rcf-lite 0.28.4 → 0.30.0

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11118.json

@@ -20,7 +20,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1203-security-auth-keycloak-introspection-client",
-        "field": "responsibilities.introspectionAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -34,7 +34,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1203-security-auth-keycloak-introspection-client",
-        "field": "responsibilities.introspectionAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -48,7 +48,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1203-security-auth-keycloak-introspection-client",
-        "field": "responsibilities.introspectionAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -62,7 +62,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1203-security-auth-keycloak-introspection-client",
-        "field": "responsibilities.introspectionAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -76,7 +76,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1203-security-auth-keycloak-introspection-client",
-        "field": "responsibilities.introspectionAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -90,7 +90,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1203-security-auth-keycloak-introspection-client",
-        "field": "responsibilities.introspectionAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -104,7 +104,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1203-security-auth-keycloak-introspection-client",
-        "field": "responsibilities.introspectionAudit"
+        "field": "responsibilities"
       }
     }
   ],

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11119.json

@@ -20,7 +20,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1204-security-auth-keycloak-provider-router",
-        "field": "responsibilities.routeAndSessionAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -34,7 +34,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1204-security-auth-keycloak-provider-router",
-        "field": "responsibilities.routeAndSessionAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -48,7 +48,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1204-security-auth-keycloak-provider-router",
-        "field": "responsibilities.routeAndSessionAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -62,7 +62,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1204-security-auth-keycloak-provider-router",
-        "field": "responsibilities.routeAndSessionAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -76,7 +76,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1204-security-auth-keycloak-provider-router",
-        "field": "responsibilities.routeAndSessionAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -90,7 +90,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1204-security-auth-keycloak-provider-router",
-        "field": "responsibilities.routeAndSessionAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -104,7 +104,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1204-security-auth-keycloak-provider-router",
-        "field": "responsibilities.routeAndSessionAudit"
+        "field": "responsibilities"
       }
     }
   ],

package/blueprints/security-auth-keycloak/contributions/user-stories/security-auth-keycloak-us-11120.json

@@ -20,7 +20,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1205-security-auth-keycloak-role-adapter",
-        "field": "responsibilities.rolesAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -34,7 +34,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1205-security-auth-keycloak-role-adapter",
-        "field": "responsibilities.rolesAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -48,7 +48,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1205-security-auth-keycloak-role-adapter",
-        "field": "responsibilities.rolesAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -62,7 +62,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1205-security-auth-keycloak-role-adapter",
-        "field": "responsibilities.rolesAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -76,7 +76,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1205-security-auth-keycloak-role-adapter",
-        "field": "responsibilities.rolesAudit"
+        "field": "responsibilities"
       }
     },
     {
@@ -90,7 +90,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1205-security-auth-keycloak-role-adapter",
-        "field": "responsibilities.rolesAudit"
+        "field": "responsibilities"
       }
     }
   ],

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-002.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-08-21T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-501-security-auth-magic-link-manager",
-    "field": "responsibilities.consume"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-003.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-08-21T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-502-security-auth-magic-link-session-manager",
-    "field": "responsibilities.handle"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-004.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-08-21T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-503-security-auth-magic-link-login-routes",
-    "field": "responsibilities.SameSite"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-005.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-08-21T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-502-security-auth-magic-link-session-manager",
-    "field": "responsibilities.revokeAllForPrincipal"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-008.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-08-21T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-501-security-auth-magic-link-manager",
-    "field": "responsibilities.store"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-009.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-08-21T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-501-security-auth-magic-link-manager",
-    "field": "responsibilities.onEvent"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-010.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-09-10T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-504-security-auth-magic-link-email-delivery-adapter",
-    "field": "responsibilities.send"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-magic-link/contributions/requirements/security-auth-magic-link-req-011.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-08-21T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-505-security-auth-magic-link-principal-registry",
-    "field": "responsibilities.isRegistered"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-magic-link/contributions/tacs/tac-501-security-auth-magic-link-manager.json

@@ -17,18 +17,18 @@
   "interfaces": [
     {
       "name": "store",
-      "kind": "read-write-api",
-      "description": "Project-supplied durable store implementing invalidatePriorMagicLinkTokens(email), insertMagicLinkToken({ token, email, expiresAt }), and consumeMagicLinkToken(token) returning the record or null."
+      "kind": "other",
+      "description": "Project-supplied durable store implementing invalidatePriorMagicLinkTokens(email), insertMagicLinkToken({ token, email, expiresAt }), and consumeMagicLinkToken(token) returning the record or null. (legacy kind: read-write-api)"
     },
     {
       "name": "onEvent",
-      "kind": "callback",
-      "description": "Structured-event sink invoked with { event, principalId, outcome, at, ... } for magicLinkMinted and magicLinkConsumed; never invoked with the token secret."
+      "kind": "other",
+      "description": "Structured-event sink invoked with { event, principalId, outcome, at, ... } for magicLinkMinted and magicLinkConsumed; never invoked with the token secret. (legacy kind: callback)"
     },
     {
       "name": "now",
-      "kind": "clock",
-      "description": "Injectable millisecond clock for expiry arithmetic (test surface)."
+      "kind": "other",
+      "description": "Injectable millisecond clock for expiry arithmetic (test surface). (legacy kind: clock)"
     }
   ],
   "dependencies": [

package/blueprints/security-auth-magic-link/contributions/tacs/tac-502-security-auth-magic-link-session-manager.json

@@ -18,18 +18,18 @@
   "interfaces": [
     {
       "name": "store",
-      "kind": "read-write-api",
-      "description": "Project-supplied durable store implementing insertSession(record), findSession(handle), refreshSession(handle, lastSeenAt), deleteSession(handle), and deleteSessionsForPrincipal(principalId)."
+      "kind": "other",
+      "description": "Project-supplied durable store implementing insertSession(record), findSession(handle), refreshSession(handle, lastSeenAt), deleteSession(handle), and deleteSessionsForPrincipal(principalId). (legacy kind: read-write-api)"
     },
     {
       "name": "onEvent",
-      "kind": "callback",
-      "description": "Structured-event sink invoked with { event, principalId, outcome, at, ... } for the four session events; never invoked with the handle value."
+      "kind": "other",
+      "description": "Structured-event sink invoked with { event, principalId, outcome, at, ... } for the four session events; never invoked with the handle value. (legacy kind: callback)"
     },
     {
       "name": "now",
-      "kind": "clock",
-      "description": "Injectable millisecond clock for expiry arithmetic."
+      "kind": "other",
+      "description": "Injectable millisecond clock for expiry arithmetic. (legacy kind: clock)"
     }
   ],
   "dependencies": [

package/blueprints/security-auth-magic-link/contributions/tacs/tac-503-security-auth-magic-link-login-routes.json

@@ -20,28 +20,28 @@
   "interfaces": [
     {
       "name": "app",
-      "kind": "framework-instance",
-      "description": "The project's HTTP framework instance the routes are registered onto; the framework must expose a per-route rate-limit configuration surface."
+      "kind": "other",
+      "description": "The project's HTTP framework instance the routes are registered onto; the framework must expose a per-route rate-limit configuration surface. (legacy kind: framework-instance)"
     },
     {
       "name": "magicLinks",
-      "kind": "collaborator",
-      "description": "TAC-501 instance; the routes call mint and consume through it."
+      "kind": "other",
+      "description": "TAC-501 instance; the routes call mint and consume through it. (legacy kind: collaborator)"
     },
     {
       "name": "sessions",
-      "kind": "collaborator",
-      "description": "TAC-502 instance; the routes call issueSession, invalidateSession, and cookie helpers through it."
+      "kind": "other",
+      "description": "TAC-502 instance; the routes call issueSession, invalidateSession, and cookie helpers through it. (legacy kind: collaborator)"
     },
     {
       "name": "adapter",
-      "kind": "collaborator",
-      "description": "TAC-504 instance; the routes call adapter.send through it."
+      "kind": "other",
+      "description": "TAC-504 instance; the routes call adapter.send through it. (legacy kind: collaborator)"
     },
     {
       "name": "registry",
-      "kind": "collaborator",
-      "description": "TAC-505 instance; the routes call registry.isRegistered through it and consume only the boolean result."
+      "kind": "other",
+      "description": "TAC-505 instance; the routes call registry.isRegistered through it and consume only the boolean result. (legacy kind: collaborator)"
     }
   ],
   "dependencies": [

package/blueprints/security-auth-magic-link/contributions/tacs/tac-504-security-auth-magic-link-email-delivery-adapter.json

@@ -15,8 +15,8 @@
   "interfaces": [
     {
       "name": "send",
-      "kind": "async-method",
-      "description": "send({ to, subject, textBody, htmlBody }) -> Promise<{ ok, providerStatus, providerMessageId, error }>; the sole method the auth code calls on the adapter."
+      "kind": "other",
+      "description": "send({ to, subject, textBody, htmlBody }) -> Promise<{ ok, providerStatus, providerMessageId, error }>; the sole method the auth code calls on the adapter. (legacy kind: async-method)"
     }
   ],
   "dependencies": [],

package/blueprints/security-auth-magic-link/contributions/tacs/tac-505-security-auth-magic-link-principal-registry.json

@@ -15,8 +15,8 @@
   "interfaces": [
     {
       "name": "isRegistered",
-      "kind": "async-method",
-      "description": "isRegistered(email) -> Promise<boolean>; the sole method the auth code calls on the registry."
+      "kind": "other",
+      "description": "isRegistered(email) -> Promise<boolean>; the sole method the auth code calls on the registry. (legacy kind: async-method)"
     }
   ],
   "dependencies": [],

package/blueprints/security-auth-magic-link/contributions/user-stories/security-auth-magic-link-us-3111.json

@@ -19,7 +19,7 @@
       "scope": "runtime",
       "ownerRef": {
         "tacId": "TAC-505-security-auth-magic-link-principal-registry",
-        "field": "interfaces.isRegistered.name"
+        "field": "interfaces"
       },
       "disposition": "fixed"
     },
@@ -43,7 +43,7 @@
       "scope": "runtime",
       "ownerRef": {
         "tacId": "TAC-505-security-auth-magic-link-principal-registry",
-        "field": "interfaces.isRegistered.name"
+        "field": "interfaces"
       },
       "disposition": "fixed"
     }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-002.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-08-30T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-1102-security-auth-oauth2-provider-adapter",
-    "field": "responsibilities.providerConfig"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-003.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-08-30T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-1101-security-auth-oauth2-flow-controller",
-    "field": "responsibilities.state"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-005.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-08-30T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-1101-security-auth-oauth2-flow-controller",
-    "field": "responsibilities.id_token"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-006.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-08-30T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
-    "field": "responsibilities.sessionRecordStore"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-008.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-08-30T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-1101-security-auth-oauth2-flow-controller",
-    "field": "responsibilities.endSessionEndpoint"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-009.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-08-30T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-1104-security-auth-oauth2-provider-selector",
-    "field": "responsibilities.providerConfig"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-011.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-09-10T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
-    "field": "responsibilities.roles"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-012.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-09-09T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-1102-security-auth-oauth2-provider-adapter",
-    "field": "responsibilities.accountUrl"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-oauth2/contributions/requirements/security-auth-oauth2-req-013.json

@@ -17,6 +17,6 @@
   "updatedAt": "2026-09-09T00:00:00Z",
   "deliveredBy": {
     "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
-    "field": "responsibilities.sessionInventory"
+    "field": "responsibilities"
   }
 }

package/blueprints/security-auth-oauth2/contributions/tacs/tac-1101-security-auth-oauth2-flow-controller.json

@@ -22,38 +22,48 @@
   "interfaces": [
     {
       "name": "providerAdapter",
-      "kind": "read-api",
-      "description": "The provider adapter (TAC-1102) resolving a provider record by id, returning `{ authorizeUrl, tokenUrl, userinfoUrl, issuer, jwksUri, clientId, clientSecret, scopes, redirectUri, providerKind, endSessionEndpoint?, providerLogout? }` and exposing a JWKS-fetching port for id_token verification."
+      "kind": "other",
+      "description": "The provider adapter (TAC-1102) resolving a provider record by id, returning `{ authorizeUrl, tokenUrl, userinfoUrl, issuer, jwksUri, clientId, clientSecret, scopes, redirectUri, providerKind, endSessionEndpoint?, providerLogout? }` and exposing a JWKS-fetching port for id_token verification. (legacy kind: read-api)"
     },
     {
       "name": "sessionBridge",
-      "kind": "read-write-api",
-      "description": "The session-bridge (TAC-1103) exposing `issue(principal, providerTokens) -> { handle, cookie }` and `verify(handle) -> { valid, principal?, refreshToken? }` and `invalidate(handle) -> void`."
+      "kind": "other",
+      "description": "The session-bridge (TAC-1103) exposing `issue(principal, providerTokens) -> { handle, cookie }` and `verify(handle) -> { valid, principal?, refreshToken? }` and `invalidate(handle) -> void`. (legacy kind: read-write-api)"
     },
     {
       "name": "pendingFlowStore",
-      "kind": "read-write-api",
-      "description": "Server-side one-time store keyed by state, exposing `put(state, record)`, `takeOnce(state) -> record | absent`, and TTL-based eviction. In-memory in the reference wiring; a project may inject a persistence-backed implementation."
+      "kind": "other",
+      "description": "Server-side one-time store keyed by state, exposing `put(state, record)`, `takeOnce(state) -> record | absent`, and TTL-based eviction. In-memory in the reference wiring; a project may inject a persistence-backed implementation. (legacy kind: read-write-api)"
     },
     {
       "name": "refreshTokenStore",
-      "kind": "read-write-api",
-      "description": "Server-side store keyed by session handle, exposing `put(handle, refreshToken)`, `rotate(handle, oldToken, newToken)`, `reuseDetect(handle, presentedToken) -> { reuse: boolean, chainRoot?: string }`, and `clearChain(chainRoot)`."
+      "kind": "other",
+      "description": "Server-side store keyed by session handle, exposing `put(handle, refreshToken)`, `rotate(handle, oldToken, newToken)`, `reuseDetect(handle, presentedToken) -> { reuse: boolean, chainRoot?: string }`, and `clearChain(chainRoot)`. (legacy kind: read-write-api)"
     },
     {
       "name": "clock",
-      "kind": "read-api",
-      "description": "Injected time source returning epoch seconds; the test harness substitutes a controllable clock for TTL and expiry-window checks."
+      "kind": "other",
+      "description": "Injected time source returning epoch seconds; the test harness substitutes a controllable clock for TTL and expiry-window checks. (legacy kind: read-api)"
     },
     {
       "name": "auditSink",
-      "kind": "callback",
-      "description": "Structured-event sink invoked with `{ event, providerId, sessionHandleHash?, reasonClass?, at }`; never invoked with a token value or a cookie value."
+      "kind": "other",
+      "description": "Structured-event sink invoked with `{ event, providerId, sessionHandleHash?, reasonClass?, at }`; never invoked with a token value or a cookie value. (legacy kind: callback)"
     }
   ],
   "dependencies": [
-    { "name": "OAuth2 provider adapter", "kind": "tac", "tacId": "TAC-1102-security-auth-oauth2-provider-adapter", "description": "Provider record resolution and JWKS fetch." },
-    { "name": "OAuth2 session-bridge", "kind": "tac", "tacId": "TAC-1103-security-auth-oauth2-session-bridge", "description": "Session issue, verify, invalidate." }
+    {
+      "name": "OAuth2 provider adapter",
+      "kind": "tac",
+      "tacId": "TAC-1102-security-auth-oauth2-provider-adapter",
+      "description": "Provider record resolution and JWKS fetch."
+    },
+    {
+      "name": "OAuth2 session-bridge",
+      "kind": "tac",
+      "tacId": "TAC-1103-security-auth-oauth2-session-bridge",
+      "description": "Session issue, verify, invalidate."
+    }
   ],
   "tradeoffs": "Fixing the flow at the controller and pushing every provider variation onto the record shape costs the project a small piece of boot-time work (declaring the provider record fields for each vendor) and buys the project one code path across every vendor for the state machine. Storing the pending-flow and the refresh-token chain on server-side stores rather than a browser cookie costs the project a small piece of state per pending sign-in and per active session; it buys the project defence against a category of front-channel exfiltration attacks against the PKCE verifier and the refresh chain. Injecting the clock costs the project one line of wiring; it buys the test harness clean TTL-and-expiry testing without real sleeps.",
   "createdAt": "2026-08-30T00:00:00Z",

package/blueprints/security-auth-oauth2/contributions/tacs/tac-1102-security-auth-oauth2-provider-adapter.json

@@ -18,13 +18,13 @@
   "interfaces": [
     {
       "name": "providerConfig",
-      "kind": "read-api",
-      "description": "The project-authored provider-config module exposing `list() -> record[]`. Each record is a plain object with the fields declared in REQ-002 and REQ-008. Server-tier records carry `clientSecret`; client-tier records carry a redacted placeholder."
+      "kind": "other",
+      "description": "The project-authored provider-config module exposing `list() -> record[]`. Each record is a plain object with the fields declared in REQ-002 and REQ-008. Server-tier records carry `clientSecret`; client-tier records carry a redacted placeholder. (legacy kind: read-api)"
     },
     {
       "name": "httpFetch",
-      "kind": "read-api",
-      "description": "The process's HTTP-fetch port used for JWKS fetch; injected so the test harness can substitute an in-process mock that returns the mock provider's JWKS."
+      "kind": "other",
+      "description": "The process's HTTP-fetch port used for JWKS fetch; injected so the test harness can substitute an in-process mock that returns the mock provider's JWKS. (legacy kind: read-api)"
     }
   ],
   "dependencies": [],

package/blueprints/security-auth-oauth2/contributions/tacs/tac-1103-security-auth-oauth2-session-bridge.json

@@ -20,28 +20,28 @@
   "interfaces": [
     {
       "name": "sessionRecordStore",
-      "kind": "read-write-api",
-      "description": "Project-supplied store exposing `put(handle, record)`, `get(handle) -> record | absent`, `delete(handle)`, and `purgeExpired(now)`. In-memory is the reference default; a persistence-data-sqlite-composed project points this at a table."
+      "kind": "other",
+      "description": "Project-supplied store exposing `put(handle, record)`, `get(handle) -> record | absent`, `delete(handle)`, and `purgeExpired(now)`. In-memory is the reference default; a persistence-data-sqlite-composed project points this at a table. (legacy kind: read-write-api)"
     },
     {
       "name": "refreshTokenStore",
-      "kind": "read-write-api",
-      "description": "Shared with the flow controller: exposes `put(handle, refreshToken)`, `clearChain(chainRoot)`."
+      "kind": "other",
+      "description": "Shared with the flow controller: exposes `put(handle, refreshToken)`, `clearChain(chainRoot)`. (legacy kind: read-write-api)"
     },
     {
       "name": "randomBytes",
-      "kind": "read-api",
-      "description": "Cryptographic random-byte source used to mint session handles; a 128-bit-or-more entropy budget is expected."
+      "kind": "other",
+      "description": "Cryptographic random-byte source used to mint session handles; a 128-bit-or-more entropy budget is expected. (legacy kind: read-api)"
     },
     {
       "name": "clock",
-      "kind": "read-api",
-      "description": "Injected time source; the same clock the flow controller uses."
+      "kind": "other",
+      "description": "Injected time source; the same clock the flow controller uses. (legacy kind: read-api)"
     },
     {
       "name": "enrichPrincipal",
-      "kind": "callback",
-      "description": "Optional project-authored hook called on the reduced Principal to add `roles` and `organisationIds` from project-side sources. A no-op default is applied when the config does not declare one."
+      "kind": "other",
+      "description": "Optional project-authored hook called on the reduced Principal to add `roles` and `organisationIds` from project-side sources. A no-op default is applied when the config does not declare one. (legacy kind: callback)"
     }
   ],
   "dependencies": [

package/blueprints/security-auth-oauth2/contributions/tacs/tac-1104-security-auth-oauth2-provider-selector.json

@@ -16,12 +16,17 @@
   "interfaces": [
     {
       "name": "providerConfig",
-      "kind": "read-api",
-      "description": "The provider-config module (same source as TAC-1102 reads); exposes `list() -> record[]` and the enabled flag."
+      "kind": "other",
+      "description": "The provider-config module (same source as TAC-1102 reads); exposes `list() -> record[]` and the enabled flag. (legacy kind: read-api)"
     }
   ],
   "dependencies": [
-    { "name": "OAuth2 provider adapter", "kind": "tac", "tacId": "TAC-1102-security-auth-oauth2-provider-adapter", "description": "Reads the same provider-config the adapter validates at boot." }
+    {
+      "name": "OAuth2 provider adapter",
+      "kind": "tac",
+      "tacId": "TAC-1102-security-auth-oauth2-provider-adapter",
+      "description": "Reads the same provider-config the adapter validates at boot."
+    }
   ],
   "tradeoffs": "A first-party selector surface makes the multi-provider posture visible without a project-side page implementation; the cost is one rendering path the blueprint owns and a small piece of style the project may want to override. Substituting a bespoke selector is a plain wire swap on the sign-in route; the query-parameter contract is the seam, not the rendering. Not owning the sign-in initiation logic (that belongs to the flow controller) keeps this TAC's surface small: it is a route that renders a list and links; the state machine is elsewhere.",
   "createdAt": "2026-08-30T00:00:00Z",

package/blueprints/security-auth-oauth2/contributions/user-stories/security-auth-oauth2-us-10111.json

@@ -30,7 +30,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-1102-security-auth-oauth2-provider-adapter",
-        "field": "responsibilities.validate"
+        "field": "responsibilities"
       }
     }
   ],