rcf-lite 0.27.0 → 0.28.0

package/blueprints/security-auth-keycloak/contributions/probes/real-account-realm-round-trip.mjs

@@ -0,0 +1,91 @@
+// Real-account Keycloak realm round-trip for security-auth-
+// keycloak. This estate does not expose a live Keycloak realm to
+// the probe pack. When the gate variable CI_HAS_KEYCLOAK_ACCOUNT is
+// unset the probe honest-skips per rule 7d naming that variable;
+// when every gate and second-tier variable is set the credential-
+// present branch returns a FAIL row with a NOT IMPLEMENTED detail
+// (no live round-trip has been authored) rather than silently
+// passing. The live branch is intended to discover the realm's
+// OIDC document, obtain an admin token via client credentials,
+// create a scratch user, read it back, and delete it, capturing
+// the Keycloak-assigned user id and every response's HTTP status
+// for evidence. It will be authored when an estate-owned realm is
+// wired to CI. The slug reads AMBER on criterion e until that
+// happens.
+//
+// capability: principalDirectory + sessionInventory (composite).
+// Anchor: AC-11112-2 (live cloud-hosted-realm smoke
+//   completes a full authorisation-code + PKCE round-trip and
+//   issues a project session whose Principal carries the
+//   deployment's realm slug).
+// accountBound: true.
+
+import { DECLARED_ENV, accountBoundSkippedResult } from './probe-utils.mjs';
+
+export const anchorAcId = 'security-auth-keycloak-AC-11112-2';
+export const capability = 'principalDirectory';
+export const accountBound = true;
+
+const SECOND_TIER_VARS = ['KEYCLOAK_BASE_URL', 'KEYCLOAK_REALM', 'KEYCLOAK_ADMIN_CLIENT_ID', 'KEYCLOAK_ADMIN_CLIENT_SECRET'];
+
+function gateResult(varName, value) {
+  if (value === undefined || value === '') return { kind: 'unset', reason: varName };
+  if (value !== 'true') return { kind: 'set-not-true', reason: `${varName}_SET_NOT_TRUE`, observedValue: value };
+  return { kind: 'true' };
+}
+
+export default async function runProbe() {
+  const gate = gateResult('CI_HAS_KEYCLOAK_ACCOUNT', process.env.CI_HAS_KEYCLOAK_ACCOUNT);
+  if (gate.kind === 'unset') {
+    return {
+      results: [accountBoundSkippedResult(anchorAcId, capability, 'CI_HAS_KEYCLOAK_ACCOUNT')],
+      extra: {
+        accountBoundSkipped: true,
+        reason: 'CI_HAS_KEYCLOAK_ACCOUNT',
+        envDeclared: [...DECLARED_ENV],
+        note: 'No live Keycloak client is available in this estate; no live realm is exposed to shelf probes. Local RFC 7662 introspection shape, RS256 verifier shape and role-adapter shape are proven by the local probes in this pack.',
+      },
+    };
+  }
+  if (gate.kind === 'set-not-true') {
+    return {
+      results: [{
+        anchorAcId, capability, verdict: 'fail',
+        detail: `AC-11112-2: CI_HAS_KEYCLOAK_ACCOUNT is set to "${gate.observedValue}" (not the string "true"). Gate refuses this shape; set the variable to the exact string "true" to run the live branch.`,
+        evidence: { gate: 'CI_HAS_KEYCLOAK_ACCOUNT', observedValue: gate.observedValue, expected: 'true' },
+      }],
+      extra: { gateMisconfigured: true, gate: 'CI_HAS_KEYCLOAK_ACCOUNT', envDeclared: [...DECLARED_ENV] },
+    };
+  }
+
+  // One result row per unset second-tier variable per rule 4.
+  const unsetRows = [];
+  for (const v of SECOND_TIER_VARS) {
+    if (!process.env[v]) {
+      unsetRows.push({
+        anchorAcId, capability, verdict: 'pass', accountBoundSkipped: true, reason: v,
+        detail: `accountBoundSkipped: ${v} unset. AC-11112-2 requires a live realm; set ${v} to run the live branch.`,
+      });
+    }
+  }
+  if (unsetRows.length > 0) {
+    return {
+      results: unsetRows,
+      extra: { accountBoundSkipped: true, unsetVars: unsetRows.map((r) => r.reason), envDeclared: [...DECLARED_ENV] },
+    };
+  }
+
+  // All credentials present but the live branch is not implemented
+  // in this estate. FAIL explicitly (never a misleading pass).
+  return {
+    results: [{
+      anchorAcId, capability, verdict: 'fail',
+      detail: 'AC-11112-2 live branch is NOT IMPLEMENTED. Every gate variable is set, but the estate has no wired live Keycloak realm and no round-trip code has been authored. Supplying credentials does not silently pass; the branch must be implemented before this result flips to pass. Local shape evidence is proven by the local probes in this pack; the live branch remains AMBER until an estate-owned realm is wired.',
+    }],
+    extra: {
+      envDeclared: [...DECLARED_ENV],
+      liveBranchImplemented: false,
+      note: 'implement admin-client credentials round-trip against KEYCLOAK_BASE_URL/KEYCLOAK_REALM/KEYCLOAK_ADMIN_CLIENT_ID/KEYCLOAK_ADMIN_CLIENT_SECRET here when the estate exposes a realm',
+    },
+  };
+}

package/blueprints/security-auth-keycloak/contributions/probes/role-adapter-shape.mjs

@@ -0,0 +1,69 @@
+// Keycloak role-adapter shape probe. Conformance-only. Every row
+// records anchorAcId=null with a limitation naming the shipped AC
+// whose verified-session behaviour the raw-claim fixture-adapter
+// observation does not exercise. The integration harness follow-up
+// is the surface where the AC-level properties become observable.
+//
+// capability: roleModel. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-keycloak', 'src');
+
+export const anchorAcId = null;
+export const capability = 'roleModel';
+export const accountBound = false;
+
+const LIM_CLIENT = 'security-auth-keycloak-AC-11107-1: probe receives a raw claim object, not a verified access token; the AC requires the client-roles path from a verified session, needs the integration harness (the auth integration harness follow-up).';
+const LIM_ABSENT = 'security-auth-keycloak-AC-11107-2: probe receives an empty raw claim object; the AC requires absent-claim behaviour on a verified session, needs the integration harness (the auth integration harness follow-up).';
+const LIM_MALFORMED = 'security-auth-keycloak-AC-11107-3: probe receives a raw claim object; the AC requires the malformed-claim refusal path on a verified session, needs the integration harness (the auth integration harness follow-up).';
+const LIM_REQ006 = 'security-auth-keycloak-AC-11107-3: probe observes an unknown-role refusal at the fixture adapter; the AC states a verified token whose expected claim path is present but not an array of strings is refused with KEYCLOAK_ROLES_MALFORMED, which requires observing the deployed adapter through the integration harness follow-up.';
+
+export default async function runProbe() {
+  const { mapKeycloakRoles, knownRoles } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'role-adapter.mjs')).href);
+  const results = [];
+
+  const clientOnly = mapKeycloakRoles({
+    resource_access: { 'app-x': { roles: ['editor', 'admin'] } },
+  }, { clientId: 'app-x', roleClaimShape: 'client-roles' });
+  results.push(deClaim({
+    capability,
+    verdict: clientOnly.ok && JSON.stringify(clientOnly.roles) === JSON.stringify(['editor', 'admin']) && clientOnly.source && clientOnly.source.client === 2 && (clientOnly.source.realm ?? 0) === 0 ? 'pass' : 'fail',
+    detail: `client-roles claim path lifts resource_access.<clientId>.roles: ok=${clientOnly.ok} roles=${JSON.stringify(clientOnly.roles)} source=${JSON.stringify(clientOnly.source)}`,
+    evidence: { adapterReturn: clientOnly, knownRoles },
+  }, { ac: 'security-auth-keycloak-AC-11107-1', limitation: LIM_CLIENT }));
+
+  const absentPath = mapKeycloakRoles({}, { clientId: 'app-x', roleClaimShape: 'client-roles' });
+  results.push(deClaim({
+    capability,
+    verdict: absentPath.ok && Array.isArray(absentPath.roles) && absentPath.roles.length === 0 ? 'pass' : 'fail',
+    detail: `absent-claim yields empty roles: ok=${absentPath.ok} roles=${JSON.stringify(absentPath.roles)}`,
+    evidence: { adapterReturn: absentPath },
+  }, { ac: 'security-auth-keycloak-AC-11107-2', limitation: LIM_ABSENT }));
+
+  const nonArray = mapKeycloakRoles({
+    resource_access: { 'app-x': { roles: 'admin' } },
+  }, { clientId: 'app-x', roleClaimShape: 'client-roles' });
+  results.push(deClaim({
+    capability,
+    verdict: !nonArray.ok && /KEYCLOAK_ROLES_MALFORMED|must be an array/i.test(nonArray.error) ? 'pass' : 'fail',
+    detail: `non-array claim refused: ok=${nonArray.ok} error=${JSON.stringify(nonArray.error)}`,
+    evidence: { adapterReturn: nonArray },
+  }, { ac: 'security-auth-keycloak-AC-11107-3', limitation: LIM_MALFORMED }));
+
+  const unknown = mapKeycloakRoles({
+    resource_access: { 'app-x': { roles: ['viewer', 'root-emperor'] } },
+  }, { clientId: 'app-x', roleClaimShape: 'client-roles' });
+  results.push(deClaim({
+    capability,
+    verdict: !unknown.ok && /root-emperor/.test(unknown.error) ? 'pass' : 'fail',
+    detail: `unknown-role refusal (fixture adapter): ok=${unknown.ok} error=${JSON.stringify(unknown.error)}`,
+    evidence: { adapterReturn: unknown },
+  }, { ac: 'security-auth-keycloak-AC-11107-3', limitation: LIM_REQ006 }));
+
+  return { results, extra: {} };
+}

package/blueprints/security-auth-keycloak/contributions/probes/run-discovery-shape.mjs

@@ -0,0 +1,4 @@
+import runProbe from './discovery-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'fixture discovery-client (local)', healthy: true };
+runShim('discovery-shape', engine, runProbe);

package/blueprints/security-auth-keycloak/contributions/probes/run-introspection-shape.mjs

@@ -0,0 +1,4 @@
+import runProbe from './introspection-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'fixture RFC 7662 introspection adapter (local)', healthy: true };
+runShim('introspection-shape', engine, runProbe);

package/blueprints/security-auth-keycloak/contributions/probes/run-jwt-verifier-shape.mjs

@@ -0,0 +1,4 @@
+import runProbe from './jwt-verifier-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'node:crypto RS256 sign+verify (throwaway keys)', healthy: true };
+runShim('jwt-verifier-shape', engine, runProbe);

package/blueprints/security-auth-keycloak/contributions/probes/run-real-account-realm-round-trip.mjs

@@ -0,0 +1,4 @@
+import runProbe from './real-account-realm-round-trip.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'keycloak' /* live-realm branch is honest-skip; slug AMBER */, image: 'estate-owned Keycloak realm (or skipped)', healthy: true };
+runShim('real-account-realm-round-trip', engine, runProbe);

package/blueprints/security-auth-keycloak/contributions/probes/run-role-adapter-shape.mjs

@@ -0,0 +1,4 @@
+import runProbe from './role-adapter-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'fixture keycloak role-adapter (local)', healthy: true };
+runShim('role-adapter-shape', engine, runProbe);

package/blueprints/security-auth-keycloak/docs/topics.md

@@ -70,8 +70,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 11101-11113 sit at the LOW end of the 11101-11899 band on purpose. A project-side story that mechanically derives from a security-auth-keycloak REQ id into the number `11113` would collide against security-auth-keycloak-US-11113 in this package; the band leaves headroom at the HIGH end (US 11181-11899) so a project's own stories anchored to security-auth-keycloak REQs can allocate without conflict. The watchpost run4 lesson applies here too.
-
+US 11101-11113 sit at the LOW end of the 11101-11899 band on purpose. A project-side story that mechanically derives from a security-auth-keycloak REQ id into the number `11113` would collide against security-auth-keycloak-US-11113 in this package; the band leaves headroom at the HIGH end (US 11181-11899) so a project's own stories anchored to security-auth-keycloak REQs can allocate without conflict.
 The ADR/TAC suffix block 1201-1299 is the third block in the four-digit suffix space; `security-auth-clerk` opened the door at 1001-1099 and `security-auth-oauth2` took 1101-1199. Every shipped blueprint continues to load, validate, and audit against this shape without a schema change: rcf-schemas 0.5.0 `adrId` and `tacId` patterns are `^ADR-\d{3,}(-[a-z0-9]+...)?$` (three-digit minimum, unbounded above); four-digit and higher suffixes validate verbatim. The registry table above records the growth for a downstream author reaching for the next block.
 
 ## Provider-aware install-design shape (plain language, no named second issuer)

package/blueprints/security-auth-magic-link/CHANGELOG.md

@@ -1,8 +1,19 @@
 # security-auth-magic-link CHANGELOG
 
-## 1.2.4
+## 1.2.7 - 2026-09-11
+
+- Criterion-e probe pack refinement: every conformance-only result row now records `anchorAcId: null` alongside a `limitation` that opens with a shipped AC id from the blueprint's user stories (token-entropy rows and the fixture manager rows move from `REQ-002` to `AC-3102-1` / `AC-3102-2` / `AC-3102-3`; the live `real-account-magic-link-send` row remains under `AC-3110-1` as its limitation citation). Detail strings on de-claimed rows describe only what was observed at the surface the probe drove (Resend adapter return for the live probe; fixture manager return for the local probes) and no longer describe `AC-3110-1` as exercised end to end. Probe source header on `real-account-magic-link-send` matches the de-claim comment (no "exercises AC-3110-1 end-to-end" wording). `token-issue-verify` header comment matches its implementation (every row de-claims, including AC-3102-3). The magic-link fixture README now records the entropy sample count as 1,000 tokens (matching the probe implementation and the run record). The anatomy helper enforces conformance-only rows to satisfy `anchorAcId === null`, requires limitations to open with an `AC-<n>-<n>` id that resolves to a shipped acceptance criterion on the blueprint's user stories (REQ-prefixed anchors are refused and fabricated ids are rejected), and does not count pre-delete presence as an absence observation on the inventory-diff shape.
+
+## 1.2.6 - 2026-09-11
+
+- Every conformance-only anchor on the criterion-e probe pack is de-claimed to `conformanceOnly` with a limitation naming the shipped AC that is observable only in the integration harness follow-up. The Resend adapter now returns `error: null` on success so the four declared keys (ok, providerStatus, providerMessageId, error) are always present, and the probe now requires all four (the previous check allowed missing `error`). Live evidence on `real-account-magic-link-send` (Resend HTTP send through the adapter) is preserved; anchor drops to null and the limitation says why.
 
-- Closure fix pass (F-2, F-3): rewrites the `README.md` shelf-latest line in neutral customer-facing voice with no spec-provenance label; drops the vendor-implementation naming from the guide narrative and describes the reference container-plus-realm shape generically.
+## 1.2.5 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering the principalDirectory capability across three probes: `token-issue-verify` (single-use, TTL-bounded, email-bound token with constant-time compare; local, deterministic clock), `token-entropy-shape` (1,000-token uniqueness + base64url shape sweep), and `real-account-magic-link-send` (LIVE; drives Resend's HTTP API sending to sandbox recipient `delivered@resend.dev` from sandbox sender `onboarding@resend.dev` and records the Resend-assigned email id, HTTP status and `cf-ray` request id on the adapter return; verifies the issued token locally for end-to-end shape). Fixture at `packages/rcf-lite/test/fixtures/security-auth-magic-link/` declares every env var; anatomy test pins pack shape, fixture manifest and the account-bound skip contract.
+- Iteration on the probe pack routed the outgoing send through a fixture `email-delivery-adapter` whose default binding is Resend, so live evidence carries the provider-assigned message id and the HTTP request id on the adapter's returned shape rather than a direct-vendor call. `aggregate([])` and null-result normalisation now report `detail: 'no checks ran'` exactly. Slug reads AMBER on criterion e.
+
+## 1.2.4
 
 ## 1.2.3
 
@@ -12,9 +23,9 @@
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 1.2.1 (hardening pass, spec 2026-09-09 section 5.4.2)
+## 1.2.1 (2026-09-09)
 
-- Adds `deliveredBy` on every `must` requirement and `disposition: fixed` on every existing acceptance criterion; adds `ownerRef` on ACs that restate the `isRegistered` interface on `TAC-505`. Extends `REQ-003` with the session-lifetime contract (sliding idle window, absolute lifetime, server-side revocation as the only truthful invalidation). Names the `principalDirectory` capability on `REQ-011`, which already carries its runtime clause through the principal-registry contract. hardening pass (criteria a, b, c on the 2026-09-09 programme). No new contributions.
+- Adds `deliveredBy` on every `must` requirement and `disposition: fixed` on every existing acceptance criterion; adds `ownerRef` on ACs that restate the `isRegistered` interface on `TAC-505`. Extends `REQ-003` with the session-lifetime contract (sliding idle window, absolute lifetime, server-side revocation as the only truthful invalidation). Names the `principalDirectory` capability on `REQ-011`, which already carries its runtime clause through the principal-registry contract. No new contributions.
 
 ## 1.2.0 (visual round, spec 2026-09-06 section 5.4.2, doc-only)
 

package/blueprints/security-auth-magic-link/README.md

@@ -30,9 +30,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the sign-in flow, the token lifecycle, the session lifecycle, the two pluggable interfaces); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the sign-in flow, the token lifecycle, the session lifecycle, the two pluggable interfaces); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 Deliberately not contributed: authorisation (roles, permissions, tenancy) is a project concern that layers above the session record's principal id, not inside this blueprint; multi-factor authentication is a project concern that layers on top of a resolved session; federated identity (OIDC, SAML) is a future auth-oidc blueprint (see guide 'when it does not fit'); email transport is a project concern behind the pluggable adapter contract; principal registry shape is a project concern behind the pluggable lookup contract.
 

package/blueprints/security-auth-magic-link/assets/principal-registry-samples/single-address.md

@@ -32,4 +32,4 @@ The project supplies one field:
 
 ## Why it exists
 
-The rcf-lite tier this blueprint targets includes solo-operator projects (watchpost, personal dashboards, single-tenant admin surfaces). The single-address registry is the smallest useful implementation and demonstrates the boolean-only shape of the contract; projects that scale past one operator write their own allow-list-file or database-lookup implementation, keeping the same interface.
+The rcf-lite tier this blueprint targets includes solo-operator projects (personal dashboards, single-tenant admin surfaces, small internal tools). The single-address registry is the smallest useful implementation and demonstrates the boolean-only shape of the contract; projects that scale past one operator write their own allow-list-file or database-lookup implementation, keeping the same interface.

package/blueprints/security-auth-magic-link/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "security-auth-magic-link",
-  "version": "1.2.4",
+  "version": "1.2.7",
   "category": "security",
   "capabilities": [
     "principalDirectory"
@@ -168,5 +168,6 @@
       "kind": "adr",
       "path": "adrs/adr-505-security-auth-magic-link-rate-limiting.json"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11T15:37:12.000Z"
 }

package/blueprints/security-auth-magic-link/contributions/probes/probe-utils.mjs

@@ -0,0 +1,174 @@
+// Shared helpers for security-auth-magic-link probes.
+//
+// Runtime-dependency posture:
+// - Local probes drive token-issue / token-verify shape on the
+//   fixture-owned magic-link manager against a deterministic clock;
+//   no network call.
+// - real-account-magic-link-send drives Resend's HTTP API
+//   (https://api.resend.com/emails, docs
+//   https://resend.com/docs/api-reference/emails/send-email
+//   verifiedOn 2026-09-11) with the vendor's documented sandbox
+//   sender `onboarding@resend.dev` and sandbox recipient
+//   `delivered@resend.dev` (per
+//   https://resend.com/docs/dashboard/emails/send-test-emails
+//   verifiedOn 2026-09-11), which routes the message to the
+//   Resend sandbox rather than a real inbox. The probe records the
+//   Resend-assigned email id and the HTTP status as positive
+//   evidence per rule 7d. Without CI_HAS_RESEND_ACCOUNT the probe
+//   honest-skips naming the missing var.
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const SLUG = 'security-auth-magic-link';
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/security-auth-magic-link');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/security-auth-magic-link');
+
+export const DECLARED_ENV = Object.freeze([
+  'CI_HAS_RESEND_ACCOUNT',
+  'RESEND_API_KEY',
+  'RESEND_API_BASE_URL',
+  'RESEND_SANDBOX_FROM',
+  'RESEND_SANDBOX_TO',
+]);
+
+export const RESEND_SANDBOX_FROM_DEFAULT = 'onboarding@resend.dev';
+export const RESEND_SANDBOX_TO_DEFAULT = 'delivered@resend.dev';
+export const RESEND_API_BASE_URL_DEFAULT = 'https://api.resend.com';
+
+// First-8-words-of-anchor helper. Each result row's `detail` starts
+// with the first eight words of the anchored AC's or REQ's
+// description text. Anchor lookup walks contributions/user-stories/
+// and contributions/requirements/ under the blueprint root and
+// caches the map on first call. Null / unknown / missing anchors
+// yield an empty prefix.
+import { readFileSync as _rf } from 'node:fs';
+import { readdirSync as _rd } from 'node:fs';
+let _anchorMap = null;
+function _loadAnchorMap() {
+  const map = new Map();
+  const dirs = [
+    { dir: resolve(PROJECT_ROOT, 'blueprints', SLUG, 'contributions', 'user-stories'), kind: 'ac' },
+    { dir: resolve(PROJECT_ROOT, 'blueprints', SLUG, 'contributions', 'requirements'), kind: 'req' },
+  ];
+  for (const { dir, kind } of dirs) {
+    let entries;
+    try { entries = _rd(dir); } catch { continue; }
+    for (const name of entries) {
+      if (!name.endsWith('.json')) continue;
+      let j;
+      try { j = JSON.parse(_rf(resolve(dir, name), 'utf8')); } catch { continue; }
+      if (kind === 'ac') {
+        const usId = j.usId;
+        for (const ac of (j.acceptanceCriteria || [])) {
+          // AC id in the shipped JSON is like "AC-9101-1"; the
+          // anchor form used by probes is "<slug>-AC-9101-1".
+          const key = `${SLUG}-${ac.id}`;
+          map.set(key, ac.description || '');
+        }
+      } else {
+        const key = j.reqId; // already "<slug>-REQ-###"
+        if (key) map.set(key, j.description || j.title || '');
+      }
+    }
+  }
+  return map;
+}
+export function first8Words(anchor) {
+  if (!anchor) return '';
+  if (!_anchorMap) _anchorMap = _loadAnchorMap();
+  const txt = _anchorMap.get(anchor) || '';
+  if (!txt) return '';
+  const words = txt.split(/\s+/).filter(Boolean).slice(0, 8).join(' ');
+  return words;
+}
+export function withAnchorPrefix(row) {
+  const prefix = first8Words(row.anchorAcId);
+  if (!prefix) return row;
+  const already = typeof row.detail === 'string' && row.detail.startsWith(prefix);
+  if (already) return row;
+  const oldDetail = row.detail || '';
+  return { ...row, detail: `${prefix} :: ${oldDetail}` };
+}
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+export function isSkipped(results) {
+  return results.length > 0 && results.every((r) => r.accountBoundSkipped === true);
+}
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  // Prefix every row's detail with the first eight words of its
+  // anchored AC or REQ description; unanchored rows are left alone.
+  const prefixedResults = (results || []).map(withAnchorPrefix);
+  const raw = aggregate(prefixedResults);
+  const aggregateVerdict = isSkipped(prefixedResults) ? 'pass' : raw;
+  const report = { slug: 'security-auth-magic-link', probeName, runAt: new Date().toISOString(), engine, results: prefixedResults, aggregateVerdict, ...(extra ?? {}) };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = await mainFn();
+    if (!outcome || !Array.isArray(outcome.results) || outcome.results.length === 0) {
+      const results = [{
+        anchorAcId: 'unknown',
+        verdict: 'fail',
+        detail: 'no checks ran',
+      }];
+      const { report, path } = await writeReport({ probeName, engine, results });
+      process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+      process.stderr.write(`no-checks-ran fail written to ${path}\n`);
+      process.exitCode = 1;
+      return;
+    }
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{ anchorAcId: 'unknown', verdict: 'fail', detail: `probe threw: ${err && err.message ? err.message : String(err)}` }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+// De-claim helper. When the shipped AC does not observe what the probe observes, the row keeps its
+// verdict, evidence and engine as they are, but the anchor drops to null and the
+// row carries conformanceOnly:true plus a limitation string naming the AC that
+// this probe does NOT observe and why. The integration-harness follow-up (the auth integration harness follow-up)
+// is the surface where those AC-level properties become observable.
+export function deClaim(row, { ac, limitation }) {
+  const acId = ac || 'unknown-AC';
+  const limText = (limitation || '').trim();
+  const finalLim = /^(security-[a-z0-9-]+-)?(AC|REQ)-/.test(limText) ? limText : (limText ? `${acId}: ${limText}` : `${acId}: not observable at this probe surface; needs the integration harness (the auth integration harness follow-up)`);
+  const out = { ...row };
+  out.anchorAcId = null;
+  if ('anchorReqId' in out) delete out.anchorReqId;
+  out.conformanceOnly = true;
+  out.limitation = finalLim;
+  const tag = ` :: conformance-only (${finalLim})`;
+  if (typeof out.detail === 'string' && !out.detail.includes('conformance-only')) {
+    out.detail = out.detail + tag;
+  }
+  return out;
+}
+
+export function accountBoundSkippedResult(anchorAcId, capability, reason) {
+  return {
+    anchorAcId, capability, verdict: 'pass',
+    accountBoundSkipped: true, reason,
+    detail: `accountBoundSkipped: ${reason} unset; probe did not execute against the live Resend API. Set the missing var and re-run.`,
+  };
+}

package/blueprints/security-auth-magic-link/contributions/probes/real-account-magic-link-send.mjs

@@ -0,0 +1,139 @@
+// Real-account magic-link send smoke. Conformance-only. The probe
+// issues a real magic-link token via the fixture manager, hands the
+// resulting message to the fixture's `email-delivery-adapter` whose
+// default binding is Resend, and verifies the issued token locally.
+// The probe observes what the adapter returned and what the fixture
+// manager did; it does not observe the shipped ACs on the project's
+// routes and managers, and the row records that limit alongside the
+// raw adapter evidence it did capture.
+//
+// Positive evidence per rule 7d that is preserved on the row: the
+// Resend-assigned `providerMessageId` returned by the adapter
+// (created-resource id), the adapter's `providerStatus` HTTP code,
+// and the `requestId` header the adapter captures. All three are
+// read off the adapter's return, not off a direct vendor call.
+//
+// capability: principalDirectory.
+// engine: resend (live) or skip:CI_HAS_RESEND_ACCOUNT.
+// accountBound: true.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+ DECLARED_ENV, accountBoundSkippedResult,
+ RESEND_SANDBOX_FROM_DEFAULT, RESEND_SANDBOX_TO_DEFAULT, RESEND_API_BASE_URL_DEFAULT,
+} from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-magic-link', 'src');
+
+export const anchorAcId = null;
+export const capability = 'principalDirectory';
+export const accountBound = true;
+// AC-3110-1 binds the routes-and-managers side of the
+// email-delivery-adapter contract: only the declared send method,
+// only the declared arguments, only the declared fields consumed.
+// This probe drives the adapter directly from a probe process, so
+// it cannot observe the routes-and-managers property; the row
+// records that limit next to the adapter-return evidence it did
+// capture.
+const DECLAIM_LIMITATION = 'security-auth-magic-link-AC-3110-1: probe drives the email-delivery-adapter directly from a probe process; the AC states the project routes and managers invoke only the declared adapter method with only the declared arguments and consume only the declared fields, which requires observing the deployed runtime through the integration harness follow-up.';
+
+function gateResult(varName, value) {
+ if (value === undefined || value === '') return { kind: 'unset', reason: varName };
+ if (value !== 'true') return { kind: 'set-not-true', reason: `${varName}_SET_NOT_TRUE`, observedValue: value };
+ return { kind: 'true' };
+}
+
+export default async function runProbe() {
+ const gate = gateResult('CI_HAS_RESEND_ACCOUNT', process.env.CI_HAS_RESEND_ACCOUNT);
+ if (gate.kind === 'unset') {
+ return {
+ results: [accountBoundSkippedResult(null, capability, 'CI_HAS_RESEND_ACCOUNT')],
+ extra: { accountBoundSkipped: true, reason: 'CI_HAS_RESEND_ACCOUNT', envDeclared: [...DECLARED_ENV] },
+ };
+ }
+ if (gate.kind === 'set-not-true') {
+ return {
+ results: [{
+ anchorAcId: null, capability, verdict: 'fail',
+ conformanceOnly: true, limitation: DECLAIM_LIMITATION,
+ detail: `conformance-only gate: CI_HAS_RESEND_ACCOUNT is set to "${gate.observedValue}" (not the string "true"). Gate refuses this shape; set the variable to the exact string "true" to run the live branch.`,
+ evidence: { gate: 'CI_HAS_RESEND_ACCOUNT', observedValue: gate.observedValue, expected: 'true' },
+ }],
+ extra: { gateMisconfigured: true, gate: 'CI_HAS_RESEND_ACCOUNT', envDeclared: [...DECLARED_ENV] },
+ };
+ }
+ if (!process.env.RESEND_API_KEY) {
+ return {
+ results: [accountBoundSkippedResult(null, capability, 'RESEND_API_KEY')],
+ extra: { accountBoundSkipped: true, reason: 'RESEND_API_KEY', envDeclared: [...DECLARED_ENV] },
+ };
+ }
+
+ const baseUrl = process.env.RESEND_API_BASE_URL || RESEND_API_BASE_URL_DEFAULT;
+ const from = process.env.RESEND_SANDBOX_FROM || RESEND_SANDBOX_FROM_DEFAULT;
+ const to = process.env.RESEND_SANDBOX_TO || RESEND_SANDBOX_TO_DEFAULT;
+
+ const evidence = { envDeclared: [...DECLARED_ENV], baseUrl, from, to };
+ const resultRow = { anchorAcId: null, conformanceOnly: true, limitation: DECLAIM_LIMITATION, capability, verdict: 'fail', detail: '', evidence: {} };
+
+ try {
+ const { createMagicLinkManager } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'magic-link-manager.mjs')).href);
+ const { createResendAdapter } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'email-delivery-adapter.mjs')).href);
+
+ const mgr = createMagicLinkManager({ ttlSeconds: 900 });
+ const issued = await mgr.issue({ emailAddress: to });
+ const magicLink = `https://app.example.com/auth/magic?token=${encodeURIComponent(issued.token)}`;
+
+ const adapter = createResendAdapter({ apiKey: process.env.RESEND_API_KEY, baseUrl, from });
+ const outcome = await adapter.send({
+ to,
+ subject: 'Sign-in link',
+ textBody: `Sign in to your account by opening this magic link: ${magicLink}\n\nIf you did not request this, ignore this email.`,
+ });
+
+ const verified = await mgr.verify({ token: issued.token, emailAddress: to });
+
+ const declaredKeys = ['ok', 'providerStatus', 'providerMessageId', 'error'];
+ const outcomeKeys = Object.keys(outcome).sort();
+ const extraKeys = outcomeKeys.filter((k) => !declaredKeys.includes(k));
+ const missingKeys = declaredKeys.filter((k) => !(k in outcome));
+ const shapeOk = extraKeys.every((k) => k === 'requestId') && missingKeys.length === 0;
+ const adapterOk = outcome && outcome.ok === true && typeof outcome.providerMessageId === 'string' && outcome.providerMessageId.length > 0 && typeof outcome.providerStatus === 'number';
+ const verifyOk = verified.ok;
+
+ if (adapterOk && shapeOk && verifyOk) {
+ resultRow.verdict = 'pass';
+ resultRow.detail =
+ `Resend adapter return observed at the probe boundary: ` +
+ `outcome.ok=true providerMessageId=${outcome.providerMessageId} providerStatus=${outcome.providerStatus} ` +
+ `(requestId=${outcome.requestId || 'n/a'}); fixture magic-link manager verify consumed the token single-use and returned ok=true.`;
+ resultRow.evidence = {
+ providerMessageId: outcome.providerMessageId,
+ providerStatus: outcome.providerStatus,
+ requestId: outcome.requestId || null,
+ adapterKind: adapter.kind,
+ outcomeKeys,
+ outcomeShapeOk: shapeOk,
+ from, to,
+ localVerifyOk: true,
+ localTokenLen: issued.token.length,
+ };
+ Object.assign(evidence, {
+ providerMessageId: outcome.providerMessageId,
+ providerStatus: outcome.providerStatus,
+ requestId: outcome.requestId || null,
+ });
+ } else {
+ resultRow.detail = `adapter return did not match the declared shape: outcome.ok=${outcome && outcome.ok} shapeOk=${shapeOk} extraKeys=${JSON.stringify(extraKeys)} providerMessageId=${outcome && outcome.providerMessageId} providerStatus=${outcome && outcome.providerStatus} error=${outcome && outcome.error} verifyOk=${verifyOk}`;
+ resultRow.evidence = { outcome, outcomeKeys, shapeOk, verifyOk };
+ }
+ } catch (err) {
+ resultRow.detail = `probe threw: ${err && err.message ? err.message : String(err)}`;
+ resultRow.evidence = { threw: err && err.message ? err.message : String(err) };
+ evidence.threw = err && err.message ? err.message : String(err);
+ }
+ return { results: [resultRow], extra: evidence };
+}

package/blueprints/security-auth-magic-link/contributions/probes/run-real-account-magic-link-send.mjs

@@ -0,0 +1,4 @@
+import runProbe from './real-account-magic-link-send.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'resend', image: 'live Resend HTTP API (sandbox sender + sandbox recipient) (or skipped)', healthy: true };
+runShim('real-account-magic-link-send', engine, runProbe);

package/blueprints/security-auth-magic-link/contributions/probes/run-token-entropy-shape.mjs

@@ -0,0 +1,4 @@
+import runProbe from './token-entropy-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'fixture magic-link-manager entropy sweep (local)', healthy: true };
+runShim('token-entropy-shape', engine, runProbe);

package/blueprints/security-auth-magic-link/contributions/probes/run-token-issue-verify.mjs

@@ -0,0 +1,4 @@
+import runProbe from './token-issue-verify.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'fixture magic-link-manager (deterministic clock)', healthy: true };
+runShim('token-issue-verify', engine, runProbe);