diff --git a/docs/plans/2026-03-30-auth-refactor-design.md b/docs/plans/2026-03-30-auth-refactor-design.md
new file mode 100644
index 0000000..daac5a6
--- /dev/null
+++ b/docs/plans/2026-03-30-auth-refactor-design.md
@@ -0,0 +1,313 @@
+# TMS Auth Refactor Design
+
+**Date:** 2026-03-30
+
+## Goal
+
+在 `tms-framework` 中重构认证模块，完整承接旧管理端的认证标准流程，但只保留一套新规范接口与一套实现代码。重构范围只调整接口命名、DTO 字段命名、控制器职责和数据模型表达方式，不改变旧系统的业务判断顺序和安全规则。
+
+## Confirmed Scope
+
+本设计覆盖：
+
+- `SUPER_ADMIN / KEY_ADMIN / AUDIT_ADMIN / OPS_ADMIN` 四个正式角色
+- 口令登录与 UKey 登录两条标准流程
+- 角色启用、重置密码、UKey 发行签名、UKey 绑定
+- 当前会话、退出登录、修改密码
+- `modules/auth/controller` 最终只保留新规范接口
+
+本设计不覆盖：
+
+- 前端页面重构
+- PCIe / UKey 底层驱动实现重写
+- 主密钥业务规则调整
+- `/openapi/**` 外部接口鉴权模型
+
+## Legacy Semantics To Preserve
+
+### 1. Four main roles
+
+旧系统主角色与新系统角色一一对应：
+
+- `superadmin -> SUPER_ADMIN`
+- `keyadmin -> KEY_ADMIN`
+- `auditadmin -> AUDIT_ADMIN`
+- `configadmin -> OPS_ADMIN`
+
+### 2. UKey login is the standard full-auth flow
+
+旧系统对上述四个主角色的标准登录方式是 `UKey + 角色口令`。
+
+固定 UKey 数量要求：
+
+- `SUPER_ADMIN` 需要 3 把 UKey
+- `KEY_ADMIN` 需要 2 把 UKey
+- `AUDIT_ADMIN` 需要 1 把 UKey
+- `OPS_ADMIN` 需要 1 把 UKey
+
+旧系统 UKey 登录必须保留的校验顺序：
+
+1. 角色与 `rid` 组合匹配
+2. UKey 发行签名校验
+3. `uid/rid` 与角色认证信息匹配
+4. 主密钥状态校验
+5. 后端随机数校验
+6. 登录签名校验
+7. 白名单校验
+8. 角色口令校验
+
+### 3. Password login is a limited-auth flow
+
+旧系统存在口令登录链路。新系统不再保留 `KEY_ADMIN_A / KEY_ADMIN_B / auditadmin_user / configadmin_user` 这样的历史角色代码，而是将其收敛为四个主角色在 `LIMITED` 认证等级下的登录结果。
+
+也就是说：
+
+- 口令登录成功 -> 同一主角色的 `LIMITED` 会话
+- UKey 登录成功 -> 同一主角色的 `FULL` 会话
+
+### 4. UKey binding is still a two-step process
+
+旧系统“绑定角色 UKey”本质上是：
+
+1. 生成发行签名
+2. 绑定落库 / 写卡完成后的登记
+
+这个两步流程必须保留，只是统一为新接口命名。
+
+## Domain Model
+
+### Roles
+
+只保留四个正式角色枚举：
+
+- `SUPER_ADMIN`
+- `KEY_ADMIN`
+- `AUDIT_ADMIN`
+- `OPS_ADMIN`
+
+### AuthMethod
+
+- `PASSWORD`
+- `UKEY`
+
+### AuthLevel
+
+- `LIMITED`
+- `FULL`
+
+关系约束：
+
+- `PASSWORD -> LIMITED`
+- `UKEY -> FULL`
+
+`roleCode` 表达“是谁”，`authLevel` 表达“当前认证强度”。接口权限只基于 `roleCode + authLevel` 判断，不再通过附加影子角色表达。
+
+## API Contract
+
+只保留新规范路径，不再保留兼容旧路径控制器。
+
+### Authentication APIs
+
+- `POST /api/v1/auth/password-login`
+- `POST /api/v1/auth/ukey-login/randoms`
+- `POST /api/v1/auth/ukey-login`
+- `POST /api/v1/auth/captcha`
+- `GET /api/v1/auth/me`
+- `POST /api/v1/auth/logout`
+- `POST /api/v1/auth/change-password`
+
+#### password-login
+
+入参：
+
+- `roleCode`
+- `password`
+- `captchaCode`
+- `captchaId`
+
+行为：
+
+- 按旧口令登录顺序校验主密钥状态、验证码、密码和失败次数
+- 成功后签发该角色的 `LIMITED` 会话
+
+#### ukey-login/randoms
+
+入参：
+
+- `roleCode`
+
+行为：
+
+- 按角色要求下发固定数量随机数
+
+#### ukey-login
+
+入参：
+
+- `roleCode`
+- `password`
+- `ukeyProofs[]`
+
+单个 `ukeyProofs[]` 项包含：
+
+- `pubKey`
+- `uid`
+- `rid`
+- `serverRandom`
+- `issueSignature`
+- `loginPayload`
+- `loginSignature`
+
+行为：
+
+- 完整保留旧项目 UKey 登录校验顺序
+- 成功后签发 `FULL` 会话
+
+### Role Administration APIs
+
+- `POST /api/v1/auth/roles/{roleCode}/enable`
+- `POST /api/v1/auth/roles/{roleCode}/reset-password`
+- `POST /api/v1/auth/roles/{roleCode}/ukeys/issue-sign`
+- `POST /api/v1/auth/roles/{roleCode}/ukeys/bind`
+
+这些接口统一要求：
+
+- `KEY_ADMIN`
+- `FULL`
+
+## Data Model
+
+### 1. tms_auth_role_account
+
+统一角色账户表，只保留四个主角色：
+
+- `role_code`
+- `display_name`
+- `required_ukey_count`
+- `password_hash`
+- `password_salt`
+- `status`
+- `need_change_password`
+- `failed_count`
+- `locked_until`
+- `last_login_at`
+- `last_active_at`
+
+### 2. tms_auth_role_ukey_binding
+
+统一 UKey 绑定表：
+
+- `role_code`
+- `slot_no`
+- `uid`
+- `rid`
+- `ukey_serial`
+- `ukey_pubkey`
+- `issuer_sign`
+- `status`
+- `bound_at`
+- `unbound_at`
+
+`slot_no`、`uid`、`rid` 是承接旧系统流程的必要字段，不能省略。
+
+### 3. tms_auth_session
+
+统一会话表：
+
+- `session_token`
+- `role_code`
+- `auth_method`
+- `auth_level`
+- `issued_at`
+- `last_active_at`
+- `expires_at`
+- `logout_at`
+
+### 4. Captcha storage
+
+验证码优先继续使用内存缓存，不在本次设计中新增持久化表。
+
+## Controller Structure
+
+`modules/auth/controller` 最终只保留一套规范控制器：
+
+- `AuthController`
+  - 认证、当前会话、修改密码
+- `AuthAdminController`
+  - 角色管理、UKey 发行签名、UKey 绑定
+
+删除：
+
+- `CompatAuthController`
+
+## Service Structure
+
+建议保留三类核心服务职责：
+
+- `AuthService`
+  - `passwordLogin`
+  - `ukeyLogin`
+  - `issueUkeyLoginRandoms`
+  - `issueCaptcha`
+  - `me`
+  - `logout`
+  - `changePassword`
+- `AuthAdminService`
+  - `enableRole`
+  - `resetPassword`
+  - `issueUkeyBindingSign`
+  - `bindIssuedUkey`
+- `AuthPolicyService`
+  - 角色 UKey 数要求
+  - `LIMITED/FULL` 接口权限策略
+  - 主角色与旧登录规则映射
+
+## Security and Permission Rules
+
+新系统的权限表达统一为：
+
+- `roleCode`
+- `authLevel`
+
+示例：
+
+- `KEY_ADMIN + FULL` 可启用角色、重置角色口令、绑定 UKey
+- `KEY_ADMIN + LIMITED` 只能访问受限密钥管理接口
+- `AUDIT_ADMIN + LIMITED` 只能访问受限审计接口
+- `AUDIT_ADMIN + FULL` 可访问完整审计接口
+- `OPS_ADMIN + LIMITED` 只能访问受限运维接口
+- `OPS_ADMIN + FULL` 可访问完整运维接口
+- `SUPER_ADMIN + FULL` 才能访问最高敏感操作
+
+## Migration Strategy
+
+本次重构不是保留旧接口再适配，而是：
+
+1. 只保留新接口
+2. 在服务层完整承接旧业务流程
+3. 删除 `CompatAuthController` 及其兼容 DTO/测试
+4. 通过数据库迁移补齐 `uid/rid/auth_method/auth_level` 等字段
+
+## Testing Strategy
+
+至少覆盖：
+
+- 口令登录成功签发 `LIMITED`
+- UKey 登录成功签发 `FULL`
+- UKey 数量不足失败
+- `rid` 组合不匹配失败
+- 发行签名校验失败
+- 登录签名校验失败
+- 主密钥未就绪失败
+- 角色启用、重置密码、绑定 UKey 权限限制
+- 删除兼容控制器后 OpenAPI 与控制器测试同步更新
+
+## Final Decision
+
+本次 auth 重构最终基线为：
+
+- 只保留新规范接口
+- 只保留四个正式角色
+- 保留两条标准登录流程
+- 使用 `authLevel` 区分认证强度和接口权限
+- `auth/controller` 仅保留一套规范控制器实现
diff --git a/docs/plans/2026-03-30-auth-refactor-plan.md b/docs/plans/2026-03-30-auth-refactor-plan.md
new file mode 100644
index 0000000..f07e99d
--- /dev/null
+++ b/docs/plans/2026-03-30-auth-refactor-plan.md
@@ -0,0 +1,401 @@
+# Auth Refactor Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
+
+**Goal:** Refactor `modules/auth` to keep only the new standardized auth API while preserving the legacy password-login and UKey-login business rules for the four main roles.
+
+**Architecture:** Keep one canonical auth module built around four roles plus `AuthLevel`, split standardized controllers for session and admin actions, and move all old flow compatibility into the service layer instead of keeping compatibility endpoints. Preserve legacy verification order for UKey login and password-login safety checks while normalizing DTO names, entity fields, and mapper contracts.
+
+**Tech Stack:** Spring Boot, MyBatis, Flyway, Jakarta Validation, JUnit 5, Maven
+
+---
+
+### Task 1: Lock the domain model to four roles plus auth level
+
+**Files:**
+- Modify: `src/main/java/com/cisd/tms/modules/auth/enums/RoleCode.java`
+- Create: `src/main/java/com/cisd/tms/modules/auth/enums/AuthMethod.java`
+- Modify: `src/main/java/com/cisd/tms/modules/auth/enums/AuthLevel.java`
+- Create: `src/main/java/com/cisd/tms/modules/auth/service/AuthPolicyService.java`
+- Test: `src/test/java/com/cisd/tms/modules/auth/service/AuthDomainModelTest.java`
+
+**Step 1: Write the failing test**
+
+Add assertions that:
+- `RoleCode` only exposes `SUPER_ADMIN`, `KEY_ADMIN`, `AUDIT_ADMIN`, `OPS_ADMIN`
+- each role has the correct required UKey count
+- `PASSWORD` maps to `LIMITED`
+- `UKEY` maps to `FULL`
+
+**Step 2: Run test to verify it fails**
+
+Run: `mvn -q -Dtest=AuthDomainModelTest test`
+Expected: FAIL because role/auth-method policy is not fully modeled yet.
+
+**Step 3: Write minimal implementation**
+
+Implement:
+- `AuthMethod` enum
+- updated `RoleCode`
+- minimal `AuthPolicyService` helpers such as:
+  - `requiredUkeyCount(roleCode)`
+  - `authLevelFor(method)`
+
+**Step 4: Run test to verify it passes**
+
+Run: `mvn -q -Dtest=AuthDomainModelTest test`
+Expected: PASS
+
+**Step 5: Commit**
+
+```bash
+git add src/main/java/com/cisd/tms/modules/auth/enums/RoleCode.java src/main/java/com/cisd/tms/modules/auth/enums/AuthMethod.java src/main/java/com/cisd/tms/modules/auth/enums/AuthLevel.java src/main/java/com/cisd/tms/modules/auth/service/AuthPolicyService.java src/test/java/com/cisd/tms/modules/auth/service/AuthDomainModelTest.java
+git commit -m "refactor: normalize auth role domain model"
+```
+
+### Task 2: Normalize request and response DTOs to the new API contract
+
+**Files:**
+- Create: `src/main/java/com/cisd/tms/modules/auth/dto/PasswordLoginRequest.java`
+- Create: `src/main/java/com/cisd/tms/modules/auth/dto/UkeyLoginRequest.java`
+- Create: `src/main/java/com/cisd/tms/modules/auth/dto/UkeyLoginProof.java`
+- Create: `src/main/java/com/cisd/tms/modules/auth/dto/UkeyLoginRandomRequest.java`
+- Modify: `src/main/java/com/cisd/tms/modules/auth/dto/UkeyLoginRandomResponse.java`
+- Create: `src/main/java/com/cisd/tms/modules/auth/dto/CaptchaResponse.java`
+- Modify: `src/main/java/com/cisd/tms/modules/auth/dto/UkeyBindRequest.java`
+- Modify: `src/main/java/com/cisd/tms/modules/auth/dto/CurrentUserResponse.java`
+- Delete: `src/main/java/com/cisd/tms/modules/auth/dto/CompatPasswordLoginRequest.java`
+- Delete: `src/main/java/com/cisd/tms/modules/auth/dto/CompatUkeyLoginRequest.java`
+- Test: `src/test/java/com/cisd/tms/modules/auth/controller/AuthControllerTest.java`
+
+**Step 1: Write the failing test**
+
+Add controller-request binding tests covering:
+- `POST /api/v1/auth/password-login`
+- `POST /api/v1/auth/ukey-login/randoms`
+- `POST /api/v1/auth/ukey-login`
+- request validation failures for missing `roleCode`, missing captcha fields, and missing UKey proof fields
+
+**Step 2: Run test to verify it fails**
+
+Run: `mvn -q -Dtest=AuthControllerTest test`
+Expected: FAIL because controller methods and DTOs still use the old contract.
+
+**Step 3: Write minimal implementation**
+
+Introduce the standardized DTOs with field names:
+- `roleCode`
+- `captchaCode`
+- `captchaId`
+- `ukeyProofs`
+- proof fields `pubKey`, `uid`, `rid`, `serverRandom`, `issueSignature`, `loginPayload`, `loginSignature`
+
+Update `UkeyBindRequest` to include `slotNo`, `ukeySerial`, `pubKey`, `uid`, `rid`, `issuerSignature`.
+
+**Step 4: Run test to verify it passes**
+
+Run: `mvn -q -Dtest=AuthControllerTest test`
+Expected: PASS
+
+**Step 5: Commit**
+
+```bash
+git add src/main/java/com/cisd/tms/modules/auth/dto/PasswordLoginRequest.java src/main/java/com/cisd/tms/modules/auth/dto/UkeyLoginRequest.java src/main/java/com/cisd/tms/modules/auth/dto/UkeyLoginProof.java src/main/java/com/cisd/tms/modules/auth/dto/UkeyLoginRandomRequest.java src/main/java/com/cisd/tms/modules/auth/dto/UkeyLoginRandomResponse.java src/main/java/com/cisd/tms/modules/auth/dto/CaptchaResponse.java src/main/java/com/cisd/tms/modules/auth/dto/UkeyBindRequest.java src/main/java/com/cisd/tms/modules/auth/dto/CurrentUserResponse.java src/test/java/com/cisd/tms/modules/auth/controller/AuthControllerTest.java
+git commit -m "refactor: standardize auth api dto contract"
+```
+
+### Task 3: Extend persistence model for legacy UKey semantics
+
+**Files:**
+- Modify: `src/main/java/com/cisd/tms/modules/auth/entity/RoleUkeyBindingEntity.java`
+- Modify: `src/main/java/com/cisd/tms/modules/auth/entity/AuthSessionEntity.java`
+- Modify: `src/main/java/com/cisd/tms/modules/auth/mapper/RoleUkeyBindingMapper.java`
+- Modify: `src/main/java/com/cisd/tms/modules/auth/mapper/AuthSessionMapper.java`
+- Modify: `src/main/resources/mapper/auth/RoleUkeyBindingMapper.xml`
+- Modify: `src/main/resources/mapper/auth/AuthSessionMapper.xml`
+- Create: `src/main/resources/db/migration/V12__refactor_auth_login_model.sql`
+- Test: `src/test/java/com/cisd/tms/modules/auth/service/AuthServiceTest.java`
+
+**Step 1: Write the failing test**
+
+Add service-level tests asserting:
+- UKey binding records preserve `uid` and `rid`
+- sessions persist `authMethod` and `authLevel`
+
+**Step 2: Run test to verify it fails**
+
+Run: `mvn -q -Dtest=AuthServiceTest test`
+Expected: FAIL because entities and mappers do not yet expose the new fields.
+
+**Step 3: Write minimal implementation**
+
+Add:
+- `uid`, `rid` to `RoleUkeyBindingEntity` and mapper XML
+- `authMethod` to `AuthSessionEntity` and mapper XML
+- Flyway migration to add the new columns and seed/normalize existing auth rows if needed
+
+**Step 4: Run test to verify it passes**
+
+Run: `mvn -q -Dtest=AuthServiceTest test`
+Expected: PASS
+
+**Step 5: Commit**
+
+```bash
+git add src/main/java/com/cisd/tms/modules/auth/entity/RoleUkeyBindingEntity.java src/main/java/com/cisd/tms/modules/auth/entity/AuthSessionEntity.java src/main/java/com/cisd/tms/modules/auth/mapper/RoleUkeyBindingMapper.java src/main/java/com/cisd/tms/modules/auth/mapper/AuthSessionMapper.java src/main/resources/mapper/auth/RoleUkeyBindingMapper.xml src/main/resources/mapper/auth/AuthSessionMapper.xml src/main/resources/db/migration/V12__refactor_auth_login_model.sql src/test/java/com/cisd/tms/modules/auth/service/AuthServiceTest.java
+git commit -m "refactor: persist normalized auth login model"
+```
+
+### Task 4: Refactor AuthService into explicit password-login and UKey-login flows
+
+**Files:**
+- Modify: `src/main/java/com/cisd/tms/modules/auth/service/AuthService.java`
+- Modify: `src/main/java/com/cisd/tms/modules/auth/service/UkeyLoginRandomService.java`
+- Modify: `src/main/java/com/cisd/tms/modules/auth/service/InMemoryUkeyLoginRandomService.java`
+- Create: `src/main/java/com/cisd/tms/modules/auth/service/CaptchaService.java`
+- Create: `src/main/java/com/cisd/tms/modules/auth/service/InMemoryCaptchaService.java`
+- Modify: `src/test/java/com/cisd/tms/modules/auth/service/AuthServiceTest.java`
+
+**Step 1: Write the failing test**
+
+Add tests for:
+- password login returns `LIMITED`
+- UKey login returns `FULL`
+- wrong captcha fails password login
+- wrong UKey count fails UKey login
+- wrong auth level is stored in session if service logic is broken
+
+**Step 2: Run test to verify it fails**
+
+Run: `mvn -q -Dtest=AuthServiceTest test`
+Expected: FAIL because `AuthService` still uses the generic old login shape.
+
+**Step 3: Write minimal implementation**
+
+Refactor service methods to explicit operations:
+- `passwordLogin(PasswordLoginRequest request)`
+- `issueUkeyLoginRandoms(UkeyLoginRandomRequest request)`
+- `ukeyLogin(UkeyLoginRequest request)`
+- `issueCaptcha()`
+
+Preserve old business order:
+- password flow validates master key, captcha, password, failure count, and status
+- UKey flow validates count, role/rid combination, issuer signature, auth info, randoms, login signature, whitelist, master key, and role password
+
+**Step 4: Run test to verify it passes**
+
+Run: `mvn -q -Dtest=AuthServiceTest test`
+Expected: PASS
+
+**Step 5: Commit**
+
+```bash
+git add src/main/java/com/cisd/tms/modules/auth/service/AuthService.java src/main/java/com/cisd/tms/modules/auth/service/UkeyLoginRandomService.java src/main/java/com/cisd/tms/modules/auth/service/InMemoryUkeyLoginRandomService.java src/main/java/com/cisd/tms/modules/auth/service/CaptchaService.java src/main/java/com/cisd/tms/modules/auth/service/InMemoryCaptchaService.java src/test/java/com/cisd/tms/modules/auth/service/AuthServiceTest.java
+git commit -m "refactor: split password and ukey auth flows"
+```
+
+### Task 5: Refactor AuthAdminService around standardized role and UKey admin APIs
+
+**Files:**
+- Modify: `src/main/java/com/cisd/tms/modules/auth/service/AuthAdminService.java`
+- Modify: `src/main/java/com/cisd/tms/modules/auth/repository/RoleUkeyBindingRepository.java`
+- Modify: `src/main/java/com/cisd/tms/modules/auth/repository/impl/RoleUkeyBindingRepositoryImpl.java`
+- Modify: `src/test/java/com/cisd/tms/modules/auth/service/AuthAdminServiceTest.java`
+
+**Step 1: Write the failing test**
+
+Add tests covering:
+- `KEY_ADMIN + FULL` can enable another role
+- `KEY_ADMIN + FULL` can reset password
+- `KEY_ADMIN + FULL` can issue UKey binding sign
+- `KEY_ADMIN + FULL` can bind UKey with `uid/rid/issuerSignature`
+- `KEY_ADMIN + LIMITED` is rejected
+
+**Step 2: Run test to verify it fails**
+
+Run: `mvn -q -Dtest=AuthAdminServiceTest test`
+Expected: FAIL because service still reflects the old compat split.
+
+**Step 3: Write minimal implementation**
+
+Refactor admin methods so they accept:
+- `roleCode`
+- `slotNo`
+- `ukeySerial`
+- `pubKey`
+- `uid`
+- `rid`
+- `issuerSignature`
+
+Ensure slot validation follows role UKey counts and binding updates are overwrite-by-role-and-slot.
+
+**Step 4: Run test to verify it passes**
+
+Run: `mvn -q -Dtest=AuthAdminServiceTest test`
+Expected: PASS
+
+**Step 5: Commit**
+
+```bash
+git add src/main/java/com/cisd/tms/modules/auth/service/AuthAdminService.java src/main/java/com/cisd/tms/modules/auth/repository/RoleUkeyBindingRepository.java src/main/java/com/cisd/tms/modules/auth/repository/impl/RoleUkeyBindingRepositoryImpl.java src/test/java/com/cisd/tms/modules/auth/service/AuthAdminServiceTest.java
+git commit -m "refactor: standardize auth admin role and ukey actions"
+```
+
+### Task 6: Collapse controller layer to one standardized API surface
+
+**Files:**
+- Modify: `src/main/java/com/cisd/tms/modules/auth/controller/AuthController.java`
+- Create: `src/main/java/com/cisd/tms/modules/auth/controller/AuthAdminController.java`
+- Delete: `src/main/java/com/cisd/tms/modules/auth/controller/CompatAuthController.java`
+- Delete: `src/test/java/com/cisd/tms/modules/auth/controller/CompatAuthControllerTest.java`
+- Modify: `src/test/java/com/cisd/tms/modules/auth/controller/AuthControllerTest.java`
+
+**Step 1: Write the failing test**
+
+Add controller tests for:
+- `POST /api/v1/auth/password-login`
+- `POST /api/v1/auth/ukey-login/randoms`
+- `POST /api/v1/auth/ukey-login`
+- `POST /api/v1/auth/captcha`
+- `POST /api/v1/auth/roles/{roleCode}/enable`
+- `POST /api/v1/auth/roles/{roleCode}/reset-password`
+- `POST /api/v1/auth/roles/{roleCode}/ukeys/issue-sign`
+- `POST /api/v1/auth/roles/{roleCode}/ukeys/bind`
+
+**Step 2: Run test to verify it fails**
+
+Run: `mvn -q -Dtest=AuthControllerTest test`
+Expected: FAIL because the endpoints are still split across standard and compat controllers.
+
+**Step 3: Write minimal implementation**
+
+Keep only:
+- `AuthController` for session-facing endpoints
+- `AuthAdminController` for role/UKey admin endpoints
+
+Delete `CompatAuthController` and route all supported behavior through the new API paths.
+
+**Step 4: Run test to verify it passes**
+
+Run: `mvn -q -Dtest=AuthControllerTest test`
+Expected: PASS
+
+**Step 5: Commit**
+
+```bash
+git add src/main/java/com/cisd/tms/modules/auth/controller/AuthController.java src/main/java/com/cisd/tms/modules/auth/controller/AuthAdminController.java src/test/java/com/cisd/tms/modules/auth/controller/AuthControllerTest.java
+git rm src/main/java/com/cisd/tms/modules/auth/controller/CompatAuthController.java src/test/java/com/cisd/tms/modules/auth/controller/CompatAuthControllerTest.java
+git commit -m "refactor: keep one standardized auth controller surface"
+```
+
+### Task 7: Update internal authorization to use role plus auth level
+
+**Files:**
+- Modify: `src/main/java/com/cisd/tms/modules/auth/security/InternalAuthorizationInterceptor.java`
+- Modify: `src/main/java/com/cisd/tms/modules/auth/security/RequireRole.java`
+- Modify: `src/main/java/com/cisd/tms/modules/auth/security/RequireAuthLevel.java`
+- Modify: `src/test/java/com/cisd/tms/modules/auth/security/InternalAuthorizationInterceptorTest.java`
+
+**Step 1: Write the failing test**
+
+Add tests asserting:
+- a `LIMITED` session is denied for `FULL` endpoints
+- role-only mismatch is denied
+- `KEY_ADMIN + FULL` is accepted for admin endpoints
+
+**Step 2: Run test to verify it fails**
+
+Run: `mvn -q -Dtest=InternalAuthorizationInterceptorTest test`
+Expected: FAIL because endpoint requirements and session mapping still reflect the pre-refactor shape.
+
+**Step 3: Write minimal implementation**
+
+Make interceptor decisions solely from:
+- session `roleCode`
+- session `authLevel`
+
+Remove any remaining dependency on compat endpoint semantics.
+
+**Step 4: Run test to verify it passes**
+
+Run: `mvn -q -Dtest=InternalAuthorizationInterceptorTest test`
+Expected: PASS
+
+**Step 5: Commit**
+
+```bash
+git add src/main/java/com/cisd/tms/modules/auth/security/InternalAuthorizationInterceptor.java src/main/java/com/cisd/tms/modules/auth/security/RequireRole.java src/main/java/com/cisd/tms/modules/auth/security/RequireAuthLevel.java src/test/java/com/cisd/tms/modules/auth/security/InternalAuthorizationInterceptorTest.java
+git commit -m "refactor: enforce auth by role and auth level"
+```
+
+### Task 8: Remove obsolete compat code and refresh docs
+
+**Files:**
+- Delete: `src/main/java/com/cisd/tms/modules/auth/service/CompatAuthService.java`
+- Delete: `src/main/java/com/cisd/tms/modules/auth/dto/CompatPasswordLoginRequest.java`
+- Delete: `src/main/java/com/cisd/tms/modules/auth/dto/CompatUkeyLoginRequest.java`
+- Delete: `src/test/java/com/cisd/tms/modules/auth/service/CompatAuthServiceTest.java`
+- Modify: `docs/plans/2026-03-23-auth-role-ukey-design.md`
+- Modify: `docs/openapi/cisd-init.openapi.yaml`
+- Modify: `docs/openapi/cisd-init.openapi.json`
+- Test: `src/test/java/com/cisd/tms/modules/auth/controller/AuthControllerTest.java`
+
+**Step 1: Write the failing test**
+
+Add an assertion in controller-level tests or OpenAPI export verification that only the standardized endpoints remain documented.
+
+**Step 2: Run test to verify it fails**
+
+Run: `mvn -q -Dtest=AuthControllerTest test`
+Expected: FAIL because compat artifacts or docs are still present.
+
+**Step 3: Write minimal implementation**
+
+Remove obsolete compat classes and update documentation to describe:
+- four roles only
+- `LIMITED/FULL`
+- `password-login` and `ukey-login` standardized endpoints
+
+**Step 4: Run test to verify it passes**
+
+Run: `mvn -q -Dtest=AuthControllerTest test`
+Expected: PASS
+
+**Step 5: Commit**
+
+```bash
+git rm src/main/java/com/cisd/tms/modules/auth/service/CompatAuthService.java src/main/java/com/cisd/tms/modules/auth/dto/CompatPasswordLoginRequest.java src/main/java/com/cisd/tms/modules/auth/dto/CompatUkeyLoginRequest.java src/test/java/com/cisd/tms/modules/auth/service/CompatAuthServiceTest.java
+git add docs/plans/2026-03-23-auth-role-ukey-design.md docs/openapi/cisd-init.openapi.yaml docs/openapi/cisd-init.openapi.json src/test/java/com/cisd/tms/modules/auth/controller/AuthControllerTest.java
+git commit -m "refactor: remove auth compat surface and refresh docs"
+```
+
+### Task 9: Final verification
+
+**Files:**
+- Verify only
+
+**Step 1: Run focused auth test suite**
+
+Run: `mvn -q -Dtest=AuthControllerTest,AuthServiceTest,AuthAdminServiceTest,AuthDomainModelTest,InternalAuthorizationInterceptorTest test`
+Expected: PASS
+
+**Step 2: Run full auth package compile verification**
+
+Run: `mvn -q -DskipTests compile`
+Expected: PASS
+
+**Step 3: Review final behavior against design**
+
+Confirm:
+- only four roles remain
+- `password-login` issues `LIMITED`
+- `ukey-login` issues `FULL`
+- no compat controller remains
+- UKey binding preserves `slotNo/uid/rid/issuerSignature`
+
+**Step 4: Commit verification touch-ups if needed**
+
+```bash
+git add .
+git commit -m "test: finalize auth refactor verification"
+```