rcf-lite 0.26.0 → 0.28.0

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10106.json

@@ -16,7 +16,8 @@
       "when": "the request is dispatched",
       "then": "the middleware attaches `request.auth` carrying `principalId`, `provider`, `email` (if the provider returned one), `roles` (empty array by default), and `organisationIds` (empty array by default); `principalId` is a stable string derived from `{ provider.id, sub }` (OIDC) or `{ provider.id, userinfo.id }` (oauth2-only)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10106-2",
@@ -25,7 +26,8 @@
       "when": "a request is dispatched with no session cookie, then with a cookie whose value has been tampered by a single byte",
       "then": "the middleware treats each request as unauthenticated; the route handler is not invoked; the response is a 4xx (or a redirect to the sign-in route, per the wiring shim's declared class); no `request.auth` is attached in either case",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10106-3",
@@ -34,7 +36,8 @@
       "when": "the request is dispatched and the resolved `request.auth` object is inspected for keys",
       "then": "the object contains only the fields named in AC-10106-1; no `accessToken`, `idToken`, `refreshToken`, or provider-raw-claims field is exposed",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10107.json

@@ -16,7 +16,8 @@
       "when": "the next protected-route request triggers the flow controller's refresh path",
       "then": "the flow controller issues a POST to the provider's `tokenUrl` with `grant_type=refresh_token` and `refresh_token=rt-old`; the provider returns a new `access_token` and new `refresh_token=rt-new`; the session record now stores `rt-new` and no other refresh-token value; the pre-refresh `rt-old` is not present in the session record or the audit log",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10107-2",
@@ -25,7 +26,8 @@
       "when": "the test injects a refresh call presenting `rt-old` at the flow controller",
       "then": "the flow controller invalidates the session handle, clears every stored refresh token that shares the same chain root, and emits one structured audit event `oauth2.refresh_token_reuse` carrying the provider id, the session-handle hash, and the detection timestamp; the event carries no token value; the next protected-route request with the original cookie is refused as unauthenticated",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10107-3",
@@ -34,7 +36,8 @@
       "when": "the sign-in completes and the session record is inspected",
       "then": "the session record's refresh-token slot is empty; the flow controller does not attempt a refresh call on any subsequent request against this session; the session's own project-lifetime expiry (per the session-bridge) is the sole grant duration",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10108.json

@@ -16,7 +16,8 @@
       "when": "the browser dispatches the sign-out request",
       "then": "the response clears the session cookie (`Set-Cookie` with the cookie name, empty value, `Max-Age=0`, `HttpOnly`, `Secure`, `SameSite=Lax`); the session-record store no longer holds a record for the pre-signout session handle; the next protected-route request from this browser is refused as unauthenticated even if the browser replays the pre-signout cookie value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10108-2",
@@ -25,7 +26,8 @@
       "when": "the sign-out route is invoked",
       "then": "the response status is 302; the `Location` header equals the declared `endSessionEndpoint` (with the configured `post_logout_redirect_uri` and, for OIDC providers, the `id_token_hint` query parameter as the raw id_token stored on the session record); the session cookie is cleared on the same response",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10108-3",
@@ -34,7 +36,8 @@
       "when": "the flow controller's provider validator runs at boot",
       "then": "the boot terminates with error code `OAUTH2_LOGOUT_NOT_DECLARED` naming the provider id; no server process is left listening; the audit log records one `oauth2.provider_config_refused` event carrying the provider id and reason class `logout-endpoint-missing`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10109.json

@@ -16,7 +16,8 @@
       "when": "a browser dispatches `GET /auth/sign-in?provider=<second-id>` and completes the round-trip",
       "then": "the resulting session's `request.auth.provider` equals the second provider's `id`; `principalId` is derived under the second provider's slug and does not collide with any principalId issued against the first provider even when the underlying `sub` claim value is identical; the flow controller's request log records the redirect and the token exchange against the second provider's URLs, not the first",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10109-2",
@@ -25,7 +26,8 @@
       "when": "a browser dispatches `GET /auth/sign-in?provider=nonexistent-id`",
       "then": "the response is a 4xx with body error code `OAUTH2_PROVIDER_UNKNOWN`; no `Location` header pointing at an authorise endpoint is emitted; no pending-flow record is written",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10110.json

@@ -16,7 +16,8 @@
       "when": "`rcf audit coverage --strict` reports the coverage state and the runtime-verify runner is invoked",
       "then": "the coverage report lists the AC as covered by a TC whose latest run outcome is `skipped` with reason `OAUTH2_LIVE_PROVIDER_UNREACHABLE`; the pipeline exit code is 0; the audit log records one `oauth2.accountbound_skip` event carrying the AC id and the missing-credential class",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-10110-2",
@@ -25,7 +26,8 @@
       "when": "the operator drives a real browser through the sign-in surface at the live provider",
       "then": "the flow completes; a project session cookie is set with the same shape as AC-10101-3; `request.auth.provider` equals the live provider's declared id; the project-authored TC for this AC records a `pass` outcome",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10111.json

@@ -16,7 +16,22 @@
       "when": "the flow controller initiates any step of the authorisation-code + PKCE flow against the configured provider (mint redirect, exchange code, verify id_token, invoke userinfo, mint sign-out redirect)",
       "then": "every URL, credential, scope list, redirect target, and provider-kind determination the flow controller reads comes from the record's declared fields (`authorizeUrl`, `tokenUrl`, `userinfoUrl`, `issuer`, `jwksUri`, `clientId`, `clientSecret`, `scopes`, `redirectUri`, `providerKind`, `endSessionEndpoint`); a source-tree scan of the flow-controller module records zero string-literal branches keyed on a provider `id` value (no `provider.id === 'google'`, no vendor-name switch); a boot with a record missing any REQ-002-mandated field refuses with the stable-coded error class named on TAC-1102's responsibilities and no server process is left listening",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-10111-2",
+      "description": "The provider adapter's boot-time validator refuses a provider-config record that is missing any `REQ-002`-mandated field with a stable-coded error class on `TAC-1102-security-auth-oauth2-provider-adapter` `responsibilities.validate`, and no server process is left listening; the refusal is emitted as one structured event and the flow controller is not initialised.",
+      "given": "a project provider-config module carrying a record whose `authorizeUrl` field is absent (or any other REQ-002-mandated field is absent), and the provider adapter loaded at boot per TAC-1102",
+      "when": "the blueprint boots and the validator inspects the record",
+      "then": "boot fails with the stable-coded error class named on `TAC-1102-security-auth-oauth2-provider-adapter` `responsibilities.validate` (identifying the missing field and the offending record); no server process remains listening; the flow-controller module is not initialised; the refusal is emitted as one structured event whose payload names the missing field but does not carry the record's `clientSecret` value or any substring of it",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1102-security-auth-oauth2-provider-adapter",
+        "field": "responsibilities.validate"
+      }
     }
   ],
   "tacIds": [
@@ -24,5 +39,5 @@
     "TAC-1102-security-auth-oauth2-provider-adapter"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10112.json

@@ -0,0 +1,82 @@
+{
+  "usId": "security-auth-oauth2-US-10112",
+  "prdId": "PRD-001",
+  "reqId": "security-auth-oauth2-REQ-011",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The reduced Principal carries the roles the provider record declares, and the union is refused on a malformed claim",
+  "asA": "operator signing in through an OAuth2 provider whose token exchange returns roles at a project-declared claim path",
+  "iWant": "the session-bridge to read the roles the provider record names and put them on `request.auth.roles`",
+  "soThat": "project routes gate on roles without reading raw provider claims",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10112-1",
+      "description": "When the provider record declares `roleSources: [\"realm_access.roles\"]` and the verified id_token carries `realm_access.roles = [\"admin\",\"auditor\"]`, the reduced Principal's `roles` array is the set `{\"admin\",\"auditor\"}`.",
+      "given": "a provider record with `roleSources: [\"realm_access.roles\"]` and a verified id_token whose `realm_access.roles` is `[\"admin\",\"auditor\",\"admin\"]`",
+      "when": "the session-bridge reduces the identity",
+      "then": "`request.auth.roles` is a two-element array whose set membership is `{\"admin\",\"auditor\"}`; the array ordering is not asserted but the set is; the audit sink records one `oauth2.roles_mapped` event carrying the count `2` and no role values",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-10112-2",
+      "description": "When `roleSources` names multiple paths, the reduced `roles` is the union.",
+      "given": "a provider record with `roleSources: [\"realm_access.roles\",\"resource_access.web.roles\"]` and a verified id_token whose `realm_access.roles = [\"a\"]` and `resource_access.web.roles = [\"b\",\"a\"]`",
+      "when": "the session-bridge reduces the identity",
+      "then": "`request.auth.roles` has set membership `{\"a\",\"b\"}`; each string appears exactly once",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-10112-3",
+      "description": "A `roleSources` path resolving to a value that is not a string and not an array of strings refuses the session issue with `OAUTH2_ROLES_MALFORMED`.",
+      "given": "a provider record with `roleSources: [\"realm_access.roles\"]` and a verified id_token whose `realm_access.roles` is the JSON object `{\"admin\": true}`",
+      "when": "the session-bridge reduces the identity",
+      "then": "the bridge throws `OAUTH2_ROLES_MALFORMED` naming the provider id and the offending path; no session cookie is issued; the audit sink records one `oauth2.roles_refused` event carrying the reason class and no claim values",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-10112-4",
+      "description": "A provider record with an empty or absent `roleSources` produces a Principal with an empty `roles` array; no error.",
+      "given": "a provider record whose `roleSources` field is `[]` (or absent) and a verified id_token that carries a `realm_access.roles` field the provider does not name",
+      "when": "the session-bridge reduces the identity",
+      "then": "`request.auth.roles` is `[]`; the session cookie is issued normally; no `oauth2.roles_refused` event fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-10112-5",
+      "description": "An `enrichPrincipal` hook, when configured, receives the Principal after `roles[]` is populated and its return value replaces the Principal on `request.auth`.",
+      "given": "a provider record with `roleSources: [\"realm_access.roles\"]` and a project-authored `enrichPrincipal(p) => ({ ...p, roles: [...p.roles, \"audit-viewer\"] })` hook",
+      "when": "the session-bridge reduces the identity of a caller whose `realm_access.roles` is `[\"admin\"]`",
+      "then": "`request.auth.roles` has set membership `{\"admin\",\"audit-viewer\"}`; the hook is invoked exactly once per session issue",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+        "field": "interfaces.enrichPrincipal.name"
+      }
+    },
+    {
+      "id": "AC-10112-6",
+      "description": "Project routes never observe a raw provider claim; every role decision reads the reduced Principal.",
+      "given": "the applied blueprint at v1.3.0 and a source-tree scan of the project's contributed routes",
+      "when": "a static scan looks for reads of `id_token`, `userinfo`, or raw provider-claim shape from any project route",
+      "then": "the scan reports zero raw-claim reads outside the flow-controller and session-bridge modules; every route's role-check reads `request.auth.roles`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    }
+  ],
+  "tacIds": [
+    "TAC-1103-security-auth-oauth2-session-bridge"
+  ],
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10113.json

@@ -0,0 +1,68 @@
+{
+  "usId": "security-auth-oauth2-US-10113",
+  "prdId": "PRD-001",
+  "reqId": "security-auth-oauth2-REQ-012",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "A signed-in caller reaches account, password and recovery through the provider's self-service surface",
+  "asA": "operator signed in through an OAuth2 provider who wants to change their password or set up MFA",
+  "iWant": "the project to send me to the provider's hosted account surface rather than owning a credential-change form",
+  "soThat": "credential material never leaves the identity source",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10113-1",
+      "description": "A provider record with `credentialSelfService: true` and no `accountUrl` refuses at boot.",
+      "given": "a provider record whose `credentialSelfService` is `true` and whose `accountUrl` is absent",
+      "when": "the provider adapter runs its boot-time validation",
+      "then": "boot refuses with stable-coded `OAUTH2_ACCOUNT_URL_MISSING` naming the provider id; the audit sink records one `oauth2.account_url_missing` event",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-10113-2",
+      "description": "`getCredentialSelfServiceUrl(principal)` returns the resolved provider `accountUrl` for the caller's provider. Applying-agent responsibility: The applying agent sets each provider record's `accountUrl` value against the provider's documented self-service origin. The AC binds the shape; the value belongs to the applied project.",
+      "given": "a caller signed in through provider `google` and a provider record for `google` whose `accountUrl` is `https://myaccount.google.com`",
+      "when": "a project route calls `getCredentialSelfServiceUrl(request.auth)`",
+      "then": "the return value is exactly `https://myaccount.google.com`; the helper appends no query parameters, no fragment, and no additional path segment",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-10113-3",
+      "description": "A provider record whose `accountUrl` origin does not match the provider's documented sign-in origin is refused at boot. Applying-agent responsibility: The origin-check compares against the provider record's documented self-service origin; the applying agent sets the expected origin for each provider they configure.",
+      "given": "a provider record for `google` whose `accountUrl` is `https://example.com/account`",
+      "when": "the provider adapter runs its boot-time validation",
+      "then": "boot refuses with stable-coded `OAUTH2_ACCOUNT_URL_ORIGIN` naming the provider id and the observed origin; the record is not loaded",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-10113-4",
+      "description": "A provider that offers no self-service surface carries `accountUrl: null` and `credentialSelfService: false`; the applied capability set reflects `credentialSelfService` as absent for callers signed in through that provider.",
+      "given": "a provider record whose `accountUrl` is `null` and whose `credentialSelfService` is `false`",
+      "when": "a caller signed in through that provider invokes `getCredentialSelfServiceUrl`",
+      "then": "the helper returns `null`; the applied capability set does not report `credentialSelfService` as active for that caller's provider",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-10113-5",
+      "description": "No project route renders a credential-change form of its own.",
+      "given": "the applied blueprint at v1.3.0 and a source-tree scan of the project's contributed pages",
+      "when": "a static scan looks for `type=password` inputs or MFA-enrolment DOM shapes owned by the project",
+      "then": "the scan reports zero credential-input controls owned by the project; every credential moment resolves to a link out through `getCredentialSelfServiceUrl`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    }
+  ],
+  "tacIds": [
+    "TAC-1102-security-auth-oauth2-provider-adapter"
+  ],
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10114.json

@@ -0,0 +1,88 @@
+{
+  "usId": "security-auth-oauth2-US-10114",
+  "prdId": "PRD-001",
+  "reqId": "security-auth-oauth2-REQ-013",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "A signed-in oauth2 caller lists their project sessions, revokes one, and revokes all others",
+  "asA": "operator signed in through an OAuth2 provider on two browsers",
+  "iWant": "to list every active project session, terminate any one of them, and terminate every one except the current in a single call",
+  "soThat": "I end a stolen or forgotten session without touching the provider's admin surface",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-10114-1",
+      "description": "A `list()` call from an authenticated caller returns one row per active project session, each row shaped per the interface owned by the local `TAC-1103-security-auth-oauth2-session-bridge` `responsibilities.sessionInventory`.",
+      "given": "a caller with two active project sessions S1 (current) and S2, both issued through provider `google`",
+      "when": "the current browser calls `sessionInventory.list()`",
+      "then": "the return is exactly two rows shaped per the ownerRef interface, one with `currentSession=true` for S1 and one with `currentSession=false` for S2",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+        "field": "responsibilities.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-10114-2",
+      "description": "`revoke(sessionId)` on a non-current session invalidates it in the session-record store; a replay from the revoked browser is treated as unauthenticated.",
+      "given": "the two-session setup from AC-10114-1",
+      "when": "the current browser calls `sessionInventory.revoke(\"S2\")` and browser B replays its next request",
+      "then": "the revoke returns successfully; the session-record store no longer holds a record for S2; browser B is refused as unauthenticated on the next request; the audit sink records exactly one `oauth2.session_inventory_revoked` event with `{ operation, sessionIdPrefix, at }` and no other cookie- or token-carrying field",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+        "field": "responsibilities.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-10114-3",
+      "description": "`revokeAllExceptCurrent()` invalidates every active project session for the caller other than the current one; the refresh-token chain for each revoked session is cleared alongside per REQ-007.",
+      "given": "a caller with sessions S1 (current), S2, S3 and stored refresh-token chains for each",
+      "when": "the current browser calls `sessionInventory.revokeAllExceptCurrent()`",
+      "then": "the return value is `2`; a subsequent `list()` returns exactly one row for S1; the refresh-token store no longer holds chains for S2 or S3",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+        "field": "responsibilities.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-10114-4",
+      "description": "An unauthenticated call to any `sessionInventory` operation refuses with `SESSION_INVENTORY_UNAUTHENTICATED` and no side effect.",
+      "given": "a request with no verified session cookie",
+      "when": "any of the three operations is invoked",
+      "then": "each call throws `SESSION_INVENTORY_UNAUTHENTICATED`; the session-record store is unchanged; the audit sink records exactly one `oauth2.session_inventory_unauthenticated` event",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+        "field": "responsibilities.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-10114-5",
+      "description": "`revoke(sessionId)` against a session id the caller does not own, or a session already invalidated, refuses without a side effect.",
+      "given": "an authenticated caller and a `sessionId` naming a session belonging to a different principal or already invalidated",
+      "when": "the caller calls `sessionInventory.revoke(sessionId)`",
+      "then": "the call throws `SESSION_INVENTORY_UNKNOWN_SESSION`; the session-record store is unchanged; the audit sink records exactly one `oauth2.session_inventory_unknown_session` event",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+        "field": "responsibilities.sessionInventory"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-1103-security-auth-oauth2-session-bridge"
+  ],
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/security-auth-oauth2/docs/topics.md

@@ -70,8 +70,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 10101-10111 sit at the LOW end of the 10101-10899 band on purpose. A project-side story that mechanically derives from a security-auth-oauth2 REQ id into the number `10111` would collide against security-auth-oauth2-US-10111 in this package; the band leaves headroom at the HIGH end (US 10181-10899) so a project's own stories anchored to security-auth-oauth2 REQs can allocate without conflict. The watchpost run4 lesson applies here too.
-
+US 10101-10111 sit at the LOW end of the 10101-10899 band on purpose. A project-side story that mechanically derives from a security-auth-oauth2 REQ id into the number `10111` would collide against security-auth-oauth2-US-10111 in this package; the band leaves headroom at the HIGH end (US 10181-10899) so a project's own stories anchored to security-auth-oauth2 REQs can allocate without conflict.
 The ADR/TAC suffix block 1101-1199 is the second block to cross into the four-digit suffix space; `security-auth-clerk` opened the four-digit door at 1001-1099. Every shipped blueprint continues to load, validate, and audit against this shape without a schema change: rcf-schemas 0.5.0 `adrId` and `tacId` patterns are `^ADR-\d{3,}(-[a-z0-9]+...)?$` (three-digit minimum, unbounded above); four-digit and higher suffixes validate verbatim. The registry table above records the growth for a downstream author reaching for the next block.
 
 ## Shared expectations for future composing blueprints

package/blueprints/security-secrets-management/CHANGELOG.md

@@ -1,10 +1,33 @@
 # security-secrets-management changelog
 
-## 1.0.1 - 2026-09-06
+## 1.1.5 - 2026-09-11
+
+- Criterion-e probe pack refinement: every conformance-only result row now records `anchorAcId: null` alongside a `limitation` that opens with a shipped AC id from the blueprint's user stories (all ten SOPS-native rows move from `REQ-002` to `AC-8102-1`, the manager-module surface these probes do not observe). Detail strings on de-claimed rows describe only what was observed at the SOPS crypto layer and no longer name REQ-002. The anatomy helper enforces conformance-only rows to satisfy `anchorAcId === null`, requires limitations to open with an `AC-<n>-<n>` id that resolves to a shipped acceptance criterion on the blueprint's user stories (REQ-prefixed anchors are refused and fabricated ids are rejected), and does not count pre-delete presence as an absence observation on the inventory-diff shape.
+
+## 1.1.4 - 2026-09-11
+
+- Every SOPS-native result row is now marked `conformanceOnly: true` with a limitation naming the shipped AC that these SOPS-native operations do not observe (the manager-client boundary). Anchors stay `null` as before. Anatomy helper enforces field COMBINATIONS per shape; bare diagnostic evidence like `{macDiverged}`, `{sameRecipients}` or `{status,matched}` passes only under the `conformanceOnly` + limitation shape. This pack is criterion-e conformance evidence pending the manager-client probe follow-up.
+
+## 1.1.3 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering the secretsProvider capability across four probes running against real `sops(1)` + `age(1)` engines with throwaway keypairs the probes self-provision and self-clean under `RCF_SECRETS_SCRATCH_DIR`: `encrypt-decrypt-round-trip` (scratch scope encrypt then decrypt; sops metadata captured as evidence excerpts), `add-recipient-rotation` (`--rotate --add-age` extends recipient list, regenerates mac, and lets the new recipient decrypt), `key-rotation` (`--rotate` re-keys the payload without changing recipients), and `mismatched-key-refusal` (foreign-key decrypt returns non-zero with no plaintext). The estate vault at `.vault/scopes/` is never touched. Fixture at `packages/rcf-lite/test/fixtures/security-secrets-management/` declares every env var the pack reads; anatomy test pins pack shape, fixture manifest and per-probe aggregate pass on the real engine.
+- Iteration on the probe pack: byte-equality is a real byte-buffer compare on `--input-type binary --output-type binary` streams; the SHA-256 witnesses stay in `evidence.byteCompare` alongside the byte-length + `Buffer.compare === 0` assertion. `aggregate([])` and null-result normalisation now report `detail: 'no checks ran'` exactly. Slug reads AMBER on criterion e until a manager-client probe is added that observes `AC-8102-1` at the module boundary.
+
+## 1.1.2
 
-Additive minor: declares `capabilities: ["secretsProvider"]` on `blueprint.json` so consumer blueprints can gate composition on an applied secrets-management surface via the T-5 capability mechanism. No REQ / US / TAC / ADR contribution changes; the `secretRef` opaque-string contract, the elicited-parameters shape, and the shipped secretsSource semantics are unchanged. First consumer at v1.0.1: `object-storage-s3` v1.0.0 declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` so `rcf define blueprint add object-storage-s3` on a project that has not applied security-secrets-management exits 3 with the stable message id on stderr; the override records a note on `source.notes` for later reconciliation.
+- Rewrites `REQ-002.description` to reference `TAC-901-security-secrets-management-manager-client` `responsibilities.get` and the sibling responsibilities on the same TAC rather than restate the `get(name)` signature verbatim; the literal remains owned by the delivering TAC.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 (2026-09-09)
+
+- Adds `elicits[]` for `environmentSet` (string; the ordered environment list) and `uiOutcome` (enum: `integrate`, `admin-spa`, `none`) already described in prose on `REQ-007` and `REQ-010`. Promotes `REQ-010` to `must` priority (an apply-time choice is not a should) and names each option value explicitly on its description. Narrows `REQ-003` to code-side enforcement of the least-privilege slice, naming SOPS's inability to issue vendor-side per-process credentials and the supersede-via-ADR path for vendors that carry the property. Adds an explicit exception clause to `REQ-005` for the ephemeral `.env` reflection under `REQ-006`, constraining its location, `.gitignore` requirement, and file mode. Adds `deliveredBy` on every `must` requirement and `disposition: fixed` on every existing acceptance criterion. Names the `secretsProvider` capability on `REQ-002`, which already carries the vendor-agnostic-manager runtime clause.
+
+## 1.0.1 - 2026-09-06
 
-Landed via infra round 5 T-2 (spec section 5.2, Baz decision 6) folded into PR #157 per HQ ruling on the runner-gap find; same-PR minor pattern as round-4 T-4 auth minors.
+Additive minor: declares `capabilities: ["secretsProvider"]` on `blueprint.json` so consumer blueprints can gate composition on an applied secrets-management surface via the capability mechanism. No REQ / US / TAC / ADR contribution changes; the `secretRef` opaque-string contract, the elicited-parameters shape, and the shipped secretsSource semantics are unchanged. First consumer at v1.0.1: `object-storage-s3` v1.0.0 declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` so `rcf define blueprint add object-storage-s3` on a project that has not applied security-secrets-management exits 3 with the stable message id on stderr; the override records a note on `source.notes` for later reconciliation.
 
 ## 1.0.0 - 2026-08-31
 

package/blueprints/security-secrets-management/README.md

@@ -27,9 +27,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the manifest shape, the client contract, the least-privilege posture, the audit shape, the agent access discipline, the `.env` reflection posture, the rotation gate, the UI-choice contract); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the manifest shape, the client contract, the least-privilege posture, the audit shape, the agent access discipline, the `.env` reflection posture, the rotation gate, the UI-choice contract); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 Deliberately not contributed: a vendor SDK (the default vendor is named in ADR-902 as SOPS+age, the shape of the vendor adapter is fixed by TAC-901, the actual adapter code is a project-authored implementation); a specific manifest schema library (any YAML parser plus the loader in TAC-902 satisfies the loader responsibilities); a project's authorisation model (secrets management authorises READ of secret material; who is allowed to act on which secret at which UI surface is a project-side authorisation concern layered above the audit sink); a rotation orchestrator (the blueprint gates on rotation age at CI, it does not itself run the rotation for you; running the rotation is a project-authored procedure the vendor's own tooling supports); the admin-UI Secrets page itself when `uiIntegration.mode` is `integrate` (the field contract is fixed by TAC-905, the page implementation lives in the host project); an admin-spa blueprint (a companion future blueprint, promotion signal noted in the guide); a project's audit-storage engine (the blueprint fixes the event shape, not where the events land).