feat(clients): reconcile a closed OIDC audience and session-claim mapper profile

[seonghobae]

Buyer-visible gap

Keyverse now validates and reconciles secret-free OIDC relying-party metadata, but the closed representation deliberately omits Keycloak protocolMappers. Naruon still depends on one audience mapper and bounded role, org, and workspace claims. Because those claims have no reviewed runtime desired-state path, naruon-web remains embedded in the portable realm and cannot be safely recreated from Keyverse after a clean realm rebuild.

Bounded product slice

Extend the existing OIDC RP preflight and desired-state lifecycle with an optional, strictly closed mapper profile:

• accept protocolMappers only as a bounded ordered list of closed ProtocolMapperRepresentation objects;
• require exactly one oidc-audience-mapper when mappers are present;
• pin included.client.audience exactly to the registration clientId;
• permit hardcoded claims only for the product allowlist role, org, and workspace;
• require one canonical mapper name per claim and reject duplicate claim names;
• bound and validate tenant-supplied hardcoded claim values without reflecting hostile input;
• require exact openid-connect protocol, consentRequired=false, and closed boolean claim destinations;
• reject script, user-attribute, regex, group-membership, address, arbitrary claim-name, and unknown mapper types;
• canonicalize mapper order as audience, role, org, workspace;
• normalize Keycloak-observed mapper IDs and ordering before drift comparison;
• preserve zero DNS, HTTP, Keycloak, storage, secret, and file side effects during preflight;
• preserve secret-free desired state, post-mutation re-observation, duplicate fail-closed behavior, remote-first deletion, and canonical receipts;
• add a Naruon runtime RP template without committing tenant-specific clients to the portable realm;
• update architecture, onboarding, operations, CHANGELOG, and APA 7th doctoring.

TDD and realistic verification

Begin with a production-shaped naruon-web registration containing its audience plus role, org, and workspace mappers. The current closed parser must reject it before implementation. Add cases for mapper reordering by Keycloak, generated mapper IDs, duplicate audience, duplicate claim names, wrong audience, unsupported mapper classes, secret-bearing or script configuration, hostile claim values, missing/extra nested fields, and zero side effects.

Completion requires locked installation, Ruff, Interrogate 100%, complete pytest, production statement and branch coverage 100%, package build, realm/Compose/template validation, CodeQL, Semgrep, Security Scan, independent current-head review, zero unresolved review threads, and protected merge.

Standards and vendor basis

Use current OpenID Connect Core audience and claim semantics, RFC 9068 where access-token audience is discussed, RFC 8725 JWT validation guidance, and the current Keycloak Admin REST ClientRepresentation/ProtocolMapperRepresentation contract. Record standards requirements, vendor behavior, stricter product policy, evidence, assumptions, and limitations separately. No formal conformance claim.

Follow-up boundary

After this profile merges, remove ecosystem-rp-template and naruon-web from deploy/keycloak/realm-cwl.json, change the realm validator to reject runtime application clients, and prove clean-realm recovery entirely through Keyverse desired state.

Tracks #2.