rcf-lite 0.26.0 → 0.28.0

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38108.json

@@ -13,12 +13,59 @@
       "id": "AC-composeHost-zeroDowntimeReload",
       "description": "The real-account-reload-burst probe, when CI_HAS_HETZNER_ACCOUNT is set, runs undici GETs against the proxy service on the throwaway server while docker compose exec caddy caddy reload runs, asserts every request returns a 2xx status inside the elicited window (10 s default), asserts no dropped connection, and tears the stack down in always(). Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped: true and the aggregate flips to pass.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-38108-2",
+      "description": "F-5 Traefik reload verb: with reverseProxy=traefik, the reload-burst probe issues the Traefik documented reload verb (docker compose kill -s USR1 traefik) while an undici burst hits the proxy. The probe asserts every request returns 2xx inside the elicited reload-window-seconds. SIMULATE_MISSING_TRAEFIK_KILL=true skips the kill and the probe still asserts no non-2xx (reload without kill is a no-op for Traefik).",
+      "given": "a fixture with reverseProxy=traefik and CI_HAS_HETZNER_ACCOUNT=true",
+      "when": "the probe issues the reload verb and the burst",
+      "then": "every response is 2xx inside the elicited window; the probe passes",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact",
+        "field": "responsibilities.reloadVerb"
+      },
+      "vendorCitation": {
+        "url": "https://doc.traefik.io/traefik/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38108-3",
+      "description": "F-5 none topology reload is a no-op: with reverseProxy=none, the reload-burst probe records \"reverseProxy=none: not applicable\" and aggregates to pass without attempting a reload. A CI_HAS_HETZNER_ACCOUNT=true run under reverseProxy=none still exits 0 with the \"not applicable\" record.",
+      "given": "a fixture with reverseProxy=none",
+      "when": "the reload-burst probe runs",
+      "then": "the probe records \"not applicable\" and aggregateVerdict is \"pass\"",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact",
+        "field": "responsibilities.noneTopology"
+      }
+    },
+    {
+      "id": "AC-38108-4",
+      "description": "Reload window shorter than reload duration: SIMULATE_SHORT_RELOAD_WINDOW=true sets the elicited reload-window-seconds to 1 (below the actual reload duration on the throwaway server, typically 2-3 seconds). The probe FAILS naming the observed dropped or non-2xx count and the elapsed millis outside the window.",
+      "given": "a fixture with SIMULATE_SHORT_RELOAD_WINDOW=true and a reload-window-seconds=1",
+      "when": "the reload-burst probe runs",
+      "then": "the probe FAILS naming dropped or non-2xx count and the observed elapsed millis",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact",
+        "field": "responsibilities.reloadWindow"
+      }
     }
   ],
   "tacIds": [
     "TAC-3904-platform-docker-compose-host-reverse-proxy-artefact"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38109.json

@@ -13,12 +13,67 @@
       "id": "AC-composeHost-logDriverClassification",
       "description": "Every service in the applied compose.yaml declares a logging: driver: block whose driver value matches the elicited log driver (default journald). The compose-config-lint probe asserts (a) every service declares logging: driver, (b) the value is one of journald or loki, and (c) SIMULATE_UNCLASSIFIED_LOG_DRIVER=true sets a disallowed driver and the probe FAILS naming the service and the disallowed value.",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-38109-2",
+      "description": "F-8 journald marker: with log-driver=journald on the throwaway server, the probe writes a marker line via a service's stdout (a unique UUID substring), then runs `journalctl CONTAINER_NAME=<name> -o cat` on the host and asserts the marker substring appears in the output within a bounded 30 seconds. Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped: true and aggregates to pass.",
+      "given": "a fixture with log-driver=journald and CI_HAS_HETZNER_ACCOUNT=true",
+      "when": "the probe writes the marker and greps journalctl",
+      "then": "the marker appears in the journalctl output within 30 seconds; the probe passes",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+        "field": "responsibilities.logDriver"
+      },
+      "vendorCitation": {
+        "url": "https://www.freedesktop.org/software/systemd/man/journalctl.html",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38109-3",
+      "description": "F-8 loki marker: with log-driver=loki and the applied Loki endpoint set, the probe writes a marker (UUID substring) via a service's stdout, then HTTP GETs the Loki push-query API at the elicited endpoint and asserts the marker appears in the response within a bounded 30 seconds. Without CI_HAS_HETZNER_ACCOUNT the probe records accountBoundSkipped: true and aggregates to pass.",
+      "given": "a fixture with log-driver=loki, a Loki endpoint and CI_HAS_HETZNER_ACCOUNT=true",
+      "when": "the probe writes the marker and queries the Loki API",
+      "then": "the marker appears in the Loki API response within 30 seconds; the probe passes",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+        "field": "responsibilities.logDriver"
+      },
+      "vendorCitation": {
+        "url": "https://grafana.com/docs/loki/latest/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38109-4",
+      "description": "Missing logging block: SIMULATE_MISSING_LOG_DRIVER=true removes the logging: block from a service. The compose-config-lint FAILS naming the service; every service must declare a logging: driver block per REQ-006.",
+      "given": "a fixture with SIMULATE_MISSING_LOG_DRIVER=true",
+      "when": "the lint runs",
+      "then": "the lint FAILS naming the service with no logging driver",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3903-platform-docker-compose-host-healthcheck-lint",
+        "field": "responsibilities.logDriver"
+      },
+      "vendorCitation": {
+        "url": "https://docs.docker.com/reference/compose-file/services/#logging",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3903-platform-docker-compose-host-healthcheck-lint"
   ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T22:00:00.000Z"
 }

package/blueprints/platform-docker-compose-host/contributions/user-stories/platform-docker-compose-host-us-38110.json

@@ -0,0 +1,92 @@
+{
+  "usId": "platform-docker-compose-host-US-38110",
+  "prdId": "PRD-001",
+  "reqId": "platform-docker-compose-host-REQ-007",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Docker Engine installs from the elicited apt channel: the observable repository source matches",
+  "asA": "operator installing the container host on a fresh Ubuntu 24.04 or Debian 12 baseline",
+  "iWant": "the shipped installer script to resolve the elicited docker-engine-channel answer into the apt sources entry actually written to the host, and to refuse any other value with a named error kind",
+  "soThat": "a project verifying against test can trust the installed engine is on the pre-release channel; a project on stable can trust it is on the stable channel",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-38110-1",
+      "description": "With docker-engine-channel=stable, the installer writes an apt sources entry pointing at the vendor stable pool; the observable file at /etc/apt/sources.list.d/docker.list carries the \"stable\" pool component; dpkg -s docker-ce reports a version from the stable pool. With docker-engine-channel=test, the same file carries the \"test\" component and dpkg -s reports a version from the test pool.",
+      "given": "a fresh Ubuntu 24.04 baseline with no prior docker-ce install",
+      "when": "the installer script runs against the elicited channel",
+      "then": "the apt sources file carries the elicited pool component and the installed docker-ce matches",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.docker.com/engine/install/ubuntu/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38110-2",
+      "description": "The installer refuses any elicited docker-engine-channel value outside {stable, test} with a stable error kind DOCKER_ENGINE_CHANNEL_UNSUPPORTED naming the offered value and lists the accepted options in the message. No apt sources entry is written on refusal.",
+      "given": "a docker-engine-channel elicit answer set to \"nightly\" (or any other unrecognised value)",
+      "when": "the installer script runs",
+      "then": "the installer refuses with DOCKER_ENGINE_CHANNEL_UNSUPPORTED and no apt sources entry lands",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-38110-3",
+      "description": "Sources file content probe: after the installer script runs on the fixture VM, a shell probe reads /etc/apt/sources.list.d/docker.list and asserts (a) the file exists, (b) the URI resolves to https://download.docker.com/linux/ubuntu (or /linux/debian) matching the OS, and (c) the pool component equals the elicited docker-engine-channel answer (\"stable\" or \"test\"). SIMULATE_STALE_SOURCES=true writes an incorrect pool value and the probe FAILS naming the observed and expected components.",
+      "given": "a fresh VM after the installer runs with docker-engine-channel=stable",
+      "when": "the probe reads the sources file",
+      "then": "the file exists, the URI matches, and the pool component equals \"stable\"",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+        "field": "responsibilities.aptSources"
+      },
+      "vendorCitation": {
+        "url": "https://docs.docker.com/engine/install/ubuntu/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38110-4",
+      "description": "Keyring probe: /etc/apt/keyrings/docker.gpg exists after the installer runs (the Docker Engine install steps place the keyring here per the Ubuntu install doc). SIMULATE_MISSING_KEYRING=true removes the file and the installer refuses on the next apt-get update with a stable error kind DOCKER_ENGINE_KEYRING_MISSING.",
+      "given": "a fresh VM after the installer runs",
+      "when": "the probe reads /etc/apt/keyrings/docker.gpg",
+      "then": "the file exists; SIMULATE_MISSING_KEYRING=true removes it and the installer refuses with DOCKER_ENGINE_KEYRING_MISSING",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+        "field": "responsibilities.aptSources"
+      },
+      "vendorCitation": {
+        "url": "https://docs.docker.com/engine/install/ubuntu/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-38110-5",
+      "description": "Idempotent install: running the installer script twice on the same VM does NOT duplicate the sources entry (a subsequent grep of /etc/apt/sources.list.d/docker.list finds exactly one URI line), does NOT re-add the keyring, and returns exit 0 on the second run. The installer detects the existing install and short-circuits (docker-ce is up to date).",
+      "given": "a fresh VM after the installer has already run once",
+      "when": "the installer script runs a second time",
+      "then": "the sources file has exactly one URI line; the keyring is unchanged; the second run exits 0",
+      "testable": true,
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3901-platform-docker-compose-host-compose-layout",
+        "field": "responsibilities.aptSources"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-3901-platform-docker-compose-host-compose-layout"
+  ],
+  "createdAt": "2026-09-09T20:25:00.000Z",
+  "updatedAt": "2026-09-09T22:00:00.000Z"
+}

package/blueprints/platform-docker-compose-host/docs/topics.md

@@ -59,13 +59,13 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 38101-38109 sit at the LOW end of the 38101-38899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a platform-docker-compose-host REQ id into the number 38109 would collide against the shipped US-38109; band headroom (38110-38899) leaves that space.
+US 38101-38109 sit at the LOW end of the 38101-38899 band on purpose. A project-side story mechanically derived from a platform-docker-compose-host REQ id into the number 38109 would collide against the shipped US-38109; band headroom (38110-38899) leaves that space.
 
-Platform-docker-compose-host suffixes for this blueprint use the 3901-3904 block, continuing the widening pattern (deploy-hetzner-server 3801-3804 for the T-1 sibling).
+Platform-docker-compose-host suffixes for this blueprint use the 3901-3904 block, continuing the widening pattern (deploy-hetzner-server 3801-3804 for the host sibling).
 
 ## Cross-references
 
-- `deploy-hetzner-server` (v1.0.0): consumed via `capabilities: [cloudHost]`; this blueprint composes on the Hetzner cloudHost T-1 provisions.
+- `deploy-hetzner-server` (v1.0.0): consumed via `capabilities: [cloudHost]`; this blueprint composes on the Hetzner cloudHost that blueprint provisions.
 - `security-secrets-management` (v1.0.1): the compose secrets file source resolves through the applied secrets facade when the secrets blueprint is applied; the guide names a file-based fallback path when it is not.
-- Round-7 T-3 `edge-cloudflare-tunnel`: composes on `capabilities: [containerHost]`; runs cloudflared as a compose service in this stack.
+- Round-7 `edge-cloudflare-tunnel`: composes on `capabilities: [containerHost]`; runs cloudflared as a compose service in this stack.
 - `observability-logging`: elicited log-driver wires the applied logging companion's endpoint (journald by default, loki opt-in).

package/blueprints/platform-docker-compose-host/guide/platform-docker-compose-host.md

@@ -1,6 +1,6 @@
 # Guide: platform-docker-compose-host v1.0.0
 
-Round-7 T-2 of the Hetzner spec at `projects/blueprint-library/specs/hetzner-round-7-spec-2026-09-07.md`. Applies on top of `deploy-hetzner-server` (or any future `cloudHost` provider) and mints `containerHost` for downstream consumers.
+Applies on top of `deploy-hetzner-server` (or any future `cloudHost` provider) and mints `containerHost` for downstream consumers.
 
 ## What this blueprint gives you
 
@@ -24,11 +24,11 @@ A docker compose stack as your application runtime on a Linux VM. The compose fi
 
 The `reverse-proxy` elicit is the one you will hit first. The defaults:
 
-- **`caddy` (default per Baz decision 19).** Matches the estate baseline (dev-01 and ops-01 both run Caddy). Small config file, automatic HTTPS in production, `docker compose exec caddy caddy reload` picks up changes instantly. Reach for it whenever you do not have a strong project-side reason for something else. See the Caddy docs at https://caddyserver.com/docs/.
+- **`caddy` (the shipped default).** Matches a common Linux-host baseline where the target hosts already run Caddy. Small config file, automatic HTTPS in production, `docker compose exec caddy caddy reload` picks up changes instantly. Reach for it whenever you do not have a strong project-side reason for something else. See the Caddy docs at https://caddyserver.com/docs/.
 - **`traefik` (alternative).** Reach for it when your project wants docker-label auto-discovery (each service declares its hostname/route via labels in `compose.yaml` and Traefik configures itself). Trade-off: your routing is spread across many service blocks rather than one Caddyfile. See the Traefik docs at https://doc.traefik.io/traefik/.
-- **`none` (alternative).** Reach for it when the project is fronted only by the round-7 tunnel (`edge-cloudflare-tunnel` v1.0.0). The connector terminates at the CF edge and forwards to a service on the internal `web-net` network; no reverse proxy is needed inside compose. The lint refuses to add a `caddy/Caddyfile` when `reverse-proxy` is `none`.
+- **`none` (alternative).** Reach for it when the project is fronted only by the `edge-cloudflare-tunnel` sibling (v1.0.0). The connector terminates at the CF edge and forwards to a service on the internal `web-net` network; no reverse proxy is needed inside compose. The lint refuses to add a `caddy/Caddyfile` when `reverse-proxy` is `none`.
 
-The Coolify note (ADR-3903 body): "reject; it shadows what the blueprints contract and adds its own DB and UI as a second source of state". Baz decision 20, verbatim. A `platform-coolify-host` sibling mints on operator demand later; it is not part of round 7.
+The Coolify note (ADR-3903 body): "reject; it shadows what the blueprints contract and adds its own DB and UI as a second source of state". Recorded as a platform decision. A `platform-coolify-host` sibling may mint on operator demand later.
 
 ## Healthcheck contract
 
@@ -50,7 +50,7 @@ When `security-secrets-management` is applied, the source path resolves through
 
 The `log-driver` elicit (ADR-3904):
 
-- **`journald` (default).** Matches the Debian 12 and Ubuntu 24.04 baseline the T-1 cloud-init sets up on the throwaway server. `journalctl -u docker.service` and `journalctl CONTAINER_NAME=<name>` reach the same stream you would see in `docker logs`.
+- **`journald` (default).** Matches the Debian 12 and Ubuntu 24.04 baseline the deploy-hetzner-server cloud-init sets up on the throwaway server. `journalctl -u docker.service` and `journalctl CONTAINER_NAME=<name>` reach the same stream you would see in `docker logs`.
 - **`loki` (opt-in).** Reach for it when the applying project runs Grafana. The compose logging block wires each service through the Grafana Loki docker plugin; the observability-logging companion supplies the loki endpoint.
 
 The compose-config-lint refuses on any driver value outside the two. The lint fires before `docker compose up` runs.
@@ -85,7 +85,7 @@ Real-account probes require `CI_HAS_HETZNER_ACCOUNT=true` plus `HCLOUD_TOKEN`; w
 
 ## Applying to your project
 
-Once T-1 (`deploy-hetzner-server`) has provisioned a `cloudHost`:
+Once `deploy-hetzner-server` has provisioned a `cloudHost`:
 
 ```
 rcf apply platform-docker-compose-host

package/blueprints/security-auth-clerk/CHANGELOG.md

@@ -1,9 +1,41 @@
 # security-auth-clerk CHANGELOG
 
-## 1.3.0 (visual round T-4, spec 2026-09-06 section 5.4.2, Baz Q2 default)
+## 1.5.4 - 2026-09-11
 
-- Declares `capabilities: [principalDirectory, roleModel, sessionInventory, hostedIdentityUi]` on `blueprint.json`. Additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump). Consumed at apply time by the visual round T-4 `application-account-settings` blueprint to gate the sessions surface (probe pack check `AC-25106-1`) and the security surface hosted-UI branch (`AC-25105-1`). Clerk exposes an inventory of active sessions with device labels and a terminate action, and hosts identity screens (sign-in, sign-up, account, security) that a link-out or embed can consume.
+- Criterion-e probe pack refinement: every conformance-only result row now records `anchorAcId: null` alongside a `limitation` that opens with a shipped AC id from the blueprint's user stories (`AC-9110-1` on the principal-directory smoke, `AC-9112-3` and `AC-9112-4` on the sign-in-token mint and revoke rows, dedicated `AC-9112-1` and `AC-9112-5` notObservableHere rows on the session-inventory probe). Detail strings on de-claimed rows describe only what was observed at the surface the probe drove (Clerk Backend API for the two live probes; the fixture URL validator or role adapter for the local ones) and no longer claim REQ-008 or any AC as observed end to end. The anatomy helper enforces conformance-only rows to satisfy `anchorAcId === null`, requires limitations to open with an `AC-<n>-<n>` id that resolves to a shipped acceptance criterion on the blueprint's user stories (REQ-prefixed anchors are refused and fabricated ids are rejected), and does not count pre-delete presence as an absence observation on the inventory-diff shape.
 
-## 1.2.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
+## 1.5.3 - 2026-09-11
 
-- Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round T-5 `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.
+- Every AC/REQ anchor on the criterion-e probe pack is de-claimed to `conformanceOnly` with a limitation naming the shipped AC that is observable only in the integration harness follow-up. Live evidence on the two `real-account-*` probes (Clerk Backend API principal-directory smoke, sign-in-token mint+revoke lifecycle) is preserved on the rows; the anchor drops to null and the limitation says why. `hosted-identity-ui-config` and `role-model-adapter` rows keep their fixture-adapter observations under the same shape.
+
+## 1.5.2 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering the four declared capabilities: `role-model-adapter` (roleModel; local), `hosted-identity-ui-config` (hostedIdentityUi; local, https-only refusal), `real-account-principal-directory-round-trip` (principalDirectory; live against Clerk Backend API, creates a scratch principal, reads back, list-diff, deletes), and `real-account-session-inventory` (sessionInventory; live against the Clerk sign-in-token surface). Fixture at `packages/rcf-lite/test/fixtures/security-auth-clerk/` declares every env var the pack reads (`CI_HAS_CLERK_ACCOUNT`, `CLERK_SECRET_KEY`, `CLERK_PUBLISHABLE_KEY`, `CLERK_API_BASE_URL`, `GITHUB_RUN_ID`); anatomy test at `packages/rcf-lite/test/blueprint/security-auth-clerk-anatomy.test.js` pins pack shape, fixture manifest completeness and the account-bound skip contract.
+- Iteration on the probe pack landed the Clerk-gate distinction between unset and set-but-not-`true` for both live probes; `aggregate([])` and null-result normalisation now report `detail: 'no checks ran'` exactly. The slug reads AMBER on criterion e until the integration-harness follow-up lifts the AC-level rows.
+
+## 1.5.1
+
+- Adds `vendorCitation` on `AC-9108-1` (`{ url, verifiedOn }` pointing at the Clerk sign-up-and-sign-in-options guide) and on `AC-9109-2` (pointing at the Clerk system-limits page). Both ACs rest on Clerk-documented facts; the citations record the exact page and the ISO-8601 verification date so an operator can retrace the fact without following prose leads.
+- Owner rule on `signInStrategy`: repoints `REQ-005.description` to reference `TAC-1001-security-auth-clerk-middleware.interfaces.config` as the owner of the record shape; `AC-9108-1` keeps the literal `{ primary: string, alternates: string[] }` as an oracle and gains an `ownerRef` at the same field.
+
+## 1.5.0
+
+- Extends `REQ-001.description` with a one-line runtime clause naming the `hostedIdentityUi` capability verbatim (Clerk-hosted sign-in, sign-up, MFA, and account-management surfaces; no project route renders a credential-input control of its own). Adds `AC-9102-3` to `US-9102` binding a fixed source-tree-scan observation against `TAC-1001-security-auth-clerk-middleware` `responsibilities.signInStrategy`. Adds `US-9113` binding `REQ-011` (audit surface) with four ACs covering the success, refusal, retry and boundary paths of the verification and sessionInventory audit-event contract, each `ownerRef` pointing at `TAC-1003-security-auth-clerk-session-verifier` `responsibilities.audit`. Rewrites `REQ-003.description` to reference `TAC-1001-security-auth-clerk-middleware` `responsibilities.verify` rather than restate the `{ authenticated, principal?, reason? }` shape verbatim, and moves the REQ's `deliveredBy` from the shape ADR to the owning TAC.
+- repoints `REQ-001.deliveredBy` from `TAC-1004-security-auth-clerk-claims-mapper.responsibilities.reduceClaims` to `TAC-1001-security-auth-clerk-middleware.responsibilities.signInStrategy`, the responsibility that carries the `hostedIdentityUi` mount behaviour (the field `AC-9102-3` observes); strengthens the TAC-1001 `signInStrategy` responsibility text to name the `hostedIdentityUi` capability verbatim. Tightens `AC-9113-1` and `AC-9113-2` to name each event by its (`operation`, `outcome`) tuple and binds the refusal case to `reasonClass=expired` for an expired `__session` cookie input (dropping the example set). Adds `AC-9113-5` (permission: unauthenticated `sessionInventory.revoke` refused with `reasonClass=unauthenticated`, no side effect) and `AC-9113-6` (idempotency: two verifications of the same valid cookie emit two events, count is one per verify call). Adds a 7a inline note in the story's `description` documenting the credential and permission scenario-class mapping.
+
+## 1.4.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.4.0 (2026-09-09)
+
+- Adds `REQ-010` and `US-9112` for the `sessionInventory` capability contract (list, revoke-one, revoke-all-except-current, unauthenticated refusal, unknown-session refusal, one structured audit event per operation) and extends `TAC-1003` with the `sessionInventory` interface. Adds `REQ-011` (verification and inventory audit surface with a fixed field allow-list and prefix boundary). Reconciles the Principal shape in `REQ-001` to the four-field record already asserted by the ACs and TAC-1004. Adds `deliveredBy` on every `must` requirement and `disposition: fixed` on every existing acceptance criterion; adds `ownerRef` on ACs that observe the `sessionInventory` interface. Names the `principalDirectory`, `roleModel`, and `hostedIdentityUi` capabilities on the requirements that already carry their runtime clauses.
+- Softens `US-9112` `AC-1` to reference the `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` `SessionRow` shape rather than restating its fields (clerk owns the shape, and the reference form keeps every consumer AC single-owner).
+
+## 1.3.0 (visual round, spec 2026-09-06 section 5.4.2, operator Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel, sessionInventory, hostedIdentityUi]` on `blueprint.json`. Additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump). Consumed at apply time by the visual round `application-account-settings` blueprint to gate the sessions surface (probe pack check `AC-25106-1`) and the security surface hosted-UI branch (`AC-25105-1`). Clerk exposes an inventory of active sessions with device labels and a terminate action, and hosts identity screens (sign-in, sign-up, account, security) that a link-out or embed can consume.
+
+## 1.2.0 (visual round, spec 2026-09-04 section 5.5.2, operator Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.

package/blueprints/security-auth-clerk/README.md

@@ -3,7 +3,7 @@
 The tenth content blueprint on the rcf-build-lite blueprint mechanism, category `security`. A Clerk-committed sibling to `security-auth-magic-link` on the `authModel` global topic: Clerk hosts the identity surface (users, sessions, sign-in UX, credential storage, MFA, account recovery); the project owns a framework-agnostic middleware boundary, a session verifier confined to one module, a Clerk-claim-to-project-verb authorisation adapter, and a reduced principal shape the rest of the codebase reasons against. Targeted at small greenfield rcf-lite projects that want hosted identity without building the user-and-session surface themselves; larger deployments supersede the vendor by superseding ADR-1001 with a project-level ADR and swapping the middleware and verifier adapters.
 
 
-> Latest: **v1.3.0** (visual round T-4, 2026-09-06). `capabilities: [principalDirectory, roleModel, sessionInventory, hostedIdentityUi]`. See [CHANGELOG.md](CHANGELOG.md).
+> Latest: **v1.5.1** (2026-09-10). `capabilities: [principalDirectory, roleModel, sessionInventory, hostedIdentityUi]`. See [CHANGELOG.md](CHANGELOG.md).
 
 ## Apply
 
@@ -25,7 +25,7 @@ Composing with `security-auth-magic-link` (or any other blueprint contributing `
 | Vue-family sample | `assets/wiring/clerk-provider-vue.md` | The same shape rendered for a Vue-family client tier so the operator can pattern-match without a framework translation step |
 | Middleware sample (Node) | `assets/middleware/node-middleware-shape.md` | The framework-agnostic middleware boundary contract (`verify(request)`), with adapter samples for Express and Fastify |
 | Middleware sample (Workers) | `assets/middleware/workers-fetch-shape.md` | The Cloudflare Workers fetch-handler adapter around the same `verify(request)` contract; a project on Workers picks up this file, a project on Node picks up the Node sample |
-| Workers wrangler integration | `assets/wiring/workers-wrangler-toml-shape.md` | The wrangler.toml overlay a Workers deployer applies: `nodejs_compat`, `CLERK_SIGN_IN_URL`, the Clerk secret names, and the `run_worker_first` posture the auth-gate bypass finding required |
+| Workers wrangler integration | `assets/wiring/workers-wrangler-toml-shape.md` | The wrangler.toml overlay a Workers deployer applies: `nodejs_compat`, `CLERK_SIGN_IN_URL`, the Clerk secret names, and the `run_worker_first` posture required to close the auth-gate bypass |
 | Role-claim mapping | `assets/authorisation/role-claim-mapping-sample.md` | A worked verb-to-role mapping-table example, with the reduction from Clerk's `org:role` claim shape into the project's `roles` array |
 | Guide | `guide/security-auth-clerk.md` | Operator-facing: when to use it, when not, the promotion signals for the OAuth2 and Keycloak siblings, the operator decisions that remain open, the cost-honesty paragraph |
 | Coordination vocabulary | `docs/topics.md` | The one global-topic string this blueprint contributes and the shared id band registry (application-spa, application-api-rest, security-auth-magic-link, email-smtp-resend, persistence-data-sqlite, delivery-ci-workflows, observability-essentials, security-secrets-management, security-auth-clerk) |
@@ -34,9 +34,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (Clerk-hosted identity, the `__session` cookie transport, the middleware boundary shape, the authorisation-adapter contract, the claims-mapping discipline, the session-lifecycle posture, the `signInStrategy` config surface, the read-only provisioning posture, the delegated rate-limit posture, the accountBound runtime-verify posture); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (Clerk-hosted identity, the `__session` cookie transport, the middleware boundary shape, the authorisation-adapter contract, the claims-mapping discipline, the session-lifecycle posture, the `signInStrategy` config surface, the read-only provisioning posture, the delegated rate-limit posture, the accountBound runtime-verify posture); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 Deliberately not contributed: a Clerk SDK version pin (the blueprint fixes the shape, not the version; the project's package manifest pins the SDK); MFA configuration (Clerk owns MFA at the hosted surface; the blueprint delegates); a Clerk-webhook consumer contract (out of scope for the default; a project that needs one adds one project-authored TAC and one scope-local ADR); a project-side user table or organisation table (Clerk is authoritative; a project that mirrors state into a local table does so through a project-authored consumer, not through this blueprint); a project-side rate limiter or anti-enumeration defence on the sign-in flow (Clerk-delegated per REQ-007); a fixed sign-in strategy choice (fixed shape per REQ-005, choice is project-owned); an OAuth2 provider list (that is the sibling `security-auth-oauth2` blueprint's territory when it ships); a Keycloak realm configuration (that is `security-auth-keycloak`'s territory when it ships).
 

package/blueprints/security-auth-clerk/assets/wiring/workers-wrangler-toml-shape.md

@@ -30,7 +30,7 @@ Secrets are declared by name only, in the deploy blueprint's discipline: no `[se
 
 Bootstrap-and-steady-state guidance for setting the values lives on the deploy blueprint's `bootstrap-vs-steady-state.md` asset; the shape is the same for both Clerk secrets.
 
-## The auth-gate bypass finding
+## The auth-gate bypass
 
 The default `[assets]` binding on a Cloudflare Worker serves any file in the assets directory at its path before the Worker's `fetch` handler runs. If an auth-gated route (`/notes` for a UI page, `/api/notes` for an API surface) collides with a static file at the same path, the static file is served without ever hitting the middleware. This is a silent auth bypass at ship time; a project ships assuming the middleware protects `/notes` and only finds out on the first live probe that `/notes` returned the HTML shell to an unauthenticated request.
 

package/blueprints/security-auth-clerk/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "security-auth-clerk",
-  "version": "1.3.0",
+  "version": "1.5.4",
   "category": "security",
   "capabilities": [
     "principalDirectory",
@@ -155,6 +155,27 @@
       "id": "ADR-1005-security-auth-clerk-session-lifecycle",
       "kind": "adr",
       "path": "adrs/adr-1005-security-auth-clerk-session-lifecycle.json"
+    },
+    {
+      "id": "security-auth-clerk-REQ-010",
+      "kind": "req",
+      "path": "requirements/security-auth-clerk-req-010.json"
+    },
+    {
+      "id": "security-auth-clerk-US-9112",
+      "kind": "us",
+      "path": "user-stories/security-auth-clerk-us-9112.json"
+    },
+    {
+      "id": "security-auth-clerk-REQ-011",
+      "kind": "req",
+      "path": "requirements/security-auth-clerk-req-011.json"
+    },
+    {
+      "id": "security-auth-clerk-US-9113",
+      "kind": "us",
+      "path": "user-stories/security-auth-clerk-us-9113.json"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11T15:37:12.000Z"
 }

package/blueprints/security-auth-clerk/contributions/probes/hosted-identity-ui-config.mjs

@@ -0,0 +1,61 @@
+// Hosted-identity-UI configuration probe for security-auth-clerk.
+// Conformance-only. Every row records anchorAcId=null with
+// a limitation naming the shipped AC whose property the fixture URL
+// validator does not observe. The integration harness follow-up is
+// the surface where the AC-level property becomes observable.
+//
+//
+// capability: hostedIdentityUi. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-clerk', 'src');
+
+export const anchorAcId = null;
+export const capability = 'hostedIdentityUi';
+export const accountBound = false;
+
+const LIM = 'security-auth-clerk-AC-9101-1: probe validates hosted-UI URL shape only; the AC states the project route mounts the Clerk hosted sign-in surface, which needs a browser-driven runner (auth integration harness follow-up).';
+
+export default async function runProbe() {
+  const { validateHostedUiConfig } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'hosted-ui-config.mjs')).href);
+  const results = [];
+
+  const good = validateHostedUiConfig({
+    signInUrl: 'https://accounts.example.com/sign-in',
+    signUpUrl: 'https://accounts.example.com/sign-up',
+    afterSignInRedirect: 'https://app.example.com/',
+  });
+  results.push(deClaim({
+    capability,
+    verdict: good.ok ? 'pass' : 'fail',
+    detail: `hosted-ui happy path: ok=${good.ok} urls=${JSON.stringify(good.urls || good.error)}`,
+    evidence: { input: 'all three https urls', validatorReturn: good },
+  }, { ac: 'security-auth-clerk-AC-9101-1', limitation: LIM }));
+
+  const missing = validateHostedUiConfig({ signInUrl: 'https://x/y' });
+  results.push(deClaim({
+    capability,
+    verdict: !missing.ok && /missing keys/.test(missing.error) ? 'pass' : 'fail',
+    detail: `hosted-ui missing-keys refusal: ok=${missing.ok} error=${JSON.stringify(missing.error)}`,
+    evidence: { validatorReturn: missing },
+  }, { ac: 'security-auth-clerk-AC-9101-1', limitation: LIM }));
+
+  const nonHttps = validateHostedUiConfig({
+    signInUrl: 'http://accounts.example.com/sign-in',
+    signUpUrl: 'https://accounts.example.com/sign-up',
+    afterSignInRedirect: 'https://app.example.com/',
+  });
+  results.push(deClaim({
+    capability,
+    verdict: !nonHttps.ok && /must be https/.test(nonHttps.error) ? 'pass' : 'fail',
+    detail: `hosted-ui non-https refusal: ok=${nonHttps.ok} error=${JSON.stringify(nonHttps.error)}`,
+    evidence: { validatorReturn: nonHttps },
+  }, { ac: 'security-auth-clerk-AC-9101-1', limitation: LIM }));
+
+  return { results, extra: {} };
+}