort();
+    const redacted = {};
+    for (const k of keys) redacted[k] = k === 'client_secret' ? '[REDACTED]' : params.get(k);
+    return { ok: req.ok, error: req.error, bodyKeys: keys, bodyRedacted: redacted };
+  }
+
+  const req = buildIntrospectionForm({ token: 'tok-abc', clientId: 'client-x', clientSecret: 'PLACEHOLDER_SECRET' });
+  const reqEv = redactedBody(req);
+  const hasFields = req.ok
+    && reqEv.bodyKeys.includes('token')
+    && reqEv.bodyKeys.includes('client_id')
+    && reqEv.bodyKeys.includes('client_secret')
+    && reqEv.bodyRedacted.token === 'tok-abc'
+    && reqEv.bodyRedacted.client_id === 'client-x';
+  results.push(deClaim({
+    capability,
+    verdict: hasFields ? 'pass' : 'fail',
+    detail: `form built (client_secret redacted): ok=${req.ok} bodyKeys=${JSON.stringify(reqEv.bodyKeys)}`,
+    evidence: { adapterReturn: reqEv },
+  }, { ac: 'security-auth-keycloak-AC-11105-1', limitation: LIM_REQ }));
+
+  const badReq = buildIntrospectionForm({ token: '', clientId: 'x', clientSecret: 'PLACEHOLDER_SECRET_2' });
+  results.push(deClaim({
+    capability,
+    verdict: !badReq.ok && /token required/.test(badReq.error) ? 'pass' : 'fail',
+    detail: `empty-token refusal: ok=${badReq.ok} error=${JSON.stringify(badReq.error)}`,
+    evidence: { adapterReturn: { ok: badReq.ok, error: badReq.error } },
+  }, { ac: 'security-auth-keycloak-AC-11105-1', limitation: LIM_REQ }));
+
+  const active = parseIntrospectionResponse({ active: true, sub: 'user-1', scope: 'openid profile', username: 'alice' });
+  results.push(deClaim({
+    capability,
+    verdict: active.ok && active.active && active.principalId === 'user-1' ? 'pass' : 'fail',
+    detail: `active:true parses to claim record: ok=${active.ok} principalId=${active.principalId} scope=${active.scope}`,
+    evidence: { parserReturn: active },
+  }, { ac: 'security-auth-keycloak-AC-11105-1', limitation: LIM_PARSE }));
+
+  const inactive = parseIntrospectionResponse({ active: false });
+  results.push(deClaim({
+    capability,
+    verdict: inactive.ok && inactive.active === false ? 'pass' : 'fail',
+    detail: `active:false parses (parser only): ok=${inactive.ok} active=${inactive.active}`,
+    evidence: { parserReturn: inactive, notObservableAt: 'parser-layer' },
+  }, { ac: 'security-auth-keycloak-AC-11105-2', limitation: LIM_INACTIVE }));
+
+  const malformed = parseIntrospectionResponse({ status: 'unknown' });
+  results.push(deClaim({
+    capability,
+    verdict: !malformed.ok && /missing boolean/.test(malformed.error) ? 'pass' : 'fail',
+    detail: `malformed-payload refused (parser only): ok=${malformed.ok} error=${JSON.stringify(malformed.error)}`,
+    evidence: { parserReturn: malformed },
+  }, { ac: 'security-auth-keycloak-AC-11105-3', limitation: LIM_MALFORMED }));
+
+  return { results, extra: {} };
+}