rcf-lite 0.26.0 → 0.28.0

package/blueprints/security-auth-keycloak/contributions/probes/jwt-verifier-shape.mjs

@@ -0,0 +1,86 @@
+// JWT verifier shape probe for security-auth-keycloak.
+// Conformance-only. Every row records anchorAcId=null with a
+// limitation naming the shipped AC whose JWKS/handler/audit
+// property the local RS256 sign+verify observation does not
+// exercise. The integration harness follow-up is the surface where
+// the AC-level properties become observable.
+//
+// capability: credentialSelfService. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-keycloak', 'src');
+
+export const anchorAcId = null;
+export const capability = 'credentialSelfService';
+export const accountBound = false;
+
+const LIM_KID = 'security-auth-keycloak-AC-11103-1: probe verifies against an in-process public key; the AC requires JWKS-cache resolution by kid, needs the integration harness (the auth integration harness follow-up).';
+const LIM_SIG = 'security-auth-keycloak-AC-11104-2: probe verifies against a static public key; the AC requires refresh-then-refuse when the kid is unpublished, needs the integration harness (the auth integration harness follow-up).';
+const LIM_EXP = 'security-auth-keycloak-AC-11104-1: probe checks expiry-refusal on a synthetic token; the AC requires session absence + 4xx + audit event at the request handler, needs the integration harness (the auth integration harness follow-up).';
+const LIM_ISS = 'security-auth-keycloak-AC-11117-7: probe observes iss mismatch refusal; the AC states an audit event with reasonClass=issuer_mismatch is emitted at the handler, needs the integration harness (the auth integration harness follow-up).';
+const LIM_ALG = 'security-auth-keycloak-AC-11104-2: probe observes alg=none refusal on the local verifier; the AC states the verifier refuses a token signed under an unpublished key with KEYCLOAK_JWT_SIGNATURE_INVALID after one JWKS refresh, which requires observing the deployed verifier through the integration harness follow-up.';
+
+export default async function runProbe() {
+  const { generateThrowawayKeypair, signRs256, verifyRs256 } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'jwt-verifier.mjs')).href);
+  const { privateKey, publicKey } = generateThrowawayKeypair();
+  const results = [];
+  const iss = 'https://kc.example.com/realms/example-realm';
+  const now = Math.floor(Date.now() / 1000);
+  const payload = { sub: 'user-abc', iss, exp: now + 300, iat: now };
+  const token = signRs256({ header: { alg: 'RS256', typ: 'JWT' }, payload, privateKey });
+
+  const good = verifyRs256({ token, publicKey, expectedIssuer: iss });
+  results.push(deClaim({
+    capability,
+    verdict: good.ok && good.payload && good.payload.sub === 'user-abc' ? 'pass' : 'fail',
+    detail: `well-formed RS256 verify against public key: ok=${good.ok} sub=${good.payload && good.payload.sub}`,
+    evidence: { verifierReturn: { ok: good.ok, sub: good.payload && good.payload.sub } },
+  }, { ac: 'security-auth-keycloak-AC-11103-1', limitation: LIM_KID }));
+
+  const parts = token.split('.');
+  const firstSigChar = parts[2].slice(0, 1);
+  const flipped = firstSigChar === 'A' ? 'B' : 'A';
+  const tampered = `${parts[0]}.${parts[1]}.${flipped}${parts[2].slice(1)}`;
+  const badSig = verifyRs256({ token: tampered, publicKey, expectedIssuer: iss });
+  results.push(deClaim({
+    capability,
+    verdict: !badSig.ok && /signature/.test(badSig.error) ? 'pass' : 'fail',
+    detail: `tampered-signature refused: ok=${badSig.ok} error=${JSON.stringify(badSig.error)}`,
+    evidence: { verifierReturn: badSig },
+  }, { ac: 'security-auth-keycloak-AC-11104-2', limitation: LIM_SIG }));
+
+  const expiredToken = signRs256({ header: { alg: 'RS256', typ: 'JWT' }, payload: { sub: 'x', iss, exp: now - 60 }, privateKey });
+  const badExp = verifyRs256({ token: expiredToken, publicKey, expectedIssuer: iss });
+  results.push(deClaim({
+    capability,
+    verdict: !badExp.ok && /expired/.test(badExp.error) ? 'pass' : 'fail',
+    detail: `past-exp refused: ok=${badExp.ok} error=${JSON.stringify(badExp.error)}`,
+    evidence: { verifierReturn: badExp },
+  }, { ac: 'security-auth-keycloak-AC-11104-1', limitation: LIM_EXP }));
+
+  const wrongIss = verifyRs256({ token, publicKey, expectedIssuer: 'https://kc.example.com/realms/other' });
+  results.push(deClaim({
+    capability,
+    verdict: !wrongIss.ok && /iss mismatch/.test(wrongIss.error) ? 'pass' : 'fail',
+    detail: `iss-mismatch refused: ok=${wrongIss.ok} error=${JSON.stringify(wrongIss.error)}`,
+    evidence: { verifierReturn: wrongIss },
+  }, { ac: 'security-auth-keycloak-AC-11117-7', limitation: LIM_ISS }));
+
+  const noneHeader = Buffer.from(JSON.stringify({ alg: 'none', typ: 'JWT' })).toString('base64url');
+  const nonePayload = Buffer.from(JSON.stringify({ sub: 'x', iss, exp: now + 300 })).toString('base64url');
+  const noneToken = `${noneHeader}.${nonePayload}.`;
+  const badAlg = verifyRs256({ token: noneToken, publicKey, expectedIssuer: iss });
+  results.push(deClaim({
+    capability,
+    verdict: !badAlg.ok && /alg must be RS256/.test(badAlg.error) ? 'pass' : 'fail',
+    detail: `alg=none refused: ok=${badAlg.ok} error=${JSON.stringify(badAlg.error)}`,
+    evidence: { verifierReturn: badAlg },
+  }, { ac: 'security-auth-keycloak-AC-11104-2', limitation: LIM_ALG }));
+
+  return { results, extra: {} };
+}

package/blueprints/security-auth-keycloak/contributions/probes/probe-utils.mjs

@@ -0,0 +1,180 @@
+// Shared helpers for security-auth-keycloak probes.
+//
+// Runtime-dependency posture:
+// - Local probes drive shipped-shape checks against the fixture at
+//   packages/rcf-lite/test/fixtures/security-auth-keycloak/ without
+//   contacting a real Keycloak realm.
+// - real-account-* probes call the Keycloak Admin REST API and
+//   OIDC endpoints against a live Keycloak realm when one is
+//   available. No live Keycloak client is available in this estate
+//   (no live realm is exposed to shelf probes in this estate), so the
+//   real-account probe honest-skips per rule 7d, recording
+//   accountBoundSkipped: true naming CI_HAS_KEYCLOAK_ACCOUNT.
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const SLUG = 'security-auth-keycloak';
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/security-auth-keycloak');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/security-auth-keycloak');
+
+export const DECLARED_ENV = Object.freeze([
+  'CI_HAS_KEYCLOAK_ACCOUNT',
+  'KEYCLOAK_BASE_URL',
+  'KEYCLOAK_REALM',
+  'KEYCLOAK_ADMIN_CLIENT_ID',
+  'KEYCLOAK_ADMIN_CLIENT_SECRET',
+  'KEYCLOAK_INTROSPECTION_TOKEN',
+]);
+
+// First-8-words-of-anchor helper. Each result row's `detail` starts
+// with the first eight words of the anchored AC's or REQ's
+// description text. Anchor lookup walks contributions/user-stories/
+// and contributions/requirements/ under the blueprint root and
+// caches the map on first call. Null / unknown / missing anchors
+// yield an empty prefix.
+import { readFileSync as _rf } from 'node:fs';
+import { readdirSync as _rd } from 'node:fs';
+let _anchorMap = null;
+function _loadAnchorMap() {
+  const map = new Map();
+  const dirs = [
+    { dir: resolve(PROJECT_ROOT, 'blueprints', SLUG, 'contributions', 'user-stories'), kind: 'ac' },
+    { dir: resolve(PROJECT_ROOT, 'blueprints', SLUG, 'contributions', 'requirements'), kind: 'req' },
+  ];
+  for (const { dir, kind } of dirs) {
+    let entries;
+    try { entries = _rd(dir); } catch { continue; }
+    for (const name of entries) {
+      if (!name.endsWith('.json')) continue;
+      let j;
+      try { j = JSON.parse(_rf(resolve(dir, name), 'utf8')); } catch { continue; }
+      if (kind === 'ac') {
+        const usId = j.usId;
+        for (const ac of (j.acceptanceCriteria || [])) {
+          // AC id in the shipped JSON is like "AC-9101-1"; the
+          // anchor form used by probes is "<slug>-AC-9101-1".
+          const key = `${SLUG}-${ac.id}`;
+          map.set(key, ac.description || '');
+        }
+      } else {
+        const key = j.reqId; // already "<slug>-REQ-###"
+        if (key) map.set(key, j.description || j.title || '');
+      }
+    }
+  }
+  return map;
+}
+export function first8Words(anchor) {
+  if (!anchor) return '';
+  if (!_anchorMap) _anchorMap = _loadAnchorMap();
+  const txt = _anchorMap.get(anchor) || '';
+  if (!txt) return '';
+  const words = txt.split(/\s+/).filter(Boolean).slice(0, 8).join(' ');
+  return words;
+}
+export function withAnchorPrefix(row) {
+  const prefix = first8Words(row.anchorAcId);
+  if (!prefix) return row;
+  const already = typeof row.detail === 'string' && row.detail.startsWith(prefix);
+  if (already) return row;
+  const oldDetail = row.detail || '';
+  return { ...row, detail: `${prefix} :: ${oldDetail}` };
+}
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export function isSkipped(results) {
+  return results.length > 0 && results.every((r) => r.accountBoundSkipped === true);
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  // Prefix every row's detail with the first eight words of its
+  // anchored AC or REQ description; unanchored rows are left alone.
+  const prefixedResults = (results || []).map(withAnchorPrefix);
+  const raw = aggregate(prefixedResults);
+  const aggregateVerdict = isSkipped(prefixedResults) ? 'pass' : raw;
+  const report = {
+    slug: 'security-auth-keycloak',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results: prefixedResults,
+    aggregateVerdict,
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = await mainFn();
+    if (!outcome || !Array.isArray(outcome.results) || outcome.results.length === 0) {
+      const results = [{
+        anchorAcId: 'unknown',
+        verdict: 'fail',
+        detail: 'no checks ran',
+      }];
+      const { report, path } = await writeReport({ probeName, engine, results });
+      process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+      process.stderr.write(`no-checks-ran fail written to ${path}\n`);
+      process.exitCode = 1;
+      return;
+    }
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{ anchorAcId: 'unknown', verdict: 'fail', detail: `probe threw: ${err && err.message ? err.message : String(err)}` }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+// De-claim helper. When the shipped AC does not observe what the probe observes, the row keeps its
+// verdict, evidence and engine as they are, but the anchor drops to null and the
+// row carries conformanceOnly:true plus a limitation string naming the AC that
+// this probe does NOT observe and why. The integration-harness follow-up (the auth integration harness follow-up)
+// is the surface where those AC-level properties become observable.
+export function deClaim(row, { ac, limitation }) {
+  const acId = ac || 'unknown-AC';
+  const limText = (limitation || '').trim();
+  const finalLim = /^(security-[a-z0-9-]+-)?(AC|REQ)-/.test(limText) ? limText : (limText ? `${acId}: ${limText}` : `${acId}: not observable at this probe surface; needs the integration harness (the auth integration harness follow-up)`);
+  const out = { ...row };
+  out.anchorAcId = null;
+  if ('anchorReqId' in out) delete out.anchorReqId;
+  out.conformanceOnly = true;
+  out.limitation = finalLim;
+  const tag = ` :: conformance-only (${finalLim})`;
+  if (typeof out.detail === 'string' && !out.detail.includes('conformance-only')) {
+    out.detail = out.detail + tag;
+  }
+  return out;
+}
+
+export function accountBoundSkippedResult(anchorAcId, capability, reason) {
+  return {
+    anchorAcId,
+    capability,
+    verdict: 'pass',
+    accountBoundSkipped: true,
+    reason,
+    detail: `accountBoundSkipped: ${reason} unset; probe did not execute against a real Keycloak realm. Set the missing var and re-run.`,
+  };
+}

package/blueprints/security-auth-keycloak/contributions/probes/real-account-realm-round-trip.mjs

@@ -0,0 +1,91 @@
+// Real-account Keycloak realm round-trip for security-auth-
+// keycloak. This estate does not expose a live Keycloak realm to
+// the probe pack. When the gate variable CI_HAS_KEYCLOAK_ACCOUNT is
+// unset the probe honest-skips per rule 7d naming that variable;
+// when every gate and second-tier variable is set the credential-
+// present branch returns a FAIL row with a NOT IMPLEMENTED detail
+// (no live round-trip has been authored) rather than silently
+// passing. The live branch is intended to discover the realm's
+// OIDC document, obtain an admin token via client credentials,
+// create a scratch user, read it back, and delete it, capturing
+// the Keycloak-assigned user id and every response's HTTP status
+// for evidence. It will be authored when an estate-owned realm is
+// wired to CI. The slug reads AMBER on criterion e until that
+// happens.
+//
+// capability: principalDirectory + sessionInventory (composite).
+// Anchor: AC-11112-2 (live cloud-hosted-realm smoke
+//   completes a full authorisation-code + PKCE round-trip and
+//   issues a project session whose Principal carries the
+//   deployment's realm slug).
+// accountBound: true.
+
+import { DECLARED_ENV, accountBoundSkippedResult } from './probe-utils.mjs';
+
+export const anchorAcId = 'security-auth-keycloak-AC-11112-2';
+export const capability = 'principalDirectory';
+export const accountBound = true;
+
+const SECOND_TIER_VARS = ['KEYCLOAK_BASE_URL', 'KEYCLOAK_REALM', 'KEYCLOAK_ADMIN_CLIENT_ID', 'KEYCLOAK_ADMIN_CLIENT_SECRET'];
+
+function gateResult(varName, value) {
+  if (value === undefined || value === '') return { kind: 'unset', reason: varName };
+  if (value !== 'true') return { kind: 'set-not-true', reason: `${varName}_SET_NOT_TRUE`, observedValue: value };
+  return { kind: 'true' };
+}
+
+export default async function runProbe() {
+  const gate = gateResult('CI_HAS_KEYCLOAK_ACCOUNT', process.env.CI_HAS_KEYCLOAK_ACCOUNT);
+  if (gate.kind === 'unset') {
+    return {
+      results: [accountBoundSkippedResult(anchorAcId, capability, 'CI_HAS_KEYCLOAK_ACCOUNT')],
+      extra: {
+        accountBoundSkipped: true,
+        reason: 'CI_HAS_KEYCLOAK_ACCOUNT',
+        envDeclared: [...DECLARED_ENV],
+        note: 'No live Keycloak client is available in this estate; no live realm is exposed to shelf probes. Local RFC 7662 introspection shape, RS256 verifier shape and role-adapter shape are proven by the local probes in this pack.',
+      },
+    };
+  }
+  if (gate.kind === 'set-not-true') {
+    return {
+      results: [{
+        anchorAcId, capability, verdict: 'fail',
+        detail: `AC-11112-2: CI_HAS_KEYCLOAK_ACCOUNT is set to "${gate.observedValue}" (not the string "true"). Gate refuses this shape; set the variable to the exact string "true" to run the live branch.`,
+        evidence: { gate: 'CI_HAS_KEYCLOAK_ACCOUNT', observedValue: gate.observedValue, expected: 'true' },
+      }],
+      extra: { gateMisconfigured: true, gate: 'CI_HAS_KEYCLOAK_ACCOUNT', envDeclared: [...DECLARED_ENV] },
+    };
+  }
+
+  // One result row per unset second-tier variable per rule 4.
+  const unsetRows = [];
+  for (const v of SECOND_TIER_VARS) {
+    if (!process.env[v]) {
+      unsetRows.push({
+        anchorAcId, capability, verdict: 'pass', accountBoundSkipped: true, reason: v,
+        detail: `accountBoundSkipped: ${v} unset. AC-11112-2 requires a live realm; set ${v} to run the live branch.`,
+      });
+    }
+  }
+  if (unsetRows.length > 0) {
+    return {
+      results: unsetRows,
+      extra: { accountBoundSkipped: true, unsetVars: unsetRows.map((r) => r.reason), envDeclared: [...DECLARED_ENV] },
+    };
+  }
+
+  // All credentials present but the live branch is not implemented
+  // in this estate. FAIL explicitly (never a misleading pass).
+  return {
+    results: [{
+      anchorAcId, capability, verdict: 'fail',
+      detail: 'AC-11112-2 live branch is NOT IMPLEMENTED. Every gate variable is set, but the estate has no wired live Keycloak realm and no round-trip code has been authored. Supplying credentials does not silently pass; the branch must be implemented before this result flips to pass. Local shape evidence is proven by the local probes in this pack; the live branch remains AMBER until an estate-owned realm is wired.',
+    }],
+    extra: {
+      envDeclared: [...DECLARED_ENV],
+      liveBranchImplemented: false,
+      note: 'implement admin-client credentials round-trip against KEYCLOAK_BASE_URL/KEYCLOAK_REALM/KEYCLOAK_ADMIN_CLIENT_ID/KEYCLOAK_ADMIN_CLIENT_SECRET here when the estate exposes a realm',
+    },
+  };
+}

package/blueprints/security-auth-keycloak/contributions/probes/role-adapter-shape.mjs

@@ -0,0 +1,69 @@
+// Keycloak role-adapter shape probe. Conformance-only. Every row
+// records anchorAcId=null with a limitation naming the shipped AC
+// whose verified-session behaviour the raw-claim fixture-adapter
+// observation does not exercise. The integration harness follow-up
+// is the surface where the AC-level properties become observable.
+//
+// capability: roleModel. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-keycloak', 'src');
+
+export const anchorAcId = null;
+export const capability = 'roleModel';
+export const accountBound = false;
+
+const LIM_CLIENT = 'security-auth-keycloak-AC-11107-1: probe receives a raw claim object, not a verified access token; the AC requires the client-roles path from a verified session, needs the integration harness (the auth integration harness follow-up).';
+const LIM_ABSENT = 'security-auth-keycloak-AC-11107-2: probe receives an empty raw claim object; the AC requires absent-claim behaviour on a verified session, needs the integration harness (the auth integration harness follow-up).';
+const LIM_MALFORMED = 'security-auth-keycloak-AC-11107-3: probe receives a raw claim object; the AC requires the malformed-claim refusal path on a verified session, needs the integration harness (the auth integration harness follow-up).';
+const LIM_REQ006 = 'security-auth-keycloak-AC-11107-3: probe observes an unknown-role refusal at the fixture adapter; the AC states a verified token whose expected claim path is present but not an array of strings is refused with KEYCLOAK_ROLES_MALFORMED, which requires observing the deployed adapter through the integration harness follow-up.';
+
+export default async function runProbe() {
+  const { mapKeycloakRoles, knownRoles } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'role-adapter.mjs')).href);
+  const results = [];
+
+  const clientOnly = mapKeycloakRoles({
+    resource_access: { 'app-x': { roles: ['editor', 'admin'] } },
+  }, { clientId: 'app-x', roleClaimShape: 'client-roles' });
+  results.push(deClaim({
+    capability,
+    verdict: clientOnly.ok && JSON.stringify(clientOnly.roles) === JSON.stringify(['editor', 'admin']) && clientOnly.source && clientOnly.source.client === 2 && (clientOnly.source.realm ?? 0) === 0 ? 'pass' : 'fail',
+    detail: `client-roles claim path lifts resource_access.<clientId>.roles: ok=${clientOnly.ok} roles=${JSON.stringify(clientOnly.roles)} source=${JSON.stringify(clientOnly.source)}`,
+    evidence: { adapterReturn: clientOnly, knownRoles },
+  }, { ac: 'security-auth-keycloak-AC-11107-1', limitation: LIM_CLIENT }));
+
+  const absentPath = mapKeycloakRoles({}, { clientId: 'app-x', roleClaimShape: 'client-roles' });
+  results.push(deClaim({
+    capability,
+    verdict: absentPath.ok && Array.isArray(absentPath.roles) && absentPath.roles.length === 0 ? 'pass' : 'fail',
+    detail: `absent-claim yields empty roles: ok=${absentPath.ok} roles=${JSON.stringify(absentPath.roles)}`,
+    evidence: { adapterReturn: absentPath },
+  }, { ac: 'security-auth-keycloak-AC-11107-2', limitation: LIM_ABSENT }));
+
+  const nonArray = mapKeycloakRoles({
+    resource_access: { 'app-x': { roles: 'admin' } },
+  }, { clientId: 'app-x', roleClaimShape: 'client-roles' });
+  results.push(deClaim({
+    capability,
+    verdict: !nonArray.ok && /KEYCLOAK_ROLES_MALFORMED|must be an array/i.test(nonArray.error) ? 'pass' : 'fail',
+    detail: `non-array claim refused: ok=${nonArray.ok} error=${JSON.stringify(nonArray.error)}`,
+    evidence: { adapterReturn: nonArray },
+  }, { ac: 'security-auth-keycloak-AC-11107-3', limitation: LIM_MALFORMED }));
+
+  const unknown = mapKeycloakRoles({
+    resource_access: { 'app-x': { roles: ['viewer', 'root-emperor'] } },
+  }, { clientId: 'app-x', roleClaimShape: 'client-roles' });
+  results.push(deClaim({
+    capability,
+    verdict: !unknown.ok && /root-emperor/.test(unknown.error) ? 'pass' : 'fail',
+    detail: `unknown-role refusal (fixture adapter): ok=${unknown.ok} error=${JSON.stringify(unknown.error)}`,
+    evidence: { adapterReturn: unknown },
+  }, { ac: 'security-auth-keycloak-AC-11107-3', limitation: LIM_REQ006 }));
+
+  return { results, extra: {} };
+}

package/blueprints/security-auth-keycloak/contributions/probes/run-discovery-shape.mjs

@@ -0,0 +1,4 @@
+import runProbe from './discovery-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'fixture discovery-client (local)', healthy: true };
+runShim('discovery-shape', engine, runProbe);

package/blueprints/security-auth-keycloak/contributions/probes/run-introspection-shape.mjs

@@ -0,0 +1,4 @@
+import runProbe from './introspection-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'fixture RFC 7662 introspection adapter (local)', healthy: true };
+runShim('introspection-shape', engine, runProbe);

package/blueprints/security-auth-keycloak/contributions/probes/run-jwt-verifier-shape.mjs

@@ -0,0 +1,4 @@
+import runProbe from './jwt-verifier-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'node:crypto RS256 sign+verify (throwaway keys)', healthy: true };
+runShim('jwt-verifier-shape', engine, runProbe);

package/blueprints/security-auth-keycloak/contributions/probes/run-real-account-realm-round-trip.mjs

@@ -0,0 +1,4 @@
+import runProbe from './real-account-realm-round-trip.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'keycloak' /* live-realm branch is honest-skip; slug AMBER */, image: 'estate-owned Keycloak realm (or skipped)', healthy: true };
+runShim('real-account-realm-round-trip', engine, runProbe);

package/blueprints/security-auth-keycloak/contributions/probes/run-role-adapter-shape.mjs

@@ -0,0 +1,4 @@
+import runProbe from './role-adapter-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'fixture keycloak role-adapter (local)', healthy: true };
+runShim('role-adapter-shape', engine, runProbe);

package/blueprints/security-auth-keycloak/contributions/requirements/security-auth-keycloak-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "security-auth-keycloak-REQ-001",
   "prdId": "PRD-001",
   "title": "A Keycloak realm is the identity source; the project federates through OIDC authorisation-code with PKCE",
-  "description": "The project's authentication model is delegated identity to a Keycloak realm the operator runs (locally at development time, in a project-owned deployment at operate time). Identity is proven by a completed OAuth2 authorisation-code round-trip with PKCE (RFC 7636, S256) against the realm's OIDC endpoints; the id_token issued by the realm carries the authenticated subject. The wire vocabulary is OIDC on top of OAuth2 and the flow shape is authorisation-code + PKCE; the vendor commitment is Keycloak. The blueprint contributes Keycloak-shaped decisions the vendor-neutral sibling `security-auth-oauth2` deliberately does not fix: a Keycloak realm as the concrete issuer, a Keycloak client with a chosen verification mode (JWT via JWKS, or opaque via the RFC 7662 introspection endpoint), the Keycloak claim shape for client roles, and the local-first stand-up shape through the vendor's official container image.",
+  "description": "The project's authentication model is delegated identity to a Keycloak realm the operator runs (locally at development time, in a project-owned deployment at operate time). Identity is proven by a completed OAuth2 authorisation-code round-trip with PKCE (RFC 7636, S256) against the realm's OIDC endpoints; the id_token issued by the realm carries the authenticated subject. The wire vocabulary is OIDC on top of OAuth2 and the flow shape is authorisation-code + PKCE; the vendor commitment is Keycloak. The blueprint contributes Keycloak-shaped decisions the vendor-neutral sibling `security-auth-oauth2` deliberately does not fix: a Keycloak realm as the concrete issuer, a Keycloak client with a chosen verification mode (JWT via JWKS, or opaque via the RFC 7662 introspection endpoint), the Keycloak claim shape for client roles, and the local-first stand-up shape through the vendor's official container image. This blueprint composes over `security-auth-oauth2` for the authorisation-code + PKCE flow controller (TAC-1101) and the session-bridge (TAC-1103); keycloak contributes the discovery client, JWT verifier, introspection client, provider router, role adapter, and its own `sessionInventory` and `credentialSelfService` surfaces on top of that flow. The composition prerequisite is declared machine-readably by the blueprint's `blueprint.json:requiresAppliedCapabilities` gate on the `authorisationCodeFlow` capability (provided by `security-auth-oauth2` or a superseding flow-owner); a project that applies keycloak without an applied provider of `authorisationCodeFlow` is refused at apply time with a stable-coded error naming both blueprint slugs, and the override lives at `--allow-no-auth-yet` for staged-scaffolding runs.",
   "category": "functional",
   "domain": "authentication",
   "priority": "must",
@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1201-security-auth-keycloak-auth-model"
+  }
 }

package/blueprints/security-auth-keycloak/contributions/requirements/security-auth-keycloak-req-002.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-08-31T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1201-security-auth-keycloak-discovery-client",
+    "field": "responsibilities.discovery"
+  }
 }

package/blueprints/security-auth-keycloak/contributions/requirements/security-auth-keycloak-req-003.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-08-31T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1202-security-auth-keycloak-jwt-verifier",
+    "field": "responsibilities.jwksCacheTtlSeconds"
+  }
 }

package/blueprints/security-auth-keycloak/contributions/requirements/security-auth-keycloak-req-004.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-08-31T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1203-security-auth-keycloak-introspection-client",
+    "field": "responsibilities.introspection"
+  }
 }

package/blueprints/security-auth-keycloak/contributions/requirements/security-auth-keycloak-req-005.json

@@ -2,7 +2,7 @@
   "reqId": "security-auth-keycloak-REQ-005",
   "prdId": "PRD-001",
   "title": "A provider-routing seam lets a project's middleware decide which issuer to consult per request",
-  "description": "The blueprint contributes a provider-router seam (TAC-1204) that a project's own middleware layer invokes on every authenticated request to answer one question: for this request, which configured realm record (or, at the operator's option, which other OAuth2/OIDC issuer the project may have declared elsewhere in its own middleware chain) is the authoritative source of identity? The seam is a pure function on the request shape: `route(request) -> { realmSlug, verificationMode }` or the sentinel `notThisIssuer` when the routing decision hands off to a middleware layer above this blueprint's mechanism reach. The seam does NOT itself name any second issuer; the blueprint is Keycloak-committed and the seam's role is to make explicit the ONE point in the request-processing chain where a project that has chosen to consult two issuers can wire that decision. A project that has only Keycloak configured wires the seam to a constant realmSlug and the mechanism is unchanged. The routing decision is expressed in generic OAuth2/OIDC vocabulary (a header the middleware layer inspects, a request-path prefix, a claim on a preflight token) and refuses to embed any concrete deployment shape.",
+  "description": "The blueprint contributes a provider-router seam (TAC-1204) that a project's own middleware layer invokes on every authenticated request to answer one question: for this request, which configured realm record (or, at the operator's option, which other OAuth2/OIDC issuer the project may have declared elsewhere in its own middleware chain) is the authoritative source of identity? The seam is a pure function on the request shape whose signature and return shape are owned by `TAC-1204-security-auth-keycloak-provider-router` `responsibilities.route` (returning the routed realm record or the sentinel `notThisIssuer` when the routing decision hands off to a middleware layer above this blueprint's mechanism reach). The seam does NOT itself name any second issuer; the blueprint is Keycloak-committed and the seam's role is to make explicit the ONE point in the request-processing chain where a project that has chosen to consult two issuers can wire that decision. A project that has only Keycloak configured wires the seam to a constant record and the mechanism is unchanged. The routing decision is expressed in generic OAuth2/OIDC vocabulary (a header the middleware layer inspects, a request-path prefix, a claim on a preflight token) and refuses to embed any concrete deployment shape.",
   "category": "functional",
   "domain": "authentication",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1204-security-auth-keycloak-provider-router",
+    "field": "responsibilities.route"
+  }
 }

package/blueprints/security-auth-keycloak/contributions/requirements/security-auth-keycloak-req-006.json

@@ -2,7 +2,7 @@
   "reqId": "security-auth-keycloak-REQ-006",
   "prdId": "PRD-001",
   "title": "Role extraction reads from Keycloak's client-roles or realm-roles claim shape",
-  "description": "Keycloak places roles on two claim families the operator selects between when configuring the client: `resource_access.<clientId>.roles` (per-client roles, the recommended default) and `realm_access.roles` (realm-wide roles). The realm record's `roleClaimShape` field declares which family this client uses (`client-roles` or `realm-roles`); the role adapter (TAC-1205) reads roles from that path on every verified token and populates the reduced Principal's `roles[]` array with the resulting string list. A token whose expected claim path is absent yields an empty `roles[]` (not a refusal); a project that wants stricter behaviour (a specific claim path must be present, or a specific role must be present, or the request is refused) authors a project-side authoriser above the reduced Principal and does not push that policy into the mechanism. The role adapter does not remap Keycloak role strings into project-defined role vocabulary; that remapping is a project-level concern and belongs on a project-authored ADR whose `related-reqs` cites this REQ.",
+  "description": "Keycloak places roles on two claim families the operator selects between when configuring the client: `resource_access.<clientId>.roles` (per-client roles, the recommended default) and `realm_access.roles` (realm-wide roles). The realm record's `roleClaimShape` field declares which family this client uses (`client-roles` or `realm-roles`); the role adapter (TAC-1205) reads roles from that path on every verified token and populates the reduced Principal's `roles[]` array with the resulting string list. A token whose expected claim path is absent yields an empty `roles[]` (not a refusal); a project that wants stricter behaviour (a specific claim path must be present, or a specific role must be present, or the request is refused) authors a project-side authoriser above the reduced Principal and does not push that policy into the mechanism. The role adapter does not remap Keycloak role strings into project-defined role vocabulary; that remapping is a project-level concern and belongs on a project-authored ADR whose `related-reqs` cites this REQ. The `roles[]` field on the reduced Principal is the sole role vocabulary the project reads; the role adapter is the mechanism by which the blueprint contributes the `roleModel` capability into the applied capability set. The reduced Principal produced by the role adapter is also the blueprint's `principalDirectory` contribution: no other read-side surface on the project answers \"who is the caller\".",
   "category": "functional",
   "domain": "authentication",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-08-31T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1205-security-auth-keycloak-role-adapter",
+    "field": "responsibilities.roles"
+  }
 }

package/blueprints/security-auth-keycloak/contributions/requirements/security-auth-keycloak-req-007.json

@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-08-31T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1206-security-auth-keycloak-refresh-and-sign-out-posture"
+  }
 }

package/blueprints/security-auth-keycloak/contributions/requirements/security-auth-keycloak-req-008.json

@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-08-31T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1204-security-auth-keycloak-session-vs-token-contract"
+  }
 }

package/blueprints/security-auth-keycloak/contributions/requirements/security-auth-keycloak-req-009.json

@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-08-31T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1201-security-auth-keycloak-auth-model"
+  }
 }

package/blueprints/security-auth-keycloak/contributions/requirements/security-auth-keycloak-req-010.json

@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-08-31T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1206-security-auth-keycloak-refresh-and-sign-out-posture"
+  }
 }

package/blueprints/security-auth-keycloak/contributions/requirements/security-auth-keycloak-req-011.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-08-31T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1201-security-auth-keycloak-discovery-client",
+    "field": "responsibilities.bootPosture"
+  }
 }

package/blueprints/security-auth-keycloak/contributions/requirements/security-auth-keycloak-req-012.json

@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-08-31T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1201-security-auth-keycloak-auth-model"
+  }
 }