rcf-lite 0.27.0 → 0.28.0

package/blueprints/security-auth-oauth2/contributions/probes/probe-utils.mjs

@@ -0,0 +1,190 @@
+// Shared helpers for security-auth-oauth2 probes.
+//
+// Runtime-dependency posture:
+// - Local probes drive shipped-shape checks against the fixture at
+//   packages/rcf-lite/test/fixtures/security-auth-oauth2/ without
+//   contacting a real identity provider.
+// - authorisation-code-flow-shape probe boots a small local mock
+//   authorisation server on a port in the 47400-47449 range (see
+//   fixture README) and drives a full RFC 6749 + RFC 7636 PKCE code
+//   flow against it: request id, response body excerpts and the
+//   final access-token response prove the wire shape locally.
+// - real-account-authorisation-code-flow probe honest-skips on
+//   CI_HAS_OAUTH2_PROVIDER: no live commercial IdP is available in
+//   this estate. The probe records accountBoundSkipped: true naming
+//   CI_HAS_OAUTH2_PROVIDER per rule 7d; the AMBER row on the shelf
+//   review is the honest outcome.
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const SLUG = 'security-auth-oauth2';
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/security-auth-oauth2');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/security-auth-oauth2');
+
+export const DECLARED_ENV = Object.freeze([
+  'CI_HAS_OAUTH2_PROVIDER',
+  'OAUTH2_ISSUER_URL',
+  'OAUTH2_CLIENT_ID',
+  'OAUTH2_CLIENT_SECRET',
+  'OAUTH2_REDIRECT_URI',
+  'OAUTH2_MOCK_PORT',
+]);
+
+export const MOCK_PORT_RANGE = { min: 47400, max: 47449 };
+
+// First-8-words-of-anchor helper. Each result row's `detail` starts
+// with the first eight words of the anchored AC's or REQ's
+// description text. Anchor lookup walks contributions/user-stories/
+// and contributions/requirements/ under the blueprint root and
+// caches the map on first call. Null / unknown / missing anchors
+// yield an empty prefix.
+import { readFileSync as _rf } from 'node:fs';
+import { readdirSync as _rd } from 'node:fs';
+let _anchorMap = null;
+function _loadAnchorMap() {
+  const map = new Map();
+  const dirs = [
+    { dir: resolve(PROJECT_ROOT, 'blueprints', SLUG, 'contributions', 'user-stories'), kind: 'ac' },
+    { dir: resolve(PROJECT_ROOT, 'blueprints', SLUG, 'contributions', 'requirements'), kind: 'req' },
+  ];
+  for (const { dir, kind } of dirs) {
+    let entries;
+    try { entries = _rd(dir); } catch { continue; }
+    for (const name of entries) {
+      if (!name.endsWith('.json')) continue;
+      let j;
+      try { j = JSON.parse(_rf(resolve(dir, name), 'utf8')); } catch { continue; }
+      if (kind === 'ac') {
+        const usId = j.usId;
+        for (const ac of (j.acceptanceCriteria || [])) {
+          // AC id in the shipped JSON is like "AC-9101-1"; the
+          // anchor form used by probes is "<slug>-AC-9101-1".
+          const key = `${SLUG}-${ac.id}`;
+          map.set(key, ac.description || '');
+        }
+      } else {
+        const key = j.reqId; // already "<slug>-REQ-###"
+        if (key) map.set(key, j.description || j.title || '');
+      }
+    }
+  }
+  return map;
+}
+export function first8Words(anchor) {
+  if (!anchor) return '';
+  if (!_anchorMap) _anchorMap = _loadAnchorMap();
+  const txt = _anchorMap.get(anchor) || '';
+  if (!txt) return '';
+  const words = txt.split(/\s+/).filter(Boolean).slice(0, 8).join(' ');
+  return words;
+}
+export function withAnchorPrefix(row) {
+  const prefix = first8Words(row.anchorAcId);
+  if (!prefix) return row;
+  const already = typeof row.detail === 'string' && row.detail.startsWith(prefix);
+  if (already) return row;
+  const oldDetail = row.detail || '';
+  return { ...row, detail: `${prefix} :: ${oldDetail}` };
+}
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export function isSkipped(results) {
+  return results.length > 0 && results.every((r) => r.accountBoundSkipped === true);
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  // Prefix every row's detail with the first eight words of its
+  // anchored AC or REQ description; unanchored rows are left alone.
+  const prefixedResults = (results || []).map(withAnchorPrefix);
+  const raw = aggregate(prefixedResults);
+  const aggregateVerdict = isSkipped(prefixedResults) ? 'pass' : raw;
+  const report = {
+    slug: 'security-auth-oauth2',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results: prefixedResults,
+    aggregateVerdict,
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = await mainFn();
+    if (!outcome || !Array.isArray(outcome.results) || outcome.results.length === 0) {
+      const results = [{
+        anchorAcId: 'unknown',
+        verdict: 'fail',
+        detail: 'no checks ran',
+      }];
+      const { report, path } = await writeReport({ probeName, engine, results });
+      process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+      process.stderr.write(`no-checks-ran fail written to ${path}\n`);
+      process.exitCode = 1;
+      return;
+    }
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorAcId: 'unknown',
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+// De-claim helper. When the shipped AC does not observe what the probe observes, the row keeps its
+// verdict, evidence and engine as they are, but the anchor drops to null and the
+// row carries conformanceOnly:true plus a limitation string naming the AC that
+// this probe does NOT observe and why. The integration-harness follow-up (the auth integration harness follow-up)
+// is the surface where those AC-level properties become observable.
+export function deClaim(row, { ac, limitation }) {
+  const acId = ac || 'unknown-AC';
+  const limText = (limitation || '').trim();
+  const finalLim = /^(security-[a-z0-9-]+-)?(AC|REQ)-/.test(limText) ? limText : (limText ? `${acId}: ${limText}` : `${acId}: not observable at this probe surface; needs the integration harness (the auth integration harness follow-up)`);
+  const out = { ...row };
+  out.anchorAcId = null;
+  if ('anchorReqId' in out) delete out.anchorReqId;
+  out.conformanceOnly = true;
+  out.limitation = finalLim;
+  const tag = ` :: conformance-only (${finalLim})`;
+  if (typeof out.detail === 'string' && !out.detail.includes('conformance-only')) {
+    out.detail = out.detail + tag;
+  }
+  return out;
+}
+
+export function accountBoundSkippedResult(anchorAcId, capability, reason) {
+  return {
+    anchorAcId,
+    capability,
+    verdict: 'pass',
+    accountBoundSkipped: true,
+    reason,
+    detail: `accountBoundSkipped: ${reason} unset; probe did not execute against a real OAuth 2.0 provider. Set the missing var and re-run.`,
+  };
+}

package/blueprints/security-auth-oauth2/contributions/probes/provider-adapter-shape.mjs

@@ -0,0 +1,64 @@
+// Provider-adapter shape probe. Conformance-only. Every row records
+// anchorAcId=null with a limitation naming the shipped AC whose
+// route/boot property the local validator/selector helper does not
+// exercise. The integration harness follow-up is the surface where
+// the AC-level properties become observable.
+//
+// capability: principalDirectory. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-oauth2', 'src');
+
+export const anchorAcId = null;
+export const capability = 'principalDirectory';
+export const accountBound = false;
+
+const LIM_VAL = 'security-auth-oauth2-AC-10111-2: probe calls a validator helper; the AC states the mechanism refuses at boot with a stable-coded error, needs the boot lifecycle (auth integration harness follow-up).';
+const LIM_SEL1 = 'security-auth-oauth2-AC-10109-1: probe checks selector known-name only; the AC states the second-provider sign-in round-trip issues a project session, needs the integration harness (the auth integration harness follow-up).';
+const LIM_SEL2 = 'security-auth-oauth2-AC-10109-2: probe calls a selector helper; the AC states the sign-in route refuses an unknown provider and the redirect guard blocks it, needs the integration harness (the auth integration harness follow-up).';
+
+export default async function runProbe() {
+  const { chooseDiscoveryUrl, selectProvider, knownProviders } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'provider-adapter.mjs')).href);
+  const results = [];
+
+  const good = chooseDiscoveryUrl('https://accounts.example.com/');
+  results.push(deClaim({
+    capability,
+    verdict: good.ok && good.discoveryUrl === 'https://accounts.example.com/.well-known/openid-configuration' ? 'pass' : 'fail',
+    detail: `validator accepts well-formed https issuer: discoveryUrl=${good.discoveryUrl}`,
+    evidence: { input: 'https://accounts.example.com/', adapterReturn: good },
+    vendorCitation: { url: 'https://openid.net/specs/openid-connect-discovery-1_0.html', verifiedOn: '2026-09-11' },
+  }, { ac: 'security-auth-oauth2-AC-10111-2', limitation: LIM_VAL }));
+
+  const insecure = chooseDiscoveryUrl('http://insecure.example.com');
+  results.push(deClaim({
+    capability,
+    verdict: !insecure.ok && /must use https/.test(insecure.error) ? 'pass' : 'fail',
+    detail: `insecure-issuer refused (helper level): error=${JSON.stringify(insecure.error)}`,
+    evidence: { input: 'http://insecure.example.com', adapterReturn: insecure },
+    vendorCitation: { url: 'https://datatracker.ietf.org/doc/html/rfc6749#section-3.1', verifiedOn: '2026-09-11' },
+  }, { ac: 'security-auth-oauth2-AC-10111-2', limitation: LIM_VAL }));
+
+  const knownOk = selectProvider('auth0');
+  results.push(deClaim({
+    capability: 'credentialSelfService',
+    verdict: knownOk.ok && knownOk.provider === 'auth0' ? 'pass' : 'fail',
+    detail: `selector known-name resolves: ok=${knownOk.ok} provider=${knownOk.provider}`,
+    evidence: { adapterReturn: knownOk, knownProviders },
+  }, { ac: 'security-auth-oauth2-AC-10109-1', limitation: LIM_SEL1 }));
+
+  const unknownRef = selectProvider('atlantis-single-signon');
+  results.push(deClaim({
+    capability: 'credentialSelfService',
+    verdict: !unknownRef.ok && /unknown provider/.test(unknownRef.error) ? 'pass' : 'fail',
+    detail: `selector refuses unknown provider (helper level): error=${JSON.stringify(unknownRef.error)}`,
+    evidence: { adapterReturn: unknownRef },
+  }, { ac: 'security-auth-oauth2-AC-10109-2', limitation: LIM_SEL2 }));
+
+  return { results, extra: {} };
+}

package/blueprints/security-auth-oauth2/contributions/probes/real-account-authorisation-code-flow.mjs

@@ -0,0 +1,93 @@
+// Real-account authorisation-code-flow probe for security-auth-
+// oauth2. Runs the RFC 6749 code flow with RFC 7636 PKCE against a
+// real, commercial OAuth 2.0 authorisation server when the estate
+// has one wired.
+//
+// This estate does NOT have a live commercial IdP available. The
+// probe honest-skips when the gate variables are not set, and when
+// credentials ARE supplied the probe explicitly reports that the
+// live-provider branch is not yet implemented and returns a FAIL
+// per rule (never a misleading pass).
+//
+// capability: authorisationCodeFlow.
+// Anchor: AC-10110-2 (a live public-provider smoke
+//   against a real IdP completes a full authorisation-code + PKCE
+//   round-trip and issues a project session).
+// accountBound: true.
+
+import { DECLARED_ENV, accountBoundSkippedResult } from './probe-utils.mjs';
+
+export const anchorAcId = 'security-auth-oauth2-AC-10110-2';
+export const capability = 'authorisationCodeFlow';
+export const accountBound = true;
+
+const SECOND_TIER_VARS = ['OAUTH2_ISSUER_URL', 'OAUTH2_CLIENT_ID', 'OAUTH2_CLIENT_SECRET', 'OAUTH2_REDIRECT_URI'];
+
+function gateResult(varName, value) {
+  // Distinguishes unset from set-but-not-true per rule 4 of the master brief.
+  if (value === undefined || value === '') {
+    return { kind: 'unset', reason: varName };
+  }
+  if (value !== 'true') {
+    return { kind: 'set-not-true', reason: `${varName}_SET_NOT_TRUE`, observedValue: value };
+  }
+  return { kind: 'true' };
+}
+
+export default async function runProbe() {
+  const gate = gateResult('CI_HAS_OAUTH2_PROVIDER', process.env.CI_HAS_OAUTH2_PROVIDER);
+  if (gate.kind === 'unset') {
+    return {
+      results: [accountBoundSkippedResult(anchorAcId, capability, 'CI_HAS_OAUTH2_PROVIDER')],
+      extra: {
+        accountBoundSkipped: true,
+        reason: 'CI_HAS_OAUTH2_PROVIDER',
+        envDeclared: [...DECLARED_ENV],
+        note: 'No live commercial OAuth 2.0 IdP is available in this estate. Local shipped-shape evidence is authorisation-code-flow-shape against the fixture mock. The live branch reads AMBER on criterion e until an IdP is wired.',
+      },
+    };
+  }
+  if (gate.kind === 'set-not-true') {
+    return {
+      results: [{
+        anchorAcId, capability, verdict: 'fail',
+        detail: `AC-10110-2 gate: CI_HAS_OAUTH2_PROVIDER is set to "${gate.observedValue}" (not the string "true"). Gate refuses this shape; set the variable to the exact string "true" to run the live branch.`,
+        evidence: { gate: 'CI_HAS_OAUTH2_PROVIDER', observedValue: gate.observedValue, expected: 'true', status: 400 },
+      }],
+      extra: { gateMisconfigured: true, gate: 'CI_HAS_OAUTH2_PROVIDER', envDeclared: [...DECLARED_ENV] },
+    };
+  }
+
+  // Second-tier variable check: one result row per unset variable
+  // per rule 4 of the master brief.
+  const unsetRows = [];
+  for (const v of SECOND_TIER_VARS) {
+    if (!process.env[v]) {
+      unsetRows.push({
+        anchorAcId, capability, verdict: 'pass', accountBoundSkipped: true, reason: v,
+        detail: `accountBoundSkipped: ${v} unset. AC-10110-2 requires a live public provider; set ${v} to run the live branch.`,
+      });
+    }
+  }
+  if (unsetRows.length > 0) {
+    return {
+      results: unsetRows,
+      extra: { accountBoundSkipped: true, unsetVars: unsetRows.map((r) => r.reason), envDeclared: [...DECLARED_ENV] },
+    };
+  }
+
+  // Credentials present but the live branch is not implemented in
+  // this estate. Return FAIL with an explicit named-not-implemented
+  // detail (never a misleading pass).
+  return {
+    results: [{
+      anchorAcId, capability, verdict: 'fail',
+      detail: 'AC-10110-2 live branch is NOT IMPLEMENTED. Every gate variable is set, but the estate has no wired live commercial IdP and no round-trip code has been authored. Supplying credentials does not silently pass; the branch must be implemented before this result flips to pass. Local shipped-shape evidence is authorisation-code-flow-shape against the fixture mock; the live branch remains AMBER until an IdP is wired.',
+    }],
+    extra: {
+      envDeclared: [...DECLARED_ENV],
+      liveBranchImplemented: false,
+      note: 'implement round-trip against OAUTH2_ISSUER_URL/OAUTH2_CLIENT_ID/OAUTH2_CLIENT_SECRET/OAUTH2_REDIRECT_URI here when a live IdP is added to the estate',
+    },
+  };
+}

package/blueprints/security-auth-oauth2/contributions/probes/run-authorisation-code-flow-shape.mjs

@@ -0,0 +1,4 @@
+import runProbe from './authorisation-code-flow-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'in-process mock RFC 6749 + RFC 7636 server on 127.0.0.1', healthy: true };
+runShim('authorisation-code-flow-shape', engine, runProbe);

package/blueprints/security-auth-oauth2/contributions/probes/run-pkce-challenge-shape.mjs

@@ -0,0 +1,4 @@
+import runProbe from './pkce-challenge-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'fixture PKCE helper (local)', healthy: true };
+runShim('pkce-challenge-shape', engine, runProbe);

package/blueprints/security-auth-oauth2/contributions/probes/run-provider-adapter-shape.mjs

@@ -0,0 +1,4 @@
+import runProbe from './provider-adapter-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'fixture provider-adapter (local)', healthy: true };
+runShim('provider-adapter-shape', engine, runProbe);

package/blueprints/security-auth-oauth2/contributions/probes/run-real-account-authorisation-code-flow.mjs

@@ -0,0 +1,4 @@
+import runProbe from './real-account-authorisation-code-flow.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'oauth2-provider' /* live-provider branch is honest-skip; slug AMBER */, image: 'commercial OAuth 2.0 authorisation server (or skipped)', healthy: true };
+runShim('real-account-authorisation-code-flow', engine, runProbe);

package/blueprints/security-auth-oauth2/contributions/probes/run-session-bridge-shape.mjs

@@ -0,0 +1,4 @@
+import runProbe from './session-bridge-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+const engine = { kind: 'fixture', image: 'fixture session-bridge (local)', healthy: true };
+runShim('session-bridge-shape', engine, runProbe);

package/blueprints/security-auth-oauth2/contributions/probes/session-bridge-shape.mjs

@@ -0,0 +1,78 @@
+// Session-bridge shape probe. Conformance-only. Every row records
+// anchorAcId=null with a limitation naming the shipped AC whose
+// request/cookie property the local bridge observation does not
+// exercise. The integration harness follow-up is the surface where
+// the AC-level properties become observable.
+//
+// capability: sessionInventory. engine: fixture. accountBound: false.
+
+import { pathToFileURL } from 'node:url';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { deClaim } from './probe-utils.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_SRC = resolve(HERE, '..', '..', '..', '..', 'packages', 'rcf-lite', 'test', 'fixtures', 'security-auth-oauth2', 'src');
+
+export const anchorAcId = null;
+export const capability = 'sessionInventory';
+export const accountBound = false;
+
+const LIM_P = 'security-auth-oauth2-AC-10106-1: probe returns a bridged session object; the AC states request.auth carries a Principal on a protected request, needs the integration harness (the auth integration harness follow-up).';
+const LIM_LEAK = 'security-auth-oauth2-AC-10106-3: probe inspects the bridge return; the AC states request.auth on a protected request does not expose provider tokens, needs the integration harness (the auth integration harness follow-up).';
+const LIM_H = 'security-auth-oauth2-AC-10101-3: probe inspects a bridge handle string; the AC states the session cookie carries an opaque project handle, needs a real cookie set at the response, needs the integration harness (the auth integration harness follow-up).';
+const LIM_INV = 'security-auth-oauth2-AC-10106-2: probe uses malformed provider inputs; the AC states a request lacking a valid handle is refused before session issue, needs the integration harness (the auth integration harness follow-up).';
+
+export default async function runProbe() {
+  const { bridgeSession } = await import(pathToFileURL(resolve(FIXTURE_SRC, 'provider-adapter.mjs')).href);
+  const results = [];
+
+  const good = bridgeSession({
+    tokenResponse: { access_token: 'tok-abc', expires_in: 3600, scope: 'openid profile' },
+    userinfo: { sub: 'user-123', email: 'u@example.com' },
+  });
+  results.push(deClaim({
+    capability,
+    verdict: good.ok && good.session && good.session.principalId === 'user-123' ? 'pass' : 'fail',
+    detail: `bridge returns session with principalId: ok=${good.ok} principalId=${good.session && good.session.principalId}`,
+    evidence: { adapterReturn: good },
+  }, { ac: 'security-auth-oauth2-AC-10106-1', limitation: LIM_P }));
+
+  const sessionKeys = good.ok ? Object.keys(good.session) : [];
+  const providerTokenLeaks = sessionKeys.filter((k) => /^(access|refresh|id)_?[Tt]oken$/.test(k));
+  results.push(deClaim({
+    capability,
+    verdict: good.ok && providerTokenLeaks.length === 0 ? 'pass' : 'fail',
+    detail: `bridge return omits provider tokens: sessionKeys=${JSON.stringify(sessionKeys)} leaks=${JSON.stringify(providerTokenLeaks)}`,
+    evidence: { sessionKeys, providerTokenLeaks },
+  }, { ac: 'security-auth-oauth2-AC-10106-3', limitation: LIM_LEAK }));
+
+  const handleOk = good.ok
+    && typeof good.session.handle === 'string'
+    && good.session.handle.length >= 20
+    && !good.session.handle.includes('tok-abc');
+  results.push(deClaim({
+    capability,
+    verdict: handleOk ? 'pass' : 'fail',
+    detail: `bridge handle is opaque and not derived from access_token: handleLen=${good.session && good.session.handle && good.session.handle.length}`,
+    evidence: { handlePrefix: good.session && good.session.handle && good.session.handle.slice(0, 4), handleLen: good.session && good.session.handle && good.session.handle.length },
+  }, { ac: 'security-auth-oauth2-AC-10101-3', limitation: LIM_H }));
+
+  const missingSub = bridgeSession({ tokenResponse: { access_token: 'tok-abc' }, userinfo: {} });
+  results.push(deClaim({
+    capability,
+    verdict: !missingSub.ok && /userinfo\.sub/.test(missingSub.error) ? 'pass' : 'fail',
+    detail: `bridge refuses missing userinfo.sub: ok=${missingSub.ok} error=${JSON.stringify(missingSub.error)}`,
+    evidence: { adapterReturn: missingSub },
+  }, { ac: 'security-auth-oauth2-AC-10106-2', limitation: LIM_INV }));
+
+  const missingTok = bridgeSession({ tokenResponse: {}, userinfo: { sub: 'x' } });
+  results.push(deClaim({
+    capability,
+    verdict: !missingTok.ok && /access_token/.test(missingTok.error) ? 'pass' : 'fail',
+    detail: `bridge refuses missing access_token: ok=${missingTok.ok} error=${JSON.stringify(missingTok.error)}`,
+    evidence: { adapterReturn: missingTok },
+  }, { ac: 'security-auth-oauth2-AC-10106-2', limitation: LIM_INV }));
+
+  return { results, extra: {} };
+}

package/blueprints/security-auth-oauth2/docs/topics.md

@@ -70,8 +70,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 10101-10111 sit at the LOW end of the 10101-10899 band on purpose. A project-side story that mechanically derives from a security-auth-oauth2 REQ id into the number `10111` would collide against security-auth-oauth2-US-10111 in this package; the band leaves headroom at the HIGH end (US 10181-10899) so a project's own stories anchored to security-auth-oauth2 REQs can allocate without conflict. The watchpost run4 lesson applies here too.
-
+US 10101-10111 sit at the LOW end of the 10101-10899 band on purpose. A project-side story that mechanically derives from a security-auth-oauth2 REQ id into the number `10111` would collide against security-auth-oauth2-US-10111 in this package; the band leaves headroom at the HIGH end (US 10181-10899) so a project's own stories anchored to security-auth-oauth2 REQs can allocate without conflict.
 The ADR/TAC suffix block 1101-1199 is the second block to cross into the four-digit suffix space; `security-auth-clerk` opened the four-digit door at 1001-1099. Every shipped blueprint continues to load, validate, and audit against this shape without a schema change: rcf-schemas 0.5.0 `adrId` and `tacId` patterns are `^ADR-\d{3,}(-[a-z0-9]+...)?$` (three-digit minimum, unbounded above); four-digit and higher suffixes validate verbatim. The registry table above records the growth for a downstream author reaching for the next block.
 
 ## Shared expectations for future composing blueprints

package/blueprints/security-secrets-management/CHANGELOG.md

@@ -1,5 +1,18 @@
 # security-secrets-management changelog
 
+## 1.1.5 - 2026-09-11
+
+- Criterion-e probe pack refinement: every conformance-only result row now records `anchorAcId: null` alongside a `limitation` that opens with a shipped AC id from the blueprint's user stories (all ten SOPS-native rows move from `REQ-002` to `AC-8102-1`, the manager-module surface these probes do not observe). Detail strings on de-claimed rows describe only what was observed at the SOPS crypto layer and no longer name REQ-002. The anatomy helper enforces conformance-only rows to satisfy `anchorAcId === null`, requires limitations to open with an `AC-<n>-<n>` id that resolves to a shipped acceptance criterion on the blueprint's user stories (REQ-prefixed anchors are refused and fabricated ids are rejected), and does not count pre-delete presence as an absence observation on the inventory-diff shape.
+
+## 1.1.4 - 2026-09-11
+
+- Every SOPS-native result row is now marked `conformanceOnly: true` with a limitation naming the shipped AC that these SOPS-native operations do not observe (the manager-client boundary). Anchors stay `null` as before. Anatomy helper enforces field COMBINATIONS per shape; bare diagnostic evidence like `{macDiverged}`, `{sameRecipients}` or `{status,matched}` passes only under the `conformanceOnly` + limitation shape. This pack is criterion-e conformance evidence pending the manager-client probe follow-up.
+
+## 1.1.3 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering the secretsProvider capability across four probes running against real `sops(1)` + `age(1)` engines with throwaway keypairs the probes self-provision and self-clean under `RCF_SECRETS_SCRATCH_DIR`: `encrypt-decrypt-round-trip` (scratch scope encrypt then decrypt; sops metadata captured as evidence excerpts), `add-recipient-rotation` (`--rotate --add-age` extends recipient list, regenerates mac, and lets the new recipient decrypt), `key-rotation` (`--rotate` re-keys the payload without changing recipients), and `mismatched-key-refusal` (foreign-key decrypt returns non-zero with no plaintext). The estate vault at `.vault/scopes/` is never touched. Fixture at `packages/rcf-lite/test/fixtures/security-secrets-management/` declares every env var the pack reads; anatomy test pins pack shape, fixture manifest and per-probe aggregate pass on the real engine.
+- Iteration on the probe pack: byte-equality is a real byte-buffer compare on `--input-type binary --output-type binary` streams; the SHA-256 witnesses stay in `evidence.byteCompare` alongside the byte-length + `Buffer.compare === 0` assertion. `aggregate([])` and null-result normalisation now report `detail: 'no checks ran'` exactly. Slug reads AMBER on criterion e until a manager-client probe is added that observes `AC-8102-1` at the module boundary.
+
 ## 1.1.2
 
 - Rewrites `REQ-002.description` to reference `TAC-901-security-secrets-management-manager-client` `responsibilities.get` and the sibling responsibilities on the same TAC rather than restate the `get(name)` signature verbatim; the literal remains owned by the delivering TAC.
@@ -8,16 +21,14 @@
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 1.1.0 (hardening pass, spec 2026-09-09 section 5.4.2)
+## 1.1.0 (2026-09-09)
 
-- Adds `elicits[]` for `environmentSet` (string; the ordered environment list) and `uiOutcome` (enum: `integrate`, `admin-spa`, `none`) already described in prose on `REQ-007` and `REQ-010`. Promotes `REQ-010` to `must` priority (an apply-time choice is not a should) and names each option value explicitly on its description. Narrows `REQ-003` to code-side enforcement of the least-privilege slice, naming SOPS's inability to issue vendor-side per-process credentials and the supersede-via-ADR path for vendors that carry the property. Adds an explicit exception clause to `REQ-005` for the ephemeral `.env` reflection under `REQ-006`, constraining its location, `.gitignore` requirement, and file mode. Adds `deliveredBy` on every `must` requirement and `disposition: fixed` on every existing acceptance criterion. Names the `secretsProvider` capability on `REQ-002`, which already carries the vendor-agnostic-manager runtime clause. hardening pass (criteria a, b, c on the 2026-09-09 programme).
+- Adds `elicits[]` for `environmentSet` (string; the ordered environment list) and `uiOutcome` (enum: `integrate`, `admin-spa`, `none`) already described in prose on `REQ-007` and `REQ-010`. Promotes `REQ-010` to `must` priority (an apply-time choice is not a should) and names each option value explicitly on its description. Narrows `REQ-003` to code-side enforcement of the least-privilege slice, naming SOPS's inability to issue vendor-side per-process credentials and the supersede-via-ADR path for vendors that carry the property. Adds an explicit exception clause to `REQ-005` for the ephemeral `.env` reflection under `REQ-006`, constraining its location, `.gitignore` requirement, and file mode. Adds `deliveredBy` on every `must` requirement and `disposition: fixed` on every existing acceptance criterion. Names the `secretsProvider` capability on `REQ-002`, which already carries the vendor-agnostic-manager runtime clause.
 
 ## 1.0.1 - 2026-09-06
 
 Additive minor: declares `capabilities: ["secretsProvider"]` on `blueprint.json` so consumer blueprints can gate composition on an applied secrets-management surface via the capability mechanism. No REQ / US / TAC / ADR contribution changes; the `secretRef` opaque-string contract, the elicited-parameters shape, and the shipped secretsSource semantics are unchanged. First consumer at v1.0.1: `object-storage-s3` v1.0.0 declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` so `rcf define blueprint add object-storage-s3` on a project that has not applied security-secrets-management exits 3 with the stable message id on stderr; the override records a note on `source.notes` for later reconciliation.
 
-Landed via infra round 5 (spec section 5.2, platform decision 6) folded into PR #157 per shelf ruling on the runner-gap find; same-PR minor pattern as round-4 auth minors.
-
 ## 1.0.0 - 2026-08-31
 
 Initial release. `secretRef` opaque-string contract, elicited-parameters (secretsSource, environment mapping), scope-global ADR on `secretsSource`.

package/blueprints/security-secrets-management/README.md

@@ -27,9 +27,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the manifest shape, the client contract, the least-privilege posture, the audit shape, the agent access discipline, the `.env` reflection posture, the rotation gate, the UI-choice contract); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the manifest shape, the client contract, the least-privilege posture, the audit shape, the agent access discipline, the `.env` reflection posture, the rotation gate, the UI-choice contract); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 Deliberately not contributed: a vendor SDK (the default vendor is named in ADR-902 as SOPS+age, the shape of the vendor adapter is fixed by TAC-901, the actual adapter code is a project-authored implementation); a specific manifest schema library (any YAML parser plus the loader in TAC-902 satisfies the loader responsibilities); a project's authorisation model (secrets management authorises READ of secret material; who is allowed to act on which secret at which UI surface is a project-side authorisation concern layered above the audit sink); a rotation orchestrator (the blueprint gates on rotation age at CI, it does not itself run the rotation for you; running the rotation is a project-authored procedure the vendor's own tooling supports); the admin-UI Secrets page itself when `uiIntegration.mode` is `integrate` (the field contract is fixed by TAC-905, the page implementation lives in the host project); an admin-spa blueprint (a companion future blueprint, promotion signal noted in the guide); a project's audit-storage engine (the blueprint fixes the event shape, not where the events land).
 

package/blueprints/security-secrets-management/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "security-secrets-management",
-  "version": "1.1.2",
+  "version": "1.1.5",
   "category": "security",
   "capabilities": [
     "secretsProvider"
@@ -177,5 +177,6 @@
         "none"
       ]
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11T15:37:12.000Z"
 }