rcf-lite 0.27.0 → 0.28.0

package/blueprints/security-auth-clerk/contributions/probes/probe-utils.mjs

@@ -0,0 +1,188 @@
+// Shared helpers for security-auth-clerk probes.
+//
+// Runtime-dependency posture:
+// - Local probes drive shipped-shape checks against the fixture at
+//   packages/rcf-lite/test/fixtures/security-auth-clerk/ without
+//   contacting Clerk.
+// - real-account-* probes call the Clerk Backend API (base URL
+//   https://api.clerk.com/v1, docs verifiedOn 2026-09-11
+//   https://clerk.com/docs/reference/backend-api) via fetch. The
+//   probe records real request ids (Clerk stamps X-Request-ID and
+//   returns object ids like user_..., ses_...) and cleans up the
+//   scratch principal in a finally block. Without
+//   CI_HAS_CLERK_ACCOUNT the probe records accountBoundSkipped: true
+//   naming the missing var per rule 7d.
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const SLUG = 'security-auth-clerk';
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/security-auth-clerk');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/security-auth-clerk');
+
+// Declared env vars (mirror the fixture README table).
+export const DECLARED_ENV = Object.freeze([
+  'CI_HAS_CLERK_ACCOUNT',
+  'CLERK_SECRET_KEY',
+  'CLERK_PUBLISHABLE_KEY',
+  'CLERK_API_BASE_URL',
+  'GITHUB_RUN_ID',
+]);
+
+export const SCRATCH_PRINCIPAL_PREFIX = 'pxe-clerk-';
+
+// First-8-words-of-anchor helper. Each result row's `detail` starts
+// with the first eight words of the anchored AC's or REQ's
+// description text. Anchor lookup walks contributions/user-stories/
+// and contributions/requirements/ under the blueprint root and
+// caches the map on first call. Null / unknown / missing anchors
+// yield an empty prefix.
+import { readFileSync as _rf } from 'node:fs';
+import { readdirSync as _rd } from 'node:fs';
+let _anchorMap = null;
+function _loadAnchorMap() {
+  const map = new Map();
+  const dirs = [
+    { dir: resolve(PROJECT_ROOT, 'blueprints', SLUG, 'contributions', 'user-stories'), kind: 'ac' },
+    { dir: resolve(PROJECT_ROOT, 'blueprints', SLUG, 'contributions', 'requirements'), kind: 'req' },
+  ];
+  for (const { dir, kind } of dirs) {
+    let entries;
+    try { entries = _rd(dir); } catch { continue; }
+    for (const name of entries) {
+      if (!name.endsWith('.json')) continue;
+      let j;
+      try { j = JSON.parse(_rf(resolve(dir, name), 'utf8')); } catch { continue; }
+      if (kind === 'ac') {
+        const usId = j.usId;
+        for (const ac of (j.acceptanceCriteria || [])) {
+          // AC id in the shipped JSON is like "AC-9101-1"; the
+          // anchor form used by probes is "<slug>-AC-9101-1".
+          const key = `${SLUG}-${ac.id}`;
+          map.set(key, ac.description || '');
+        }
+      } else {
+        const key = j.reqId; // already "<slug>-REQ-###"
+        if (key) map.set(key, j.description || j.title || '');
+      }
+    }
+  }
+  return map;
+}
+export function first8Words(anchor) {
+  if (!anchor) return '';
+  if (!_anchorMap) _anchorMap = _loadAnchorMap();
+  const txt = _anchorMap.get(anchor) || '';
+  if (!txt) return '';
+  const words = txt.split(/\s+/).filter(Boolean).slice(0, 8).join(' ');
+  return words;
+}
+export function withAnchorPrefix(row) {
+  const prefix = first8Words(row.anchorAcId);
+  if (!prefix) return row;
+  const already = typeof row.detail === 'string' && row.detail.startsWith(prefix);
+  if (already) return row;
+  const oldDetail = row.detail || '';
+  return { ...row, detail: `${prefix} :: ${oldDetail}` };
+}
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export function isSkipped(results) {
+  return results.length > 0 && results.every((r) => r.accountBoundSkipped === true);
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  // Prefix every row's detail with the first eight words of its
+  // anchored AC or REQ description; unanchored rows are left alone.
+  const prefixedResults = (results || []).map(withAnchorPrefix);
+  const raw = aggregate(prefixedResults);
+  const aggregateVerdict = isSkipped(prefixedResults) ? 'pass' : raw;
+  const report = {
+    slug: 'security-auth-clerk',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results: prefixedResults,
+    aggregateVerdict,
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = await mainFn();
+    if (!outcome || !Array.isArray(outcome.results) || outcome.results.length === 0) {
+      const results = [{
+        anchorAcId: 'unknown',
+        verdict: 'fail',
+        detail: 'no checks ran',
+      }];
+      const { report, path } = await writeReport({ probeName, engine, results });
+      process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+      process.stderr.write(`no-checks-ran fail written to ${path}\n`);
+      process.exitCode = 1;
+      return;
+    }
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorAcId: 'unknown',
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+// De-claim helper. When the shipped AC does not observe what the probe observes, the row keeps its
+// verdict, evidence and engine as they are, but the anchor drops to null and the
+// row carries conformanceOnly:true plus a limitation string naming the AC that
+// this probe does NOT observe and why. The integration-harness follow-up (the auth integration harness follow-up)
+// is the surface where those AC-level properties become observable.
+export function deClaim(row, { ac, limitation }) {
+  const acId = ac || 'unknown-AC';
+  const limText = (limitation || '').trim();
+  const finalLim = /^(security-[a-z0-9-]+-)?(AC|REQ)-/.test(limText) ? limText : (limText ? `${acId}: ${limText}` : `${acId}: not observable at this probe surface; needs the integration harness (the auth integration harness follow-up)`);
+  const out = { ...row };
+  out.anchorAcId = null;
+  if ('anchorReqId' in out) delete out.anchorReqId;
+  out.conformanceOnly = true;
+  out.limitation = finalLim;
+  const tag = ` :: conformance-only (${finalLim})`;
+  if (typeof out.detail === 'string' && !out.detail.includes('conformance-only')) {
+    out.detail = out.detail + tag;
+  }
+  return out;
+}
+
+export function accountBoundSkippedResult(anchorAcId, capability, reason) {
+  return {
+    anchorAcId,
+    capability,
+    verdict: 'pass',
+    accountBoundSkipped: true,
+    reason,
+    detail: `accountBoundSkipped: ${reason} unset; probe did not execute against a real Clerk account. Set the missing var and re-run.`,
+  };
+}

package/blueprints/security-auth-clerk/contributions/probes/real-account-principal-directory-round-trip.mjs

@@ -0,0 +1,216 @@
+// Real-account principal-directory smoke for security-auth-clerk.
+//
+// Conformance-only. This probe drives the Clerk Backend API
+// principal-directory (users) surface end to end (create + read +
+// list + delete + list-diff) and records what the Backend API
+// returned. The blueprint's shipped principal-directory acceptance
+// criteria bind runtime sign-in and session semantics on the
+// project's own middleware; a Backend API smoke against
+// api.clerk.com does not observe those runtime properties, so the
+// row is emitted with `anchorAcId: null` and a limitation naming
+// the nearest shipped AC whose property the probe does not
+// observe. Positive evidence per rule 7d is preserved on the row:
+// the Clerk-assigned user_ id, the created-then-deleted resource id
+// in the pre-diff / post-diff inventory pair, and the HTTP status
+// codes. The probe reads the X-Request-Id header from each response
+// and records it on every call, but Clerk's Backend API did not
+// return that header on the instance these records were captured
+// from, so every request-id field is null; the evidence rests on
+// the created id, the inventory-diff pair and the response
+// statuses rather than on request-id capture.
+//
+// Teardown is fail-safe: a mid-run crash leaves the user address
+// deterministic; the finally block always issues DELETE. A
+// teardown failure flips the verdict to FAIL regardless of
+// upstream success.
+//
+// Base URL is https://api.clerk.com/v1 by default; CLERK_API_BASE_URL
+// (declared, optional) may override for local mock testing.
+//
+// Docs: Clerk Backend API https://clerk.com/docs/reference/backend-api
+// verifiedOn 2026-09-11.
+//
+// capability: principalDirectory.
+// accountBound: true.
+
+import { DECLARED_ENV, SCRATCH_PRINCIPAL_PREFIX, accountBoundSkippedResult } from './probe-utils.mjs';
+
+export const anchorAcId = null;
+export const capability = 'principalDirectory';
+export const accountBound = true;
+// AC-9110-1 states the project runtime does not create, update, or
+// delete users on Clerk. This probe drives the Backend API from a
+// probe process, not the project runtime, so it cannot observe the
+// runtime property AC-9110-1 states; the row records that limit
+// alongside the raw Backend API evidence it did capture.
+const DECLAIM_LIMITATION = 'security-auth-clerk-AC-9110-1: probe drives the Clerk Backend API users surface from a probe process; the AC states the project runtime does not create, update or delete users on Clerk, which requires observing the deployed runtime through the integration harness follow-up.';
+
+const BASE_URL_DEFAULT = 'https://api.clerk.com/v1';
+
+function shortRandom() {
+  return Math.random().toString(36).slice(2, 10);
+}
+
+function pickRequestId(headers) {
+  return (
+    headers.get('x-request-id') ||
+    headers.get('cf-request-id') ||
+    headers.get('x-clerk-request-id') ||
+    null
+  );
+}
+
+async function clerkFetch({ baseUrl, path, method, body, token }) {
+  const url = `${baseUrl}${path}`;
+  const init = {
+    method,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: 'application/json',
+    },
+  };
+  if (body !== undefined) {
+    init.headers['Content-Type'] = 'application/json';
+    init.body = JSON.stringify(body);
+  }
+  const res = await fetch(url, init);
+  const requestId = pickRequestId(res.headers);
+  let payload = null;
+  const text = await res.text();
+  if (text.length > 0) {
+    try { payload = JSON.parse(text); } catch { payload = { rawText: text.slice(0, 200) }; }
+  }
+  return { status: res.status, ok: res.ok, requestId, payload };
+}
+
+function gateResult(varName, value) {
+  if (value === undefined || value === '') return { kind: 'unset', reason: varName };
+  if (value !== 'true') return { kind: 'set-not-true', reason: `${varName}_SET_NOT_TRUE`, observedValue: value };
+  return { kind: 'true' };
+}
+
+export default async function runProbe() {
+  const gate = gateResult('CI_HAS_CLERK_ACCOUNT', process.env.CI_HAS_CLERK_ACCOUNT);
+  if (gate.kind === 'unset') {
+    return {
+      results: [accountBoundSkippedResult(null, capability, 'CI_HAS_CLERK_ACCOUNT')],
+      extra: { accountBoundSkipped: true, reason: 'CI_HAS_CLERK_ACCOUNT', envDeclared: [...DECLARED_ENV] },
+    };
+  }
+  if (gate.kind === 'set-not-true') {
+    return {
+      results: [{
+        anchorAcId: null, capability, verdict: 'fail',
+        conformanceOnly: true, limitation: DECLAIM_LIMITATION,
+        detail: `conformance-only: CI_HAS_CLERK_ACCOUNT is set to "${gate.observedValue}" (not the string "true"). Gate refuses this shape; set the variable to the exact string "true" to run the live branch.`,
+        evidence: { gate: 'CI_HAS_CLERK_ACCOUNT', observedValue: gate.observedValue, expected: 'true' },
+      }],
+      extra: { gateMisconfigured: true, gate: 'CI_HAS_CLERK_ACCOUNT', envDeclared: [...DECLARED_ENV] },
+    };
+  }
+  if (!process.env.CLERK_SECRET_KEY) {
+    return {
+      results: [accountBoundSkippedResult(null, capability, 'CLERK_SECRET_KEY')],
+      extra: { accountBoundSkipped: true, reason: 'CLERK_SECRET_KEY', envDeclared: [...DECLARED_ENV] },
+    };
+  }
+
+  const baseUrl = process.env.CLERK_API_BASE_URL || BASE_URL_DEFAULT;
+  const token = process.env.CLERK_SECRET_KEY;
+  const runId = process.env.GITHUB_RUN_ID || `local-${Date.now()}`;
+  const short = shortRandom();
+  const emailAddress = `${SCRATCH_PRINCIPAL_PREFIX}${short}+clerk_test@example.com`;
+
+  const evidence = {
+    envDeclared: [...DECLARED_ENV],
+    baseUrl,
+    scratchEmailAddress: emailAddress,
+    runId,
+    calls: [],
+  };
+  const resultRow = { anchorAcId: null, conformanceOnly: true, limitation: DECLAIM_LIMITATION, capability, verdict: 'fail', detail: '', evidence: {} };
+  let createdUserId = null;
+
+  try {
+    const created = await clerkFetch({
+      baseUrl,
+      path: '/users',
+      method: 'POST',
+      token,
+      body: {
+        email_address: [emailAddress],
+        first_name: 'ProbeUser',
+        last_name: short,
+        username: `probe_clerk_${short}`,
+        skip_password_requirement: true,
+      },
+    });
+    evidence.calls.push({ verb: 'POST /users', status: created.status, requestId: created.requestId, resourceId: created.payload && created.payload.id });
+    if (!created.ok || !(created.payload && created.payload.id)) {
+      resultRow.detail = `POST /v1/users failed: status=${created.status} requestId=${created.requestId} payloadKeys=${JSON.stringify(Object.keys(created.payload || {}))} bodyExcerpt=${JSON.stringify(created.payload).slice(0, 200)}`;
+      return { results: [resultRow], extra: evidence };
+    }
+    createdUserId = created.payload.id;
+    evidence.createdUserId = createdUserId;
+
+    const readBack = await clerkFetch({ baseUrl, path: `/users/${createdUserId}`, method: 'GET', token });
+    evidence.calls.push({ verb: `GET /users/${createdUserId}`, status: readBack.status, requestId: readBack.requestId, resourceId: readBack.payload && readBack.payload.id });
+    const readOk = readBack.ok && readBack.payload && readBack.payload.id === createdUserId;
+
+    const listPre = await clerkFetch({ baseUrl, path: `/users?limit=200&order_by=-created_at`, method: 'GET', token });
+    const listedIdsPre = Array.isArray(listPre.payload) ? listPre.payload.map((u) => u.id) : [];
+    evidence.calls.push({ verb: 'GET /users?limit=200 (pre-delete)', status: listPre.status, requestId: listPre.requestId, listedCount: listedIdsPre.length, foundScratch: listedIdsPre.includes(createdUserId) });
+    const listPreOk = listPre.ok && listedIdsPre.includes(createdUserId);
+
+    const deleted = await clerkFetch({ baseUrl, path: `/users/${createdUserId}`, method: 'DELETE', token });
+    evidence.calls.push({ verb: `DELETE /users/${createdUserId}`, status: deleted.status, requestId: deleted.requestId });
+    const deleteOk = deleted.ok;
+
+    const listPost = await clerkFetch({ baseUrl, path: `/users?limit=200&order_by=-created_at`, method: 'GET', token });
+    const listedIdsPost = Array.isArray(listPost.payload) ? listPost.payload.map((u) => u.id) : [];
+    evidence.calls.push({ verb: 'GET /users?limit=200 (post-delete)', status: listPost.status, requestId: listPost.requestId, listedCount: listedIdsPost.length, foundScratch: listedIdsPost.includes(createdUserId) });
+    const listPostOk = listPost.ok && !listedIdsPost.includes(createdUserId);
+
+    if (readOk && listPreOk && deleteOk && listPostOk) {
+      resultRow.verdict = 'pass';
+      resultRow.detail =
+        `Clerk Backend API users surface observation: created ${createdUserId} (POST status ${created.status}, requestId ${created.requestId}); ` +
+        `readBack GET ${readBack.status} (requestId ${readBack.requestId}); listPre observed ${listedIdsPre.length} users, created id present; ` +
+        `DELETE ${deleted.status} (requestId ${deleted.requestId}); listPost observed ${listedIdsPost.length} users, created id absent.`;
+      resultRow.evidence = {
+        createdUserId,
+        createStatus: created.status, createRequestId: created.requestId,
+        readBackStatus: readBack.status, readBackRequestId: readBack.requestId,
+        listPreCount: listedIdsPre.length, listPreContainsCreated: listPreOk,
+        deleteStatus: deleted.status, deleteRequestId: deleted.requestId,
+        listPostCount: listedIdsPost.length, listPostAbsence: listPostOk,
+      };
+      createdUserId = null;
+    } else {
+      resultRow.evidence = { calls: evidence.calls }; resultRow.detail = `one or more Backend API calls failed: readOk=${readOk} listPreOk=${listPreOk} deleteOk=${deleteOk} listPostOk=${listPostOk}; calls=${JSON.stringify(evidence.calls)}`;
+    }
+  } catch (err) {
+    resultRow.detail = `probe threw: ${err && err.message ? err.message : String(err)}`;
+    resultRow.evidence = { threw: err && err.message ? err.message : String(err) };
+    evidence.threw = err && err.message ? err.message : String(err);
+  } finally {
+    if (createdUserId) {
+      try {
+        const teardown = await clerkFetch({ baseUrl, path: `/users/${createdUserId}`, method: 'DELETE', token });
+        evidence.teardownDelete = { status: teardown.status, requestId: teardown.requestId };
+        if (!teardown.ok) {
+          resultRow.verdict = 'fail';
+          resultRow.detail = (resultRow.detail ? resultRow.detail + ' ' : '') +
+            `TEARDOWN FAILED leaving orphan user ${createdUserId}: DELETE status=${teardown.status} requestId=${teardown.requestId}. This run is FAIL-WITH-ORPHAN.`;
+          evidence.orphanUserId = createdUserId;
+        }
+      } catch (err) {
+        resultRow.verdict = 'fail';
+        resultRow.detail = (resultRow.detail ? resultRow.detail + ' ' : '') +
+          `TEARDOWN THREW: ${err && err.message ? err.message : String(err)} leaving orphan user ${createdUserId}.`;
+        evidence.orphanUserId = createdUserId;
+      }
+    }
+  }
+  return { results: [resultRow], extra: evidence };
+}

package/blueprints/security-auth-clerk/contributions/probes/real-account-session-inventory.mjs

@@ -0,0 +1,260 @@
+// Real-account sign-in-token surface smoke for security-auth-clerk.
+//
+// Scope of observation. The blueprint's session-inventory ACs bind
+// authenticated browser sessions and inventory operations that
+// Clerk's Backend API cannot author from the server side (Sessions
+// are created by Clerk's Frontend API in a browser flow; the
+// Backend API exposes only list/get/revoke/refresh/verify). This
+// probe therefore does not observe the session-inventory
+// properties AC-9112-1, AC-9112-3, AC-9112-4 or AC-9112-5 name;
+// each row is emitted with `anchorAcId: null` and a limitation
+// citing the nearest shipped session-inventory AC whose runtime
+// property the probe does not observe.
+//
+// What THIS probe drives at the Backend API surface. Create a
+// scratch user; mint a sign-in token for that user with
+// `POST /v1/sign_in_tokens`; capture the returned token id; revoke
+// it with `POST /v1/sign_in_tokens/{id}/revoke`; re-fetch the
+// token to observe the `revoked` status flip (or 404). Delete the
+// user in the finally block. Positive evidence per rule 7d is
+// preserved: the Clerk-assigned token id (created-then-revoked
+// resource id in the token's lifecycle state, shape 3), and the
+// HTTP statuses. The probe reads the X-Request-Id header from each
+// response and records it on every call, but Clerk's Backend API
+// did not return that header on the instance these records were
+// captured from, so every request-id field is null; the evidence
+// rests on the token lifecycle transitions and response statuses
+// rather than on request-id capture.
+//
+// engine: clerk-backend-api (live) or skip:CI_HAS_CLERK_ACCOUNT.
+// accountBound: true.
+
+import { DECLARED_ENV, SCRATCH_PRINCIPAL_PREFIX, accountBoundSkippedResult } from './probe-utils.mjs';
+
+export const anchorAcId = null;
+export const capability = 'sessionInventory';
+export const accountBound = true;
+const LIM_MINT = 'security-auth-clerk-AC-9112-3: probe drives the Backend API sign-in-token mint from a probe process; the AC binds revokeAllExceptCurrent semantics on the project session-inventory interface, which requires a browser-driven runner (the integration harness follow-up).';
+const LIM_REVOKE = 'security-auth-clerk-AC-9112-4: probe drives the Backend API sign-in-token revoke from a probe process; the AC binds SESSION_INVENTORY_UNAUTHENTICATED refusal at the project inventory operations, which requires a browser-driven runner (the integration harness follow-up).';
+const LIM_NOT_OBS_1 = 'security-auth-clerk-AC-9112-1: two shaped active sessions cannot be authored server-side against the Clerk Backend API; the AC needs a browser-driven runner (the integration harness follow-up).';
+const LIM_NOT_OBS_5 = 'security-auth-clerk-AC-9112-5: revoke against an unowned or already-revoked session id cannot be authored server-side against the Backend API; the AC needs a browser-driven runner (the integration harness follow-up).';
+
+const BASE_URL_DEFAULT = 'https://api.clerk.com/v1';
+
+function shortRandom() {
+  return Math.random().toString(36).slice(2, 10);
+}
+
+function pickRequestId(headers) {
+  return (
+    headers.get('x-request-id') ||
+    headers.get('cf-request-id') ||
+    headers.get('x-clerk-request-id') ||
+    null
+  );
+}
+
+async function clerkFetch({ baseUrl, path, method, body, form, token }) {
+  const url = `${baseUrl}${path}`;
+  const init = {
+    method,
+    headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+  };
+  if (body !== undefined) {
+    init.headers['Content-Type'] = 'application/json';
+    init.body = JSON.stringify(body);
+  } else if (form !== undefined) {
+    init.headers['Content-Type'] = 'application/x-www-form-urlencoded';
+    init.body = form.toString();
+  }
+  const res = await fetch(url, init);
+  const requestId = pickRequestId(res.headers);
+  let payload = null;
+  const text = await res.text();
+  if (text.length > 0) {
+    try { payload = JSON.parse(text); } catch { payload = { rawText: text.slice(0, 200) }; }
+  }
+  return { status: res.status, ok: res.ok, requestId, payload };
+}
+
+function gateResult(varName, value) {
+  if (value === undefined || value === '') return { kind: 'unset', reason: varName };
+  if (value !== 'true') return { kind: 'set-not-true', reason: `${varName}_SET_NOT_TRUE`, observedValue: value };
+  return { kind: 'true' };
+}
+
+export default async function runProbe() {
+  const gate = gateResult('CI_HAS_CLERK_ACCOUNT', process.env.CI_HAS_CLERK_ACCOUNT);
+  if (gate.kind === 'unset') {
+    return {
+      results: [accountBoundSkippedResult(null, capability, 'CI_HAS_CLERK_ACCOUNT')],
+      extra: { accountBoundSkipped: true, reason: 'CI_HAS_CLERK_ACCOUNT', envDeclared: [...DECLARED_ENV] },
+    };
+  }
+  if (gate.kind === 'set-not-true') {
+    return {
+      results: [{
+        anchorAcId: null, capability, verdict: 'fail',
+        conformanceOnly: true, limitation: LIM_MINT,
+        detail: `conformance-only: CI_HAS_CLERK_ACCOUNT is set to "${gate.observedValue}" (not the string "true"). Gate refuses this shape; set the variable to the exact string "true" to run the live branch.`,
+        evidence: { gate: 'CI_HAS_CLERK_ACCOUNT', observedValue: gate.observedValue, expected: 'true' },
+      }],
+      extra: { gateMisconfigured: true, gate: 'CI_HAS_CLERK_ACCOUNT', envDeclared: [...DECLARED_ENV] },
+    };
+  }
+  if (!process.env.CLERK_SECRET_KEY) {
+    return {
+      results: [accountBoundSkippedResult(null, capability, 'CLERK_SECRET_KEY')],
+      extra: { accountBoundSkipped: true, reason: 'CLERK_SECRET_KEY', envDeclared: [...DECLARED_ENV] },
+    };
+  }
+
+  const baseUrl = process.env.CLERK_API_BASE_URL || BASE_URL_DEFAULT;
+  const token = process.env.CLERK_SECRET_KEY;
+  const short = shortRandom();
+  const emailAddress = `${SCRATCH_PRINCIPAL_PREFIX}sess-${short}+clerk_test@example.com`;
+
+  const evidence = { envDeclared: [...DECLARED_ENV], baseUrl, scratchEmailAddress: emailAddress, calls: [] };
+  const results = [];
+  const rowSignIn = { anchorAcId: null, conformanceOnly: true, limitation: LIM_MINT, capability, verdict: 'fail', detail: '' };
+  const rowRevoke = { anchorAcId: null, conformanceOnly: true, limitation: LIM_REVOKE, capability, verdict: 'fail', detail: '' };
+  const rowNotObservable1 = {
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_NOT_OBS_1,
+    capability,
+    verdict: 'pass',
+    detail:
+      'AC-9112-1 (two shaped active sessions per Backend API list()) is not observable at the Backend API surface: Clerk creates authenticated sessions via the Frontend API in a browser flow, and the Backend API exposes only list/get/revoke/refresh/verify on Sessions (no server-side session-create). Full AC-9112-1 observation requires a shelf-level browser-driven auth harness, tracked as a separate follow-up.',
+    evidence: {
+      notObservableACs: ['security-auth-clerk-AC-9112-1'],
+      notObservableReason: 'Clerk Backend API cannot create authenticated browser sessions from the server side; observation requires a Frontend-API-driven browser flow.',
+      docsUrl: 'https://clerk.com/docs/reference/backend-api',
+      docsVerifiedOn: '2026-09-11',
+    },
+  };
+  const rowNotObservable5 = {
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_NOT_OBS_5,
+    capability,
+    verdict: 'pass',
+    detail:
+      'AC-9112-5 (revoke against an unowned or already-revoked session id refuses with SESSION_INVENTORY_UNKNOWN_SESSION and audit event) is not observable at the Backend API surface: the AC is bound to the project session-inventory interface driven from an authenticated caller, and the Backend API cannot create such an authenticated caller server-side. Full AC-9112-5 observation requires a shelf-level browser-driven auth harness, tracked as a separate follow-up.',
+    evidence: {
+      notObservableACs: ['security-auth-clerk-AC-9112-5'],
+      notObservableReason: 'AC-9112-5 binds a project session-inventory refusal that requires an authenticated project caller; the Backend API cannot create one server-side.',
+      docsUrl: 'https://clerk.com/docs/reference/backend-api',
+      docsVerifiedOn: '2026-09-11',
+    },
+  };
+  let createdUserId = null;
+  let createdTokenId = null;
+
+  try {
+    const created = await clerkFetch({
+      baseUrl, path: '/users', method: 'POST', token,
+      body: {
+        email_address: [emailAddress],
+        first_name: 'ProbeUser', last_name: short,
+        username: `probe_clerk_${short}`,
+        skip_password_requirement: true,
+      },
+    });
+    evidence.calls.push({ verb: 'POST /users', status: created.status, requestId: created.requestId, resourceId: created.payload && created.payload.id });
+    if (!created.ok || !(created.payload && created.payload.id)) {
+      rowSignIn.detail = `precondition POST /v1/users failed status=${created.status} requestId=${created.requestId} bodyExcerpt=${JSON.stringify(created.payload).slice(0, 200)}`;
+      rowSignIn.evidence = { call: evidence.calls[evidence.calls.length - 1] };
+      rowRevoke.detail = 'skipped: precondition POST /users failed';
+      rowRevoke.evidence = { skipped: 'precondition failed' };
+      results.push(rowSignIn, rowRevoke, rowNotObservable1, rowNotObservable5);
+      return { results, extra: evidence };
+    }
+    createdUserId = created.payload.id;
+    evidence.createdUserId = createdUserId;
+
+    const mint = await clerkFetch({
+      baseUrl, path: '/sign_in_tokens', method: 'POST', token,
+      body: { user_id: createdUserId, expires_in_seconds: 300 },
+    });
+    evidence.calls.push({
+      verb: 'POST /sign_in_tokens', status: mint.status, requestId: mint.requestId,
+      resourceId: mint.payload && mint.payload.id, status_flag: mint.payload && mint.payload.status,
+    });
+    const mintOk = mint.ok && mint.payload && typeof mint.payload.id === 'string' && mint.payload.status === 'pending';
+    createdTokenId = (mint.payload && mint.payload.id) || null;
+    rowSignIn.verdict = mintOk ? 'pass' : 'fail';
+    rowSignIn.detail = mintOk
+      ? `Clerk Backend API sign-in-token mint observed: POST /v1/sign_in_tokens user_id=${createdUserId} status=${mint.status} requestId=${mint.requestId} tokenId=${createdTokenId} tokenStatus=pending.`
+      : `Clerk Backend API sign-in-token mint failed: status=${mint.status} requestId=${mint.requestId} bodyExcerpt=${JSON.stringify(mint.payload).slice(0, 200)}`;
+    rowSignIn.evidence = {
+      requestId: mint.requestId,
+      status: mint.status,
+      tokenId: createdTokenId,
+      tokenStatus: mint.payload && mint.payload.status,
+      createdUserId,
+    };
+
+    if (!createdTokenId) {
+      rowRevoke.detail = 'skipped: mint did not return a token id';
+      rowRevoke.evidence = { skipped: 'no tokenId' };
+      results.push(rowSignIn, rowRevoke, rowNotObservable1, rowNotObservable5);
+      return { results, extra: evidence };
+    }
+
+    const revoked = await clerkFetch({
+      baseUrl, path: `/sign_in_tokens/${createdTokenId}/revoke`, method: 'POST', token,
+    });
+    evidence.calls.push({
+      verb: `POST /sign_in_tokens/${createdTokenId}/revoke`, status: revoked.status, requestId: revoked.requestId,
+      status_flag: revoked.payload && revoked.payload.status,
+    });
+    const readBack = await clerkFetch({
+      baseUrl, path: `/sign_in_tokens/${createdTokenId}`, method: 'GET', token,
+    });
+    evidence.calls.push({
+      verb: `GET /sign_in_tokens/${createdTokenId}`, status: readBack.status, requestId: readBack.requestId,
+      status_flag: readBack.payload && readBack.payload.status,
+    });
+    const revokedFlag = readBack.payload && (readBack.payload.status === 'revoked' || readBack.payload.revoked === true);
+    const goneAfterRevoke = revokedFlag || readBack.status === 404 || readBack.status === 410;
+    const revokeOk = revoked.ok && goneAfterRevoke;
+    rowRevoke.verdict = revokeOk ? 'pass' : 'fail';
+    rowRevoke.detail = revokeOk
+      ? `Clerk Backend API sign-in-token revoke observed: revoke POST status=${revoked.status} requestId=${revoked.requestId}; re-fetch status=${readBack.status} tokenStatus=${readBack.payload && readBack.payload.status || (readBack.status === 404 ? 'gone-404' : 'unknown')}; the created-then-revoked tokenId (${createdTokenId}) records the Backend API lifecycle transition (404 after revoke means the resource no longer resolves).`
+      : `Clerk Backend API sign-in-token revoke failed: revokeStatus=${revoked.status} readBackStatus=${readBack.status} readBackStatusFlag=${readBack.payload && readBack.payload.status}`;
+    rowRevoke.evidence = {
+      revokeStatus: revoked.status,
+      revokeRequestId: revoked.requestId,
+      readBackStatus: readBack.status,
+      readBackRequestId: readBack.requestId,
+      readBackTokenStatus: readBack.payload && readBack.payload.status,
+      tokenId: createdTokenId,
+      createdThenRevokedTokenId: createdTokenId,
+    };
+
+    results.push(rowSignIn, rowRevoke, rowNotObservable1, rowNotObservable5);
+  } catch (err) {
+    rowSignIn.detail = `probe threw: ${err && err.message ? err.message : String(err)}`;
+    rowSignIn.evidence = { threw: err && err.message ? err.message : String(err) };
+    rowRevoke.detail = 'skipped: probe threw before completing';
+    rowRevoke.evidence = { skipped: 'threw' };
+    results.push(rowSignIn, rowRevoke, rowNotObservable1, rowNotObservable5);
+    evidence.threw = err && err.message ? err.message : String(err);
+  } finally {
+    if (createdUserId) {
+      try {
+        const teardown = await clerkFetch({ baseUrl, path: `/users/${createdUserId}`, method: 'DELETE', token });
+        evidence.teardownDelete = { status: teardown.status, requestId: teardown.requestId };
+        if (!teardown.ok) {
+          for (const r of results) { r.verdict = 'fail'; r.detail = (r.detail || '') + ` TEARDOWN FAILED leaving orphan user ${createdUserId}: status=${teardown.status} requestId=${teardown.requestId}.`; }
+          evidence.orphanUserId = createdUserId;
+        }
+      } catch (err) {
+        for (const r of results) { r.verdict = 'fail'; r.detail = (r.detail || '') + ` TEARDOWN THREW: ${err && err.message ? err.message : String(err)} leaving orphan user ${createdUserId}.`; }
+        evidence.orphanUserId = createdUserId;
+      }
+    }
+  }
+  return { results, extra: evidence };
+}