jposluns · Oct 19, 2026 · Oct 19, 2026 · Oct 19, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -12,6 +12,7 @@ service can change a gate's answer, and a pull request number is only knowable f
 
 ## 2026-10-19
 
+- Nineteen more guides move to the two-section layout (maintainer request, 2026-10-18), with each guide's own tool named first in its header; `mfa.md`, already in the layout, now lists authentik, Keycloak and oauth2-proxy in its header (Authelia has no recorded release version, so it stays in the folded count); no guide body or digest changes. Guides: `dotnet.md`, `php.md`, `ruby.md`, `nextjs.md`, `frontend-frameworks.md`, `web-exposure.md`, `admin-uis.md`, `bi-dashboards.md`, `devops-uis.md`, `server-admin-panels.md`, `low-code-builders.md`, `python.md`, `deployment-lifecycle.md`, `gpu-clouds.md`, `mlflow.md`, `paas.md`, `sqlite.md`, `sqlite-http-frontends.md`, `transactional-email-posture.md` (#699)
 - `authentication.md`: the secret-scan Verify step now cites Gitleaks v8.30.1's staged and pre-commit flags (which switch it to scanning `git diff`) and its `--log-opts` option over `git log -p` history, so the instruction to verify staged, all-ref and merge-commit coverage with the chosen scanner and configuration rests on cited behaviour; the claim keeps the limits of the supplementary `git log` search; rule 15 now says the cited protocol sources do not establish that an HTML login protects those endpoints; TODO row 1.295 moves to DONE (#698)
 - `agent-builders.md`: the Dify plugin debug-permission remedy now cites the pinned console web code that reads and writes the setting, alongside the API remedy already cited; which roles can reach it and where the console shows it stay open under TODO row 1.283 (#695)
 - Twenty more guides move to the two-section layout (maintainer request, 2026-10-18), with each guide's own tool named first in its header; `workflow-orchestrators.md`, already in the layout, now lists Temporal, Flower and Argo with its other headline tools in its header; no guide body or digest changes. Guides: `host.md`, `cloud-firewalls.md`, `egress-metadata.md`, `cloudflare.md`, `tunnels.md`, `tailscale.md`, `cloud-identity-proxies.md`, `fronting-auth.md`, `mfa.md`, `identity-providers.md`, `oidc-integration.md`, `self-hosted-idp.md`, `secrets.md`, `machine-auth.md`, `connection-poolers.md`, `neo4j.md`, `surrealdb.md`, `nodejs.md`, `go.md`, `java.md` (#697)

diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-1.0.698
+1.0.699
diff --git a/admin-uis.md b/admin-uis.md
diff --git a/bi-dashboards.md b/bi-dashboards.md
diff --git a/deployment-lifecycle.md b/deployment-lifecycle.md
diff --git a/devops-uis.md b/devops-uis.md
diff --git a/dotnet.md b/dotnet.md
diff --git a/frontend-frameworks.md b/frontend-frameworks.md
diff --git a/gpu-clouds.md b/gpu-clouds.md
diff --git a/low-code-builders.md b/low-code-builders.md
diff --git a/mfa.md b/mfa.md
@@ -1,6 +1,6 @@
 # Multi-factor authentication (MFA)
 
-Written against TOTP standard (no recorded version), Caddy forward_auth minimum 2.5.1, google-authenticator-libpam source 1.11, MySQL 8.0 multifactor authentication 8.0, MySQL 8.4 multifactor authentication 8.4, MySQL 8.4 WebAuthn authentication 8.4, and authentik source version/2026.8.3, plus 10 more recorded bases; 14 further sources are pinned to a commit and 13 carry no recorded version. Metadata reviewed 2026-10-18; documentation checked September 2026. The guide records 35 claims: 2 demonstrated by a check that ran and 33 reasoned from cited sources.
+Written against TOTP standard (no recorded version), authentik source version/2026.8.3, Keycloak documentation 26.7.4, oauth2-proxy documentation v7.15.4, Caddy forward_auth minimum 2.5.1, google-authenticator-libpam source 1.11, and MySQL 8.0 multifactor authentication 8.0, plus 10 more recorded bases; 14 further sources are pinned to a commit and 13 carry no recorded version. Metadata reviewed 2026-10-18; documentation checked September 2026. The guide records 35 claims: 2 demonstrated by a check that ran and 33 reasoned from cited sources.
 
 A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
 
@@ -171,6 +171,9 @@ Components (recorded basis):
 - uri: Authenticator key URI format (unknown)
 - webauthn: WebAuthn standard (unknown)
 - authelia: Authelia proxy support (unknown)
+- authentik-source: authentik source (version/2026.8.3)
+- keycloak-source: Keycloak documentation (26.7.4)
+- oauth2-proxy-source: oauth2-proxy documentation (v7.15.4)
 - caddy-min: Caddy forward_auth minimum (2.5.1)
 - duo: Duo editions (unknown)
 - duo-push-policy: Duo Verified Push policy (unknown)
@@ -184,9 +187,6 @@ Components (recorded basis):
 - mysql: MySQL 8.0 multifactor authentication (8.0)
 - mysql-8-4: MySQL 8.4 multifactor authentication (8.4)
 - mysql-webauthn: MySQL 8.4 WebAuthn authentication (8.4)
-- authentik-source: authentik source (version/2026.8.3)
-- keycloak-source: Keycloak documentation (26.7.4)
-- oauth2-proxy-source: oauth2-proxy documentation (v7.15.4)
 - entra-docs: Microsoft Entra documentation (231747abc59ae3d50c74e215c1cdd592eb980723)
 - owasp-docs: OWASP cheat sheets (668ba7db3d0da5868b8a0305c259f7f6914a6ecd)
 - otp-source: pquerna/otp source (617f8d5f3f518bae0f5c3ec14a17ca19f2a6f870)
@@ -291,6 +291,28 @@ Claims (full source mapping in the JSON block below):
         "s1409ac8fe3d9": "https://www.authelia.com/integration/proxies/support/"
       }
     },
+    "authentik-source": {
+      "name": "authentik source",
+      "basis": "version/2026.8.3",
+      "sources": {
+        "s18275a7072e9": "https://github.com/goauthentik/authentik/blob/version/2026.8.3/authentik/stages/authenticator_validate/stage.py#L80-L108"
+      }
+    },
+    "keycloak-source": {
+      "name": "Keycloak documentation",
+      "basis": "26.7.4",
+      "sources": {
+        "s1e55f7daaa0d": "https://github.com/keycloak/keycloak/blob/26.7.4/docs/documentation/server_admin/topics/authentication/otp-policies.adoc#L2-L21"
+      }
+    },
+    "oauth2-proxy-source": {
+      "name": "oauth2-proxy documentation",
+      "basis": "v7.15.4",
+      "sources": {
+        "sa403e3d826b4": "https://github.com/oauth2-proxy/oauth2-proxy/blob/v7.15.4/docs/docs/configuration/overview.md#L94-L108",
+        "se7a200583def": "https://github.com/oauth2-proxy/oauth2-proxy/blob/v7.15.4/docs/docs/configuration/overview.md#L274"
+      }
+    },
     "caddy-min": {
       "name": "Caddy forward_auth minimum",
       "basis": "2.5.1",
@@ -385,28 +407,6 @@ Claims (full source mapping in the JSON block below):
         "s807a77fa8872": "https://dev.mysql.com/doc/refman/8.4/en/webauthn-pluggable-authentication.html"
       }
     },
-    "authentik-source": {
-      "name": "authentik source",
-      "basis": "version/2026.8.3",
-      "sources": {
-        "s18275a7072e9": "https://github.com/goauthentik/authentik/blob/version/2026.8.3/authentik/stages/authenticator_validate/stage.py#L80-L108"
-      }
-    },
-    "keycloak-source": {
-      "name": "Keycloak documentation",
-      "basis": "26.7.4",
-      "sources": {
-        "s1e55f7daaa0d": "https://github.com/keycloak/keycloak/blob/26.7.4/docs/documentation/server_admin/topics/authentication/otp-policies.adoc#L2-L21"
-      }
-    },
-    "oauth2-proxy-source": {
-      "name": "oauth2-proxy documentation",
-      "basis": "v7.15.4",
-      "sources": {
-        "sa403e3d826b4": "https://github.com/oauth2-proxy/oauth2-proxy/blob/v7.15.4/docs/docs/configuration/overview.md#L94-L108",
-        "se7a200583def": "https://github.com/oauth2-proxy/oauth2-proxy/blob/v7.15.4/docs/docs/configuration/overview.md#L274"
-      }
-    },
     "entra-docs": {
       "name": "Microsoft Entra documentation",
       "basis": "231747abc59ae3d50c74e215c1cdd592eb980723",