rcf-lite 0.27.0 → 0.28.0

package/blueprints/platform-docker-compose-host/contributions/probes/secrets-as-files-scan.mjs

@@ -1,30 +1,74 @@
-// Probe: secrets-as-files-scan.
+// Probe: secrets-as-files-scan (v1.1.8).
 //
-// anchorAcId: AC-composeHost-secretsAreFiles (primary), AC-composeHost-secretShape.
-// accountBound: false.
+// This is an offline scanner: it reads the shipped compose.yaml,
+// the shipped .env, and every file under every declared service
+// bind-mount source, looking for a plaintext-token literal and for
+// the file-source shape of every top-level secret. It has no
+// engine-minted identifier - the sha256 of compose.yaml is
+// computed by this probe with Node's `createHash` and the service
+// and secret names are Compose's own choices, not engine-returned
+// identities.
+//
+// Every result row is a `conformanceOnly` de-claim naming the
+// shipped AC clause the offline scan does not observe. The live
+// observation for both AC-composeHost-secretShape ("mounted 0o400"
+// clause, in-container stat) and AC-composeHost-secretsAreFiles
+// (service secrets actually mounted, not present in env) lives on
+// `real-account-minimal-stack-up`, which runs
+// `docker exec ... stat -c %a /run/secrets/<name>` inside every
+// consuming container. The mode observation belongs there, not to
+// this offline scan.
 //
-// Passes when:
-// - every secret declared under the compose top-level secrets: key
-//   references a file: source (never inline).
-// - no line in compose.yaml or any referenced service config carries a
-//   plaintext token pattern matching (secretName, secretValue).
+// accountBound: false.
 //
-// Mutation:
-// - SIMULATE_PLAINTEXT_SECRET=true writes the fixture web-token literal
-//   into compose.yaml (as an environment entry on the web service) and
-//   the probe FAILS naming the file and the literal.
+// Scans:
+//   - compose.yaml: every declared top-level secret references a
+//     file: source (secretShape); every top-level secret has at
+//     least one consuming service (an orphan top-level entry fails).
+//   - compose.yaml: for every consuming service, the reference lives
+//     in the service-level secrets: array (never in environment).
+//     A long-form entry with an explicit `mode` field is recorded
+//     verbatim; missing modes are NOT assumed to be 0o400 here (that
+//     assertion belongs to the real-account probe that observes the
+//     mounted file inside the container).
+//   - compose.yaml, .env, plus every file under every service's
+//     bind-mount source directory (config discovery walks the compose
+//     service list, not a hardcoded caddy/ dir): no plaintext token
+//     literal appears.
+//   - The mutation switch SIMULATE_PLAINTEXT_SECRET writes a plaintext
+//     literal into a scratch copy of compose.yaml and the probe FAILS
+//     naming file+line.
 
-import { readFile, cp, rm, mkdir } from 'node:fs/promises';
+import { readFile, cp, rm, mkdir, readdir, stat } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { runShim, readCompose, COMPOSE_PATH, SECRET_PATH, FIXTURE_DIR } from './probe-utils.mjs';
+import { join, resolve, dirname, isAbsolute, relative } from 'node:path';
+import { runShim, readCompose, COMPOSE_PATH, SECRET_PATH, ENV_PATH, FIXTURE_DIR } from './probe-utils.mjs';
 
-export const anchorAcIds = [
-  'AC-composeHost-secretsAreFiles',
-  'AC-composeHost-secretShape',
-];
+function sha256(text) {
+  return createHash('sha256').update(text, 'utf8').digest('hex');
+}
+
+export const anchorAcIds = [];
 export const accountBound = false;
 
+const LIMIT_SHAPE = 'AC-composeHost-secretShape: top-level `file:` source is validated offline against the shipped compose.yaml; the live observation ("mounted at mode 0o400" clause, in-container `stat -c %a /run/secrets/<name>`) is carried by real-account-minimal-stack-up.';
+const LIMIT_FILES = 'AC-composeHost-secretsAreFiles: service-level secrets: reference shape is validated offline against the shipped compose.yaml; the live observation (the service consuming the file mount inside the container) is carried by real-account-minimal-stack-up.';
+
+async function walkFiles(root) {
+  const out = [];
+  const entries = await readdir(root, { withFileTypes: true }).catch(() => []);
+  for (const e of entries) {
+    const full = join(root, e.name);
+    if (e.isDirectory()) {
+      out.push(...await walkFiles(full));
+    } else if (e.isFile()) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+
 async function applyPlaintextMutation() {
   const scratch = join(tmpdir(), `rcf-lite-t2-secrets-scan-${Date.now()}`);
   await mkdir(scratch, { recursive: true });
@@ -32,23 +76,61 @@ async function applyPlaintextMutation() {
   const composePath = join(scratch, 'compose.yaml');
   let text = await readFile(composePath, 'utf8');
   const secret = (await readFile(SECRET_PATH, 'utf8')).trim();
-  // Inject WEB_TOKEN=<literal> as an environment entry on the web service.
   text = text.replace(/(\n    env_file:\n)/, `\n    environment:\n      - WEB_TOKEN=${secret}\n$1`);
   const { writeFile } = await import('node:fs/promises');
   await writeFile(composePath, text, 'utf8');
   return { scratch, composePath };
 }
 
-async function scanForLiteral({ composePath, secret, secretName }) {
-  const text = await readFile(composePath, 'utf8');
-  const lines = text.split('\n');
-  const hits = [];
-  for (let i = 0; i < lines.length; i++) {
-    if (lines[i].includes(secret)) {
-      hits.push({ file: composePath, line: i + 1, snippet: lines[i].trim() });
+async function scanFileForLiteral(file, secret) {
+  try {
+    const s = await stat(file);
+    if (s.size > 4 * 1024 * 1024) return []; // skip large binaries
+    const text = await readFile(file, 'utf8');
+    const hits = [];
+    const lines = text.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+      if (lines[i].includes(secret)) {
+        hits.push({ file, line: i + 1, snippet: lines[i].trim().slice(0, 200) });
+      }
     }
+    return hits;
+  } catch (_) {
+    return [];
   }
-  return hits;
+}
+
+function collectServiceConfigSources(doc, composeDir) {
+  const sources = new Set();
+  const services = doc.services ?? {};
+  for (const [, svc] of Object.entries(services)) {
+    const vols = (svc && svc.volumes) || [];
+    if (!Array.isArray(vols)) continue;
+    for (const v of vols) {
+      if (typeof v === 'string') {
+        const idx = v.indexOf(':');
+        if (idx <= 0) continue;
+        const src = v.slice(0, idx);
+        if (src.startsWith('./') || src.startsWith('/') || src.startsWith('~')) {
+          sources.add(isAbsolute(src) ? src : resolve(composeDir, src));
+        }
+      } else if (v && typeof v === 'object') {
+        if (v.type === 'bind' && typeof v.source === 'string') {
+          sources.add(isAbsolute(v.source) ? v.source : resolve(composeDir, v.source));
+        }
+      }
+    }
+  }
+  return [...sources];
+}
+
+function getServiceSecretMode(svcSecretsEntry) {
+  if (typeof svcSecretsEntry === 'string') return null;
+  if (svcSecretsEntry && typeof svcSecretsEntry === 'object') {
+    if (svcSecretsEntry.mode === undefined || svcSecretsEntry.mode === null) return null;
+    return svcSecretsEntry.mode;
+  }
+  return null;
 }
 
 export default async function runProbe() {
@@ -65,45 +147,167 @@ export default async function runProbe() {
     scratchToClean = m.scratch;
   }
   try {
-    // Secret-shape scan: every declared secret has a file: source.
+    const composeTextForHash = await readFile(composePathToScan, 'utf8');
+    const composeSha256 = sha256(composeTextForHash);
     const { doc } = await readCompose();
     const secretsBlock = doc.secrets ?? {};
     const secretNames = Object.keys(secretsBlock);
     extra.declaredSecrets = secretNames;
+
     for (const name of secretNames) {
       const spec = secretsBlock[name] ?? {};
       if (!spec.file) {
         results.push({
-          anchorAcId: 'AC-composeHost-secretShape',
+          anchorAcId: null,
+          conformanceOnly: true,
+          limitation: LIMIT_SHAPE,
           verdict: 'fail',
-          detail: `compose secret '${name}' is not a file: source`,
+          detail: `offline secrets-as-files-scan: compose secret '${name}' is not a file: source`,
+          evidence: { composeSha256, declaredSecretName: name, spec, expectedShape: 'file: <path>' },
         });
       } else {
         results.push({
-          anchorAcId: 'AC-composeHost-secretShape',
+          anchorAcId: null,
+          conformanceOnly: true,
+          limitation: LIMIT_SHAPE,
           verdict: 'pass',
-          detail: `compose secret '${name}' -> file: ${spec.file}`,
+          detail: `offline secrets-as-files-scan: compose secret '${name}' declares file: ${spec.file}`,
+          evidence: { composeSha256, declaredSecretName: name, fileSource: spec.file, scannedFrom: 'compose.yaml top-level secrets block' },
         });
       }
     }
-    // Plaintext-literal scan.
-    const hits = await scanForLiteral({ composePath: composePathToScan, secret, secretName: 'web-token' });
-    if (hits.length > 0) {
-      for (const h of hits) {
+
+    const services = doc.services ?? {};
+    const consumerBySecret = {};
+    for (const name of secretNames) consumerBySecret[name] = [];
+    for (const [svcName, svc] of Object.entries(services)) {
+      const svcSecrets = Array.isArray(svc && svc.secrets) ? svc.secrets : [];
+      for (const entry of svcSecrets) {
+        const secretName = typeof entry === 'string' ? entry : (entry && entry.source) || null;
+        if (secretName && secretNames.includes(secretName)) consumerBySecret[secretName].push(svcName);
+      }
+    }
+    for (const name of secretNames) {
+      const consumers = consumerBySecret[name];
+      if (consumers.length === 0) {
+        results.push({
+          anchorAcId: null,
+          conformanceOnly: true,
+          limitation: LIMIT_SHAPE,
+          verdict: 'fail',
+          detail: `offline secrets-as-files-scan: compose secret '${name}' is declared at the top level but no service references it via the service-level secrets: array (orphan)`,
+          evidence: { composeSha256, declaredSecretName: name, consumingServices: [], expectedShape: 'at least one consuming service' },
+        });
+      } else {
+        results.push({
+          anchorAcId: null,
+          conformanceOnly: true,
+          limitation: LIMIT_SHAPE,
+          verdict: 'pass',
+          detail: `offline secrets-as-files-scan: compose secret '${name}' is referenced by ${consumers.length} service(s): ${consumers.join(', ')}`,
+          evidence: { composeSha256, declaredSecretName: name, consumingServices: consumers, scannedFrom: 'compose.yaml services block' },
+        });
+      }
+    }
+
+    for (const [svcName, svc] of Object.entries(services)) {
+      const svcSecrets = Array.isArray(svc && svc.secrets) ? svc.secrets : [];
+      for (const entry of svcSecrets) {
+        const secretName = typeof entry === 'string' ? entry : (entry && entry.source) || null;
+        if (!secretName) continue;
+        if (!secretNames.includes(secretName)) {
+          results.push({
+            anchorAcId: null,
+            conformanceOnly: true,
+            limitation: LIMIT_FILES,
+            verdict: 'fail',
+            detail: `offline secrets-as-files-scan: service '${svcName}' references undeclared secret '${secretName}' via the service-level secrets: block`,
+            evidence: { composeSha256, serviceName: svcName, declaredSecretName: secretName, declaredSecrets: secretNames },
+          });
+          continue;
+        }
+        const declaredMode = getServiceSecretMode(entry);
+        results.push({
+          anchorAcId: null,
+          conformanceOnly: true,
+          limitation: LIMIT_FILES,
+          verdict: 'pass',
+          detail: `offline secrets-as-files-scan: service '${svcName}' references secret '${secretName}' via service-level secrets: (declaredMode=${declaredMode === null ? 'unset' : String(declaredMode)})`,
+          evidence: {
+            composeSha256,
+            serviceName: svcName,
+            declaredSecretName: secretName,
+            declaredMode: declaredMode === null ? 'unset' : String(declaredMode),
+            scannedFrom: 'compose.yaml service secrets: block',
+          },
+        });
+      }
+      const environment = (svc && svc.environment) || [];
+      const envList = Array.isArray(environment) ? environment : Object.keys(environment).map((k) => `${k}=${environment[k]}`);
+      const svcSecretRefNames = svcSecrets.map((e) => (typeof e === 'string' ? e : (e && e.source) || null)).filter(Boolean);
+      for (const entry of envList) {
+        for (const n of secretNames) {
+          if (String(entry).includes(n) && !svcSecretRefNames.includes(n)) {
+            results.push({
+              anchorAcId: null,
+              conformanceOnly: true,
+              limitation: LIMIT_FILES,
+              verdict: 'fail',
+              detail: `offline secrets-as-files-scan: service '${svcName}' references secret '${n}' via environment entry '${entry}' instead of the service-level secrets: block`,
+              evidence: { composeSha256, serviceName: svcName, envEntry: String(entry), declaredSecretName: n },
+            });
+          }
+        }
+      }
+    }
+
+    const composeDir = dirname(composePathToScan);
+    const scanTargets = [composePathToScan, ENV_PATH];
+    const configSources = collectServiceConfigSources(doc, composeDir);
+    extra.discoveredConfigSources = configSources.map((p) => relative(FIXTURE_DIR, p));
+    for (const src of configSources) {
+      try {
+        const s = await stat(src);
+        if (s.isDirectory()) {
+          for (const f of await walkFiles(src)) scanTargets.push(f);
+        } else if (s.isFile()) {
+          scanTargets.push(src);
+        }
+      } catch (_) { /* skip missing/unresolvable sources */ }
+    }
+
+    const allHits = [];
+    for (const t of scanTargets) {
+      allHits.push(...await scanFileForLiteral(t, secret));
+    }
+    if (allHits.length > 0) {
+      for (const h of allHits) {
         results.push({
-          anchorAcId: 'AC-composeHost-secretsAreFiles',
+          anchorAcId: null,
+          conformanceOnly: true,
+          limitation: LIMIT_FILES,
           verdict: 'fail',
-          detail: `plaintext secret literal for 'web-token' found in ${h.file}:${h.line} (snippet: ${h.snippet})`,
+          detail: `offline secrets-as-files-scan: plaintext secret literal for 'web-token' found in ${h.file}:${h.line} (snippet: ${h.snippet})`,
+          evidence: { composeSha256, scannedFile: h.file, lineNumber: h.line, snippet: h.snippet, declaredSecretName: 'web-token' },
         });
       }
     } else {
       results.push({
-        anchorAcId: 'AC-composeHost-secretsAreFiles',
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_FILES,
         verdict: 'pass',
-        detail: `no plaintext secret literal for 'web-token' found in the scanned compose.yaml`,
+        detail: `offline secrets-as-files-scan: no plaintext secret literal for 'web-token' found across ${scanTargets.length} scanned files (compose.yaml, .env, and every file under each service's bind-mount source)`,
+        evidence: {
+          composeSha256,
+          scannedFilenames: scanTargets.map((f) => f.replace(FIXTURE_DIR + '/', '')),
+          fileCount: scanTargets.length,
+          discoveredConfigSources: extra.discoveredConfigSources,
+          declaredSecretName: 'web-token',
+        },
       });
     }
-    extra.hits = hits.map((h) => ({ file: h.file, line: h.line }));
+    extra.scannedFileCount = scanTargets.length;
   } finally {
     if (scratchToClean) await rm(scratchToClean, { recursive: true, force: true });
   }

package/blueprints/platform-docker-compose-host/docs/topics.md

@@ -59,7 +59,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 38101-38109 sit at the LOW end of the 38101-38899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from a platform-docker-compose-host REQ id into the number 38109 would collide against the shipped US-38109; band headroom (38110-38899) leaves that space.
+US 38101-38109 sit at the LOW end of the 38101-38899 band on purpose. A project-side story mechanically derived from a platform-docker-compose-host REQ id into the number 38109 would collide against the shipped US-38109; band headroom (38110-38899) leaves that space.
 
 Platform-docker-compose-host suffixes for this blueprint use the 3901-3904 block, continuing the widening pattern (deploy-hetzner-server 3801-3804 for the host sibling).
 

package/blueprints/security-auth-clerk/CHANGELOG.md

@@ -1,24 +1,36 @@
 # security-auth-clerk CHANGELOG
 
+## 1.5.4 - 2026-09-11
+
+- Criterion-e probe pack refinement: every conformance-only result row now records `anchorAcId: null` alongside a `limitation` that opens with a shipped AC id from the blueprint's user stories (`AC-9110-1` on the principal-directory smoke, `AC-9112-3` and `AC-9112-4` on the sign-in-token mint and revoke rows, dedicated `AC-9112-1` and `AC-9112-5` notObservableHere rows on the session-inventory probe). Detail strings on de-claimed rows describe only what was observed at the surface the probe drove (Clerk Backend API for the two live probes; the fixture URL validator or role adapter for the local ones) and no longer claim REQ-008 or any AC as observed end to end. The anatomy helper enforces conformance-only rows to satisfy `anchorAcId === null`, requires limitations to open with an `AC-<n>-<n>` id that resolves to a shipped acceptance criterion on the blueprint's user stories (REQ-prefixed anchors are refused and fabricated ids are rejected), and does not count pre-delete presence as an absence observation on the inventory-diff shape.
+
+## 1.5.3 - 2026-09-11
+
+- Every AC/REQ anchor on the criterion-e probe pack is de-claimed to `conformanceOnly` with a limitation naming the shipped AC that is observable only in the integration harness follow-up. Live evidence on the two `real-account-*` probes (Clerk Backend API principal-directory smoke, sign-in-token mint+revoke lifecycle) is preserved on the rows; the anchor drops to null and the limitation says why. `hosted-identity-ui-config` and `role-model-adapter` rows keep their fixture-adapter observations under the same shape.
+
+## 1.5.2 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering the four declared capabilities: `role-model-adapter` (roleModel; local), `hosted-identity-ui-config` (hostedIdentityUi; local, https-only refusal), `real-account-principal-directory-round-trip` (principalDirectory; live against Clerk Backend API, creates a scratch principal, reads back, list-diff, deletes), and `real-account-session-inventory` (sessionInventory; live against the Clerk sign-in-token surface). Fixture at `packages/rcf-lite/test/fixtures/security-auth-clerk/` declares every env var the pack reads (`CI_HAS_CLERK_ACCOUNT`, `CLERK_SECRET_KEY`, `CLERK_PUBLISHABLE_KEY`, `CLERK_API_BASE_URL`, `GITHUB_RUN_ID`); anatomy test at `packages/rcf-lite/test/blueprint/security-auth-clerk-anatomy.test.js` pins pack shape, fixture manifest completeness and the account-bound skip contract.
+- Iteration on the probe pack landed the Clerk-gate distinction between unset and set-but-not-`true` for both live probes; `aggregate([])` and null-result normalisation now report `detail: 'no checks ran'` exactly. The slug reads AMBER on criterion e until the integration-harness follow-up lifts the AC-level rows.
+
 ## 1.5.1
 
-- Adds `vendorCitation` on `AC-9108-1` (`{ url, verifiedOn }` pointing at the Clerk sign-up-and-sign-in-options guide) and on `AC-9109-2` (pointing at the Clerk system-limits page): closes F-4 and F-5. Both ACs rest on Clerk-documented facts; the citations record the exact page and the ISO-8601 verification date so a reviewer can retrace the fact without following prose leads.
-- Closure fix pass (F-6): rewrites the `README.md` shelf-latest line in neutral customer-facing voice with no spec-provenance label.
+- Adds `vendorCitation` on `AC-9108-1` (`{ url, verifiedOn }` pointing at the Clerk sign-up-and-sign-in-options guide) and on `AC-9109-2` (pointing at the Clerk system-limits page). Both ACs rest on Clerk-documented facts; the citations record the exact page and the ISO-8601 verification date so an operator can retrace the fact without following prose leads.
 - Owner rule on `signInStrategy`: repoints `REQ-005.description` to reference `TAC-1001-security-auth-clerk-middleware.interfaces.config` as the owner of the record shape; `AC-9108-1` keeps the literal `{ primary: string, alternates: string[] }` as an oracle and gains an `ownerRef` at the same field.
 
 ## 1.5.0
 
 - Extends `REQ-001.description` with a one-line runtime clause naming the `hostedIdentityUi` capability verbatim (Clerk-hosted sign-in, sign-up, MFA, and account-management surfaces; no project route renders a credential-input control of its own). Adds `AC-9102-3` to `US-9102` binding a fixed source-tree-scan observation against `TAC-1001-security-auth-clerk-middleware` `responsibilities.signInStrategy`. Adds `US-9113` binding `REQ-011` (audit surface) with four ACs covering the success, refusal, retry and boundary paths of the verification and sessionInventory audit-event contract, each `ownerRef` pointing at `TAC-1003-security-auth-clerk-session-verifier` `responsibilities.audit`. Rewrites `REQ-003.description` to reference `TAC-1001-security-auth-clerk-middleware` `responsibilities.verify` rather than restate the `{ authenticated, principal?, reason? }` shape verbatim, and moves the REQ's `deliveredBy` from the shape ADR to the owning TAC.
-- Closure fixes: repoints `REQ-001.deliveredBy` from `TAC-1004-security-auth-clerk-claims-mapper.responsibilities.reduceClaims` to `TAC-1001-security-auth-clerk-middleware.responsibilities.signInStrategy`, the responsibility that carries the `hostedIdentityUi` mount behaviour (the field `AC-9102-3` observes); strengthens the TAC-1001 `signInStrategy` responsibility text to name the `hostedIdentityUi` capability verbatim. Tightens `AC-9113-1` and `AC-9113-2` to name each event by its (`operation`, `outcome`) tuple and binds the refusal case to `reasonClass=expired` for an expired `__session` cookie input (dropping the example set). Adds `AC-9113-5` (permission: unauthenticated `sessionInventory.revoke` refused with `reasonClass=unauthenticated`, no side effect) and `AC-9113-6` (idempotency: two verifications of the same valid cookie emit two events, count is one per verify call). Adds a 7a inline note in the story's `description` documenting the credential and permission scenario-class mapping.
+- repoints `REQ-001.deliveredBy` from `TAC-1004-security-auth-clerk-claims-mapper.responsibilities.reduceClaims` to `TAC-1001-security-auth-clerk-middleware.responsibilities.signInStrategy`, the responsibility that carries the `hostedIdentityUi` mount behaviour (the field `AC-9102-3` observes); strengthens the TAC-1001 `signInStrategy` responsibility text to name the `hostedIdentityUi` capability verbatim. Tightens `AC-9113-1` and `AC-9113-2` to name each event by its (`operation`, `outcome`) tuple and binds the refusal case to `reasonClass=expired` for an expired `__session` cookie input (dropping the example set). Adds `AC-9113-5` (permission: unauthenticated `sessionInventory.revoke` refused with `reasonClass=unauthenticated`, no side effect) and `AC-9113-6` (idempotency: two verifications of the same valid cookie emit two events, count is one per verify call). Adds a 7a inline note in the story's `description` documenting the credential and permission scenario-class mapping.
 
 ## 1.4.1 (register-sweep patch, 2026-09-10)
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 1.4.0 (hardening pass, spec 2026-09-09 section 5.4.2)
+## 1.4.0 (2026-09-09)
 
-- Adds `REQ-010` and `US-9112` for the `sessionInventory` capability contract (list, revoke-one, revoke-all-except-current, unauthenticated refusal, unknown-session refusal, one structured audit event per operation) and extends `TAC-1003` with the `sessionInventory` interface. Adds `REQ-011` (verification and inventory audit surface with a fixed field allow-list and prefix boundary). Reconciles the Principal shape in `REQ-001` to the four-field record already asserted by the ACs and TAC-1004. Adds `deliveredBy` on every `must` requirement and `disposition: fixed` on every existing acceptance criterion; adds `ownerRef` on ACs that observe the `sessionInventory` interface. Names the `principalDirectory`, `roleModel`, and `hostedIdentityUi` capabilities on the requirements that already carry their runtime clauses. hardening pass (criteria a, b, c on the 2026-09-09 programme).
-- Review fix pass (PR #188 findings): softens `US-9112` `AC-1` to reference the `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` `SessionRow` shape rather than restating its fields (clerk owns the shape, and the reference form keeps every consumer AC single-owner).
+- Adds `REQ-010` and `US-9112` for the `sessionInventory` capability contract (list, revoke-one, revoke-all-except-current, unauthenticated refusal, unknown-session refusal, one structured audit event per operation) and extends `TAC-1003` with the `sessionInventory` interface. Adds `REQ-011` (verification and inventory audit surface with a fixed field allow-list and prefix boundary). Reconciles the Principal shape in `REQ-001` to the four-field record already asserted by the ACs and TAC-1004. Adds `deliveredBy` on every `must` requirement and `disposition: fixed` on every existing acceptance criterion; adds `ownerRef` on ACs that observe the `sessionInventory` interface. Names the `principalDirectory`, `roleModel`, and `hostedIdentityUi` capabilities on the requirements that already carry their runtime clauses.
+- Softens `US-9112` `AC-1` to reference the `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` `SessionRow` shape rather than restating its fields (clerk owns the shape, and the reference form keeps every consumer AC single-owner).
 
 ## 1.3.0 (visual round, spec 2026-09-06 section 5.4.2, operator Q2 default)
 

package/blueprints/security-auth-clerk/README.md

@@ -25,7 +25,7 @@ Composing with `security-auth-magic-link` (or any other blueprint contributing `
 | Vue-family sample | `assets/wiring/clerk-provider-vue.md` | The same shape rendered for a Vue-family client tier so the operator can pattern-match without a framework translation step |
 | Middleware sample (Node) | `assets/middleware/node-middleware-shape.md` | The framework-agnostic middleware boundary contract (`verify(request)`), with adapter samples for Express and Fastify |
 | Middleware sample (Workers) | `assets/middleware/workers-fetch-shape.md` | The Cloudflare Workers fetch-handler adapter around the same `verify(request)` contract; a project on Workers picks up this file, a project on Node picks up the Node sample |
-| Workers wrangler integration | `assets/wiring/workers-wrangler-toml-shape.md` | The wrangler.toml overlay a Workers deployer applies: `nodejs_compat`, `CLERK_SIGN_IN_URL`, the Clerk secret names, and the `run_worker_first` posture the auth-gate bypass finding required |
+| Workers wrangler integration | `assets/wiring/workers-wrangler-toml-shape.md` | The wrangler.toml overlay a Workers deployer applies: `nodejs_compat`, `CLERK_SIGN_IN_URL`, the Clerk secret names, and the `run_worker_first` posture required to close the auth-gate bypass |
 | Role-claim mapping | `assets/authorisation/role-claim-mapping-sample.md` | A worked verb-to-role mapping-table example, with the reduction from Clerk's `org:role` claim shape into the project's `roles` array |
 | Guide | `guide/security-auth-clerk.md` | Operator-facing: when to use it, when not, the promotion signals for the OAuth2 and Keycloak siblings, the operator decisions that remain open, the cost-honesty paragraph |
 | Coordination vocabulary | `docs/topics.md` | The one global-topic string this blueprint contributes and the shared id band registry (application-spa, application-api-rest, security-auth-magic-link, email-smtp-resend, persistence-data-sqlite, delivery-ci-workflows, observability-essentials, security-secrets-management, security-auth-clerk) |
@@ -34,9 +34,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (Clerk-hosted identity, the `__session` cookie transport, the middleware boundary shape, the authorisation-adapter contract, the claims-mapping discipline, the session-lifecycle posture, the `signInStrategy` config surface, the read-only provisioning posture, the delegated rate-limit posture, the accountBound runtime-verify posture); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (Clerk-hosted identity, the `__session` cookie transport, the middleware boundary shape, the authorisation-adapter contract, the claims-mapping discipline, the session-lifecycle posture, the `signInStrategy` config surface, the read-only provisioning posture, the delegated rate-limit posture, the accountBound runtime-verify posture); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 Deliberately not contributed: a Clerk SDK version pin (the blueprint fixes the shape, not the version; the project's package manifest pins the SDK); MFA configuration (Clerk owns MFA at the hosted surface; the blueprint delegates); a Clerk-webhook consumer contract (out of scope for the default; a project that needs one adds one project-authored TAC and one scope-local ADR); a project-side user table or organisation table (Clerk is authoritative; a project that mirrors state into a local table does so through a project-authored consumer, not through this blueprint); a project-side rate limiter or anti-enumeration defence on the sign-in flow (Clerk-delegated per REQ-007); a fixed sign-in strategy choice (fixed shape per REQ-005, choice is project-owned); an OAuth2 provider list (that is the sibling `security-auth-oauth2` blueprint's territory when it ships); a Keycloak realm configuration (that is `security-auth-keycloak`'s territory when it ships).
 

package/blueprints/security-auth-clerk/assets/wiring/workers-wrangler-toml-shape.md

@@ -30,7 +30,7 @@ Secrets are declared by name only, in the deploy blueprint's discipline: no `[se
 
 Bootstrap-and-steady-state guidance for setting the values lives on the deploy blueprint's `bootstrap-vs-steady-state.md` asset; the shape is the same for both Clerk secrets.
 
-## The auth-gate bypass finding
+## The auth-gate bypass
 
 The default `[assets]` binding on a Cloudflare Worker serves any file in the assets directory at its path before the Worker's `fetch` handler runs. If an auth-gated route (`/notes` for a UI page, `/api/notes` for an API surface) collides with a static file at the same path, the static file is served without ever hitting the middleware. This is a silent auth bypass at ship time; a project ships assuming the middleware protects `/notes` and only finds out on the first live probe that `/notes` returned the HTML shell to an unauthenticated request.
 

package/blueprints/security-auth-clerk/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "security-auth-clerk",
-  "version": "1.5.1",
+  "version": "1.5.4",
   "category": "security",
   "capabilities": [
     "principalDirectory",
@@ -176,5 +176,6 @@
       "kind": "us",
       "path": "user-stories/security-auth-clerk-us-9113.json"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11T15:37:12.000Z"
 }

package/blueprints/security-auth-clerk/contributions/probes/hosted-identity-ui-config.mjs

@@ -0,0 +1,61 @@
+// Hosted-identity-UI configuration probe for security-auth-clerk.
+// Conformance-only. Every row records anchorAcId=null with
+// a limitation naming the shipped AC whose property the fixture URL
+// validator does not observe. The integration harness follow-up is
+// the surface where the AC-level property becomes observable.
+//
+//
+// capability: hostedIdentityUi. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-clerk', 'src');
+
+export const anchorAcId = null;
+export const capability = 'hostedIdentityUi';
+export const accountBound = false;
+
+const LIM = 'security-auth-clerk-AC-9101-1: probe validates hosted-UI URL shape only; the AC states the project route mounts the Clerk hosted sign-in surface, which needs a browser-driven runner (auth integration harness follow-up).';
+
+export default async function runProbe() {
+  const { validateHostedUiConfig } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'hosted-ui-config.mjs')).href);
+  const results = [];
+
+  const good = validateHostedUiConfig({
+    signInUrl: 'https://accounts.example.com/sign-in',
+    signUpUrl: 'https://accounts.example.com/sign-up',
+    afterSignInRedirect: 'https://app.example.com/',
+  });
+  results.push(deClaim({
+    capability,
+    verdict: good.ok ? 'pass' : 'fail',
+    detail: `hosted-ui happy path: ok=${good.ok} urls=${JSON.stringify(good.urls || good.error)}`,
+    evidence: { input: 'all three https urls', validatorReturn: good },
+  }, { ac: 'security-auth-clerk-AC-9101-1', limitation: LIM }));
+
+  const missing = validateHostedUiConfig({ signInUrl: 'https://x/y' });
+  results.push(deClaim({
+    capability,
+    verdict: !missing.ok && /missing keys/.test(missing.error) ? 'pass' : 'fail',
+    detail: `hosted-ui missing-keys refusal: ok=${missing.ok} error=${JSON.stringify(missing.error)}`,
+    evidence: { validatorReturn: missing },
+  }, { ac: 'security-auth-clerk-AC-9101-1', limitation: LIM }));
+
+  const nonHttps = validateHostedUiConfig({
+    signInUrl: 'http://accounts.example.com/sign-in',
+    signUpUrl: 'https://accounts.example.com/sign-up',
+    afterSignInRedirect: 'https://app.example.com/',
+  });
+  results.push(deClaim({
+    capability,
+    verdict: !nonHttps.ok && /must be https/.test(nonHttps.error) ? 'pass' : 'fail',
+    detail: `hosted-ui non-https refusal: ok=${nonHttps.ok} error=${JSON.stringify(nonHttps.error)}`,
+    evidence: { validatorReturn: nonHttps },
+  }, { ac: 'security-auth-clerk-AC-9101-1', limitation: LIM }));
+
+  return { results, extra: {} };
+}