keycloak-wallet-authenticator

Proof discipline for the W3-Auth backend and its SDKs. Use this whenever reporting test results, build status, or whether something is "done" — anything that claims tests pass, a Testcontainers or Anvil run succeeded, a build is green, or a feature is complete. ALSO use it whenever writing, reviewing, or pinning ANY cryptographic constant or test vector (addresses, hashes, signatures, public keys, bytecode, checksummed hex, golden vectors). Also use it before closing out a work session. Forces every claim to be checked against a real artifact (HTML report, git diff, Redis output, docker ps) instead of a console total or a remembered number.

Architecture guardrails for the W3-Auth wallet-authentication backend. Use this whenever adding or changing code, deciding where new code belongs, naming a package, or considering a new interface, abstraction, Gradle module, dependency, or registry. Apply it before writing the code, not after. Encodes the locked CAIP-10 identity model, the core/infra layer boundaries enforced by ArchUnit, the ephemeral-vs-durable split, and the rule of three. If a request would weaken any of these, push back first.

How to write docs/ANTIGRAVITY_JOURNAL.md entries for the W3-Auth backend. Use this whenever finishing a step or feature and writing its journal entry, or just before a milestone merge. Also use it when updating the journal's big-picture section after a structural change. Encodes the two-part structure, the two-commit citation rule (code first, journal entry second citing the code hash), and the What / Why-with-rejected-alternative / Learned / Open-next entry format written from the diff, not from memory.

Security review checklist for the W3-Auth backend's crypto and auth paths. Use this whenever writing or reviewing code in the challenge, verification, or session packages, or anything touching SIWE messages, signature verification (ecrecover / EIP-1271 / EIP-6492), nonces, JWTs, or refresh tokens. Also use it when adding tests for those paths or when tempted to change a production setting to make a test pass. Demands failure-path tests and blocks the common "false fix" footguns.