(causeway) 07/11: docs(openspec): sync secured tertiary action specs

[da...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

danhaywood pushed a commit to branch htmx
in repository https://gitbox.apache.org/repos/asf/causeway.git

commit 7e886e42d6db41eed6e7713770ebb7ad0e3da133
Author: Dan Haywood <da...@haywood-associates.co.uk>
AuthorDate: Fri Sep 4 00:18:04 2026 +0100

    docs(openspec): sync secured tertiary action specs
---
 .../htmx-viewer-local-secman-authentication/spec.md    | 18 +++++++++++++++---
 .../vue-viewer-local-secman-authentication/spec.md     | 12 ++++++++++--
 2 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/openspec/specs/htmx-viewer-local-secman-authentication/spec.md b/openspec/specs/htmx-viewer-local-secman-authentication/spec.md
index 1c876966f5c..ed291d7f658 100644
--- a/openspec/specs/htmx-viewer-local-secman-authentication/spec.md
+++ b/openspec/specs/htmx-viewer-local-secman-authentication/spec.md
@@ -241,22 +241,34 @@ The host MUST use its native current-CSRF POST logout contract for activation an
 - **THEN** the host does not suppress, relabel, or reinterpret that domain action
 
 ### Requirement: Secured Petclinic acceptance runtime
+
 The project SHALL provide a deterministic secured Petclinic application configuration and acceptance suite that exercises the local authentication capability without requiring Wicket, bypass security, OAuth, or a live identity provider.
+The deterministic secured user SHALL receive the established regular-user and configuration-access roles in addition to the Petclinic application role, so authorized framework tertiary actions remain available.
 The existing Petclinic default runtime and comparison journey MUST remain available unchanged by default.
 
 #### Scenario: Secured runtime starts
+
 - **WHEN** the secured Petclinic configuration starts with active CSRF filters and seeded SecMan users
 - **THEN** anonymous HTMX and GraphQL access is protected
 - **AND** the login page remains reachable without GraphQL
 
+#### Scenario: Authorized tertiary actions are preserved
+
+- **WHEN** the deterministic secured user loads the HTMX application menus
+- **THEN** exact framework **Me**, **Configuration**, and Logout actions are present in their authoritative tertiary menu locations
+- **AND** Logout is presented as **Sign out** while **Me** and **Configuration** retain their authoritative labels and identities
+- **AND** the viewer does not synthesize an action that SecMan omits
+
 #### Scenario: Browser authentication journey runs
-- **WHEN** the browser suite exercises invalid login, valid login, a saved deep link, authorized reads and mutations, logout, history, and session expiry
-- **THEN** each transition satisfies the local authentication, CSRF, routing, and confidentiality requirements
+
+- **WHEN** the browser suite exercises invalid login, valid login, a saved deep link, authorized reads and mutations, tertiary framework actions, logout, history, and session expiry
+- **THEN** each transition satisfies the local authentication, authorization, CSRF, routing, and confidentiality requirements
 - **AND** no unexpected browser, GraphQL, HTTP, persistence, or security failure is recorded
 
 #### Scenario: Ordinary Petclinic runtime starts
+
 - **WHEN** the existing default Petclinic application is launched without the optional authentication configuration
-- **THEN** its current HTMX, Wicket comparison, fixture, and bypass behavior remains unchanged
+- **THEN** its current HTMX, Wicket comparison, fixture, tertiary menu, and bypass behavior remains unchanged
 
 ### Requirement: HTMX authentication consumes the shared bridge
 
diff --git a/openspec/specs/vue-viewer-local-secman-authentication/spec.md b/openspec/specs/vue-viewer-local-secman-authentication/spec.md
index 75f2f0fbd14..97477b22105 100644
--- a/openspec/specs/vue-viewer-local-secman-authentication/spec.md
+++ b/openspec/specs/vue-viewer-local-secman-authentication/spec.md
@@ -187,6 +187,7 @@ It MUST NOT claim unrelated Wicket, HTMX, actuator, console, application, or bea
 ### Requirement: Secured Vue Petclinic acceptance runtime
 
 The Vue Petclinic sample SHALL provide a deterministic secured application variant using the same shared domain, production frontend assets, local user credentials, and profile context as secured HTMX.
+The deterministic secured user SHALL receive the established regular-user and configuration-access roles in addition to the Petclinic application role, so authorized framework tertiary actions remain available.
 It SHALL provide integration and headless browser coverage without requiring HTMX, Wicket, bypass security, OAuth, or a live identity provider.
 
 #### Scenario: Secured Vue runtime starts
@@ -195,8 +196,15 @@ It SHALL provide integration and headless browser coverage without requiring HTM
 - **THEN** anonymous Vue and GraphQL access is protected and login remains available without GraphQL
 - **AND** the ordinary Vue runtime remains available through its unchanged profile
 
+#### Scenario: Authorized tertiary actions are preserved
+
+- **WHEN** the deterministic secured user loads the Vue application menus
+- **THEN** exact framework **Me**, **Configuration**, and Logout actions are present in their authoritative tertiary menu locations
+- **AND** Logout is presented as **Sign out** while **Me** and **Configuration** retain their authoritative labels and identities
+- **AND** the viewer does not synthesize an action that SecMan omits
+
 #### Scenario: Secured browser journey runs
 
-- **WHEN** headless automation exercises invalid and valid login, deep-link restoration, authorized reads and mutations, CSRF rejection, host logout, history, and session expiry
-- **THEN** each transition satisfies the authentication, routing, CSRF, and confidentiality contracts
+- **WHEN** headless automation exercises invalid and valid login, deep-link restoration, authorized reads and mutations, tertiary framework actions, CSRF rejection, host logout, history, and session expiry
+- **THEN** each transition satisfies the authentication, authorization, routing, CSRF, and confidentiality contracts
 - **AND** unexpected browser, GraphQL, HTTP, persistence, or security failures fail the suite