build(account-unification): resync uv lockfile

.github/workflows/ci.yml

@@ -26,9 +26,9 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
-          # v9 changed this default to false; retain bounded cache usage.
+          # Keep cache pruning enabled to bound runner disk usage.
           prune-cache: true
       - name: Install locked dependencies
         run: uv sync --locked --extra dev
@@ -38,6 +38,9 @@ jobs:
         run: uv run interrogate .
       - name: Compile Python sources
         run: uv run python -m compileall -q app tests tools
+      - name: Test repository documentation contracts
+        working-directory: ${{ github.workspace }}
+        run: uv run --locked --project services/account_unification --extra dev pytest tests/test_documentation_contract.py -q
       - name: Test and enforce production coverage
         run: |
           uv run coverage run --branch --source=app -m pytest -q

.github/workflows/codeql.yml

@@ -26,8 +26,8 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           languages: python
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

.github/workflows/hourly-product-development.yml

@@ -49,7 +49,7 @@ jobs:
       patch_sha256: ${{ steps.package.outputs.patch_sha256 }}
     steps:
       - name: Harden runner and block undeclared egress
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: block
           disable-telemetry: true
@@ -319,7 +319,7 @@ jobs:
 
       - name: Set up the locked package runner
         if: steps.gate.outputs.develop == 'true'
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           prune-cache: true
 
@@ -639,7 +639,7 @@ jobs:
       publish: ${{ steps.seal.outputs.publish }}
     steps:
       - name: Harden independent verification
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: block
           disable-telemetry: true
@@ -670,7 +670,7 @@ jobs:
           python-version: "3.12"
 
       - name: Set up the independent locked package runner
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           prune-cache: true
 
@@ -780,7 +780,7 @@ jobs:
       pull-requests: read
     steps:
       - name: Harden publication
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: block
           disable-telemetry: true

ARCHITECTURE.md

@@ -114,6 +114,10 @@ private rendered payload
 
 Validation never fetches metadata or discovery documents. Deployment egress
 policy and Keycloak perform remote interaction only after explicit apply.
+Reconciliation compares desired observable fields exactly; the fixed Keycloak
+mask for the known non-observable `clientSecret` field is the sole exception and
+does not prove secret equality. Missing, changed, or unknown fields remain
+drift.
 
 ### LDAP and Active Directory
 

CHANGELOG.md

@@ -55,6 +55,24 @@ Keep a Changelog, and releases use semantic versioning.
 
 ### Changed
 
+- Federation PUT and apply now report `applied_to_keycloak: true` only after a
+  fresh live Keycloak identity-provider observation matches the desired
+  observable representation. Keycloak's fixed mask for the known
+  non-observable `clientSecret` field is accepted without claiming secret
+  equality; mutation or any other observation drift retains desired state for
+  retry.
+- Buyer README and accepted ADRs 0001–0007 now describe Keyverse as a
+  standalone identity leaf/hub, point operators at published OIDC/OAuth
+  2.0, SAML, LDAP, and SCIM contracts, and cite independently opened
+  official records in `docs/REFERENCES.md`. OAuth 2.1 is labeled an IETF
+  Internet-Draft, not a final RFC.
+- Updated the design-only MCP authorization contract to MCP Authorization
+  2026-07-28, RFC 9207 callback-issuer validation, and RFC 9068 JWT
+  access-token header, claim, signature, and algorithm rejection evidence;
+  runtime acceptance remains unimplemented.
+- Added the product/technical gap baseline and its APA 7th doctoring record,
+  including the current exact-head PR/Issue inventory and explicit
+  `gap-not-claimed` runtime and release boundaries.
 - Relying-party deployment controllers now send validated, secret-free metadata
   to Keyverse desired-state PUT instead of applying client representations
   directly to Keycloak; confidential credential placement remains a separate

DOCUMENTATION.md

@@ -14,6 +14,7 @@ Keyverse already has strong feature-specific specifications, doctoring, federati
 | Test strategy | [`docs/TEST_STRATEGY.md`](docs/TEST_STRATEGY.md) |
 | Operability/recovery/release | [`docs/OPERABILITY.md`](docs/OPERABILITY.md) |
 | Requirements/evidence traceability | [`docs/TRACEABILITY.md`](docs/TRACEABILITY.md) |
+| Product and technical gap baseline | [`docs/product-technical-gap-baseline.md`](docs/product-technical-gap-baseline.md) and [`docs/doctoring/product-technical-gap-baseline.md`](docs/doctoring/product-technical-gap-baseline.md) |
 | Architecture decisions | [`docs/adr/README.md`](docs/adr/README.md) |
 | Federation onboarding | [`docs/federation-onboarding.md`](docs/federation-onboarding.md) |
 | RP onboarding | [`docs/rp-onboarding.md`](docs/rp-onboarding.md) |
@@ -34,4 +35,4 @@ Keyverse already has strong feature-specific specifications, doctoring, federati
 - **external-system** — Keycloak/ADFS/LDAP/external OIDC/HR/IGA behavior not implemented by Keyverse itself.
 - **planned** — accepted target without executable implementation.
 
-Open PR #72 OIDC RP claim mapper profile and PR #74 hourly GitHub API remediation remain active-PR until merged. Keyverse's current protected-main desired-state/reconciliation capabilities are documented independently from those changes.
+Open PR #72 OIDC RP claim mapper profile and PR #74 hourly GitHub API remediation remain active-PR until merged. Keyverse's current protected-main desired-state/reconciliation capabilities are documented independently from those changes.