cemililik · Oct 20, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026
diff --git a/.env.example b/.env.example
@@ -63,6 +63,10 @@ ConnectionStrings__PlatformAdmin='Host=localhost;Port=5432;Database=learnstack;U
 ConnectionStrings__OutboxDispatcher='Host=localhost;Port=5432;Database=learnstack;Username=learnstack_outbox_admin;Password=learnstack-outbox-dev'
 
 # ─── Keycloak (two realms per ADR-0004 Amendment 1) ──────────────────────
+# The Development API defaults to the loopback tenant issuer declared in
+# backend/src/LearnStack.Api/appsettings.Development.json. Other deployment modes
+# require an explicit canonical HTTPS issuer; this override goes only to the API.
+# Authentication__Tenant__Issuer=https://identity.example/realms/learnstack
 KEYCLOAK_ADMIN=admin
 KEYCLOAK_ADMIN_PASSWORD=admin-dev-secret
 

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -229,11 +229,52 @@ records verified corrections and two further independent review rounds; the
 records subsequent runtime/proof corrections and their completed reviews. The
 [P02b-3 merge closeout](docs/roadmap/phase-02b-events-auth.md#p02b-3-merge-and-closeout-2026-10-15)
 owns final source/merge and CI verification.
-P02b-4's transactional job infrastructure is implemented under Accepted ADR-0047
-and its lifecycle decisions. ADR-0062/0063 supply the bounded CI implementation.
-The [live Phase 02b status](docs/roadmap/phase-02b-events-auth.md) owns current remediation,
-review and final-source A/B qualification; new source requires both complete
-assignments. Production business and recurrence definitions remain empty.
+**P02b-4 is complete and merged** through
+[PR #32](https://github.com/HodeTech/LearnStack/pull/32) on 2026-10-19. Its
+[merge closeout](docs/roadmap/phase-02b-events-auth.md#p02b-4-merge-and-closeout-2026-10-19)
+records all nine job-runtime steps, three CI steps, independent reviews and both
+complete final-source hosted assignments. Production business and recurrence
+definitions remain empty. **P02b-5's decision package and ADR-0064 are Accepted
+— 2026-10-19**; their
+[decision pass](docs/roadmap/phase-02b-events-auth.md#p02b-5-decision-package-2026-10-19)
+authorizes five implementation steps, each with commit and two fresh independent
+review rounds. Step 1 completes acceptance disclosures and the isolated token
+foundation after both independent review rounds; its
+[record](docs/roadmap/phase-02b-events-auth.md#p02b-5-step-1--token-foundation-2026-10-19)
+owns the verified metric-privacy correction. Step 2 completes the real read-only
+subject after both independent review rounds; its
+[record](docs/roadmap/phase-02b-events-auth.md#p02b-5-step-2--real-read-only-application-subject-2026-10-19)
+owns validation. Step 3 completes attributed reconciliation and subject admission
+after both independent reviews; its
+[record](docs/roadmap/phase-02b-events-auth.md#p02b-5-step-3--attributed-reconciliation-and-subject-admission-2026-10-19)
+owns verified log-emission and default-window test corrections. Step 4 installs
+the complete HTTP boundary and typed contract after both review rounds; its
+[record](docs/roadmap/phase-02b-events-auth.md#p02b-5-step-4--atomic-http-activation-and-contracts-2026-10-19)
+owns validation and completed reviews. Step 5 completes production enforcement
+and both independent review rounds; its
+[local closeout](docs/roadmap/phase-02b-events-auth.md#p02b-5-step-5--local-implementation-and-review-closeout-2026-10-19)
+separates source-bound CI receipts from live PR-head qualification and merge.
+All five steps are locally complete and unmerged. A subsequent
+[review remediation](docs/roadmap/phase-02b-events-auth.md#p02b-5-external-review-remediation-2026-10-20)
+verifies external findings. ADR-0065 is Accepted on 2026-10-20 after maintainer
+review. Its implementation and local proofs are delivered; the remediation
+record owns completed independent correction reviews and current PR-head CI
+qualification. Realm reconciliation, BFF
+sessions and phase exit remain
+P02b-6–8.
+The [second external-review follow-up](docs/roadmap/phase-02b-events-auth.md#p02b-5-second-external-review-follow-up-2026-10-20)
+owns subsequent runtime/proof corrections and their source-bound reviews.
+[ADR-0066](docs/decisions/0066-bounded-tenant-subject-admission.md) is Accepted —
+2026-10-20. Its retained-subject bound, cleanup ownership and closed fault/refusal
+signals are implemented with local runtime/exported proofs. The
+[implementation record](docs/roadmap/phase-02b-events-auth.md#adr-0066-acceptance-and-implementation-2026-10-20)
+owns source-bound validation, independent reviews and final-source CI qualification.
+The [systematic correction record](docs/roadmap/phase-02b-events-auth.md#p02b-5-systematic-proof-and-document-corrections-2026-10-20)
+owns subsequent proof/diagnostic, document and measured CI timing reconciliation;
+all three correction steps and both independent review rounds are complete.
+The live PR handoff owns exact current-source hosted qualification, including
+fresh A/B qualification of the reviewed timing revision under ADR-0063.
+No next packet or merge is authorized by this work.
 Phase 06 retains the full
 renderer/Studio expansion.
 
@@ -444,8 +485,12 @@ Then read the phase that is live and the one it stands on:
   2026-10-13; its merge closeout above owns final verification. P02b-3 is complete
   and merged through PR #31 on 2026-10-15; all six steps and correction bundles
   completed both review rounds. Its merge closeout above owns final verification.
-  The linked phase status owns current P02b-4 remediation, reviews and final-source
-  qualification. P02b-5–8 remain pending; each later packet accepts its gates first.
+  P02b-4 is complete and merged through PR #32 on 2026-10-19; its merge closeout
+  above owns final verification. P02b-5's decision package and ADR-0064 are Accepted;
+  all five implementation steps and both review rounds per step are locally
+  complete and unmerged. Its closeout above owns CI/handoff status. P02b-6–8 remain
+  pending, with each
+  packet accepting its gates first.
 - [docs/roadmap/phase-02d-walking-skeleton.md](docs/roadmap/phase-02d-walking-skeleton.md)
   — complete and merged; the delivered public-site baseline and P02b-0 handoff.
   `02d` sorts after `02b`/`02c` but runs **before** them; the roadmap dependency

diff --git a/README.md b/README.md
@@ -37,7 +37,7 @@ the boundary between customization and capabilities that require platform code.
 
 > **Under active development.** The backend foundation and Education schema are
 > implemented. The first working browser experience is the current milestone;
-> authentication, enrolment, payments and live teaching are still ahead.
+> browser sign-in, enrolment, payments and live teaching are still ahead.
 > See [current status](#where-it-is-today) before trying the local scaffold.
 
 ## What it does
@@ -82,11 +82,18 @@ durable subscriber acceptance, shared inbox/delivery ledger, both real default
 subscriptions and Seeder handoff. Its
 [merge closeout](docs/roadmap/phase-02b-events-auth.md#p02b-3-merge-and-closeout-2026-10-15)
 owns final verification.
-P02b-4's transactional job infrastructure is implemented under Accepted ADR-0047
-and its lifecycle decisions. ADR-0062/0063 supply the bounded CI implementation.
-The [live Phase 02b status](docs/roadmap/phase-02b-events-auth.md) owns current remediation,
-review and final-source A/B qualification; new source requires both complete
-assignments. Production business and recurrence definitions remain empty.
+**P02b-4 is complete and merged** through
+[PR #32](https://github.com/HodeTech/LearnStack/pull/32) on 2026-10-19. Its
+[merge closeout](docs/roadmap/phase-02b-events-auth.md#p02b-4-merge-and-closeout-2026-10-19)
+records all nine job-runtime steps, three CI steps, independent reviews and both
+complete final-source hosted assignments. Production business and recurrence
+definitions remain empty. **P02b-5 API authentication is locally complete and
+unmerged** under Accepted ADR-0064/0065/0066. All five steps completed both independent
+review rounds and verified corrections. Its
+[Step 5 closeout](docs/roadmap/phase-02b-events-auth.md#p02b-5-step-5--local-implementation-and-review-closeout-2026-10-19)
+records implementation, exact CI evidence and final PR-head qualification limits.
+Realm reconciliation, BFF sessions and phase exit remain P02b-6–8; browser sign-in
+is not implemented.
 Phase 02b remains in progress.
 [P02d-1](docs/roadmap/phase-02d-walking-skeleton.md#merge-and-closeout-2026-09-14) is
 **complete and merged**: Education domain, schema and isolation proofs.
@@ -137,14 +144,15 @@ proof pass real CI; the seventh required context is active. The
 owns CI enforcement, reviews and the positive phase-exit verdict.
 [PR #28](https://github.com/HodeTech/LearnStack/pull/28) is merged; the
 [merge closeout](docs/roadmap/phase-02d-walking-skeleton.md#p02d-7-merge-and-closeout-2026-10-11)
-owns final verification. P02b-0 through P02b-3 are complete; the
-[P02b-3 merge closeout](docs/roadmap/phase-02b-events-auth.md#p02b-3-merge-and-closeout-2026-10-15)
-owns final source/merge verification. P02b-3 Steps 1–5 implement durable acceptance,
-shared inbox/ledger, independent subscriber scheduling and both useful defaults
-with semantic Seeder handoff. Its
+owns final verification. P02b-0 through P02b-4 are complete. P02b-0 has an entry
+verification; P02b-1–4 have the merge closeouts above for final source/merge
+verification. P02b-3 Steps 1–5 implement durable
+acceptance, shared inbox/ledger, independent subscriber scheduling and both
+useful defaults with semantic Seeder handoff. Its
 [Step 6 record](docs/roadmap/phase-02b-events-auth.md#p02b-3-step-6--production-enforcement-and-pr-closeout-2026-10-13)
 records completed enforcement/regression and both review rounds for all six steps.
-The merge closeout also records the verified external-review corrections. The
+Its [merge closeout](docs/roadmap/phase-02b-events-auth.md#p02b-3-merge-and-closeout-2026-10-15)
+also records the verified external-review corrections. The
 [P02d-4 decision package](docs/roadmap/phase-02d-walking-skeleton.md#p02d-4-decision-package-2026-10-03)
 is Accepted — 2026-10-03. All four implementation steps and their review loops
 are complete. P02d-5 supplies trusted server rendering; P02d-6 supplies public
@@ -156,7 +164,7 @@ page consumers and P02d-7 the two-host browser demo.
 | **Customization** | Content types, level taxonomies, exact-definition and generation-cached batched display readers, text-card metadata validation, create-only provisioning defaults and semantic built-in seed verification | Remaining authoring capabilities across [Phases 04–08a](docs/roadmap/README.md) |
 | **Audit** | Classified write path and transactional durability for business changes | Operational hardening in [Phase 11](docs/roadmap/phase-11-production-hardening.md) |
 | **Education** | Course and Lesson aggregates, translations, protected-content policy, scoped authoring commands, complete demo seeds and isolated public GET/HEAD reads | Full versioned curriculum in [Phase 05](docs/roadmap/phase-05-education-learning-content.md) |
-| **API foundation** | Error contracts, validation, tenancy, concurrency, observability, transactional event production, hosted producer dispatch and independent durable subscriber delivery | Background jobs and authentication in [Phase 02b](docs/roadmap/phase-02b-events-auth.md) |
+| **API foundation** | Error contracts, validation, tenancy, concurrency, observability, durable events/subscriber delivery, background jobs and the closed tenant bearer/AccountSite boundary | Realm reconciliation and BFF sessions in [Phase 02b](docs/roadmap/phase-02b-events-auth.md) |
 | **Frontend** | Native TLS ingress, live locale entry, trusted server caller, localized catalog/course/lesson pages, safe themes, accessibility controls/manual smoke and generated typed SDK | Full renderer/Studio and Playwright Test/axe in [Phase 06](docs/roadmap/phase-06-renderer-admin-studio.md) |
 
 **Four modules contain domain implementations:** Tenancy, Customization, Audit and
@@ -263,6 +271,12 @@ no-hop API startup remains supported outside this paired renderer recipe; supply
 both `ConnectionStrings:Default` (`learnstack_app`) and
 `ConnectionStrings:OutboxDispatcher` (`learnstack_outbox_admin`). The mandatory
 API worker verifies dispatcher connectivity at startup.
+Supply `Authentication:Tenant:Issuer` too: the canonical HTTPS tenant-realm URL,
+with loopback HTTP allowed only in `Development`. The development configuration
+defaults to `http://localhost:8080/realms/learnstack`; issuer configuration is
+validated without contacting Keycloak at startup. Credential-free public reads
+remain available when Keycloak is stopped. Real realm issuance/reconciliation and
+browser sessions remain P02b-6 and P02b-7 respectively.
 
 **P02d-5 is complete: ingress, visitor budgets and public entry.** The web
 bootstraps the captured host through the API, redirects using enabled/default
@@ -305,7 +319,7 @@ three product surfaces. See the
 | Database | PostgreSQL 18 | Migrations, tenant / organization RLS and integration proofs |
 | Frontend | Next.js 15 · React 19 · TypeScript | App/UI scaffolds; generated SDK and injected transport implemented |
 | Observability | OpenTelemetry · Serilog → OTLP | Cross-cutting backend instrumentation implemented |
-| Identity | Keycloak | Local realms configured; application authentication belongs to Phase 02b |
+| Identity | Keycloak | P02b-5 tenant API bearer boundary active; real realm reconciliation and browser sessions remain P02b-6–7 |
 | Storage and search | SeaweedFS · PostgreSQL full-text search | Selected architecture; feature delivery belongs to Phases 04–05 |
 | Live classroom | LiveKit through a provider adapter | Planned in Phase 08c, starting with Cloud and retaining a self-hosted path |
 

diff --git a/backend/Directory.Packages.props b/backend/Directory.Packages.props
@@ -12,6 +12,7 @@
          range of a high-severity advisory (GHSA-v5pm-xwqc-g5wc); 10.0.12 requires
          2.12.0 or later. -->
     <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.12" />
 
     <!-- EF Core (per-module Infrastructure projects). One servicing release for the
          whole EF set, and every project that references the Npgsql provider references