rcf-lite 0.27.0 → 0.28.0

package/blueprints/security-auth-magic-link/contributions/probes/token-entropy-shape.mjs

@@ -0,0 +1,60 @@
+// Magic-link TOKEN entropy shape probe. Conformance-only. Every row
+// records anchorAcId=null with a limitation naming the shipped AC
+// whose route-level token property the fixture-manager sample does
+// not observe. The integration harness follow-up is the surface
+// where the AC-level properties become observable.
+//
+// capability: principalDirectory. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-magic-link', 'src');
+
+export const anchorAcId = null;
+export const capability = 'principalDirectory';
+export const accountBound = false;
+
+const LIM = 'security-auth-magic-link-AC-3102-1: probe samples fixture-manager tokens for uniqueness and base64url shape at the manager layer; the AC states GET /login/verify consumes each token exactly once, which requires observing the deployed route through the integration harness follow-up.';
+
+export default async function runProbe() {
+  const { createMagicLinkManager } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'magic-link-manager.mjs')).href);
+  const mgr = createMagicLinkManager({ ttlSeconds: 900 });
+  const tokens = new Set();
+  const N = 1_000;
+  const shapeBad = [];
+  const jwtShaped = [];
+  for (let i = 0; i < N; i++) {
+    const { token } = await mgr.issue({ emailAddress: `u${i}@example.com` });
+    tokens.add(token);
+    if (!/^[A-Za-z0-9_-]+$/.test(token) || token.length < 32) {
+      if (shapeBad.length < 3) shapeBad.push({ len: token.length, sample: token.slice(0, 6) });
+    }
+    if (token.includes('.')) {
+      if (jwtShaped.length < 3) jwtShaped.push({ sample: token.slice(0, 12) });
+    }
+  }
+  const results = [];
+  results.push(deClaim({
+    capability,
+    verdict: tokens.size === N ? 'pass' : 'fail',
+    detail: `distinct-token sample across ${N} issues: unique=${tokens.size}`,
+    evidence: { uniqueCount: tokens.size, requested: N },
+  }, { ac: 'security-auth-magic-link-AC-3102-1', limitation: LIM }));
+  results.push(deClaim({
+    capability,
+    verdict: shapeBad.length === 0 ? 'pass' : 'fail',
+    detail: `base64url shape sweep at token layer: violations=${JSON.stringify(shapeBad)}`,
+    evidence: { shapeBadSample: shapeBad, sampledN: N },
+  }, { ac: 'security-auth-magic-link-AC-3102-1', limitation: LIM }));
+  results.push(deClaim({
+    capability,
+    verdict: jwtShaped.length === 0 ? 'pass' : 'fail',
+    detail: `JWT-delimiter absence sweep at token layer: violations=${JSON.stringify(jwtShaped)}`,
+    evidence: { jwtShapedSample: jwtShaped, sampledN: N },
+  }, { ac: 'security-auth-magic-link-AC-3102-1', limitation: LIM }));
+  return { results, extra: {} };
+}

package/blueprints/security-auth-magic-link/contributions/probes/token-issue-verify.mjs

@@ -0,0 +1,90 @@
+// Magic-link token issue+verify shape probe. Conformance-only.
+// Every row records anchorAcId=null with a limitation naming the
+// nearest shipped AC whose GET /login/verify runtime property the
+// probe does not observe. The probe drives the fixture manager
+// directly and does not observe the deployed HTTP surface; the
+// integration harness follow-up is where the AC-level properties
+// become observable.
+//
+// capability: principalDirectory. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-magic-link', 'src');
+
+export const anchorAcId = null;
+export const capability = 'principalDirectory';
+export const accountBound = false;
+
+const LIM_TTL = 'security-auth-magic-link-AC-3102-3: probe checks the config constant on the fixture manager; the AC states the recorded expiresAt is fifteen minutes after the mint clock on issued tokens, which requires observing the deployed manager through the integration harness follow-up.';
+const LIM_ISSUE = 'security-auth-magic-link-AC-3102-1: probe calls the fixture manager.issue directly; the AC states GET /login/verify consumes each token exactly once with no session issued on a second call, which requires observing the deployed route through the integration harness follow-up.';
+const LIM_EMAIL = 'security-auth-magic-link-AC-3102-1: probe calls the fixture manager.verify with a wrong email; the AC states GET /login/verify consumes each token exactly once and returns 401 without a Set-Cookie on refusal, which requires observing the deployed route through the integration harness follow-up.';
+const LIM_HAPPY = 'security-auth-magic-link-AC-3102-1: probe calls the fixture manager.verify happy path; the AC states GET /login/verify issues the session on first use and returns 401 without a Set-Cookie on a second call, which requires observing the deployed route through the integration harness follow-up.';
+const LIM_REPLAY = 'security-auth-magic-link-AC-3102-1: probe calls the fixture manager.verify twice; the AC states GET /login/verify returns 401 with no Set-Cookie on the second call, which requires observing the deployed route through the integration harness follow-up.';
+const LIM_EXPIRED = 'security-auth-magic-link-AC-3102-2: probe calls the fixture manager.verify past expiry; the AC states GET /login/verify returns 401 with no Set-Cookie after the expiry window, which requires observing the deployed route through the integration harness follow-up.';
+
+export default async function runProbe() {
+  const { createMagicLinkManager } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'magic-link-manager.mjs')).href);
+
+  const results = [];
+  let now = 1_000_000_000_000;
+
+  const mgrDefault = createMagicLinkManager({ clock: () => now });
+  const defaultTtl = typeof mgrDefault.ttlSeconds === 'number' ? mgrDefault.ttlSeconds : mgrDefault.getTtlSeconds && mgrDefault.getTtlSeconds();
+  results.push(deClaim({
+    capability,
+    verdict: defaultTtl === 900 ? 'pass' : 'fail',
+    detail: `manager.ttlSeconds default config observation: observed=${defaultTtl}`,
+    evidence: { defaultTtlSeconds: defaultTtl, expected: 900 },
+  }, { ac: 'security-auth-magic-link-AC-3102-3', limitation: LIM_TTL }));
+
+  const mgr = createMagicLinkManager({ ttlSeconds: 900, clock: () => now });
+
+  const issued = await mgr.issue({ emailAddress: 'alice@example.com' });
+  results.push(deClaim({
+    capability,
+    verdict: issued.ok && typeof issued.token === 'string' && issued.token.length >= 32 ? 'pass' : 'fail',
+    detail: `manager.issue returned a token: ok=${issued.ok} tokenLen=${issued.token && issued.token.length} expiresAt=${issued.expiresAt}`,
+    evidence: { adapterReturn: { ok: issued.ok, tokenLen: issued.token && issued.token.length, expiresAt: issued.expiresAt } },
+  }, { ac: 'security-auth-magic-link-AC-3102-1', limitation: LIM_ISSUE }));
+
+  const wrongEmail = await mgr.verify({ token: issued.token, emailAddress: 'mallory@example.com' });
+  results.push(deClaim({
+    capability,
+    verdict: !wrongEmail.ok && /email does not match/.test(wrongEmail.error) ? 'pass' : 'fail',
+    detail: `manager.verify wrong-email refusal: ok=${wrongEmail.ok} error=${JSON.stringify(wrongEmail.error)}`,
+    evidence: { adapterReturn: wrongEmail },
+  }, { ac: 'security-auth-magic-link-AC-3102-1', limitation: LIM_EMAIL }));
+
+  const good = await mgr.verify({ token: issued.token, emailAddress: 'alice@example.com' });
+  results.push(deClaim({
+    capability,
+    verdict: good.ok && good.emailAddress === 'alice@example.com' ? 'pass' : 'fail',
+    detail: `manager.verify happy path: ok=${good.ok} emailAddress=${good.emailAddress}`,
+    evidence: { adapterReturn: good },
+  }, { ac: 'security-auth-magic-link-AC-3102-1', limitation: LIM_HAPPY }));
+
+  const replay = await mgr.verify({ token: issued.token, emailAddress: 'alice@example.com' });
+  results.push(deClaim({
+    capability,
+    verdict: !replay.ok && /already consumed/.test(replay.error) ? 'pass' : 'fail',
+    detail: `manager.verify replay refusal: ok=${replay.ok} error=${JSON.stringify(replay.error)}`,
+    evidence: { adapterReturn: replay },
+  }, { ac: 'security-auth-magic-link-AC-3102-1', limitation: LIM_REPLAY }));
+
+  const issued2 = await mgr.issue({ emailAddress: 'bob@example.com' });
+  now += 901_000;
+  const expired = await mgr.verify({ token: issued2.token, emailAddress: 'bob@example.com' });
+  results.push(deClaim({
+    capability,
+    verdict: !expired.ok && /expired/.test(expired.error) ? 'pass' : 'fail',
+    detail: `manager.verify past-expiry refusal: ok=${expired.ok} error=${JSON.stringify(expired.error)}`,
+    evidence: { adapterReturn: expired, clockAdvancedByMs: 901_000 },
+  }, { ac: 'security-auth-magic-link-AC-3102-2', limitation: LIM_EXPIRED }));
+
+  return { results, extra: {} };
+}

package/blueprints/security-auth-magic-link/docs/topics.md

@@ -14,7 +14,7 @@ Rules for new topics (inherited from the application-spa and REST vocabularies,
 
 ## Id number bands (registry bootstrap)
 
-AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is ratified policy (2026-08-19); this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
+AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is policy; this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
 
 This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
 

package/blueprints/security-auth-oauth2/CHANGELOG.md

@@ -1,8 +1,19 @@
 # security-auth-oauth2 CHANGELOG
 
-## 1.3.3
+## 1.3.6 - 2026-09-11
+
+- Criterion-e probe pack refinement: every conformance-only result row now records `anchorAcId: null` alongside a `limitation` that opens with a shipped AC id from the blueprint's user stories (the PKCE length-band row moves from `REQ-002` to `AC-10101-1`). The retained live-branch anchor on `real-account-authorisation-code-flow` (`AC-10110-2`) is unchanged and honest-skips on `CI_HAS_OAUTH2_PROVIDER`; when skipped the row records `engine: oauth2-provider`, not `engine: skip:...`. Detail strings on de-claimed rows describe only what was observed at the fixture-mock surface and no longer claim REQ-002 or an AC as observed end to end. The `real-account-authorisation-code-flow` source header now states plainly that its credential-present branch returns a `NOT IMPLEMENTED` failure record (no live commercial IdP is wired in this estate) rather than describing a real-provider round trip. The anatomy helper enforces conformance-only rows to satisfy `anchorAcId === null`, requires limitations to open with an `AC-<n>-<n>` id that resolves to a shipped acceptance criterion on the blueprint's user stories (REQ-prefixed anchors are refused and fabricated ids are rejected), and does not count pre-delete presence as an absence observation on the inventory-diff shape.
+
+## 1.3.5 - 2026-09-11
+
+- Every conformance-only anchor on the criterion-e probe pack is de-claimed to `conformanceOnly` with a limitation naming the shipped AC that is observable only in the integration harness follow-up; the retained live-branch anchor on `real-account-authorisation-code-flow` (`AC-10110-2`) is preserved and honest-skips on `CI_HAS_OAUTH2_PROVIDER`. The mock authorisation server keeps real consumed-code state; `/callback-check` reads that record and callers now observe `preExchange` from the mock's request-order records instead of asserting it as a constant. Fixture README and mock header comment describe the mock as a fixture, not a local engine, and `X-Mock-Request-Id` as a diagnostic side channel rather than a rule 7d shape.
 
-- Closure fix pass (F-4): rewrites the `README.md` shelf-latest line in neutral customer-facing voice with no spec-provenance label.
+## 1.3.4 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering the six declared capabilities via five probes: `pkce-challenge-shape` and `authorisation-code-flow-shape` (authorisationCodeFlow via a local mock RFC 6749 + RFC 7636 server on ports 47400-47449), `provider-adapter-shape` (principalDirectory + credentialSelfService), `session-bridge-shape` (sessionInventory + hostedIdentityUi), and `real-account-authorisation-code-flow` (LIVE; honest-skips on `CI_HAS_OAUTH2_PROVIDER` since this estate has no live commercial IdP). Fixture at `packages/rcf-lite/test/fixtures/security-auth-oauth2/` declares every env var the pack reads; anatomy test at `packages/rcf-lite/test/blueprint/security-auth-oauth2-anatomy.test.js` pins pack shape, fixture manifest completeness and the account-bound skip contract.
+- Iteration on the probe pack labelled every local-mock row `engine: fixture`, adjusted `authorisation-code-flow-shape` so the callback-refusal row observes a consumed authorisation code before any second `/token` request, and settled `aggregate([])` / null-result normalisation to `detail: 'no checks ran'` exactly. `real-account-authorisation-code-flow` honest-skips on `CI_HAS_OAUTH2_PROVIDER`; when skipped the record's `engine.kind` remains `oauth2-provider`. Slug reads AMBER on criterion e.
+
+## 1.3.3
 
 ## 1.3.2
 
@@ -12,10 +23,10 @@
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 1.3.0 (hardening pass, spec 2026-09-09 section 5.4.2)
+## 1.3.0 (2026-09-09)
 
-- Adds `REQ-011`/`US-10112` (roleModel: provider-record `roleSources[]`, malformed-claim refusal, enrichPrincipal hook), `REQ-012`/`US-10113` (credentialSelfService: provider-record `accountUrl`, boot-time validation, `getCredentialSelfServiceUrl` helper), `REQ-013`/`US-10114` (sessionInventory: list, revoke-one, revoke-all-except-current, unauthenticated refusal, unknown-session refusal). Extends `TAC-1102` with the `accountUrl` validation responsibility and `TAC-1103` with the roles-population and sessionInventory responsibilities. Adds `deliveredBy` on every `must` requirement and `disposition` on every existing acceptance criterion; adds `ownerRef` on ACs that observe the shared `sessionInventory` interface at owner id `TAC-1003-security-auth-clerk-session-verifier`. Names the `principalDirectory` and `hostedIdentityUi` capabilities on the requirements that carry their runtime clauses. Fixes the pass-1 `OAuth2-only` casing drift on `REQ-008` against `TAC-1102`'s canonical `oauth2-only`. hardening pass (criteria a, b, c on the 2026-09-09 programme).
-- Review fix pass (PR #188 findings): adds `authorisationCodeFlow` to `capabilities[]` and names the token verbatim in `REQ-001` with story references (`US-10101` plus refusal siblings), so a machine-readable composition token backs the flow that keycloak now gates on; rewrites `US-10114` `AC-1` to reference the `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` `SessionRow` shape rather than restating its fields.
+- Adds `REQ-011`/`US-10112` (roleModel: provider-record `roleSources[]`, malformed-claim refusal, enrichPrincipal hook), `REQ-012`/`US-10113` (credentialSelfService: provider-record `accountUrl`, boot-time validation, `getCredentialSelfServiceUrl` helper), `REQ-013`/`US-10114` (sessionInventory: list, revoke-one, revoke-all-except-current, unauthenticated refusal, unknown-session refusal). Extends `TAC-1102` with the `accountUrl` validation responsibility and `TAC-1103` with the roles-population and sessionInventory responsibilities. Adds `deliveredBy` on every `must` requirement and `disposition` on every existing acceptance criterion; adds `ownerRef` on ACs that observe the shared `sessionInventory` interface at owner id `TAC-1003-security-auth-clerk-session-verifier`. Names the `principalDirectory` and `hostedIdentityUi` capabilities on the requirements that carry their runtime clauses. REQ-008 uses the canonical `oauth2-only` casing that matches `TAC-1102`.
+- Adds `authorisationCodeFlow` to `capabilities[]` and names the token verbatim in `REQ-001` with story references (`US-10101` plus refusal siblings), so a machine-readable composition token backs the flow that keycloak now gates on; rewrites `US-10114` `AC-1` to reference the `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` `SessionRow` shape rather than restating its fields.
 
 ## 1.2.0 (visual round, spec 2026-09-06 section 5.4.2, operator Q2 default)
 

package/blueprints/security-auth-oauth2/README.md

@@ -32,9 +32,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the OAuth2 authorisation-code + PKCE flow, the provider-abstraction contract, the CSRF-via-state discipline, the id_token verification path, the session-bridge shape, the refresh-token rotation posture, the sign-out semantics, the multi-provider routing, the accountBound runtime-verify posture); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the OAuth2 authorisation-code + PKCE flow, the provider-abstraction contract, the CSRF-via-state discipline, the id_token verification path, the session-bridge shape, the refresh-token rotation posture, the sign-out semantics, the multi-provider routing, the accountBound runtime-verify posture); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 Deliberately not contributed: a specific OAuth2 or OIDC library dependency (Node has several; project chooses); the mock OIDC provider's binary or a full runtime dependency (the blueprint commits the shape a project stands one up against; the tool itself lives on the project); MFA specifics (the IdP owns MFA at the hosted surface; the blueprint delegates); vendor-specific quirks (Google's `hd` claim, GitHub's per-org enforcement, Microsoft's tenant scoping); a specific session store (the session-bridge injects it; in-memory in the reference wiring, table-backed on a persistence-composed project); real IdP client credentials, real tenant identifiers, real callback URLs (placeholders only); a Clerk-webhook consumer (out of scope for OAuth2-generic; the Clerk sibling owns that territory); a Keycloak realm configuration (out of scope; the Keycloak sibling when it ships owns that territory).
 

package/blueprints/security-auth-oauth2/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "security-auth-oauth2",
-  "version": "1.3.3",
+  "version": "1.3.6",
   "category": "security",
   "capabilities": [
     "principalDirectory",
@@ -198,5 +198,6 @@
       "kind": "us",
       "path": "user-stories/security-auth-oauth2-us-10114.json"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11T15:37:12.000Z"
 }

package/blueprints/security-auth-oauth2/contributions/probes/authorisation-code-flow-shape.mjs

@@ -0,0 +1,259 @@
+// Local wire-shape probe for the security-auth-oauth2 authorisation
+// code flow. Boots the fixture's local mock authorisation server
+// (a hand-rolled RFC 6749 / RFC 7636 stub) on a port in the security
+// family's declared 47400-47449 range and drives the full code flow
+// against it end to end. The mock is a fixture, not a live IdP;
+// every row records anchorAcId=null with a limitation naming the
+// shipped AC whose route-level property the fixture-layer
+// observation does not exercise. preExchange is OBSERVED from the
+// mock's requestNo record ordering (callback runs before /token only
+// if the token exchange has not consumed the code yet), not
+// asserted as a constant.
+//
+// capability: authorisationCodeFlow. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { randomBytes } from 'node:crypto';
+import { MOCK_PORT_RANGE, deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-oauth2', 'src');
+
+export const anchorAcId = null;
+export const capability = 'authorisationCodeFlow';
+export const accountBound = false;
+
+const LIM_AUTHZ = 'security-auth-oauth2-AC-10101-1: probe calls /authorize on a local mock; the AC states the project sign-in route drives a live IdP through a real browser, needs the integration harness (the auth integration harness follow-up).';
+const LIM_TOKEN = 'security-auth-oauth2-AC-10101-2: probe calls /token on a local mock; the AC states the project session issues on a real IdP exchange, needs the integration harness (the auth integration harness follow-up).';
+const LIM_REPLAY = 'security-auth-oauth2-AC-10102-2: probe observes the mock callback-tier refusing a consumed code; the AC states the project callback controller refuses without issuing a session, needs the integration harness (the auth integration harness follow-up).';
+const LIM_PKCE = 'security-auth-oauth2-AC-10103-2: probe observes the mock /token refusing a tampered verifier; the AC states the project sign-in flow terminates without issuing a session, needs the integration harness (the auth integration harness follow-up).';
+
+function pickPort() {
+  const override = Number(process.env.OAUTH2_MOCK_PORT);
+  if (Number.isFinite(override) && override >= MOCK_PORT_RANGE.min && override <= MOCK_PORT_RANGE.max) return override;
+  return MOCK_PORT_RANGE.min + Math.floor(Math.random() * (MOCK_PORT_RANGE.max - MOCK_PORT_RANGE.min + 1));
+}
+
+function freshState() {
+  return `st_${randomBytes(12).toString('base64url')}`;
+}
+
+export default async function runProbe() {
+  const { createMockAuthServer, generatePkcePair } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'mock-authorization-server.mjs')).href);
+  const port = pickPort();
+  const clientId = 'mock-client';
+  const redirectUri = 'http://127.0.0.1:47499/callback';
+  const server = createMockAuthServer({ port, clientId, redirectUri, oidc: true });
+  const evidence = { port, clientId, redirectUri, oidc: true, calls: [], observedStates: [] };
+  const results = [];
+  let teardownFailed = false;
+
+  try {
+    await server.start();
+    const pkce = generatePkcePair();
+
+    // 1. /authorize
+    const state1 = freshState();
+    evidence.observedStates.push(state1);
+    const authUrl = new URL(`http://127.0.0.1:${port}/authorize`);
+    authUrl.searchParams.set('response_type', 'code');
+    authUrl.searchParams.set('client_id', clientId);
+    authUrl.searchParams.set('redirect_uri', redirectUri);
+    authUrl.searchParams.set('code_challenge', pkce.challenge);
+    authUrl.searchParams.set('code_challenge_method', 'S256');
+    authUrl.searchParams.set('state', state1);
+    authUrl.searchParams.set('nonce', `n_${randomBytes(8).toString('base64url')}`);
+    const authRes = await fetch(authUrl, { redirect: 'manual' });
+    const authRequestId = authRes.headers.get('x-mock-request-id');
+    const authText = await authRes.text();
+    let authPayload = null; try { authPayload = JSON.parse(authText); } catch {}
+    const codeFromRes = authPayload && authPayload.code;
+    evidence.calls.push({ verb: 'GET /authorize (1)', status: authRes.status, requestId: authRequestId, resourceId: codeFromRes, state: state1 });
+
+    if (!(authRes.status === 302 && codeFromRes)) {
+      results.push(deClaim({
+        capability, verdict: 'fail',
+        detail: `/authorize failed: status=${authRes.status} requestId=${authRequestId} bodyExcerpt=${authText.slice(0, 200)}`,
+        evidence: { requestId: authRequestId, status: authRes.status, bodyExcerpt: authText.slice(0, 200) },
+      }, { ac: 'security-auth-oauth2-AC-10101-1', limitation: LIM_AUTHZ }));
+      return { results, extra: evidence };
+    }
+    results.push(deClaim({
+      capability,
+      verdict: 'pass',
+      detail: `/authorize redirected with S256 code_challenge and distinct state; status=${authRes.status} requestId=${authRequestId} state=${state1}`,
+      evidence: { requestId: authRequestId, status: authRes.status, state: state1, codeIssued: codeFromRes, codeChallengeMethod: 'S256' },
+    }, { ac: 'security-auth-oauth2-AC-10101-1', limitation: LIM_AUTHZ }));
+
+    // 2. /callback-check BEFORE any /token exchange , preExchange observed
+    // from the mock's consumedCodes record: if the code is not yet in
+    // consumedCodes, the callback runs pre-exchange.
+    const preCallbackUrl = new URL(`http://127.0.0.1:${port}/callback-check`);
+    preCallbackUrl.searchParams.set('code', codeFromRes);
+    preCallbackUrl.searchParams.set('state', state1);
+    const preCallbackRes = await fetch(preCallbackUrl);
+    const preCallbackRequestId = preCallbackRes.headers.get('x-mock-request-id');
+    const preCallbackText = await preCallbackRes.text();
+    let preCallbackPayload = null; try { preCallbackPayload = JSON.parse(preCallbackText); } catch {}
+    const preExchangeObservedTokenCallsAtCallback = server.tokenCallCount;
+    evidence.calls.push({
+      verb: 'GET /callback-check (pre-token, fresh code)',
+      status: preCallbackRes.status, requestId: preCallbackRequestId,
+      body: preCallbackPayload,
+      observedTokenCallsAtThisPoint: preExchangeObservedTokenCallsAtCallback,
+    });
+
+    // 3. /token
+    const tokenBody = new URLSearchParams({
+      grant_type: 'authorization_code',
+      code: codeFromRes,
+      redirect_uri: redirectUri,
+      client_id: clientId,
+      code_verifier: pkce.verifier,
+    });
+    const tokenRes = await fetch(`http://127.0.0.1:${port}/token`, {
+      method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: tokenBody.toString(),
+    });
+    const tokenRequestId = tokenRes.headers.get('x-mock-request-id');
+    const tokenText = await tokenRes.text();
+    let tokenPayload = null; try { tokenPayload = JSON.parse(tokenText); } catch {}
+    const idTokenShape = tokenPayload && typeof tokenPayload.id_token === 'string'
+      && tokenPayload.id_token.split('.').length === 3;
+    evidence.calls.push({
+      verb: 'POST /token (valid, OIDC)',
+      status: tokenRes.status,
+      requestId: tokenRequestId,
+      accessTokenPresent: Boolean(tokenPayload && tokenPayload.access_token),
+      idTokenPresent: Boolean(tokenPayload && tokenPayload.id_token),
+      idTokenSegments: tokenPayload && tokenPayload.id_token ? tokenPayload.id_token.split('.').length : 0,
+      tokenType: tokenPayload && tokenPayload.token_type,
+    });
+    const tokenOk = tokenRes.status === 200
+      && tokenPayload
+      && typeof tokenPayload.access_token === 'string'
+      && tokenPayload.token_type === 'Bearer'
+      && idTokenShape;
+    results.push(deClaim({
+      capability,
+      verdict: tokenOk ? 'pass' : 'fail',
+      detail: tokenOk
+        ? `/token returned access_token AND id_token: status=200 requestId=${tokenRequestId} segments=3`
+        : `/token failure: status=${tokenRes.status} requestId=${tokenRequestId}`,
+      evidence: {
+        requestId: tokenRequestId,
+        status: tokenRes.status,
+        accessTokenPresent: Boolean(tokenPayload && tokenPayload.access_token),
+        idTokenPresent: Boolean(tokenPayload && tokenPayload.id_token),
+        idTokenSegments: tokenPayload && tokenPayload.id_token ? tokenPayload.id_token.split('.').length : 0,
+        tokenType: tokenPayload && tokenPayload.token_type,
+      },
+    }, { ac: 'security-auth-oauth2-AC-10101-2', limitation: LIM_TOKEN }));
+
+    // 4. /callback-check AFTER /token , code now in consumedCodes.
+    // The refusal is observed from the mock's records; preExchange
+    // for THIS second callback is false (observed, not asserted).
+    const postCallbackUrl = new URL(`http://127.0.0.1:${port}/callback-check`);
+    postCallbackUrl.searchParams.set('code', codeFromRes);
+    postCallbackUrl.searchParams.set('state', state1);
+    const postCallbackRes = await fetch(postCallbackUrl);
+    const postCallbackRequestId = postCallbackRes.headers.get('x-mock-request-id');
+    const postCallbackText = await postCallbackRes.text();
+    let postCallbackPayload = null; try { postCallbackPayload = JSON.parse(postCallbackText); } catch {}
+    const tokenCallCountAtPostCallback = server.tokenCallCount;
+    // Observed preExchange for the FIRST (pre-token) callback: token
+    // calls at that point were 0. The mock's consumedCodes for the
+    // code was empty when the first callback ran.
+    const preExchangeObserved = preExchangeObservedTokenCallsAtCallback === 0
+      && preCallbackPayload && preCallbackPayload.ok === true;
+    // Observed refusal for the SECOND (post-token) callback: code
+    // now recorded as consumed in the mock's consumedCodes map
+    // with consumedAtRequestNo < thisRequestNo.
+    const consumed = server.consumedCodes.get(codeFromRes);
+    const consumedRefusalObserved = postCallbackRes.status >= 400
+      && postCallbackPayload
+      && postCallbackPayload.error === 'invalid_grant'
+      && consumed
+      && typeof consumed.consumedAtRequestNo === 'number';
+    evidence.calls.push({
+      verb: 'GET /callback-check (post-token, consumed code)',
+      status: postCallbackRes.status, requestId: postCallbackRequestId,
+      body: postCallbackPayload,
+      consumedRecord: consumed || null,
+      tokenCallCountAtThisPoint: tokenCallCountAtPostCallback,
+    });
+    results.push(deClaim({
+      capability,
+      verdict: preExchangeObserved && consumedRefusalObserved ? 'pass' : 'fail',
+      detail: `callback-check: pre-token=${preCallbackRes.status} (tokenCalls=${preExchangeObservedTokenCallsAtCallback}, ok=${preCallbackPayload && preCallbackPayload.ok}); post-token=${postCallbackRes.status} error=${postCallbackPayload && postCallbackPayload.error} consumedAtRequestNo=${consumed && consumed.consumedAtRequestNo}`,
+      evidence: {
+        requestId: postCallbackRequestId,
+        status: postCallbackRes.status,
+        error: postCallbackPayload && postCallbackPayload.error,
+        preExchangeObserved,
+        preExchangeTokenCallCount: preExchangeObservedTokenCallsAtCallback,
+        consumedAtRequestNo: consumed && consumed.consumedAtRequestNo,
+        tokenCallCountAtPostCallback,
+      },
+      vendorCitation: { url: 'https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2', verifiedOn: '2026-09-11' },
+    }, { ac: 'security-auth-oauth2-AC-10102-2', limitation: LIM_REPLAY }));
+
+    // 5. PKCE-verifier mismatch (fresh code, tampered verifier)
+    const state2 = freshState();
+    evidence.observedStates.push(state2);
+    const authUrl2 = new URL(`http://127.0.0.1:${port}/authorize`);
+    for (const [k, v] of authUrl.searchParams) authUrl2.searchParams.set(k, v);
+    authUrl2.searchParams.set('state', state2);
+    authUrl2.searchParams.set('nonce', `n_${randomBytes(8).toString('base64url')}`);
+    const authRes2 = await fetch(authUrl2, { redirect: 'manual' });
+    const authRequestId2 = authRes2.headers.get('x-mock-request-id');
+    const authText2 = await authRes2.text();
+    let authPayload2 = null; try { authPayload2 = JSON.parse(authText2); } catch {}
+    evidence.calls.push({ verb: 'GET /authorize (2)', status: authRes2.status, requestId: authRequestId2, resourceId: authPayload2 && authPayload2.code, state: state2 });
+    if (!(authRes2.status === 302 && authPayload2 && authPayload2.code)) {
+      results.push(deClaim({
+        capability, verdict: 'fail',
+        detail: `precondition /authorize did not issue a code: status=${authRes2.status} requestId=${authRequestId2}`,
+        evidence: { requestId: authRequestId2, status: authRes2.status },
+      }, { ac: 'security-auth-oauth2-AC-10103-2', limitation: LIM_PKCE }));
+    } else {
+      const tamperBody = new URLSearchParams({
+        grant_type: 'authorization_code',
+        code: authPayload2.code,
+        redirect_uri: redirectUri,
+        client_id: clientId,
+        code_verifier: pkce.verifier + 'X',
+      });
+      const tamperRes = await fetch(`http://127.0.0.1:${port}/token`, {
+        method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: tamperBody.toString(),
+      });
+      const tamperRequestId = tamperRes.headers.get('x-mock-request-id');
+      const tamperText = await tamperRes.text();
+      let tamperPayload = null; try { tamperPayload = JSON.parse(tamperText); } catch {}
+      evidence.calls.push({ verb: 'POST /token (PKCE mismatch)', status: tamperRes.status, requestId: tamperRequestId, error: tamperPayload && tamperPayload.error });
+      results.push(deClaim({
+        capability,
+        verdict: tamperRes.status === 400 && tamperPayload && tamperPayload.error === 'invalid_grant' ? 'pass' : 'fail',
+        detail: `verifier mismatch refused: status=${tamperRes.status} requestId=${tamperRequestId} error=${tamperPayload && tamperPayload.error}`,
+        evidence: { requestId: tamperRequestId, status: tamperRes.status, error: tamperPayload && tamperPayload.error, detail: tamperPayload && tamperPayload.detail },
+        vendorCitation: { url: 'https://datatracker.ietf.org/doc/html/rfc7636#section-4.6', verifiedOn: '2026-09-11' },
+      }, { ac: 'security-auth-oauth2-AC-10103-2', limitation: LIM_PKCE }));
+    }
+
+  } finally {
+    try {
+      await server.stop();
+    } catch (err) {
+      teardownFailed = true;
+      results.push(deClaim({
+        capability, verdict: 'fail',
+        detail: `TEARDOWN FAILED: mock server stop threw: ${err && err.message ? err.message : String(err)}`,
+        evidence: { teardownError: err && err.message ? err.message : String(err) },
+      }, { ac: 'security-auth-oauth2-AC-10101-1', limitation: LIM_AUTHZ }));
+      evidence.teardownError = err && err.message ? err.message : String(err);
+    }
+  }
+  evidence.teardownFailed = teardownFailed;
+  return { results, extra: evidence };
+}

package/blueprints/security-auth-oauth2/contributions/probes/pkce-challenge-shape.mjs

@@ -0,0 +1,58 @@
+// PKCE challenge-and-verify shape probe. Conformance-only. Every
+// row records anchorAcId=null with a limitation naming the shipped
+// AC whose route-level flow property the local helper derivation
+// does not observe. The integration harness follow-up is the
+// surface where the AC-level properties become observable.
+//
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createHash } from 'node:crypto';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-oauth2', 'src');
+
+export const anchorAcId = null;
+export const capability = 'authorisationCodeFlow';
+export const accountBound = false;
+
+const LIM_HAPPY = 'security-auth-oauth2-AC-10101-1: probe checks S256 derivation only; the AC states the project sign-in route redirects to the provider /authorize with a valid code_challenge, needs the integration harness (the auth integration harness follow-up).';
+const LIM_MISMATCH = 'security-auth-oauth2-AC-10103-2: probe observes verifier-hash divergence only; the AC states invalid_grant at /token, flow termination, and absence of session issue, needs the integration harness (the auth integration harness follow-up).';
+const LIM_LEN = 'security-auth-oauth2-AC-10101-1: probe checks the local verifier length band against RFC 7636 sec 4.1; the AC states the project sign-in route redirects to the provider /authorize with a valid code_challenge, which requires observing the deployed route through the integration harness follow-up.';
+
+export default async function runProbe() {
+  const { generatePkcePair } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'mock-authorization-server.mjs')).href);
+  const results = [];
+
+  const pair = generatePkcePair();
+  const derived = createHash('sha256').update(pair.verifier).digest('base64url');
+  const nonEmptyChallenge = typeof pair.challenge === 'string' && pair.challenge.length > 0;
+  results.push(deClaim({
+    capability,
+    verdict: derived === pair.challenge && pair.method === 'S256' && nonEmptyChallenge ? 'pass' : 'fail',
+    detail: `code_challenge_method=${pair.method} code_challenge non-empty=${nonEmptyChallenge} derived==challenge=${derived === pair.challenge}`,
+    evidence: { verifierLength: pair.verifier.length, challengePreviewFirst8: pair.challenge.slice(0, 8), method: pair.method, derivationMatched: derived === pair.challenge },
+  }, { ac: 'security-auth-oauth2-AC-10101-1', limitation: LIM_HAPPY }));
+
+  const mutatedVerifier = pair.verifier + 'X';
+  const mutatedDerived = createHash('sha256').update(mutatedVerifier).digest('base64url');
+  results.push(deClaim({
+    capability,
+    verdict: mutatedDerived !== pair.challenge ? 'pass' : 'fail',
+    detail: `verifier-mutation derivation diverges from original: collided=${mutatedDerived === pair.challenge}`,
+    evidence: { mutation: 'verifier+X', collidedWithOriginal: mutatedDerived === pair.challenge },
+  }, { ac: 'security-auth-oauth2-AC-10103-2', limitation: LIM_MISMATCH }));
+
+  const okLen = pair.verifier.length >= 43 && pair.verifier.length <= 128;
+  results.push(deClaim({
+    capability,
+    verdict: okLen ? 'pass' : 'fail',
+    detail: `RFC 7636 sec 4.1 verifier length in [43,128]: observed=${pair.verifier.length}.`,
+    evidence: { verifierLength: pair.verifier.length, min: 43, max: 128 },
+    vendorCitation: { url: 'https://datatracker.ietf.org/doc/html/rfc7636#section-4.1', verifiedOn: '2026-09-11' },
+  }, { ac: 'security-auth-oauth2-AC-10101-1', limitation: LIM_LEN }));
+
+  return { results, extra: {} };
+}