rcf-lite 0.27.0 → 0.28.0

package/blueprints/security-auth-clerk/contributions/probes/role-model-adapter.mjs

@@ -0,0 +1,53 @@
+// Role-model adapter probe for security-auth-clerk.
+// Conformance-only. Every row records anchorAcId=null with a
+// limitation naming the shipped AC whose can/assert project-verb
+// adapter behaviour the fixture-layer probe does not observe. The
+// integration harness follow-up exercises the adapter against a
+// verified session token.
+//
+// capability: roleModel. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-clerk', 'src');
+
+export const anchorAcId = null;
+export const capability = 'roleModel';
+export const accountBound = false;
+
+const LIM = 'security-auth-clerk-AC-9107-1: probe checks raw-role reduction only; the AC states the can/assert adapter refuses a role token absent from the project verb list against a verified session, which needs the integration harness (the auth integration harness follow-up).';
+
+export default async function runProbe() {
+  const { mapRoles, knownRoles } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'role-adapter.mjs')).href);
+  const results = [];
+
+  const good = mapRoles({ roles: ['viewer', 'admin'] });
+  results.push(deClaim({
+    capability,
+    verdict: good.ok && good.roles.join(',') === 'viewer,admin' ? 'pass' : 'fail',
+    detail: `known-role mapping: ok=${good.ok} roles=${JSON.stringify(good.roles)}; knownRoles=${JSON.stringify(knownRoles)}`,
+    evidence: { input: ['viewer', 'admin'], output: good.roles, adapterReturn: good },
+  }, { ac: 'security-auth-clerk-AC-9107-1', limitation: LIM }));
+
+  const bad = mapRoles({ roles: ['viewer', 'root-emperor'] });
+  results.push(deClaim({
+    capability,
+    verdict: !bad.ok && /root-emperor/.test(bad.error) ? 'pass' : 'fail',
+    detail: `unknown-role refusal: ok=${bad.ok} error=${JSON.stringify(bad.error)}`,
+    evidence: { input: ['viewer', 'root-emperor'], adapterReturn: bad },
+  }, { ac: 'security-auth-clerk-AC-9107-1', limitation: LIM }));
+
+  const bad2 = mapRoles({ roles: 'admin' });
+  results.push(deClaim({
+    capability,
+    verdict: !bad2.ok && /must be an array/.test(bad2.error) ? 'pass' : 'fail',
+    detail: `non-array-refusal: ok=${bad2.ok} error=${JSON.stringify(bad2.error)}`,
+    evidence: { input: 'admin', adapterReturn: bad2 },
+  }, { ac: 'security-auth-clerk-AC-9107-1', limitation: LIM }));
+
+  return { results, extra: {} };
+}

package/blueprints/security-auth-clerk/contributions/probes/run-hosted-identity-ui-config.mjs

@@ -0,0 +1,4 @@
+import runProbe from './hosted-identity-ui-config.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'fixture hosted-ui-config validator (local)', healthy: true };
+runShim('hosted-identity-ui-config', engine, runProbe);

package/blueprints/security-auth-clerk/contributions/probes/run-real-account-principal-directory-round-trip.mjs

@@ -0,0 +1,4 @@
+import runProbe from './real-account-principal-directory-round-trip.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'clerk-backend-api', image: 'live Clerk Backend API via https (or skipped)', healthy: true };
+runShim('real-account-principal-directory-round-trip', engine, runProbe);

package/blueprints/security-auth-clerk/contributions/probes/run-real-account-session-inventory.mjs

@@ -0,0 +1,4 @@
+import runProbe from './real-account-session-inventory.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'clerk-backend-api', image: 'live Clerk Backend API sessions endpoint via https (or skipped)', healthy: true };
+runShim('real-account-session-inventory', engine, runProbe);

package/blueprints/security-auth-clerk/contributions/probes/run-role-model-adapter.mjs

@@ -0,0 +1,4 @@
+import runProbe from './role-model-adapter.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'fixture role-adapter (local)', healthy: true };
+runShim('role-model-adapter', engine, runProbe);

package/blueprints/security-auth-clerk/docs/topics.md

@@ -14,7 +14,7 @@ Rules for new topics (inherited from the application-spa, application-api-rest,
 
 ## Id number bands (registry bootstrap)
 
-AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is ratified policy (2026-08-19); this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
+AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is policy; this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
 
 This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
 
@@ -59,8 +59,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 9101-9110 sit at the LOW end of the 9101-9899 band on purpose. A project-side story that mechanically derives from a security-auth-clerk REQ id into the number `9110` would collide against security-auth-clerk-US-9110 in this package; the band leaves headroom at the HIGH end (US 9181-9899) so a project's own stories anchored to security-auth-clerk REQs can allocate without conflict. The watchpost run4 lesson applies here too.
-
+US 9101-9110 sit at the LOW end of the 9101-9899 band on purpose. A project-side story that mechanically derives from a security-auth-clerk REQ id into the number `9110` would collide against security-auth-clerk-US-9110 in this package; the band leaves headroom at the HIGH end (US 9181-9899) so a project's own stories anchored to security-auth-clerk REQs can allocate without conflict.
 ADR and TAC suffixes for this blueprint widen to four digits (1001-1099) because the three-digit space fills at 9xx (security-secrets-management). Sibling round-2 auth blueprints (security-auth-oauth2, security-auth-keycloak) will continue the widening at 1101-1199 and 1201-1299 respectively; the shipped shelf has not carried four-digit suffixes before this blueprint, so the fallback rule on this PR's cover note applies if the rcf-schemas grammar refuses that shape.
 
 ## Shared expectations for future composing blueprints

package/blueprints/security-auth-keycloak/CHANGELOG.md

@@ -1,23 +1,34 @@
 # security-auth-keycloak CHANGELOG
 
-## 1.4.1
+## 1.4.4 - 2026-09-11
+
+- Criterion-e probe pack refinement: every conformance-only result row now records `anchorAcId: null` alongside a `limitation` that opens with a shipped AC id from the blueprint's user stories (introspection `REQ-004` rows move to `AC-11105-1`; JWT `REQ-003` row moves to `AC-11104-2`; role-adapter `REQ-006` row moves to `AC-11107-3`). The retained live-branch anchor on `real-account-realm-round-trip` (`AC-11112-2`) is unchanged and honest-skips on `CI_HAS_KEYCLOAK_ACCOUNT`; when skipped the row records `engine: keycloak`, not `engine: skip:...`. Detail strings on de-claimed rows describe only what was observed at the fixture-parser or fixture-verifier surface and no longer claim a REQ or AC as observed end to end. The anatomy helper enforces conformance-only rows to satisfy `anchorAcId === null`, requires limitations to open with an `AC-<n>-<n>` id that resolves to a shipped acceptance criterion on the blueprint's user stories (REQ-prefixed anchors are refused and fabricated ids are rejected), and does not count pre-delete presence as an absence observation on the inventory-diff shape.
+
+## 1.4.3 - 2026-09-11
+
+- Every conformance-only anchor on the criterion-e probe pack is de-claimed to `conformanceOnly` with a limitation naming the shipped AC that is observable only in the integration harness follow-up; the retained live-branch anchor on `real-account-realm-round-trip` (`AC-11112-2`) is preserved and honest-skips on `CI_HAS_KEYCLOAK_ACCOUNT`. `discovery-shape`, `jwt-verifier-shape`, `introspection-shape` and `role-adapter-shape` rows keep their fixture-layer observations under the same shape.
 
-- Closure fix pass (F-8): rewrites the `README.md` shelf-latest line in neutral customer-facing voice with no spec-provenance label.
+## 1.4.2 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering the four declared capabilities: `discovery-shape` (principalDirectory; OIDC discovery URL derivation and validator), `jwt-verifier-shape` (credentialSelfService; node:crypto RS256 sign+verify with alg/exp/iss/signature-tamper refusal paths on throwaway keys), `introspection-shape` (sessionInventory; RFC 7662 request/response shape), `role-adapter-shape` (roleModel; realm+resource-access role mapper). `real-account-realm-round-trip` (LIVE) honest-skips on `CI_HAS_KEYCLOAK_ACCOUNT` because this estate does not expose a Keycloak client to shelf probes. Fixture at `packages/rcf-lite/test/fixtures/security-auth-keycloak/` declares every env var the pack reads; anatomy test pins pack shape, fixture manifest and the account-bound skip contract.
+- Iteration on the probe pack labelled every local-fixture row `engine: fixture`, redacted the placeholder client secret out of the introspection body evidence, and settled `aggregate([])` / null-result normalisation to `detail: 'no checks ran'` exactly. `real-account-realm-round-trip` honest-skips on `CI_HAS_KEYCLOAK_ACCOUNT`; when skipped the record's `engine.kind` remains `keycloak`. Slug reads AMBER on criterion e.
+
+## 1.4.1
 
 ## 1.4.0
 
 - Adds `US-11116`, `US-11117`, `US-11118`, `US-11119`, `US-11120` binding stories to the five audit-surface must requirements `REQ-015` (discovery and account-console), `REQ-016` (JWT), `REQ-017` (introspection), `REQ-018` (route and sessionInventory), and `REQ-019` (roles). Each story ships one AC per success, refusal, retry and boundary path on the delivering mechanism, with `ownerRef` at the owning TAC and its audit-emission responsibility. Rewrites `US-11115` `AC-1` to reference the local `TAC-1204-security-auth-keycloak-provider-router` `responsibilities.sessionInventory` and updates the sibling ACs to the same local owner (the interface shape remains owned by `TAC-1003-security-auth-clerk-session-verifier` `interfaces.sessionInventory` and is referenced by that owner id). Rewrites `REQ-005.description` to reference `TAC-1204-security-auth-keycloak-provider-router` `responsibilities.route` rather than restate the `{ realmSlug, verificationMode }` shape verbatim.
-- Closure fixes on the audit stories: extends `TAC-1201` with a named `discoveryAudit` responsibility and repoints `REQ-015.deliveredBy` and every `US-11116` `ownerRef` at it; tightens the refusal oracles on `AC-11116-2`, `AC-11117-2`, and `AC-11118-2` from a category or example to a specific input-to-reasonClass binding; adds an idempotency AC to `US-11116`, `US-11117`, `US-11118`, `US-11119`, `US-11120` naming the event count per repeat call; adds `AC-11118-5` (non-2xx `upstream_error` path), `AC-11119-5` (revoke-one), `AC-11119-6` (revoke-all-except-current) so every named `REQ-018` interaction is independently bound; adds a 7a inline note in each audit story's `description` documenting the credential and permission scenario-class mapping (bound to an AC, or not applicable with the reason).
-- Second closure fix pass: adds explicit credential and permission acceptance criteria on every audit-event story where they were previously carried as prose only. Adds `AC-11116-6` (credential: realm-config `realmSlug` is the credential the discovery fetch is bound to and the event records the realm principal in the `realmSlug` payload field) and `AC-11116-7` (permission: `accountConsoleUrl` origin that differs from the discovered issuer origin is refused with `reasonClass=account_console_malformed`). Adds `AC-11117-6` (permission: `audience_mismatch` binds the audience-scope refusal) and `AC-11117-7` (issuer_mismatch), so every `REQ-016` named refusal reason is bound to a concrete AC. Tightens `AC-11118-3` to name `reasonClass=upstream_error` as the concrete 503-retry oracle and adds `AC-11118-7` (permission: an upstream `401 Unauthorized` on the client credentials is refused with `reasonClass=client_forbidden`). Adds `AC-11120-6` (permission: an absent role-claim path is refused with `reasonClass=roles_absent`). Updates each story's `description` 7a inline note to reference the new ACs and removes every "not applicable" clause the ACs replace.
+- On the audit stories: extends `TAC-1201` with a named `discoveryAudit` responsibility and repoints `REQ-015.deliveredBy` and every `US-11116` `ownerRef` at it; tightens the refusal oracles on `AC-11116-2`, `AC-11117-2`, and `AC-11118-2` from a category or example to a specific input-to-reasonClass binding; adds an idempotency AC to `US-11116`, `US-11117`, `US-11118`, `US-11119`, `US-11120` naming the event count per repeat call; adds `AC-11118-5` (non-2xx `upstream_error` path), `AC-11119-5` (revoke-one), `AC-11119-6` (revoke-all-except-current) so every named `REQ-018` interaction is independently bound; adds a 7a inline note in each audit story's `description` documenting the credential and permission scenario-class mapping (bound to an AC, or not applicable with the reason).
+- Adds explicit credential and permission acceptance criteria on every audit-event story where they were previously carried as prose only. Adds `AC-11116-6` (credential: realm-config `realmSlug` is the credential the discovery fetch is bound to and the event records the realm principal in the `realmSlug` payload field) and `AC-11116-7` (permission: `accountConsoleUrl` origin that differs from the discovered issuer origin is refused with `reasonClass=account_console_malformed`). Adds `AC-11117-6` (permission: `audience_mismatch` binds the audience-scope refusal) and `AC-11117-7` (issuer_mismatch), so every `REQ-016` named refusal reason is bound to a concrete AC. Tightens `AC-11118-3` to name `reasonClass=upstream_error` as the concrete 503-retry oracle and adds `AC-11118-7` (permission: an upstream `401 Unauthorized` on the client credentials is refused with `reasonClass=client_forbidden`). Adds `AC-11120-6` (permission: an absent role-claim path is refused with `reasonClass=roles_absent`). Updates each story's `description` 7a inline note to reference the new ACs and removes every "not applicable" clause the ACs replace.
 
 ## 1.3.1 (register-sweep patch, 2026-09-10)
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 1.3.0 (hardening pass, spec 2026-09-09 section 5.4.2)
+## 1.3.0 (2026-09-09)
 
-- Adds `REQ-013`/`US-11114` (credentialSelfService: realm-config `accountConsoleUrl`, boot-time verification, `getCredentialSelfServiceUrl` helper), `REQ-014`/`US-11115` (sessionInventory: list, revoke-one, revoke-all-except-current, unauthenticated refusal, unknown-session refusal), and `REQ-015` (cross-cutting audit surface with a fixed field allow-list, token exclusion, and sink-failure posture). Adds a composition clause on `REQ-001` naming `security-auth-oauth2` as the required flow-controller and session-bridge owner. Extends `TAC-1201` with the account-console verification responsibility and `TAC-1204` with the sessionInventory responsibility. Adds `elicits[]` for `bootPosture` (strict/deferred/standby) and `verificationMode` (jwks/introspection) already described in prose. Adds `deliveredBy` on every `must` requirement and `disposition` on every existing acceptance criterion; adds `ownerRef` on ACs that observe interfaces owned by other TACs. Names the `principalDirectory` and `roleModel` capabilities on the requirements that carry their runtime clauses. hardening pass (criteria a, b, c on the 2026-09-09 programme).
-- Review fix pass (PR #188 findings): moves the composition requirement from a REQ-level `requiresAppliedCapabilities` array (a level the apply gate never reads) to a `blueprint.json:requiresAppliedCapabilities` gate on `authorisationCodeFlow` with override `--allow-no-auth-yet` and stable id `security-auth-keycloak-flow-required`; `REQ-001` now points at that manifest gate. Narrows `REQ-015` to the discovery-client and account-console audit families (TAC-1201) and adds four must REQs (`REQ-016` JWT, `REQ-017` introspection, `REQ-018` route + sessionInventory, `REQ-019` roles), each with its own `deliveredBy` and a companion audit responsibility line on the target TAC. Rewrites `US-11115` `AC-1` to reference the `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` `SessionRow` shape rather than restating its fields.
+- Adds `REQ-013`/`US-11114` (credentialSelfService: realm-config `accountConsoleUrl`, boot-time verification, `getCredentialSelfServiceUrl` helper), `REQ-014`/`US-11115` (sessionInventory: list, revoke-one, revoke-all-except-current, unauthenticated refusal, unknown-session refusal), and `REQ-015` (cross-cutting audit surface with a fixed field allow-list, token exclusion, and sink-failure posture). Adds a composition clause on `REQ-001` naming `security-auth-oauth2` as the required flow-controller and session-bridge owner. Extends `TAC-1201` with the account-console verification responsibility and `TAC-1204` with the sessionInventory responsibility. Adds `elicits[]` for `bootPosture` (strict/deferred/standby) and `verificationMode` (jwks/introspection) already described in prose. Adds `deliveredBy` on every `must` requirement and `disposition` on every existing acceptance criterion; adds `ownerRef` on ACs that observe interfaces owned by other TACs. Names the `principalDirectory` and `roleModel` capabilities on the requirements that carry their runtime clauses.
+- Moves the composition requirement from a REQ-level `requiresAppliedCapabilities` array (a level the apply gate never reads) to a `blueprint.json:requiresAppliedCapabilities` gate on `authorisationCodeFlow` with override `--allow-no-auth-yet` and stable id `security-auth-keycloak-flow-required`; `REQ-001` now points at that manifest gate. Narrows `REQ-015` to the discovery-client and account-console audit families (TAC-1201) and adds four must REQs (`REQ-016` JWT, `REQ-017` introspection, `REQ-018` route + sessionInventory, `REQ-019` roles), each with its own `deliveredBy` and a companion audit responsibility line on the target TAC. Rewrites `US-11115` `AC-1` to reference the `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` `SessionRow` shape rather than restating its fields.
 
 ## 1.2.0 (visual round, spec 2026-09-06 section 5.4.2, operator Q2 default)
 

package/blueprints/security-auth-keycloak/README.md

@@ -33,9 +33,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the Keycloak realm as identity source, the OIDC discovery contract, the JWKS-with-rotation-cache verification path, the RFC 7662 introspection path, the provider-routing seam, the Keycloak client-roles / realm-roles claim shape, the refresh-and-sign-out posture inherited from the realm, the session-vs-token separation, the local-first stand-up shape, the fail-safe boot postures, the runtime-verify posture with accountBound cloud smokes); the implementing agent derives the HOW-tasks (FBS) in the host project.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the Keycloak realm as identity source, the OIDC discovery contract, the JWKS-with-rotation-cache verification path, the RFC 7662 introspection path, the provider-routing seam, the Keycloak client-roles / realm-roles claim shape, the refresh-and-sign-out posture inherited from the realm, the session-vs-token separation, the local-first stand-up shape, the fail-safe boot postures, the runtime-verify posture with accountBound cloud smokes); the implementing agent derives the HOW-tasks (FBS) in the host project.
 
 Deliberately not contributed: the OAuth2 authorisation-code flow controller itself (a project either draws it from the sibling `security-auth-oauth2` blueprint or authors one above this blueprint's five TACs; the Keycloak-committed decisions here bind the flow controller's provider adapter to a Keycloak realm and no more); a specific HTTP framework adapter (the middleware wiring is framework-agnostic; framework adapters are a project responsibility); a specific session-record store (opaque-handle mode injects it; in-memory is the reference default; a persistence-composed project points at a table); MFA specifics (Keycloak owns MFA at the realm surface); real realm data (a placeholder `example` realm name is the shape; no lifted config); any specific second identity provider (the provider-routing seam is generic; the blueprint does not name a second issuer, per the ratified reshape ruling).
 

package/blueprints/security-auth-keycloak/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "security-auth-keycloak",
-  "version": "1.4.1",
+  "version": "1.4.4",
   "category": "security",
   "requiresAppliedCapabilities": {
     "capabilities": [
@@ -291,5 +291,6 @@
         "introspection"
       ]
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11T15:37:12.000Z"
 }

package/blueprints/security-auth-keycloak/contributions/probes/discovery-shape.mjs

@@ -0,0 +1,68 @@
+// OIDC discovery-URL derivation and document-shape probe for
+// security-auth-keycloak. Conformance-only. Every row records
+// anchorAcId=null with a limitation naming the shipped AC whose
+// boot-time fetch/population/refusal property the fixture discovery
+// client does not observe. The integration harness follow-up is
+// the surface where the AC-level properties become observable.
+//
+// capability: principalDirectory. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-keycloak', 'src');
+
+export const anchorAcId = null;
+export const capability = 'principalDirectory';
+export const accountBound = false;
+
+const LIM_URL = 'security-auth-keycloak-AC-11102-1: probe checks URL derivation and doc-shape refusal only; the AC states the boot-time discovery fetch fills a cache read at request time, which needs a real Keycloak realm and boot lifecycle (auth integration harness follow-up).';
+const LIM_REFUSAL = 'security-auth-keycloak-AC-11102-3: probe checks validator refusal only; the AC states the boot itself refuses when the discovery document is malformed, which needs the boot lifecycle (auth integration harness follow-up).';
+
+export default async function runProbe() {
+  const { buildDiscoveryUrl, validateDiscoveryDocument } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'discovery-client.mjs')).href);
+  const results = [];
+
+  const built = buildDiscoveryUrl({ baseUrl: 'https://keycloak.example.com/', realm: 'example-realm' });
+  const expected = 'https://keycloak.example.com/realms/example-realm/.well-known/openid-configuration';
+  results.push(deClaim({
+    capability,
+    verdict: built.ok && built.discoveryUrl === expected ? 'pass' : 'fail',
+    detail: `discovery URL construction (well-formed input): ok=${built.ok} url=${built.discoveryUrl}`,
+    evidence: { input: { baseUrl: 'https://keycloak.example.com/', realm: 'example-realm' }, adapterReturn: built },
+  }, { ac: 'security-auth-keycloak-AC-11102-1', limitation: LIM_URL }));
+
+  const insecure = buildDiscoveryUrl({ baseUrl: 'http://insecure.example.com', realm: 'example-realm' });
+  results.push(deClaim({
+    capability,
+    verdict: !insecure.ok && /must be https/.test(insecure.error) ? 'pass' : 'fail',
+    detail: `insecure baseUrl refusal: ok=${insecure.ok} error=${JSON.stringify(insecure.error)}`,
+    evidence: { adapterReturn: insecure },
+  }, { ac: 'security-auth-keycloak-AC-11102-1', limitation: LIM_URL }));
+
+  const missing = validateDiscoveryDocument({ issuer: 'x', authorization_endpoint: 'x' });
+  results.push(deClaim({
+    capability,
+    verdict: !missing.ok && /missing required fields/.test(missing.error) ? 'pass' : 'fail',
+    detail: `doc-shape missing-fields refusal: ok=${missing.ok} error=${JSON.stringify(missing.error)}`,
+    evidence: { validatorReturn: missing },
+  }, { ac: 'security-auth-keycloak-AC-11102-3', limitation: LIM_REFUSAL }));
+
+  const good = validateDiscoveryDocument({
+    issuer: 'https://kc.example.com/realms/dev',
+    authorization_endpoint: 'https://kc.example.com/realms/dev/protocol/openid-connect/auth',
+    token_endpoint: 'https://kc.example.com/realms/dev/protocol/openid-connect/token',
+    jwks_uri: 'https://kc.example.com/realms/dev/protocol/openid-connect/certs',
+  });
+  results.push(deClaim({
+    capability,
+    verdict: good.ok ? 'pass' : 'fail',
+    detail: `well-formed doc passes validation: ok=${good.ok} endpoints=${JSON.stringify(good.endpoints || good.error)}`,
+    evidence: { validatorReturn: good },
+  }, { ac: 'security-auth-keycloak-AC-11102-1', limitation: LIM_URL }));
+
+  return { results, extra: {} };
+}

package/blueprints/security-auth-keycloak/contributions/probes/introspection-shape.mjs

@@ -0,0 +1,88 @@
+// RFC 7662 introspection request/response shape probe for
+// security-auth-keycloak. Conformance-only. Every row records
+// anchorAcId=null with a limitation naming the shipped AC whose
+// HTTP introspection round-trip the fixture parser observation does
+// not exercise. The integration harness follow-up is the surface
+// where the AC-level properties become observable.
+//
+// capability: sessionInventory. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-keycloak', 'src');
+
+export const anchorAcId = null;
+export const capability = 'sessionInventory';
+export const accountBound = false;
+
+const LIM_REQ = 'security-auth-keycloak-AC-11105-1: probe builds an introspection form body against the fixture parser; the AC states the client issues a real POST to the introspection endpoint with HTTP Basic authentication and consumes the JSON body, which requires observing the deployed client through the integration harness follow-up.';
+const LIM_PARSE = 'security-auth-keycloak-AC-11105-1: probe parses a fabricated introspection object; the AC states an opaque token round-trips through the introspection endpoint, needs the integration harness (the auth integration harness follow-up).';
+const LIM_INACTIVE = 'security-auth-keycloak-AC-11105-2: probe observes fixture parser only; the AC requires the client-layer refusal (4xx + KEYCLOAK_INTROSPECTION_INACTIVE + no cookie + audit event), needs the integration harness (the auth integration harness follow-up).';
+const LIM_MALFORMED = 'security-auth-keycloak-AC-11105-3: probe parses a malformed shape locally; the AC states the endpoint returns a non-2xx response with KEYCLOAK_INTROSPECTION_ENDPOINT_ERROR, needs the integration harness (the auth integration harness follow-up).';
+
+export default async function runProbe() {
+  const { buildIntrospectionForm, parseIntrospectionResponse } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'introspection-client.mjs')).href);
+  const results = [];
+
+  function redactedBody(req) {
+    if (!req || !req.body) return req;
+    const params = new URLSearchParams(req.body);
+    const keys = [...params.keys()].sort();
+    const redacted = {};
+    for (const k of keys) redacted[k] = k === 'client_secret' ? '[REDACTED]' : params.get(k);
+    return { ok: req.ok, error: req.error, bodyKeys: keys, bodyRedacted: redacted };
+  }
+
+  const req = buildIntrospectionForm({ token: 'tok-abc', clientId: 'client-x', clientSecret: 'PLACEHOLDER_SECRET' });
+  const reqEv = redactedBody(req);
+  const hasFields = req.ok
+    && reqEv.bodyKeys.includes('token')
+    && reqEv.bodyKeys.includes('client_id')
+    && reqEv.bodyKeys.includes('client_secret')
+    && reqEv.bodyRedacted.token === 'tok-abc'
+    && reqEv.bodyRedacted.client_id === 'client-x';
+  results.push(deClaim({
+    capability,
+    verdict: hasFields ? 'pass' : 'fail',
+    detail: `form built (client_secret redacted): ok=${req.ok} bodyKeys=${JSON.stringify(reqEv.bodyKeys)}`,
+    evidence: { adapterReturn: reqEv },
+  }, { ac: 'security-auth-keycloak-AC-11105-1', limitation: LIM_REQ }));
+
+  const badReq = buildIntrospectionForm({ token: '', clientId: 'x', clientSecret: 'PLACEHOLDER_SECRET_2' });
+  results.push(deClaim({
+    capability,
+    verdict: !badReq.ok && /token required/.test(badReq.error) ? 'pass' : 'fail',
+    detail: `empty-token refusal: ok=${badReq.ok} error=${JSON.stringify(badReq.error)}`,
+    evidence: { adapterReturn: { ok: badReq.ok, error: badReq.error } },
+  }, { ac: 'security-auth-keycloak-AC-11105-1', limitation: LIM_REQ }));
+
+  const active = parseIntrospectionResponse({ active: true, sub: 'user-1', scope: 'openid profile', username: 'alice' });
+  results.push(deClaim({
+    capability,
+    verdict: active.ok && active.active && active.principalId === 'user-1' ? 'pass' : 'fail',
+    detail: `active:true parses to claim record: ok=${active.ok} principalId=${active.principalId} scope=${active.scope}`,
+    evidence: { parserReturn: active },
+  }, { ac: 'security-auth-keycloak-AC-11105-1', limitation: LIM_PARSE }));
+
+  const inactive = parseIntrospectionResponse({ active: false });
+  results.push(deClaim({
+    capability,
+    verdict: inactive.ok && inactive.active === false ? 'pass' : 'fail',
+    detail: `active:false parses (parser only): ok=${inactive.ok} active=${inactive.active}`,
+    evidence: { parserReturn: inactive, notObservableAt: 'parser-layer' },
+  }, { ac: 'security-auth-keycloak-AC-11105-2', limitation: LIM_INACTIVE }));
+
+  const malformed = parseIntrospectionResponse({ status: 'unknown' });
+  results.push(deClaim({
+    capability,
+    verdict: !malformed.ok && /missing boolean/.test(malformed.error) ? 'pass' : 'fail',
+    detail: `malformed-payload refused (parser only): ok=${malformed.ok} error=${JSON.stringify(malformed.error)}`,
+    evidence: { parserReturn: malformed },
+  }, { ac: 'security-auth-keycloak-AC-11105-3', limitation: LIM_MALFORMED }));
+
+  return { results, extra: {} };
+}

package/blueprints/security-auth-keycloak/contributions/probes/jwt-verifier-shape.mjs

@@ -0,0 +1,86 @@
+// JWT verifier shape probe for security-auth-keycloak.
+// Conformance-only. Every row records anchorAcId=null with a
+// limitation naming the shipped AC whose JWKS/handler/audit
+// property the local RS256 sign+verify observation does not
+// exercise. The integration harness follow-up is the surface where
+// the AC-level properties become observable.
+//
+// capability: credentialSelfService. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-keycloak', 'src');
+
+export const anchorAcId = null;
+export const capability = 'credentialSelfService';
+export const accountBound = false;
+
+const LIM_KID = 'security-auth-keycloak-AC-11103-1: probe verifies against an in-process public key; the AC requires JWKS-cache resolution by kid, needs the integration harness (the auth integration harness follow-up).';
+const LIM_SIG = 'security-auth-keycloak-AC-11104-2: probe verifies against a static public key; the AC requires refresh-then-refuse when the kid is unpublished, needs the integration harness (the auth integration harness follow-up).';
+const LIM_EXP = 'security-auth-keycloak-AC-11104-1: probe checks expiry-refusal on a synthetic token; the AC requires session absence + 4xx + audit event at the request handler, needs the integration harness (the auth integration harness follow-up).';
+const LIM_ISS = 'security-auth-keycloak-AC-11117-7: probe observes iss mismatch refusal; the AC states an audit event with reasonClass=issuer_mismatch is emitted at the handler, needs the integration harness (the auth integration harness follow-up).';
+const LIM_ALG = 'security-auth-keycloak-AC-11104-2: probe observes alg=none refusal on the local verifier; the AC states the verifier refuses a token signed under an unpublished key with KEYCLOAK_JWT_SIGNATURE_INVALID after one JWKS refresh, which requires observing the deployed verifier through the integration harness follow-up.';
+
+export default async function runProbe() {
+  const { generateThrowawayKeypair, signRs256, verifyRs256 } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'jwt-verifier.mjs')).href);
+  const { privateKey, publicKey } = generateThrowawayKeypair();
+  const results = [];
+  const iss = 'https://kc.example.com/realms/example-realm';
+  const now = Math.floor(Date.now() / 1000);
+  const payload = { sub: 'user-abc', iss, exp: now + 300, iat: now };
+  const token = signRs256({ header: { alg: 'RS256', typ: 'JWT' }, payload, privateKey });
+
+  const good = verifyRs256({ token, publicKey, expectedIssuer: iss });
+  results.push(deClaim({
+    capability,
+    verdict: good.ok && good.payload && good.payload.sub === 'user-abc' ? 'pass' : 'fail',
+    detail: `well-formed RS256 verify against public key: ok=${good.ok} sub=${good.payload && good.payload.sub}`,
+    evidence: { verifierReturn: { ok: good.ok, sub: good.payload && good.payload.sub } },
+  }, { ac: 'security-auth-keycloak-AC-11103-1', limitation: LIM_KID }));
+
+  const parts = token.split('.');
+  const firstSigChar = parts[2].slice(0, 1);
+  const flipped = firstSigChar === 'A' ? 'B' : 'A';
+  const tampered = `${parts[0]}.${parts[1]}.${flipped}${parts[2].slice(1)}`;
+  const badSig = verifyRs256({ token: tampered, publicKey, expectedIssuer: iss });
+  results.push(deClaim({
+    capability,
+    verdict: !badSig.ok && /signature/.test(badSig.error) ? 'pass' : 'fail',
+    detail: `tampered-signature refused: ok=${badSig.ok} error=${JSON.stringify(badSig.error)}`,
+    evidence: { verifierReturn: badSig },
+  }, { ac: 'security-auth-keycloak-AC-11104-2', limitation: LIM_SIG }));
+
+  const expiredToken = signRs256({ header: { alg: 'RS256', typ: 'JWT' }, payload: { sub: 'x', iss, exp: now - 60 }, privateKey });
+  const badExp = verifyRs256({ token: expiredToken, publicKey, expectedIssuer: iss });
+  results.push(deClaim({
+    capability,
+    verdict: !badExp.ok && /expired/.test(badExp.error) ? 'pass' : 'fail',
+    detail: `past-exp refused: ok=${badExp.ok} error=${JSON.stringify(badExp.error)}`,
+    evidence: { verifierReturn: badExp },
+  }, { ac: 'security-auth-keycloak-AC-11104-1', limitation: LIM_EXP }));
+
+  const wrongIss = verifyRs256({ token, publicKey, expectedIssuer: 'https://kc.example.com/realms/other' });
+  results.push(deClaim({
+    capability,
+    verdict: !wrongIss.ok && /iss mismatch/.test(wrongIss.error) ? 'pass' : 'fail',
+    detail: `iss-mismatch refused: ok=${wrongIss.ok} error=${JSON.stringify(wrongIss.error)}`,
+    evidence: { verifierReturn: wrongIss },
+  }, { ac: 'security-auth-keycloak-AC-11117-7', limitation: LIM_ISS }));
+
+  const noneHeader = Buffer.from(JSON.stringify({ alg: 'none', typ: 'JWT' })).toString('base64url');
+  const nonePayload = Buffer.from(JSON.stringify({ sub: 'x', iss, exp: now + 300 })).toString('base64url');
+  const noneToken = `${noneHeader}.${nonePayload}.`;
+  const badAlg = verifyRs256({ token: noneToken, publicKey, expectedIssuer: iss });
+  results.push(deClaim({
+    capability,
+    verdict: !badAlg.ok && /alg must be RS256/.test(badAlg.error) ? 'pass' : 'fail',
+    detail: `alg=none refused: ok=${badAlg.ok} error=${JSON.stringify(badAlg.error)}`,
+    evidence: { verifierReturn: badAlg },
+  }, { ac: 'security-auth-keycloak-AC-11104-2', limitation: LIM_ALG }));
+
+  return { results, extra: {} };
+}

package/blueprints/security-auth-keycloak/contributions/probes/probe-utils.mjs

@@ -0,0 +1,180 @@
+// Shared helpers for security-auth-keycloak probes.
+//
+// Runtime-dependency posture:
+// - Local probes drive shipped-shape checks against the fixture at
+//   packages/rcf-lite/test/fixtures/security-auth-keycloak/ without
+//   contacting a real Keycloak realm.
+// - real-account-* probes call the Keycloak Admin REST API and
+//   OIDC endpoints against a live Keycloak realm when one is
+//   available. No live Keycloak client is available in this estate
+//   (no live realm is exposed to shelf probes in this estate), so the
+//   real-account probe honest-skips per rule 7d, recording
+//   accountBoundSkipped: true naming CI_HAS_KEYCLOAK_ACCOUNT.
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const SLUG = 'security-auth-keycloak';
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/security-auth-keycloak');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/security-auth-keycloak');
+
+export const DECLARED_ENV = Object.freeze([
+  'CI_HAS_KEYCLOAK_ACCOUNT',
+  'KEYCLOAK_BASE_URL',
+  'KEYCLOAK_REALM',
+  'KEYCLOAK_ADMIN_CLIENT_ID',
+  'KEYCLOAK_ADMIN_CLIENT_SECRET',
+  'KEYCLOAK_INTROSPECTION_TOKEN',
+]);
+
+// First-8-words-of-anchor helper. Each result row's `detail` starts
+// with the first eight words of the anchored AC's or REQ's
+// description text. Anchor lookup walks contributions/user-stories/
+// and contributions/requirements/ under the blueprint root and
+// caches the map on first call. Null / unknown / missing anchors
+// yield an empty prefix.
+import { readFileSync as _rf } from 'node:fs';
+import { readdirSync as _rd } from 'node:fs';
+let _anchorMap = null;
+function _loadAnchorMap() {
+  const map = new Map();
+  const dirs = [
+    { dir: resolve(PROJECT_ROOT, 'blueprints', SLUG, 'contributions', 'user-stories'), kind: 'ac' },
+    { dir: resolve(PROJECT_ROOT, 'blueprints', SLUG, 'contributions', 'requirements'), kind: 'req' },
+  ];
+  for (const { dir, kind } of dirs) {
+    let entries;
+    try { entries = _rd(dir); } catch { continue; }
+    for (const name of entries) {
+      if (!name.endsWith('.json')) continue;
+      let j;
+      try { j = JSON.parse(_rf(resolve(dir, name), 'utf8')); } catch { continue; }
+      if (kind === 'ac') {
+        const usId = j.usId;
+        for (const ac of (j.acceptanceCriteria || [])) {
+          // AC id in the shipped JSON is like "AC-9101-1"; the
+          // anchor form used by probes is "<slug>-AC-9101-1".
+          const key = `${SLUG}-${ac.id}`;
+          map.set(key, ac.description || '');
+        }
+      } else {
+        const key = j.reqId; // already "<slug>-REQ-###"
+        if (key) map.set(key, j.description || j.title || '');
+      }
+    }
+  }
+  return map;
+}
+export function first8Words(anchor) {
+  if (!anchor) return '';
+  if (!_anchorMap) _anchorMap = _loadAnchorMap();
+  const txt = _anchorMap.get(anchor) || '';
+  if (!txt) return '';
+  const words = txt.split(/\s+/).filter(Boolean).slice(0, 8).join(' ');
+  return words;
+}
+export function withAnchorPrefix(row) {
+  const prefix = first8Words(row.anchorAcId);
+  if (!prefix) return row;
+  const already = typeof row.detail === 'string' && row.detail.startsWith(prefix);
+  if (already) return row;
+  const oldDetail = row.detail || '';
+  return { ...row, detail: `${prefix} :: ${oldDetail}` };
+}
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export function isSkipped(results) {
+  return results.length > 0 && results.every((r) => r.accountBoundSkipped === true);
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  // Prefix every row's detail with the first eight words of its
+  // anchored AC or REQ description; unanchored rows are left alone.
+  const prefixedResults = (results || []).map(withAnchorPrefix);
+  const raw = aggregate(prefixedResults);
+  const aggregateVerdict = isSkipped(prefixedResults) ? 'pass' : raw;
+  const report = {
+    slug: 'security-auth-keycloak',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results: prefixedResults,
+    aggregateVerdict,
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = await mainFn();
+    if (!outcome || !Array.isArray(outcome.results) || outcome.results.length === 0) {
+      const results = [{
+        anchorAcId: 'unknown',
+        verdict: 'fail',
+        detail: 'no checks ran',
+      }];
+      const { report, path } = await writeReport({ probeName, engine, results });
+      process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+      process.stderr.write(`no-checks-ran fail written to ${path}\n`);
+      process.exitCode = 1;
+      return;
+    }
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{ anchorAcId: 'unknown', verdict: 'fail', detail: `probe threw: ${err && err.message ? err.message : String(err)}` }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+// De-claim helper. When the shipped AC does not observe what the probe observes, the row keeps its
+// verdict, evidence and engine as they are, but the anchor drops to null and the
+// row carries conformanceOnly:true plus a limitation string naming the AC that
+// this probe does NOT observe and why. The integration-harness follow-up (the auth integration harness follow-up)
+// is the surface where those AC-level properties become observable.
+export function deClaim(row, { ac, limitation }) {
+  const acId = ac || 'unknown-AC';
+  const limText = (limitation || '').trim();
+  const finalLim = /^(security-[a-z0-9-]+-)?(AC|REQ)-/.test(limText) ? limText : (limText ? `${acId}: ${limText}` : `${acId}: not observable at this probe surface; needs the integration harness (the auth integration harness follow-up)`);
+  const out = { ...row };
+  out.anchorAcId = null;
+  if ('anchorReqId' in out) delete out.anchorReqId;
+  out.conformanceOnly = true;
+  out.limitation = finalLim;
+  const tag = ` :: conformance-only (${finalLim})`;
+  if (typeof out.detail === 'string' && !out.detail.includes('conformance-only')) {
+    out.detail = out.detail + tag;
+  }
+  return out;
+}
+
+export function accountBoundSkippedResult(anchorAcId, capability, reason) {
+  return {
+    anchorAcId,
+    capability,
+    verdict: 'pass',
+    accountBoundSkipped: true,
+    reason,
+    detail: `accountBoundSkipped: ${reason} unset; probe did not execute against a real Keycloak realm. Set the missing var and re-run.`,
+  };
+}