{
  "contract": "ores.shared-auth.capability-ledger.v1",
  "asOf": "2026-09-05",
  "issue": "DEN-606",
  "disclaimer": "This is an evidence ledger, not a blanket parity claim. A feature becomes available only when its independent interface authorities, persistence, authorization, audit, tests, deployment, and failure-state UX agree.",
  "capabilities": [
    {
      "id": "token-exchange",
      "domain": "Token exchange, verification, and JWKS",
      "status": "available",
      "userSurface": "Provider-token exchange, access-token verification, issuer and audience enforcement, and public key discovery.",
      "backendEvidence": [
        "shared-auth-api-server.rs",
        "shared-auth-clients",
        "shared-auth-interfaces"
      ],
      "nextGate": "Keep issuer, audience, algorithm, expiry, replay, and key-rotation fixtures current across every supported SDK."
    },
    {
      "id": "protected-introspection",
      "domain": "Protected introspection and explicit assurance",
      "status": "available",
      "userSurface": "Resource servers can require exact audience, scopes, AAL or ACR, AMR, and revocation-aware token state.",
      "backendEvidence": [
        "shared-auth-api-server.rs",
        "shared-auth-clients"
      ],
      "nextGate": "Certify every production resource server with negative audience, scope, credential, revocation, timeout, and stale-key canaries."
    },
    {
      "id": "hosted-auth",
      "domain": "Hosted sign-in, sign-up, passwordless, and social identity",
      "status": "partial",
      "userSurface": "Provider exchange plus email and SMS challenge primitives exist; complete hosted journeys, linking, recovery, and callback UX are not certified.",
      "backendEvidence": [
        "shared-auth-api-server.rs",
        "shared-auth-clients"
      ],
      "nextGate": "Publish typed sign-up, recovery, OAuth callback, identity-linking, abuse-control, consent, and accessibility contracts."
    },
    {
      "id": "mfa-step-up",
      "domain": "MFA, TOTP, OTP, 3FA, and step-up",
      "status": "partial",
      "userSurface": "Factor listing, TOTP enrollment and confirmation, email and SMS challenges, and assurance-bearing step-up primitives exist.",
      "backendEvidence": [
        "shared-auth-clients",
        "3FA-app"
      ],
      "nextGate": "Add tenant policy, recovery approvals, reset audit, anti-enumeration, rate limits, and complete customer and admin workflows."
    },
    {
      "id": "passkeys-webauthn",
      "domain": "Passkeys and WebAuthn",
      "status": "partial",
      "userSurface": "Registration and authentication ceremonies carry opaque credential JSON without taking custody of biometric templates.",
      "backendEvidence": [
        "shared-auth-clients",
        "shared-auth-api-server.rs"
      ],
      "nextGate": "Certify RP-ID and origin policy, discoverable credentials, device naming, recovery, deletion, attestation policy, and replay-negative fixtures."
    },
    {
      "id": "customer-security-center",
      "domain": "Customer account and security center",
      "status": "in_review",
      "userSurface": "MASH, Leptos SSR, and Dioxus SSR views read live identity, factor, and capability evidence while unsupported mutations remain disabled.",
      "backendEvidence": [
        "shared-auth-web-server.rs#11"
      ],
      "nextGate": "Pass format, clippy, tests, authorization, cookie, dependency, image, Cloud Run, and Kubernetes admission gates before promotion."
    },
    {
      "id": "organizations-rbac",
      "domain": "Organizations, tenants, invitations, RBAC, and ABAC",
      "status": "planned",
      "userSurface": "Organization switching, invitation lifecycle, memberships, groups, roles, permissions, and tenant policy are requirements, not shipped claims.",
      "backendEvidence": [],
      "nextGate": "Define TypeSpec and JSON Schema as independent peer authorities, normalize and cross-check them, then add ORM, audit, and authorization tests."
    },
    {
      "id": "enterprise-sso",
      "domain": "Enterprise SSO and identity brokering",
      "status": "planned",
      "userSurface": "SAML and enterprise OIDC connections, verified domains, JIT enrollment, metadata rotation, and test-IdP flows are not available yet.",
      "backendEvidence": [],
      "nextGate": "Land protocol, connection lifecycle, domain ownership, signing, encryption, rollback, and conformance contracts before exposing setup controls."
    },
    {
      "id": "directory-sync",
      "domain": "SCIM and directory synchronization",
      "status": "blocked",
      "userSurface": "Provisioning, deprovisioning, groups, role mapping, cursor state, retries, quarantine, and reconciliation UI remain disabled.",
      "backendEvidence": [],
      "nextGate": "Publish SCIM 2.0 and directory connector authorities with idempotency, tombstones, replay handling, audit, and dead-letter recovery."
    },
    {
      "id": "sessions-devices",
      "domain": "Sessions, devices, trusted-device policy, and global logout",
      "status": "planned",
      "userSurface": "A complete session and device inventory with bounded search, revocation, compromise response, and cross-region propagation is not exposed.",
      "backendEvidence": [],
      "nextGate": "Define device identifiers, privacy retention, trust state, revocation fan-out, event ordering, and read-after-write verification."
    },
    {
      "id": "conditional-access",
      "domain": "Conditional access, risk signals, and adaptive challenges",
      "status": "blocked",
      "userSurface": "No deterministic, versioned policy decision and explanation contract is currently available to customer or admin interfaces.",
      "backendEvidence": [],
      "nextGate": "Specify policy inputs, outputs, exceptions, safe degradation, privacy constraints, simulation, and rollback before enforcement controls appear."
    },
    {
      "id": "lifecycle-audit-webhooks",
      "domain": "Lifecycle, audit log, webhooks, and compliance export",
      "status": "partial",
      "userSurface": "Idempotent admin-operation primitives exist, but immutable identity event search, webhook delivery, replay, retention, and signed export views do not.",
      "backendEvidence": [
        "shared-auth-admin-api-server.rs",
        "shared-auth-admin-web-server.rs"
      ],
      "nextGate": "Add retention-aware projections, delivery state, signed exports, privacy filters, redaction tests, and bounded replay authorization."
    },
    {
      "id": "admin-operations",
      "domain": "Isolated IAM administration",
      "status": "in_review",
      "userSurface": "The private MASH, Leptos, and Dioxus console exposes an evidence ledger behind Shared Auth, product grants, and trusted-network admission.",
      "backendEvidence": [
        "shared-auth-admin-web-server.rs#6"
      ],
      "nextGate": "Pass repository-native gates and certify separate admin identities, secrets, database roles, origins, ingress, and audit in both runtimes."
    },
    {
      "id": "developer-platform",
      "domain": "SDKs, machine identities, webhooks, and test environments",
      "status": "partial",
      "userSurface": "Typed clients span several languages, while service-account lifecycle, API credential rotation, webhook tooling, and test-tenant UX remain incomplete.",
      "backendEvidence": [
        "shared-auth-clients",
        "shared-auth-interfaces"
      ],
      "nextGate": "Version machine-principal contracts, credential rotation, webhook signatures, test clocks, fixtures, and generated client parity."
    },
    {
      "id": "branding-accessibility",
      "domain": "Hosted and headless UI, branding, localization, and accessibility",
      "status": "partial",
      "userSurface": "HTML-first SSR shells exist, but theme tokens, localization catalogs, accessibility conformance, and embeddable headless component contracts are incomplete.",
      "backendEvidence": [
        "shared-auth-web-server.rs",
        "shared-auth-admin-web-server.rs"
      ],
      "nextGate": "Add WCAG gates, keyboard and focus suites, localization contracts, CSP-safe theming, and versioned component APIs."
    },
    {
      "id": "multi-cloud-runtime",
      "domain": "Cloudflare, Cloud Run, and Kubernetes resilience",
      "status": "in_review",
      "userSurface": "Exact-host routing and four-service desired state are in review; the production DNS, revisions, workloads, failover, and rollback are not control-plane certified.",
      "backendEvidence": [
        "shared-auth-infra#26",
        "shared-auth-infra#41",
        "oresoftware/k8s-cluster#1452",
        "shared-auth-e2e#34"
      ],
      "nextGate": "Promote immutable digests only after exact-head tests, then prove DNS, TLS, private origin admission, readiness, failover, non-replayed writes, and rollback read-after-write."
    }
  ],
  "taxonomyReferences": [
    {
      "name": "Clerk",
      "url": "https://clerk.com/docs"
    },
    {
      "name": "Supabase Auth",
      "url": "https://supabase.com/docs/guides/auth"
    },
    {
      "name": "Neon Auth",
      "url": "https://neon.com/docs/guides/neon-auth"
    },
    {
      "name": "Okta / Auth0",
      "url": "https://auth0.com/docs"
    },
    {
      "name": "WorkOS",
      "url": "https://workos.com/docs"
    },
    {
      "name": "Stytch",
      "url": "https://stytch.com/docs"
    },
    {
      "name": "Frontegg",
      "url": "https://developers.frontegg.com"
    },
    {
      "name": "Microsoft Entra ID",
      "url": "https://learn.microsoft.com/entra/identity/"
    },
    {
      "name": "Ping Identity",
      "url": "https://docs.pingidentity.com"
    },
    {
      "name": "OneLogin",
      "url": "https://developers.onelogin.com"
    },
    {
      "name": "Keycloak",
      "url": "https://www.keycloak.org/documentation"
    },
    {
      "name": "Ory",
      "url": "https://www.ory.sh/docs"
    },
    {
      "name": "Logto",
      "url": "https://docs.logto.io"
    },
    {
      "name": "SuperTokens",
      "url": "https://supertokens.com/docs"
    }
  ],
  "canonicalMarketingHost": "ores-shared-auth.com",
  "marketingOrigin": {
    "host": "shared-auth.github.io",
    "purpose": "Credential-free GitHub Pages origin and review URL for the Astro artifact",
    "service": "Astro GitHub Pages artifact",
    "exposure": "public origin; no credential handling",
    "certification": "available"
  },
  "hostContract": [
    {
      "host": "ores-shared-auth.com",
      "purpose": "Canonical public marketing site",
      "service": "marketing",
      "surface": "marketing",
      "originPool": null,
      "sitePath": "/",
      "staticOnly": true,
      "exposure": "public through Cloudflare; credential-free static proxy",
      "certification": "in_review"
    },
    {
      "host": "auth.ores-shared-auth.com",
      "purpose": "Hosted authentication journey",
      "service": "auth",
      "surface": "auth",
      "originPool": "auth",
      "sitePath": null,
      "staticOnly": false,
      "exposure": "public through Cloudflare",
      "certification": "partial"
    },
    {
      "host": "app.ores-shared-auth.com",
      "purpose": "Application selector and authenticated handoff",
      "service": "app",
      "surface": "app",
      "originPool": "web",
      "sitePath": "/app",
      "staticOnly": false,
      "exposure": "public through Cloudflare",
      "certification": "partial"
    },
    {
      "host": "user.ores-shared-auth.com",
      "purpose": "Individual login, account, and security UI",
      "service": "user",
      "surface": "user",
      "originPool": "web",
      "sitePath": "/user",
      "staticOnly": false,
      "exposure": "public through Cloudflare; authenticated functions require Shared Auth",
      "certification": "in_review"
    },
    {
      "host": "org.ores-shared-auth.com",
      "purpose": "Organization login, membership, and tenant UI",
      "service": "org",
      "surface": "org",
      "originPool": "web",
      "sitePath": "/org",
      "staticOnly": false,
      "exposure": "public through Cloudflare; tenant functions require membership authorization",
      "certification": "planned"
    },
    {
      "host": "m.ores-shared-auth.com",
      "purpose": "Mobile-first user and organization entry selector",
      "service": "mobile",
      "surface": "mobile",
      "originPool": null,
      "sitePath": "/m",
      "staticOnly": true,
      "exposure": "public through Cloudflare; credential-free static proxy",
      "certification": "in_review"
    },
    {
      "host": "api.ores-shared-auth.com",
      "purpose": "Customer identity and account API",
      "service": "api",
      "surface": "api",
      "originPool": "api",
      "sitePath": null,
      "staticOnly": false,
      "exposure": "public through Cloudflare; endpoint-specific authorization required",
      "certification": "partial"
    },
    {
      "host": "admin.ores-shared-auth.com",
      "purpose": "Operator IAM console",
      "service": "admin",
      "surface": "admin",
      "originPool": "admin-web",
      "sitePath": "/admin",
      "staticOnly": false,
      "exposure": "public DNS; Cloudflare Access, admin identity, product grant, and trusted-network admission required",
      "certification": "in_review"
    },
    {
      "host": "api-admin.ores-shared-auth.com",
      "purpose": "Canonical operator IAM command API",
      "service": "admin-api",
      "surface": "admin-api",
      "originPool": "admin-api",
      "sitePath": null,
      "staticOnly": false,
      "exposure": "public DNS; private service and administrator admission required",
      "certification": "partial"
    },
    {
      "host": "admin-api.ores-shared-auth.com",
      "purpose": "Direct compatibility alias for the operator IAM command API",
      "service": "admin-api",
      "surface": "admin-api",
      "originPool": "admin-api",
      "sitePath": null,
      "staticOnly": false,
      "exposure": "public DNS; same private admission and authority as api-admin",
      "certification": "partial"
    },
    {
      "host": "quote.ores-shared-auth.com",
      "purpose": "Public quote intake handoff",
      "service": "quote",
      "surface": "quote",
      "originPool": "web",
      "sitePath": "/quote",
      "staticOnly": false,
      "exposure": "public through Cloudflare; credential-free static fallback",
      "certification": "partial"
    },
    {
      "host": "pre-interest.ores-shared-auth.com",
      "purpose": "Public early-access interest handoff",
      "service": "pre-interest",
      "surface": "pre-interest",
      "originPool": "web",
      "sitePath": "/pre-interest",
      "staticOnly": false,
      "exposure": "public through Cloudflare; credential-free static fallback",
      "certification": "partial"
    }
  ],
  "statusDefinitions": {
    "available": "Merged repository and test evidence exists; this does not by itself prove a production deployment.",
    "partial": "A bounded primitive exists, but the complete product workflow or operational evidence does not.",
    "in_review": "Implementation is on a pull request and must not be represented as deployed.",
    "planned": "The capability is in scope but no authoritative implementation is claimed.",
    "blocked": "A prerequisite contract, security boundary, persistence model, or control-plane verification is missing."
  }
}