nold-ai · djm81 · Mar 4, 2026 · Mar 2, 2026 · Mar 2, 2026 · Mar 2, 2026
diff --git a/docs/adapters/azuredevops.md b/docs/adapters/azuredevops.md
@@ -131,15 +131,15 @@ The adapter supports multiple authentication methods (in order of precedence):
 
 1. **Explicit token**: `api_token` parameter or `--ado-token` CLI flag
 2. **Environment variable**: `AZURE_DEVOPS_TOKEN` (also accepts `ADO_TOKEN` or `AZURE_DEVOPS_PAT`)
-3. **Stored auth token**: `specfact auth azure-devops` (device code flow or PAT token)
+3. **Stored auth token**: `specfact backlog auth azure-devops` (device code flow or PAT token)
 
 **Token Resolution Priority**:
 
 When using ADO commands, tokens are resolved in this order:
 
 1. Explicit `--ado-token` parameter
 2. `AZURE_DEVOPS_TOKEN` environment variable
-3. Stored token via `specfact auth azure-devops`
+3. Stored token via `specfact backlog auth azure-devops`
 4. Expired stored token (shows warning with options to refresh)
 
 **Token Types**:

diff --git a/docs/adapters/github.md b/docs/adapters/github.md
@@ -74,7 +74,7 @@ The adapter supports multiple authentication methods (in order of precedence):
 
 1. **Explicit token**: `api_token` parameter
 2. **Environment variable**: `GITHUB_TOKEN`
-3. **Stored auth token**: `specfact auth github` (device code flow)
+3. **Stored auth token**: `specfact backlog auth github` (device code flow)
 4. **GitHub CLI**: `gh auth token` (if `use_gh_cli=True`)
 
 **Note:** The default device-code client ID is only valid for `https://github.com`. For GitHub Enterprise, supply `--client-id` or set `SPECFACT_GITHUB_CLIENT_ID`.

diff --git a/docs/getting-started/installation.md b/docs/getting-started/installation.md
@@ -191,7 +191,7 @@ uvx specfact-cli@latest import from-code my-project --repo .
 Fresh install exposes only core commands:
 
 - `specfact init`
-- `specfact auth`
+- `specfact backlog auth`
 - `specfact module`
 - `specfact upgrade`
 

diff --git a/docs/getting-started/tutorial-backlog-quickstart-demo.md b/docs/getting-started/tutorial-backlog-quickstart-demo.md
@@ -32,9 +32,9 @@ Preferred ceremony aliases:
 - Auth configured:
 
 ```bash
-specfact auth github
-specfact auth azure-devops
-specfact auth status
+specfact backlog auth github
+specfact backlog auth azure-devops
+specfact backlog auth status
 ```
 
 Expected status should show both providers as valid.
@@ -207,7 +207,7 @@ Then verify retrieval by ID using `daily` or `refine --id <id>`.
 ## Quick Troubleshooting
 
 - DNS/network errors (`api.github.com`, `dev.azure.com`): verify outbound network access.
-- Auth errors: re-run `specfact auth status`.
+- Auth errors: re-run `specfact backlog auth status`.
 - ADO mapping issues: re-run `backlog map-fields` and confirm `--ado-framework` is correct.
 - Refine import mismatch: check `**ID**` was preserved exactly.
 

diff --git a/docs/getting-started/tutorial-daily-standup-sprint-review.md b/docs/getting-started/tutorial-daily-standup-sprint-review.md
@@ -38,7 +38,7 @@ Preferred command path is `specfact backlog ceremony standup ...`. The legacy `s
 ## Prerequisites
 
 - SpecFact CLI installed (`uvx specfact-cli@latest` or `pip install specfact-cli`)
-- **Authenticated** to your backlog provider: `specfact auth github` or Azure DevOps (PAT in env)
+- **Authenticated** to your backlog provider: `specfact backlog auth github` or Azure DevOps (PAT in env)
 - A **clone** of your repo (GitHub or Azure DevOps) so the CLI can auto-detect org/repo or org/project from `git remote origin`
 
 ---
@@ -167,7 +167,7 @@ supported. Use it with the **`specfact.backlog-daily`** slash prompt for interac
 1. **Authenticate once** (if not already):
 
    ```bash
-   specfact auth github
+   specfact backlog auth github
    ```
 
 2. **Open your repo** and run daily (repo auto-detected):

diff --git a/docs/guides/agile-scrum-workflows.md b/docs/guides/agile-scrum-workflows.md
@@ -142,7 +142,7 @@ Override with `.specfact/backlog.yaml`, environment variables (`SPECFACT_GITHUB_
 
 ```bash
 # 1. Authenticate once (if not already)
-specfact auth github
+specfact backlog auth github
 
 # 2. From repo root: view standup (repo auto-detected)
 cd /path/to/your-repo

diff --git a/docs/guides/backlog-refinement.md b/docs/guides/backlog-refinement.md
@@ -1054,7 +1054,7 @@ specfact backlog ceremony refinement ado \
   --ado-token "your-pat-token"
 
 # Method 3: Stored token (via device code flow)
-specfact auth azure-devops  # Interactive device code flow
+specfact backlog auth azure-devops  # Interactive device code flow
 specfact backlog ceremony refinement ado --ado-org "my-org" --ado-project "my-project"
 ```
 

diff --git a/docs/guides/custom-field-mapping.md b/docs/guides/custom-field-mapping.md
@@ -295,11 +295,11 @@ This command:
 
 **Token Resolution:**
 
-The command automatically uses stored tokens from `specfact auth azure-devops` if available. Token resolution priority:
+The command automatically uses stored tokens from `specfact backlog auth azure-devops` if available. Token resolution priority:
 
 1. Explicit `--ado-token` parameter
 2. `AZURE_DEVOPS_TOKEN` environment variable
-3. Stored token via `specfact auth azure-devops`
+3. Stored token via `specfact backlog auth azure-devops`
 4. Expired stored token (with warning and options to refresh)
 
 **Examples:**
@@ -593,22 +593,22 @@ If the interactive mapping command (`specfact backlog map-fields`) fails:
 1. **Check Token Resolution**: The command uses token resolution priority:
    - First: Explicit `--ado-token` parameter
    - Second: `AZURE_DEVOPS_TOKEN` environment variable
-   - Third: Stored token via `specfact auth azure-devops`
+   - Third: Stored token via `specfact backlog auth azure-devops`
    - Fourth: Expired stored token (shows warning with options)
 
    **Solutions:**
    - Use `--ado-token` to provide token explicitly
    - Set `AZURE_DEVOPS_TOKEN` environment variable
-   - Store token: `specfact auth azure-devops --pat your_pat_token`
-   - Re-authenticate: `specfact auth azure-devops`
+   - Store token: `specfact backlog auth azure-devops --pat your_pat_token`
+   - Re-authenticate: `specfact backlog auth azure-devops`
 
 2. **Check ADO Connection**: Verify you can connect to Azure DevOps
    - Test with: `curl -u ":{token}" "https://dev.azure.com/{org}/{project}/_apis/wit/fields?api-version=7.1"`
 
 3. **Verify Permissions**: Ensure your PAT has "Work Items (Read)" permission
 
 4. **Check Token Expiration**: OAuth tokens expire after ~1 hour
-   - Use PAT token for longer expiration (up to 1 year): `specfact auth azure-devops --pat your_pat_token`
+   - Use PAT token for longer expiration (up to 1 year): `specfact backlog auth azure-devops --pat your_pat_token`
 
 5. **Verify Organization/Project**: Ensure the org and project names are correct
    - Check for typos in organization or project names

diff --git a/docs/guides/devops-adapter-integration.md b/docs/guides/devops-adapter-integration.md
@@ -163,9 +163,9 @@ SpecFact CLI supports multiple authentication methods:
 **Option 1: Device Code (SSO-friendly)**
 
 ```bash
-specfact auth github
+specfact backlog auth github
 # or use a custom OAuth app
-specfact auth github --client-id YOUR_CLIENT_ID
+specfact backlog auth github --client-id YOUR_CLIENT_ID
 ```
 
 **Note:** The default client ID works only for `https://github.com`. For GitHub Enterprise, provide `--client-id` or set `SPECFACT_GITHUB_CLIENT_ID`.
@@ -1436,14 +1436,14 @@ Azure DevOps adapter (`--adapter ado`) is now available and supports:
 ### Prerequisites
 
 - Azure DevOps organization and project
-- Personal Access Token (PAT) with work item read/write permissions **or** device code auth via `specfact auth azure-devops`
+- Personal Access Token (PAT) with work item read/write permissions **or** device code auth via `specfact backlog auth azure-devops`
 - OpenSpec change proposals in `openspec/changes/<change-id>/proposal.md`
 
 ### Authentication
 
 ```bash
 # Option 1: Device Code (SSO-friendly)
-specfact auth azure-devops
+specfact backlog auth azure-devops
 
 # Option 2: Environment Variable
 export AZURE_DEVOPS_TOKEN=your_pat_token

diff --git a/docs/guides/troubleshooting.md b/docs/guides/troubleshooting.md
@@ -659,9 +659,9 @@ FORCE_COLOR=1 specfact import from-code my-bundle
 1. **Use stored token** (recommended):
 
    ```bash
-   specfact auth azure-devops
+   specfact backlog auth azure-devops
    # Or use PAT token for longer expiration:
-   specfact auth azure-devops --pat your_pat_token
+   specfact backlog auth azure-devops --pat your_pat_token
    ```
 
 2. **Use explicit token**:
@@ -683,7 +683,7 @@ The command automatically uses tokens in this order:
 
 1. Explicit `--ado-token` parameter
 2. `AZURE_DEVOPS_TOKEN` environment variable
-3. Stored token via `specfact auth azure-devops`
+3. Stored token via `specfact backlog auth azure-devops`
 4. Expired stored token (shows warning with options)
 
 ### OAuth Token Expired
@@ -697,13 +697,13 @@ The command automatically uses tokens in this order:
 1. **Use PAT token** (recommended for automation, up to 1 year expiration):
 
    ```bash
-   specfact auth azure-devops --pat your_pat_token
+   specfact backlog auth azure-devops --pat your_pat_token
    ```
 
 2. **Re-authenticate**:
 
    ```bash
-   specfact auth azure-devops
+   specfact backlog auth azure-devops
    ```
 
 3. **Use explicit token**:

diff --git a/docs/reference/commands.md b/docs/reference/commands.md
@@ -13,7 +13,7 @@ SpecFact CLI now ships a lean core. Workflow commands are installed from marketp
 Fresh install includes only:
 
 - `specfact init`
-- `specfact auth`
+- `specfact backlog auth`
 - `specfact module`
 - `specfact upgrade`
 

diff --git a/docs/reference/module-categories.md b/docs/reference/module-categories.md
@@ -12,7 +12,7 @@ SpecFact groups feature modules into workflow-oriented command families.
 Core commands remain top-level:
 
 - `specfact init`
-- `specfact auth`
+- `specfact backlog auth`
 - `specfact module`
 - `specfact upgrade`
 

diff --git a/modules/backlog-core/module-package.yaml b/modules/backlog-core/module-package.yaml
@@ -1,5 +1,5 @@
 name: backlog-core
-version: 0.1.6
+version: 0.1.7
 commands:
   - backlog
 category: backlog
@@ -10,7 +10,7 @@ command_help:
   backlog: Backlog dependency analysis, delta workflows, and release readiness
 pip_dependencies: []
 module_dependencies: []
-core_compatibility: '>=0.28.0,<1.0.0'
+core_compatibility: '>=0.40.0,<1.0.0'
 tier: community
 schema_extensions:
   project_bundle:
@@ -26,8 +26,8 @@ publisher:
   url: https://github.com/nold-ai/specfact-cli-modules
   email: hello@noldai.com
 integrity:
-  checksum: sha256:786a67c54f70930208265217499634ccd5e04cb8404d00762bce2e01904c55e4
-  signature: Q8CweUicTL/btp9p5QYTlBuXF3yoKvz9ZwaGK0yw3QSM72nni28ZBJ+FivGkmBfcH5zXWAGtASbqC4ry8m5DDQ==
+  checksum: sha256:a35403726458f7ae23206cc7388e5faed4c3d5d14515d0d4656767b4b63828ac
+  signature: BoXhTVXslvHYwtUcJlVAVjNaDE8DE3GNE1D5/RBEzsur4OUwn+AQTBBGyZPf+5rrlNWqDFTg0R29OO+dF+5uCw==
 dependencies: []
 description: Provide advanced backlog analysis and readiness capabilities.
 license: Apache-2.0
diff --git a/modules/bundle-mapper/module-package.yaml b/modules/bundle-mapper/module-package.yaml
@@ -1,10 +1,10 @@
 name: bundle-mapper
-version: 0.1.3
+version: 0.1.4
 commands: []
 category: core
 pip_dependencies: []
 module_dependencies: []
-core_compatibility: '>=0.28.0,<1.0.0'
+core_compatibility: '>=0.40.0,<1.0.0'
 tier: community
 schema_extensions:
   project_bundle: {}
@@ -20,8 +20,8 @@ publisher:
   url: https://github.com/nold-ai/specfact-cli-modules
   email: hello@noldai.com
 integrity:
-  checksum: sha256:359763f8589be35f00b53a996d76ccec32789508d0a2d7dae7e3cdb039a92fc3
-  signature: OmAp12Rdk79IewQYiKRqvvAm8UgM6onL52Y2/ixSgX3X7onoc9FBKzBYuPmynEVgmJWAI2AX2gdujo/bKH5nAg==
+  checksum: sha256:e336ded0148c01695247dbf8304c9e1eaf0406785e93964f9d1e2de838c23dee
+  signature: /sl1DEUwF6Cf/geXruKz/mgUVPJ217qBLfqwRB1ZH9bZ/MwgTyAAU3QiM7i8RrgZOSNNSf49s5MplO0SwfpCBQ==
 dependencies: []
 description: Map backlog items to best-fit modules using scoring heuristics.
 license: Apache-2.0
diff --git a/openspec/CHANGE_ORDER.md b/openspec/CHANGE_ORDER.md
@@ -86,14 +86,14 @@ These are derived extensions of the same 2026-02-15 plan and are required to ope
 
 | Module | Order | Change folder | GitHub # | Blocked by |
 |--------|-------|---------------|----------|------------|
-| module-migration | 01 | ✅ module-migration-01-categorize-and-group (implemented 2026-03-03; archived) | [#315](https://github.com/nold-ai/specfact-cli/issues/315) | ✅ #215 (marketplace-02) |
-| module-migration | 02 | ✅ module-migration-02-bundle-extraction (implemented 2026-03-03; archived) | [#316](https://github.com/nold-ai/specfact-cli/issues/316) | ✅ #315 (module-migration-01) |
-| module-migration | 03 | module-migration-03-core-slimming | [#317](https://github.com/nold-ai/specfact-cli/issues/317) | #316 (module-migration-02); #334 (module-migration-05) sections 18-22 (tests, decoupling, docs, pipeline/config) must precede deletion |
-| module-migration | 04 | module-migration-04-remove-flat-shims | [#330](https://github.com/nold-ai/specfact-cli/issues/330) | #315 (module-migration-01); shim-removal scope only (no broad legacy test migration) |
-| module-migration | 05 | module-migration-05-modules-repo-quality | [#334](https://github.com/nold-ai/specfact-cli/issues/334) | #316 (module-migration-02); sections 18-22 must precede #317 (module-migration-03); owns bundle-test migration to modules repo |
-| module-migration | 06 | module-migration-06-core-decoupling-cleanup | [#338](https://github.com/nold-ai/specfact-cli/issues/338) | #317 (module-migration-03); #334 (module-migration-05) bundle-parity baseline (remove remaining non-core coupling in specfact-cli core) |
-| module-migration | 07 | module-migration-07-test-migration-cleanup | [#339](https://github.com/nold-ai/specfact-cli/issues/339) | #317 (module-migration-03) phase 20 handoff; #330 (module-migration-04) and #334 (module-migration-05) residual specfact-cli test debt |
-| backlog-auth | 01 | ✅ backlog-auth-01-backlog-auth-commands (implemented 2026-03-03; archived) | [#340](https://github.com/nold-ai/specfact-cli/issues/340) | ✅ #317 (module-migration-03) |
+| module-migration | 01 | module-migration-01-categorize-and-group | [#315](https://github.com/nold-ai/specfact-cli/issues/315) | #215 ✅ (marketplace-02) |
+| module-migration | 02 | module-migration-02-bundle-extraction | [#316](https://github.com/nold-ai/specfact-cli/issues/316) | module-migration-01 ✅ |
+| module-migration | 03 | module-migration-03-core-slimming | [#317](https://github.com/nold-ai/specfact-cli/issues/317) | module-migration-02; migration-05 sections 18-22 (tests, decoupling, docs, pipeline/config) must precede deletion |
+| module-migration | 04 | module-migration-04-remove-flat-shims | [#330](https://github.com/nold-ai/specfact-cli/issues/330) | module-migration-01; shim-removal scope only (no broad legacy test migration) |
+| module-migration | 05 | module-migration-05-modules-repo-quality | [#334](https://github.com/nold-ai/specfact-cli/issues/334) | module-migration-02; sections 18-22 must precede migration-03; owns bundle-test migration to modules repo |
+| module-migration | 06 | module-migration-06-core-decoupling-cleanup | [#338](https://github.com/nold-ai/specfact-cli/issues/338) | module-migration-03; migration-05 bundle-parity baseline (remove remaining non-core coupling in specfact-cli core) |
+| module-migration | 07 | module-migration-07-test-migration-cleanup | [#339](https://github.com/nold-ai/specfact-cli/issues/339) | migration-03 phase 20 handoff; migration-04 and migration-05 residual specfact-cli test debt |
+| backlog-auth | 01 | backlog-auth-01-backlog-auth-commands | TBD | module-migration-03 (central auth interface in core; auth removed from core) |
 
 ### Cross-cutting foundations (no hard dependencies — implement early)
 
@@ -342,10 +342,10 @@ Dependencies flow left-to-right; a wave may start once all its hard blockers are
   - marketplace-05-registry-federation (#329) (needs marketplace-03 #327)
 
 - **Wave 4 — Ceremony layer + module slimming + modules repo quality** (needs Wave 3):
-  - ✅ ceremony-cockpit-01 (#185) (probes installed backlog-* modules at runtime; no hard deps but best after Wave 3)
-  - **module-migration-05-modules-repo-quality (#334)** (needs module-migration-02 #316; sections 18-22 must land **before or simultaneously with** module-migration-03 #317): quality tooling, tests, dependency decoupling, docs, pipeline/config for specfact-cli-modules
-  - module-migration-03-core-slimming (#317) (needs module-migration-02 #316 AND migration-05 (#334) sections 18-22; removes bundled modules from core; see tasks.md 17.9 for proposal consistency requirements before implementation starts)
-  - **module-migration-06-core-decoupling-cleanup (#338)** (needs module-migration-03 #317 + migration-05 #334 baseline; removes residual non-core components/couplings from specfact-cli core, e.g. models/utilities tied only to extracted modules)
+  - ceremony-cockpit-01 ✅ (probes installed backlog-* modules at runtime; no hard deps but best after Wave 3)
+  - **module-migration-05-modules-repo-quality** (needs module-migration-02; sections 18-22 must land **before or simultaneously with** module-migration-03): quality tooling, tests, dependency decoupling, docs, pipeline/config for specfact-cli-modules
+  - module-migration-03-core-slimming (needs module-migration-02 AND migration-05 sections 18-22; removes bundled modules from core; see tasks.md 17.9 for proposal consistency requirements before implementation starts)
+  - **module-migration-06-core-decoupling-cleanup** (needs module-migration-03 + migration-05 baseline; removes residual non-core components/couplings from specfact-cli core, e.g. models/utilities tied only to extracted modules)
 
 - **Wave 5 — Foundations for business-first chain** (architecture integration):
   - profile-01 (#237)

diff --git a/openspec/changes/backlog-auth-01-backlog-auth-commands/proposal.md b/openspec/changes/backlog-auth-01-backlog-auth-commands/proposal.md
@@ -0,0 +1,30 @@
+# Change: Backlog auth commands (specfact backlog auth)
+
+## Why
+
+
+Module-migration-03 removes the auth module from core and keeps only a central auth interface (token storage by provider_id). Auth for DevOps providers (GitHub, Azure DevOps) belongs with the backlog domain: users who install the backlog bundle need `specfact backlog auth azure-devops` and `specfact backlog auth github`, not a global `specfact auth`. This change implements those commands in the specfact-cli-modules backlog bundle so that after migration-03, backlog users get auth under `specfact backlog auth`.
+
+## What Changes
+
+
+- **specfact-cli-modules (backlog bundle)**: Add a `backlog auth` subgroup to the backlog Typer app with subcommands:
+  - `specfact backlog auth azure-devops` (options: `--pat`, `--use-device-code`; same behaviour as former `specfact auth azure-devops`)
+  - `specfact backlog auth github` (device code flow; same as former `specfact auth github`)
+  - `specfact backlog auth status` — show stored tokens for github / azure-devops
+  - `specfact backlog auth clear` — clear stored tokens (optionally by provider)
+- **Implementation**: Auth command implementations use the **central auth interface** from specfact-cli core (`specfact_cli.utils.auth_tokens`: `get_token`, `set_token`, `clear_token`, `clear_all_tokens`) to store and retrieve tokens. No duplicate token storage logic; the backlog bundle depends on specfact-cli and calls the same interface that adapters (GitHub, Azure DevOps) in the bundle use.
+- **specfact-cli**: No code changes in this repo; migration-03 already provides the central auth interface and removes the auth module.
+
+## Capabilities
+- `backlog-auth-commands`: When the specfact-backlog bundle is installed, the CLI exposes `specfact backlog auth` with subcommands azure-devops, github, status, clear. Each subcommand uses the core auth interface for persistence. Existing tokens stored by a previous `specfact auth` (pre–migration-03) continue to work because the storage path and provider_ids are unchanged.
+
+---
+
+## Source Tracking
+
+<!-- source_repo: nold-ai/specfact-cli -->
+- **GitHub Issue**: #340
+- **Issue URL**: <https://github.com/nold-ai/specfact-cli/issues/340>
+- **Last Synced Status**: proposed
+- **Sanitized**: false