chore(deps): update dependency symfony/console to v7.4.16

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "68916c1b58d9ce06a59f6c58e4a2d226",
+    "content-hash": "62e72748cdabd7f94ea7593267f5bc02",
     "packages": [
         {
             "name": "laravel/serializable-closure",
@@ -606,16 +606,16 @@
         },
         {
             "name": "symfony/console",
-            "version": "v7.4.14",
+            "version": "v7.4.16",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/console.git",
-                "reference": "92f58bc4bf97a92ed1b9f367f0cd44f20bde0e87"
+                "reference": "f4c69c9aed03abf933b294257d618bdd9b30a06d"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/console/zipball/92f58bc4bf97a92ed1b9f367f0cd44f20bde0e87",
-                "reference": "92f58bc4bf97a92ed1b9f367f0cd44f20bde0e87",
+                "url": "https://api.github.com/repos/symfony/console/zipball/f4c69c9aed03abf933b294257d618bdd9b30a06d",
+                "reference": "f4c69c9aed03abf933b294257d618bdd9b30a06d",
                 "shasum": ""
             },
             "require": {
@@ -680,7 +680,7 @@
                 "terminal"
             ],
             "support": {
-                "source": "https://github.com/symfony/console/tree/v7.4.14"
+                "source": "https://github.com/symfony/console/tree/v7.4.16"
             },
             "funding": [
                 {
@@ -700,7 +700,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-06-16T11:50:14+00:00"
+            "time": "2026-07-31T12:37:14+00:00"
         },
         {
             "name": "symfony/deprecation-contracts",
@@ -3057,5 +3057,5 @@
         "ext-iconv": "*"
     },
     "platform-dev": {},
-    "plugin-api-version": "2.6.0"
+    "plugin-api-version": "2.9.0"
 }

core/lib/Console/Event/EventsDebugCommand.php

@@ -4,7 +4,7 @@ declare(strict_types=1);
 
 namespace KTXC\Console\Event;
 
-use KTXF\Event\EventListenerRegistry;
+use KTXC\Event\EventListenerRegistry;
 use Symfony\Component\Console\Attribute\AsCommand;
 use Symfony\Component\Console\Command\Command;
 use Symfony\Component\Console\Input\InputInterface;

core/lib/Console/Tenant/TenantCreateCommand.php

@@ -4,10 +4,12 @@ declare(strict_types=1);
 
 namespace KTXC\Console\Tenant;
 
+use KTXC\Context\TenantContext;
 use KTXC\Models\Tenant\DomainCollection;
 use KTXC\Models\Tenant\TenantConfiguration;
 use KTXC\Models\Tenant\TenantObject;
 use KTXC\Service\TenantService;
+use KTXC\Service\UserAccountsService;
 use KTXC\Stores\UserAccountsStore;
 use KTXC\Stores\UserRolesStore;
 use KTXF\Utile\UUID;
@@ -35,6 +37,8 @@ class TenantCreateCommand extends Command
         private readonly TenantService $tenantService,
         private readonly UserRolesStore $rolesStore,
         private readonly UserAccountsStore $userStore,
+        private readonly UserAccountsService $userService,
+        private readonly TenantContext $tenantContext,
         private readonly LoggerInterface $logger
     ) {
         parent::__construct();
@@ -97,6 +101,10 @@ class TenantCreateCommand extends Command
                 $io->error('Failed to create tenant.');
                 return Command::FAILURE;
             }
+            if (!$this->tenantContext->resolveIdentifier($identifier)) {
+                throw new \RuntimeException("Failed to initialize tenant context for '{$identifier}'.");
+            }
+            $identifier = $this->tenantContext->requireIdentifier();
 
             $this->logger->info('Tenant created via console', [
                 'identifier' => $identifier,
@@ -134,7 +142,7 @@ class TenantCreateCommand extends Command
                 if ($this->userStore->fetchByIdentity($identifier, $adminIdentity)) {
                     $io->warning("User '{$adminIdentity}' already exists in tenant '{$identifier}'; skipping admin user creation.");
                 } else {
-                    $this->userStore->createUser($identifier, [
+                    $this->userService->createUser([
                         'identity' => $adminIdentity,
                         'label' => 'Administrator',
                         'enabled' => true,

core/lib/Console/User/UserCreateCommand.php

@@ -4,7 +4,8 @@ declare(strict_types=1);
 
 namespace KTXC\Console\User;
 
-use KTXC\Service\TenantService;
+use KTXC\Context\TenantContext;
+use KTXC\Service\UserAccountsService;
 use KTXC\Stores\UserAccountsStore;
 use KTXC\Stores\UserRolesStore;
 use Psr\Log\LoggerInterface;
@@ -28,8 +29,9 @@ use Symfony\Component\Console\Style\SymfonyStyle;
 class UserCreateCommand extends Command
 {
     public function __construct(
-        private readonly TenantService $tenantService,
+        private readonly TenantContext $tenantContext,
         private readonly UserAccountsStore $userStore,
+        private readonly UserAccountsService $userService,
         private readonly UserRolesStore $rolesStore,
         private readonly LoggerInterface $logger
     ) {
@@ -59,11 +61,11 @@ class UserCreateCommand extends Command
         $io->title('Create User');
 
         try {
-            // Ensure the tenant exists
-            if (!$this->tenantService->fetchById($tenant)) {
+            if (!$this->tenantContext->resolveIdentifier($tenant)) {
                 $io->error("Tenant '{$tenant}' not found.");
                 return Command::FAILURE;
             }
+            $tenant = $this->tenantContext->requireIdentifier();
 
             // Ensure identity is unique within the tenant
             if ($this->userStore->fetchByIdentity($tenant, $identity)) {
@@ -95,7 +97,7 @@ class UserCreateCommand extends Command
                 $userData['uid'] = $input->getOption('uid');
             }
 
-            $user = $this->userStore->createUser($tenant, $userData);
+            $user = $this->userService->createUser($userData);
 
             $this->logger->info('User created via console', [
                 'tenant' => $tenant,

core/lib/Console/User/UserDeleteCommand.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace KTXC\Console\User;
 
+use KTXC\Context\TenantContext;
+use KTXC\Service\UserAccountsService;
 use KTXC\Stores\UserAccountsStore;
 use Psr\Log\LoggerInterface;
 use Symfony\Component\Console\Attribute\AsCommand;
@@ -26,7 +28,9 @@ use Symfony\Component\Console\Style\SymfonyStyle;
 class UserDeleteCommand extends Command
 {
     public function __construct(
+        private readonly TenantContext $tenantContext,
         private readonly UserAccountsStore $userStore,
+        private readonly UserAccountsService $userService,
         private readonly LoggerInterface $logger
     ) {
         parent::__construct();
@@ -52,6 +56,12 @@ class UserDeleteCommand extends Command
         $io->title('Delete User');
 
         try {
+            if (!$this->tenantContext->resolveIdentifier($tenant)) {
+                $io->error("Tenant '{$tenant}' not found.");
+                return Command::FAILURE;
+            }
+            $tenant = $this->tenantContext->requireIdentifier();
+
             $user = $this->userStore->fetchByIdentity($tenant, $identity);
 
             if (!$user) {
@@ -64,7 +74,7 @@ class UserDeleteCommand extends Command
                 return Command::SUCCESS;
             }
 
-            if (!$this->userStore->deleteUser($tenant, $user['uid'])) {
+            if (!$this->userService->deleteUser($user['uid'])) {
                 $io->error("Failed to delete user '{$identity}'.");
                 return Command::FAILURE;
             }

core/lib/Controllers/AuthenticationController.php

@@ -92,9 +92,9 @@ class AuthenticationController extends ControllerAbstract
         }
 
         $request = AuthenticationRequest::verify($session, $method, $response);
-        $authResponse = $this->authManager->handle($request);
+        $response = $this->authManager->handle($request);
 
-        return $this->buildJsonResponse($authResponse);
+        return $this->buildJsonResponse($response);
     }
 
     /**
@@ -120,8 +120,8 @@ class AuthenticationController extends ControllerAbstract
         $host = $request->getHost();
         $callbackUrl = "{$scheme}://{$host}/auth/callback/{$method}";
 
-        $authRequest = AuthenticationRequest::redirect($sessionId, $method, $callbackUrl, $returnUrl);
-        $response = $this->authManager->handle($authRequest);
+        $request = AuthenticationRequest::redirect($sessionId, $method, $callbackUrl, $returnUrl);
+        $response = $this->authManager->handle($request);
 
         return $this->buildJsonResponse($response);
     }
@@ -142,8 +142,8 @@ class AuthenticationController extends ControllerAbstract
             return $this->redirectWithError('Missing state parameter');
         }
 
-        $authRequest = AuthenticationRequest::callback($sessionId, $provider, $params);
-        $response = $this->authManager->handle($authRequest);
+        $request = AuthenticationRequest::callback($sessionId, $provider, $params);
+        $response = $this->authManager->handle($request);
 
         if ($response->isSuccess()) {
             $returnUrl = $response->returnUrl ?? '/';
@@ -178,8 +178,8 @@ class AuthenticationController extends ControllerAbstract
             );
         }
 
-        $authRequest = AuthenticationRequest::status($sessionId);
-        $response = $this->authManager->handle($authRequest);
+        $request = AuthenticationRequest::status($sessionId);
+        $response = $this->authManager->handle($request);
 
         return $this->buildJsonResponse($response);
     }
@@ -192,8 +192,8 @@ class AuthenticationController extends ControllerAbstract
     {
         $sessionId = $request->query->get('session', '');
         
-        $authRequest = AuthenticationRequest::cancel($sessionId);
-        $this->authManager->handle($authRequest);
+        $request = AuthenticationRequest::cancel($sessionId);
+        $this->authManager->handle($request);
 
         return new JsonResponse(['status' => 'cancelled', 'message' => 'Session cancelled']);
     }
@@ -217,8 +217,8 @@ class AuthenticationController extends ControllerAbstract
             );
         }
 
-        $authRequest = AuthenticationRequest::refresh($refreshToken);
-        $response = $this->authManager->handle($authRequest);
+        $request = AuthenticationRequest::refresh($refreshToken);
+        $response = $this->authManager->handle($request);
 
         if ($response->isFailed()) {
             $httpResponse = new JsonResponse($response->toArray(), $response->httpStatus);
@@ -259,8 +259,8 @@ class AuthenticationController extends ControllerAbstract
     {
         $token = $request->cookies->get('accessToken');
         
-        $authRequest = AuthenticationRequest::logout($token, false);
-        $this->authManager->handle($authRequest);
+        $request = AuthenticationRequest::logout($token, false);
+        $this->authManager->handle($request);
 
         $response = new JsonResponse(['status' => 'success', 'message' => 'Logged out successfully']);
         return $this->clearTokenCookies($response);
@@ -274,8 +274,8 @@ class AuthenticationController extends ControllerAbstract
     {
         $token = $request->cookies->get('accessToken');
         
-        $authRequest = AuthenticationRequest::logout($token, true);
-        $this->authManager->handle($authRequest);
+        $request = AuthenticationRequest::logout($token, true);
+        $this->authManager->handle($request);
 
         $response = new JsonResponse(['status' => 'success', 'message' => 'Logged out from all devices']);
         return $this->clearTokenCookies($response);

core/lib/Controllers/FirewallController.php

@@ -0,0 +1,465 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Controllers;
+
+use KTXC\Http\Request\Request;
+use KTXC\Http\Response\JsonResponse;
+use KTXC\Service\FirewallRuleConflictException;
+use KTXC\Service\SystemFirewallLogService;
+use KTXC\Service\SystemFirewallRuleService;
+use KTXC\Service\SystemFirewallStatusService;
+use KTXC\Service\TenantFirewallLogService;
+use KTXC\Service\TenantFirewallRuleService;
+use KTXC\Service\TenantFirewallStatusService;
+use KTXF\Controller\ControllerAbstract;
+use KTXF\Routing\Attributes\AuthenticatedRoute;
+
+final class FirewallController extends ControllerAbstract
+{
+    public function __construct(
+        private readonly TenantFirewallRuleService $tenantRules,
+        private readonly SystemFirewallRuleService $systemRules,
+        private readonly TenantFirewallLogService $tenantLogs,
+        private readonly SystemFirewallLogService $systemLogs,
+        private readonly TenantFirewallStatusService $tenantStatus,
+        private readonly SystemFirewallStatusService $systemStatus,
+    ) {
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/rules',
+        name: 'firewall.tenant.rules.list',
+        permissions: [TenantFirewallRuleService::PERMISSION_READ],
+    )]
+    public function tenantRules(
+        string $status = 'active',
+        ?string $type = null,
+        ?string $action = null,
+        string $limit = '50',
+        string $offset = '0'
+    ): JsonResponse {
+        return $this->queryResponse(
+            fn(int $parsedLimit, int $parsedOffset): array => $this->tenantRules->queryRules(
+                $status,
+                $type,
+                $action,
+                $parsedLimit,
+                $parsedOffset
+            ),
+            $limit,
+            $offset
+        );
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/rules/{ruleId}',
+        name: 'firewall.tenant.rules.fetch',
+        permissions: [TenantFirewallRuleService::PERMISSION_READ],
+    )]
+    public function tenantRule(string $ruleId): JsonResponse
+    {
+        return $this->ruleResponse($this->tenantRules->fetchRule($ruleId));
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/effective-policy',
+        name: 'firewall.tenant.policy.effective',
+        permissions: [TenantFirewallRuleService::PERMISSION_READ],
+    )]
+    public function effectivePolicy(): JsonResponse
+    {
+        return new JsonResponse($this->tenantRules->effectivePolicy());
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/system/rules',
+        name: 'firewall.system.rules.list',
+        permissions: [SystemFirewallRuleService::PERMISSION_READ],
+    )]
+    public function systemRules(
+        string $status = 'active',
+        ?string $type = null,
+        ?string $action = null,
+        string $limit = '50',
+        string $offset = '0'
+    ): JsonResponse {
+        return $this->queryResponse(
+            fn(int $parsedLimit, int $parsedOffset): array => $this->systemRules->queryRules(
+                $status,
+                $type,
+                $action,
+                $parsedLimit,
+                $parsedOffset
+            ),
+            $limit,
+            $offset
+        );
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/system/rules/{ruleId}',
+        name: 'firewall.system.rules.fetch',
+        permissions: [SystemFirewallRuleService::PERMISSION_READ],
+    )]
+    public function systemRule(string $ruleId): JsonResponse
+    {
+        return $this->ruleResponse($this->systemRules->fetchRule($ruleId));
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/rules',
+        name: 'firewall.tenant.rules.create',
+        methods: ['POST'],
+        permissions: [TenantFirewallRuleService::PERMISSION_MANAGE],
+    )]
+    public function createTenantRule(
+        Request $request,
+        string $type,
+        string $action,
+        string $value,
+        string $reason,
+        ?int $durationSeconds = null,
+        bool $confirmCurrentIp = false
+    ): JsonResponse {
+        return $this->mutationResponse(fn() => $this->tenantRules->createRule(
+            $type,
+            $action,
+            $value,
+            $reason,
+            $durationSeconds,
+            $request->getClientIp(),
+            $confirmCurrentIp
+        ));
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/system/rules',
+        name: 'firewall.system.rules.create',
+        methods: ['POST'],
+        permissions: [SystemFirewallRuleService::PERMISSION_MANAGE],
+    )]
+    public function createSystemRule(
+        Request $request,
+        string $type,
+        string $action,
+        string $value,
+        string $reason,
+        ?int $durationSeconds = null,
+        bool $confirmCurrentIp = false
+    ): JsonResponse {
+        return $this->mutationResponse(fn() => $this->systemRules->createRule(
+            $type,
+            $action,
+            $value,
+            $reason,
+            $durationSeconds,
+            $request->getClientIp(),
+            $confirmCurrentIp
+        ));
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/rules/{ruleId}',
+        name: 'firewall.tenant.rules.update',
+        methods: ['PATCH'],
+        permissions: [TenantFirewallRuleService::PERMISSION_MANAGE],
+    )]
+    public function updateTenantRule(
+        Request $request,
+        string $ruleId,
+        string $operation,
+        string $reason,
+        ?int $durationSeconds = null,
+        bool $confirmCurrentIp = false
+    ): JsonResponse {
+        return $this->lifecycleResponse(fn() => match ($operation) {
+            'disable' => $this->tenantRules->disableRule($ruleId, $reason),
+            'enable' => $this->tenantRules->enableRule(
+                $ruleId, $reason, $request->getClientIp(), $confirmCurrentIp
+            ),
+            'extend' => $this->tenantRules->extendRule(
+                $ruleId,
+                $durationSeconds ?? throw new \InvalidArgumentException('Rule extension duration is required.'),
+                $reason
+            ),
+            default => throw new \InvalidArgumentException('Invalid firewall rule operation.'),
+        });
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/system/rules/{ruleId}',
+        name: 'firewall.system.rules.update',
+        methods: ['PATCH'],
+        permissions: [SystemFirewallRuleService::PERMISSION_MANAGE],
+    )]
+    public function updateSystemRule(
+        Request $request,
+        string $ruleId,
+        string $operation,
+        string $reason,
+        ?int $durationSeconds = null,
+        bool $confirmCurrentIp = false
+    ): JsonResponse {
+        return $this->lifecycleResponse(fn() => match ($operation) {
+            'disable' => $this->systemRules->disableRule($ruleId, $reason),
+            'enable' => $this->systemRules->enableRule(
+                $ruleId, $reason, $request->getClientIp(), $confirmCurrentIp
+            ),
+            'extend' => $this->systemRules->extendRule(
+                $ruleId,
+                $durationSeconds ?? throw new \InvalidArgumentException('Rule extension duration is required.'),
+                $reason
+            ),
+            default => throw new \InvalidArgumentException('Invalid firewall rule operation.'),
+        });
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/rules/{ruleId}',
+        name: 'firewall.tenant.rules.delete',
+        methods: ['DELETE'],
+        permissions: [TenantFirewallRuleService::PERMISSION_MANAGE],
+    )]
+    public function deleteTenantRule(string $ruleId, string $reason): JsonResponse
+    {
+        return $this->lifecycleResponse(fn() => $this->tenantRules->removeRule($ruleId, $reason));
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/system/rules/{ruleId}',
+        name: 'firewall.system.rules.delete',
+        methods: ['DELETE'],
+        permissions: [SystemFirewallRuleService::PERMISSION_MANAGE],
+    )]
+    public function deleteSystemRule(string $ruleId, string $reason): JsonResponse
+    {
+        return $this->lifecycleResponse(fn() => $this->systemRules->removeRule($ruleId, $reason));
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/logs',
+        name: 'firewall.tenant.logs.list',
+        permissions: [TenantFirewallLogService::PERMISSION_READ],
+    )]
+    public function tenantLogs(
+        ?string $ipAddress = null,
+        ?string $eventType = null,
+        ?string $result = null,
+        ?string $ruleId = null,
+        ?string $ruleScope = null,
+        ?string $from = null,
+        ?string $to = null,
+        string $limit = '50',
+        string $offset = '0'
+    ): JsonResponse {
+        return $this->queryResponse(
+            fn(int $parsedLimit, int $parsedOffset): array => $this->tenantLogs->query(
+                compact('ipAddress', 'eventType', 'result', 'ruleId', 'ruleScope', 'from', 'to'),
+                $parsedLimit,
+                $parsedOffset
+            ),
+            $limit,
+            $offset
+        );
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/system/logs',
+        name: 'firewall.system.logs.list',
+        permissions: [SystemFirewallLogService::PERMISSION_READ],
+    )]
+    public function systemLogs(
+        ?string $tenantId = null,
+        ?string $ipAddress = null,
+        ?string $eventType = null,
+        ?string $result = null,
+        ?string $ruleId = null,
+        ?string $ruleScope = null,
+        ?string $from = null,
+        ?string $to = null,
+        string $limit = '50',
+        string $offset = '0'
+    ): JsonResponse {
+        return $this->queryResponse(
+            fn(int $parsedLimit, int $parsedOffset): array => $this->systemLogs->query(
+                $tenantId,
+                compact('ipAddress', 'eventType', 'result', 'ruleId', 'ruleScope', 'from', 'to'),
+                $parsedLimit,
+                $parsedOffset
+            ),
+            $limit,
+            $offset
+        );
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/metrics',
+        name: 'firewall.tenant.metrics.read',
+        permissions: [TenantFirewallLogService::PERMISSION_READ],
+    )]
+    public function tenantMetrics(?string $since = null): JsonResponse
+    {
+        return $this->readResponse(fn(): array => $this->tenantStatus->metrics($since));
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/configuration',
+        name: 'firewall.tenant.configuration.read',
+        permissions: [TenantFirewallStatusService::PERMISSION_SETTINGS_READ],
+    )]
+    public function tenantConfiguration(): JsonResponse
+    {
+        return new JsonResponse($this->tenantStatus->configuration());
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/configuration',
+        name: 'firewall.tenant.configuration.update',
+        methods: ['PUT'],
+        permissions: [TenantFirewallStatusService::PERMISSION_SETTINGS_MANAGE],
+    )]
+    public function updateTenantConfiguration(
+        bool $enabled,
+        int $maxAuthFailures,
+        int $authFailureWindow,
+        int $autoBlockDuration,
+        string $reason
+    ): JsonResponse {
+        return $this->settingsResponse(fn() => $this->tenantStatus->updateConfiguration(
+            $enabled, $maxAuthFailures, $authFailureWindow, $autoBlockDuration, $reason
+        ));
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/system/tenants/{tenantId}/configuration',
+        name: 'firewall.system.tenant.configuration.update',
+        methods: ['PUT'],
+        permissions: [SystemFirewallStatusService::PERMISSION_SETTINGS_MANAGE],
+    )]
+    public function updateSystemTenantConfiguration(
+        string $tenantId,
+        bool $enabled,
+        int $maxAuthFailures,
+        int $authFailureWindow,
+        int $autoBlockDuration,
+        string $reason
+    ): JsonResponse {
+        return $this->settingsResponse(fn() => $this->systemStatus->updateTenantConfiguration(
+            $tenantId, $enabled, $maxAuthFailures, $authFailureWindow, $autoBlockDuration, $reason
+        ));
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/system/metrics',
+        name: 'firewall.system.metrics.read',
+        permissions: [SystemFirewallLogService::PERMISSION_READ],
+    )]
+    public function systemMetrics(?string $tenantId = null, ?string $since = null): JsonResponse
+    {
+        return $this->readResponse(fn(): array => $this->systemStatus->metrics($tenantId, $since));
+    }
+
+    #[AuthenticatedRoute(
+        '/firewall/system/maintenance',
+        name: 'firewall.system.maintenance.read',
+        permissions: [SystemFirewallStatusService::PERMISSION_MAINTENANCE_READ],
+    )]
+    public function maintenanceStatus(): JsonResponse
+    {
+        return new JsonResponse($this->systemStatus->maintenanceStatus());
+    }
+
+    private function queryResponse(callable $query, string $limit, string $offset): JsonResponse
+    {
+        try {
+            if (!ctype_digit($limit) || !ctype_digit($offset)) {
+                throw new \InvalidArgumentException('Pagination values must be non-negative integers.');
+            }
+            return new JsonResponse($query((int)$limit, (int)$offset));
+        } catch (\InvalidArgumentException $error) {
+            return new JsonResponse(['error' => $error->getMessage()], JsonResponse::HTTP_BAD_REQUEST);
+        }
+    }
+
+    private function ruleResponse(?\JsonSerializable $rule): JsonResponse
+    {
+        if ($rule === null) {
+            return new JsonResponse(['error' => 'Firewall rule not found.'], JsonResponse::HTTP_NOT_FOUND);
+        }
+
+        return new JsonResponse($rule);
+    }
+
+    private function readResponse(callable $read): JsonResponse
+    {
+        try {
+            return new JsonResponse($read());
+        } catch (\InvalidArgumentException $error) {
+            return new JsonResponse(['error' => $error->getMessage()], JsonResponse::HTTP_BAD_REQUEST);
+        }
+    }
+
+    private function mutationResponse(callable $mutation): JsonResponse
+    {
+        try {
+            return new JsonResponse(['rule' => $mutation()], JsonResponse::HTTP_CREATED);
+        } catch (FirewallRuleConflictException $error) {
+            return new JsonResponse(['error' => [
+                'code' => $error->conflictCode,
+                'message' => $error->getMessage(),
+            ]], JsonResponse::HTTP_CONFLICT);
+        } catch (\InvalidArgumentException $error) {
+            return new JsonResponse(['error' => [
+                'code' => 'invalid_firewall_rule',
+                'message' => $error->getMessage(),
+            ]], JsonResponse::HTTP_BAD_REQUEST);
+        }
+    }
+
+    private function lifecycleResponse(callable $mutation): JsonResponse
+    {
+        try {
+            $rule = $mutation();
+            if ($rule === null) {
+                return new JsonResponse(['error' => [
+                    'code' => 'firewall_rule_not_found',
+                    'message' => 'Firewall rule not found.',
+                ]], JsonResponse::HTTP_NOT_FOUND);
+            }
+
+            return new JsonResponse(['rule' => $rule]);
+        } catch (FirewallRuleConflictException $error) {
+            return new JsonResponse(['error' => [
+                'code' => $error->conflictCode,
+                'message' => $error->getMessage(),
+            ]], JsonResponse::HTTP_CONFLICT);
+        } catch (\InvalidArgumentException $error) {
+            return new JsonResponse(['error' => [
+                'code' => 'invalid_firewall_rule',
+                'message' => $error->getMessage(),
+            ]], JsonResponse::HTTP_BAD_REQUEST);
+        }
+    }
+
+    private function settingsResponse(callable $mutation): JsonResponse
+    {
+        try {
+            $configuration = $mutation();
+            if ($configuration === null) {
+                return new JsonResponse(['error' => [
+                    'code' => 'tenant_not_found',
+                    'message' => 'Tenant not found.',
+                ]], JsonResponse::HTTP_NOT_FOUND);
+            }
+
+            return new JsonResponse(['configuration' => $configuration]);
+        } catch (\InvalidArgumentException $error) {
+            return new JsonResponse(['error' => [
+                'code' => 'invalid_firewall_configuration',
+                'message' => $error->getMessage(),
+            ]], JsonResponse::HTTP_BAD_REQUEST);
+        }
+    }
+}

core/lib/Event/DeferredEventProcessorInterface.php

@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 
-namespace KTXF\Event;
+namespace KTXC\Event;
 
 interface DeferredEventProcessorInterface
 {

core/lib/Event/DeferredProcessingResult.php

@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 
-namespace KTXF\Event;
+namespace KTXC\Event;
 
 final readonly class DeferredProcessingResult
 {

core/lib/Event/EventDispatcher.php

@@ -2,8 +2,12 @@
 
 declare(strict_types=1);
 
-namespace KTXF\Event;
+namespace KTXC\Event;
 
+use KTXF\Event\DeliveryMode;
+use KTXF\Event\Event;
+use KTXF\Event\EventDispatcherInterface;
+use KTXF\Event\FailurePolicy;
 use Psr\Container\ContainerInterface;
 use Psr\Log\LoggerInterface;
 
@@ -56,34 +60,34 @@ final class EventDispatcher implements EventDispatcherInterface, DeferredEventPr
             throw new \LogicException('Cannot process deferred events for an inactive execution.');
         }
 
-        $processed = 0;
-        $deadline = microtime(true) + 1.0;
-        $deadlineExceeded = false;
-        $limitExceeded = false;
-        while (($event = array_shift($this->deferred[$executionId])) !== null) {
-            if ($processed >= 1000) {
-                $limitExceeded = true;
-                array_unshift($this->deferred[$executionId], $event);
-                break;
+        try {
+            $processed = 0;
+            $deadline = microtime(true) + 1.0;
+            $deadlineExceeded = false;
+            $limitExceeded = false;
+            while (($event = array_shift($this->deferred[$executionId])) !== null) {
+                if ($processed >= 1000) {
+                    $limitExceeded = true;
+                    array_unshift($this->deferred[$executionId], $event);
+                    break;
+                }
+                if (microtime(true) >= $deadline) {
+                    $deadlineExceeded = true;
+                    array_unshift($this->deferred[$executionId], $event);
+                    break;
+                }
+                $processed += $this->invoke($event, DeliveryMode::Deferred);
             }
-            if (microtime(true) >= $deadline) {
-                $deadlineExceeded = true;
-                array_unshift($this->deferred[$executionId], $event);
-                break;
-            }
-            $processed += $this->invoke($event, DeliveryMode::Deferred);
+
+            return new DeferredProcessingResult(
+                $processed,
+                count($this->deferred[$executionId]),
+                $deadlineExceeded,
+                $limitExceeded,
+            );
+        } finally {
+            $this->discardDeferred($executionId);
         }
-
-        $remaining = count($this->deferred[$executionId]);
-        unset($this->deferred[$executionId]);
-        $this->activeExecution = null;
-
-        return new DeferredProcessingResult(
-            $processed,
-            $remaining,
-            $deadlineExceeded,
-            $limitExceeded,
-        );
     }
 
     public function discardDeferred(string $executionId): void

core/lib/Event/EventListenerDefinition.php

@@ -2,7 +2,10 @@
 
 declare(strict_types=1);
 
-namespace KTXF\Event;
+namespace KTXC\Event;
+
+use KTXF\Event\DeliveryMode;
+use KTXF\Event\FailurePolicy;
 
 final readonly class EventListenerDefinition
 {

core/lib/Event/EventListenerRegistry.php

@@ -2,11 +2,14 @@
 
 declare(strict_types=1);
 
-namespace KTXF\Event;
+namespace KTXC\Event;
 
+use KTXF\Event\DeliveryMode;
+use KTXF\Event\EventListenerRegistrarInterface;
+use KTXF\Event\FailurePolicy;
 use Psr\Container\ContainerInterface;
 
-final class EventListenerRegistry
+final class EventListenerRegistry implements EventListenerRegistrarInterface
 {
     /** @var array<string, list<EventListenerDefinition>> */
     private array $listeners = [];

core/lib/Http/Request/RequestContext.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Http\Request;
+
+/**
+ * Holds the HTTP request for the duration of the current runtime execution.
+ */
+final class RequestContext
+{
+    private ?Request $request = null;
+
+    public function initialize(Request $request): void
+    {
+        if ($this->request !== null) {
+            throw new \LogicException('The request context has already been initialized.');
+        }
+
+        $this->request = $request;
+    }
+
+    public function current(): ?Request
+    {
+        return $this->request;
+    }
+
+    public function clear(): void
+    {
+        $this->request = null;
+    }
+}

core/lib/Kernel.php

@@ -27,10 +27,11 @@ use KTXC\Module\ModuleManager;
 use Psr\Log\LoggerInterface;
 use KTXC\Logger\LoggerFactory;
 use KTXC\Logger\TenantAwareLogger;
-use KTXF\Event\DeferredEventProcessorInterface;
-use KTXF\Event\EventDispatcher;
+use KTXC\Event\DeferredEventProcessorInterface;
+use KTXC\Event\EventDispatcher;
+use KTXC\Event\EventListenerRegistry;
 use KTXF\Event\EventDispatcherInterface;
-use KTXF\Event\EventListenerRegistry;
+use KTXF\Event\EventListenerRegistrarInterface;
 use KTXF\Cache\EphemeralCacheInterface;
 use KTXF\Cache\PersistentCacheInterface;
 use KTXF\Cache\BlobCacheInterface;
@@ -410,6 +411,7 @@ class Kernel implements KernelInterface
             
             EventDispatcherInterface::class => \DI\get(EventDispatcher::class),
             DeferredEventProcessorInterface::class => \DI\get(EventDispatcher::class),
+            EventListenerRegistrarInterface::class => \DI\get(EventListenerRegistry::class),
             // Ephemeral Cache - for short-lived data (sessions, rate limits, challenges)
             EphemeralCacheInterface::class => function(ContainerInterface $c) use ($projectDir) {
                 $storeType = $c->has('cache.ephemeral') ? $c->get('cache.ephemeral') : 'file';

core/lib/Models/Firewall/FirewallLogObject.php

@@ -23,8 +23,10 @@ class FirewallLogObject implements \JsonSerializable, JsonDeserializable
     public const EVENT_ACCESS_CHECK = 'access_check';
     public const EVENT_RULE_CREATED = 'rule_created';
     public const EVENT_RULE_EXTENDED = 'rule_extended';
+    public const EVENT_RULE_ENABLED = 'rule_enabled';
     public const EVENT_RULE_DISABLED = 'rule_disabled';
     public const EVENT_RULE_REMOVED = 'rule_removed';
+    public const EVENT_SETTINGS_UPDATED = 'settings_updated';
 
     private ?string $id = null;
     private ?string $eventId = null;

core/lib/Module/Module.php

@@ -5,11 +5,26 @@ namespace KTXC\Module;
 use KTXC\Console\Firewall\FirewallMaintenanceCommand;
 use KTXC\Console\Firewall\FirewallSetupCommand;
 use KTXC\Service\FirewallService;
+use KTXC\Service\SystemFirewallLogService;
 use KTXC\Service\SystemFirewallRuleService;
+use KTXC\Service\SystemFirewallStatusService;
+use KTXC\Service\TenantFirewallLogService;
 use KTXC\Service\TenantFirewallRuleService;
+use KTXC\Service\TenantFirewallStatusService;
+use KTXC\Security\Event\AccessDeniedEvent;
+use KTXC\Security\Event\AuthenticationFailedEvent;
+use KTXC\Security\Event\AuthenticationSucceededEvent;
+use KTXC\Security\Event\BruteForceDetectedEvent;
+use KTXC\Security\Event\FirewallRuleCreatedEvent;
+use KTXC\Security\Event\FirewallRuleDisabledEvent;
+use KTXC\Security\Event\FirewallRuleEnabledEvent;
+use KTXC\Security\Event\FirewallRuleExtendedEvent;
+use KTXC\Security\Event\FirewallRuleRemovedEvent;
+use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
+use KTXC\Security\Event\RateLimitExceededEvent;
+use KTXC\Security\Event\SuspiciousActivityEvent;
 use KTXF\Event\DeliveryMode;
-use KTXF\Event\EventListenerRegistry;
-use KTXF\Event\SecurityEvent;
+use KTXF\Event\EventListenerRegistrarInterface;
 use KTXF\Module\ModuleBrowserInterface;
 use KTXF\Module\ModuleConsoleInterface;
 use KTXF\Module\ModuleInstanceAbstract;
@@ -22,7 +37,7 @@ use KTXF\Module\ModuleInstanceAbstract;
 class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface, ModuleBrowserInterface
 {
     public function __construct(
-        private readonly EventListenerRegistry $events,
+        private readonly EventListenerRegistrarInterface $events,
     ) {
     }
 
@@ -30,22 +45,32 @@ class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface, M
     {
         $this->events->listen(
             'core',
-            SecurityEvent::AUTH_FAILURE,
+            AuthenticationFailedEvent::class,
             FirewallService::class,
             'handleAuthFailure',
+            DeliveryMode::Immediate,
             priority: 100,
         );
 
+        $this->events->listen(
+            'core',
+            AuthenticationSucceededEvent::class,
+            FirewallService::class,
+            'logAuthenticationSuccess',
+            DeliveryMode::Deferred,
+        );
+
         foreach ([
-            SecurityEvent::AUTH_SUCCESS,
-            SecurityEvent::ACCESS_DENIED,
-            SecurityEvent::BRUTE_FORCE_DETECTED,
-            SecurityEvent::RATE_LIMIT_EXCEEDED,
-            SecurityEvent::SUSPICIOUS_ACTIVITY,
-            SecurityEvent::FIREWALL_RULE_CREATED,
-            SecurityEvent::FIREWALL_RULE_EXTENDED,
-            SecurityEvent::FIREWALL_RULE_DISABLED,
-            SecurityEvent::FIREWALL_RULE_REMOVED,
+            AccessDeniedEvent::class,
+            BruteForceDetectedEvent::class,
+            RateLimitExceededEvent::class,
+            SuspiciousActivityEvent::class,
+            FirewallRuleCreatedEvent::class,
+            FirewallRuleExtendedEvent::class,
+            FirewallRuleEnabledEvent::class,
+            FirewallRuleDisabledEvent::class,
+            FirewallRuleRemovedEvent::class,
+            FirewallSettingsUpdatedEvent::class,
         ] as $event) {
             $this->events->listen(
                 'core',
@@ -135,6 +160,21 @@ class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface, M
                 'description' => 'Create, disable, and remove firewall rules owned by the current tenant',
                 'group' => 'Firewall Management'
             ],
+            TenantFirewallLogService::PERMISSION_READ => [
+                'label' => 'View Tenant Firewall Logs',
+                'description' => 'View firewall security and audit logs owned by the current tenant',
+                'group' => 'Firewall Management'
+            ],
+            TenantFirewallStatusService::PERMISSION_SETTINGS_READ => [
+                'label' => 'View Tenant Firewall Settings',
+                'description' => 'View effective firewall settings for the current tenant',
+                'group' => 'Firewall Management'
+            ],
+            TenantFirewallStatusService::PERMISSION_SETTINGS_MANAGE => [
+                'label' => 'Manage Tenant Firewall Settings',
+                'description' => 'Update firewall settings for the current tenant',
+                'group' => 'Firewall Management'
+            ],
             SystemFirewallRuleService::PERMISSION_READ => [
                 'label' => 'View System Firewall Rules',
                 'description' => 'View firewall rules that apply to every tenant',
@@ -145,6 +185,21 @@ class Module extends ModuleInstanceAbstract implements ModuleConsoleInterface, M
                 'description' => 'Create, disable, and remove firewall rules that apply to every tenant',
                 'group' => 'System Administration'
             ],
+            SystemFirewallLogService::PERMISSION_READ => [
+                'label' => 'View System Firewall Logs',
+                'description' => 'View firewall security and audit logs across tenants',
+                'group' => 'System Administration'
+            ],
+            SystemFirewallStatusService::PERMISSION_MAINTENANCE_READ => [
+                'label' => 'View Firewall Maintenance Status',
+                'description' => 'View the last firewall cleanup result and operational status',
+                'group' => 'System Administration'
+            ],
+            SystemFirewallStatusService::PERMISSION_SETTINGS_MANAGE => [
+                'label' => 'Manage Tenant Firewall Settings System-Wide',
+                'description' => 'Update firewall settings for any tenant',
+                'group' => 'System Administration'
+            ],
             'system.admin' => [
                 'label' => 'System Administrator',
                 'description' => 'Full system access (superuser)',

core/lib/Runtime/Http/HttpRuntime.php

@@ -11,6 +11,7 @@ use KTXC\Http\Middleware\MiddlewarePipeline;
 use KTXC\Http\Middleware\RouterMiddleware;
 use KTXC\Http\Middleware\TenantMiddleware;
 use KTXC\Http\Request\Request;
+use KTXC\Http\Request\RequestContext;
 use KTXC\Http\Response\Response;
 use KTXC\KernelInterface;
 
@@ -25,26 +26,34 @@ final class HttpRuntime
     public function run(?Request $request = null, bool $send = true): Response
     {
         $request ??= Request::createFromGlobals();
+        $requestContext = null;
 
-        return $this->kernel->executionRunner()->execute(
-            ExecutionDescriptor::http(),
-            function () use ($request, $send): Response {
-                $response = $this->pipeline()->handle($request);
-                if ($send) {
-                    $response->send();
-                }
+        try {
+            return $this->kernel->executionRunner()->execute(
+                ExecutionDescriptor::http(),
+                function () use ($request, $send, &$requestContext): Response {
+                    $requestContext = $this->kernel->container()->get(RequestContext::class);
+                    $requestContext->initialize($request);
 
-                return $response;
-            },
-            function (\Throwable $error) use ($send): Response {
-                $response = $this->errorResponse($error);
-                if ($send) {
-                    $response->send();
-                }
+                    $response = $this->pipeline()->handle($request);
+                    if ($send) {
+                        $response->send();
+                    }
 
-                return $response;
-            },
-        );
+                    return $response;
+                },
+                function (\Throwable $error) use ($send): Response {
+                    $response = $this->errorResponse($error);
+                    if ($send) {
+                        $response->send();
+                    }
+
+                    return $response;
+                },
+            );
+        } finally {
+            $requestContext?->clear();
+        }
     }
 
     private function pipeline(): MiddlewarePipeline

core/lib/Security/AuthenticationManager.php

@@ -8,11 +8,14 @@ use KTXC\Models\Identity\User;
 use KTXC\Resource\ProviderManager;
 use KTXC\Security\Authentication\AuthenticationRequest;
 use KTXC\Security\Authentication\AuthenticationResponse;
+use KTXC\Security\Event\AuthenticationFailedEvent;
+use KTXC\Security\Event\AuthenticationSucceededEvent;
 use KTXC\Service\TokenService;
 use KTXC\Service\UserAccountsService;
 use KTXC\Context\TenantContextInterface;
 use KTXF\Cache\CacheScope;
 use KTXF\Cache\EphemeralCacheInterface;
+use KTXF\Event\EventDispatcherInterface;
 use KTXF\Security\Authentication\AuthenticationProviderInterface;
 use KTXF\Security\Authentication\AuthenticationSession;
 use KTXF\Security\Authentication\ProviderContext;
@@ -31,6 +34,7 @@ class AuthenticationManager
         private readonly ProviderManager $providerManager,
         private readonly TokenService $tokenService,
         private readonly UserAccountsService $userService,
+        private readonly EventDispatcherInterface $events,
     ) {
         $this->securityCode = $this->tenantContext->configuration()->security()->code();
     }
@@ -187,6 +191,10 @@ class AuthenticationManager
 
         if (!$result->isSuccess()) {
             $this->saveSession($session);
+            $this->publishAuthenticationFailure(
+                $session,
+                $result->errorCode ?? AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
+            );
             return AuthenticationResponse::failed(
                 AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
                 'Authentication failed. If you haven\'t set up this method, try another option.',
@@ -389,6 +397,10 @@ class AuthenticationManager
         $result = $provider->completeRedirect($context, $request->params);
 
         if ($result->isFailed()) {
+            $this->publishAuthenticationFailure(
+                $session,
+                $result->errorCode ?? AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
+            );
             $this->deleteSession($session->id);
             return AuthenticationResponse::failed(
                 AuthenticationResponse::ERROR_INVALID_CREDENTIALS,
@@ -566,6 +578,17 @@ class AuthenticationManager
     // Helper Methods
     // =========================================================================
 
+    private function publishAuthenticationFailure(
+        AuthenticationSession $session,
+        string $reason,
+    ): void {
+        $this->events->dispatch(new AuthenticationFailedEvent(
+            userId: $session->userIdentifier,
+            reason: $reason,
+            tenantId: $session->tenantIdentifier,
+        ));
+    }
+
     /**
      * Build provider context from session
      */
@@ -594,7 +617,16 @@ class AuthenticationManager
      */
     private function completeAuthentication(AuthenticationSession $session): AuthenticationResponse
     {
-        $userData = $this->userService->fetchByIdentifier($session->userIdentifier);
+        $userId = $session->userIdentifier;
+        if ($userId === null) {
+            return AuthenticationResponse::failed(
+                AuthenticationResponse::ERROR_INVALID_SESSION,
+                'Authenticated user is missing',
+                401,
+            );
+        }
+
+        $userData = $this->userService->fetchByIdentifier($userId);
         
         if ($userData === null) {
             return AuthenticationResponse::failed(
@@ -611,6 +643,11 @@ class AuthenticationManager
 
         $this->deleteSession($session->id);
 
+        $this->events->dispatch(new AuthenticationSucceededEvent(
+            $userId,
+            $session->tenantIdentifier,
+        ));
+
         return AuthenticationResponse::success(
             $this->buildUserData($user),
             $tokens

core/lib/Security/Event/AccessDeniedEvent.php

@@ -0,0 +1,88 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXC\Models\Firewall\FirewallRuleObject;
+use KTXF\Event\Event;
+
+final class AccessDeniedEvent extends Event implements SecurityRequestEventInterface
+{
+    public function __construct(
+        private readonly string $ipAddress,
+        private readonly string $ruleId,
+        private readonly string $ruleScope,
+        private readonly ?string $deviceFingerprint = null,
+        private readonly ?string $reason = null,
+        ?string $tenantId = null,
+        ?string $identityId = null,
+    ) {
+        if ($ipAddress === '') {
+            throw new \InvalidArgumentException('Access denial requires an IP address.');
+        }
+        if ($ruleId === '') {
+            throw new \InvalidArgumentException('Access denial requires a firewall rule ID.');
+        }
+        if (!in_array($ruleScope, [FirewallRuleObject::SCOPE_SYSTEM, FirewallRuleObject::SCOPE_TENANT], true)) {
+            throw new \InvalidArgumentException('Access denial requires a valid firewall rule scope.');
+        }
+
+        parent::__construct(
+            self::class,
+            ['ruleId' => $ruleId, 'ruleScope' => $ruleScope, 'reason' => $reason],
+            $tenantId,
+            $identityId,
+        );
+    }
+
+    public function getIpAddress(): string
+    {
+        return $this->ipAddress;
+    }
+
+    public function getRuleId(): string
+    {
+        return $this->ruleId;
+    }
+
+    public function getRuleScope(): string
+    {
+        return $this->ruleScope;
+    }
+
+    public function getDeviceFingerprint(): ?string
+    {
+        return $this->deviceFingerprint;
+    }
+
+    public function getUserAgent(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestPath(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestMethod(): ?string
+    {
+        return null;
+    }
+
+    public function getUserId(): ?string
+    {
+        return null;
+    }
+
+    public function getReason(): ?string
+    {
+        return $this->reason;
+    }
+
+    public function getSeverity(): SecurityEventSeverity
+    {
+        return SecurityEventSeverity::WARNING;
+    }
+}

core/lib/Security/Event/AuthenticationFailedEvent.php

@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXF\Event\Event;
+
+final class AuthenticationFailedEvent extends Event implements SecurityEventInterface
+{
+    public function __construct(
+        private readonly ?string $userId = null,
+        private readonly ?string $reason = null,
+        ?string $tenantId = null,
+        ?string $identityId = null,
+    ) {
+        parent::__construct(
+            self::class,
+            ['userId' => $userId, 'reason' => $reason],
+            $tenantId,
+            $identityId,
+        );
+    }
+
+    public function getUserId(): ?string
+    {
+        return $this->userId;
+    }
+
+    public function getReason(): ?string
+    {
+        return $this->reason;
+    }
+
+    public function getSeverity(): SecurityEventSeverity
+    {
+        return SecurityEventSeverity::WARNING;
+    }
+}

core/lib/Security/Event/AuthenticationSucceededEvent.php

@@ -0,0 +1,40 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXF\Event\Event;
+
+final class AuthenticationSucceededEvent extends Event implements SecurityEventInterface
+{
+    public function __construct(
+        private readonly string $userId,
+        ?string $tenantId = null,
+    ) {
+        if ($userId === '') {
+            throw new \InvalidArgumentException('Successful authentication requires a user ID.');
+        }
+
+        parent::__construct(
+            self::class,
+            ['userId' => $userId],
+            $tenantId,
+        );
+    }
+
+    public function getUserId(): string
+    {
+        return $this->userId;
+    }
+
+    public function getReason(): ?string
+    {
+        return null;
+    }
+
+    public function getSeverity(): SecurityEventSeverity
+    {
+        return SecurityEventSeverity::INFO;
+    }
+}

core/lib/Security/Event/BruteForceDetectedEvent.php

@@ -0,0 +1,91 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXF\Event\Event;
+
+final class BruteForceDetectedEvent extends Event implements SecurityRequestEventInterface
+{
+    private readonly string $reason;
+
+    public function __construct(
+        private readonly string $ipAddress,
+        private readonly int $failureCount,
+        private readonly int $windowSeconds,
+        ?string $tenantId = null,
+    ) {
+        if ($ipAddress === '') {
+            throw new \InvalidArgumentException('Brute-force detection requires an IP address.');
+        }
+        if ($failureCount < 1) {
+            throw new \InvalidArgumentException('Brute-force detection requires at least one failure.');
+        }
+        if ($windowSeconds < 1) {
+            throw new \InvalidArgumentException('Brute-force detection requires a positive window.');
+        }
+
+        $this->reason = sprintf(
+            '%d failed attempts in %d seconds',
+            $failureCount,
+            $windowSeconds,
+        );
+
+        parent::__construct(
+            self::class,
+            ['failureCount' => $failureCount, 'windowSeconds' => $windowSeconds],
+            $tenantId,
+        );
+    }
+
+    public function getIpAddress(): string
+    {
+        return $this->ipAddress;
+    }
+
+    public function getFailureCount(): int
+    {
+        return $this->failureCount;
+    }
+
+    public function getWindowSeconds(): int
+    {
+        return $this->windowSeconds;
+    }
+
+    public function getDeviceFingerprint(): ?string
+    {
+        return null;
+    }
+
+    public function getUserAgent(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestPath(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestMethod(): ?string
+    {
+        return null;
+    }
+
+    public function getUserId(): ?string
+    {
+        return null;
+    }
+
+    public function getReason(): string
+    {
+        return $this->reason;
+    }
+
+    public function getSeverity(): SecurityEventSeverity
+    {
+        return SecurityEventSeverity::CRITICAL;
+    }
+}

core/lib/Security/Event/DeviceBlockedEvent.php

@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXF\Event\Event;
+
+final class DeviceBlockedEvent extends Event implements SecurityRequestEventInterface
+{
+    public function __construct(
+        private readonly string $deviceFingerprint,
+        private readonly ?string $reason = null,
+        ?string $tenantId = null,
+    ) {
+        if ($deviceFingerprint === '') {
+            throw new \InvalidArgumentException('Device-block events require a fingerprint.');
+        }
+
+        parent::__construct(
+            self::class,
+            ['device' => $deviceFingerprint, 'reason' => $reason],
+            $tenantId,
+        );
+    }
+
+    public function getIpAddress(): ?string
+    {
+        return null;
+    }
+
+    public function getDeviceFingerprint(): string
+    {
+        return $this->deviceFingerprint;
+    }
+
+    public function getUserAgent(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestPath(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestMethod(): ?string
+    {
+        return null;
+    }
+
+    public function getUserId(): ?string
+    {
+        return null;
+    }
+
+    public function getReason(): ?string
+    {
+        return $this->reason;
+    }
+
+    public function getSeverity(): SecurityEventSeverity
+    {
+        return SecurityEventSeverity::CRITICAL;
+    }
+}

core/lib/Security/Event/FirewallIpEvent.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXF\Event\Event;
+
+abstract class FirewallIpEvent extends Event implements SecurityRequestEventInterface
+{
+    protected const SecurityEventSeverity SEVERITY = SecurityEventSeverity::INFO;
+
+    final public function __construct(
+        private readonly string $ipAddress,
+        private readonly ?string $reason = null,
+        ?string $tenantId = null,
+    ) {
+        if ($ipAddress === '') {
+            throw new \InvalidArgumentException('Firewall IP events require an IP address.');
+        }
+
+        parent::__construct(
+            static::class,
+            ['ip' => $ipAddress, 'reason' => $reason],
+            $tenantId,
+        );
+    }
+
+    public function getIpAddress(): string
+    {
+        return $this->ipAddress;
+    }
+
+    public function getDeviceFingerprint(): ?string
+    {
+        return null;
+    }
+
+    public function getUserAgent(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestPath(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestMethod(): ?string
+    {
+        return null;
+    }
+
+    public function getUserId(): ?string
+    {
+        return null;
+    }
+
+    public function getReason(): ?string
+    {
+        return $this->reason;
+    }
+
+    public function getSeverity(): SecurityEventSeverity
+    {
+        return static::SEVERITY;
+    }
+}

core/lib/Security/Event/FirewallRuleCreatedEvent.php

@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+final class FirewallRuleCreatedEvent extends FirewallRuleEvent
+{
+}

core/lib/Security/Event/FirewallRuleDisabledEvent.php

@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+final class FirewallRuleDisabledEvent extends FirewallRuleEvent
+{
+}

core/lib/Security/Event/FirewallRuleEnabledEvent.php

@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+final class FirewallRuleEnabledEvent extends FirewallRuleEvent
+{
+}

core/lib/Security/Event/FirewallRuleEvent.php

@@ -0,0 +1,158 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXC\Models\Firewall\FirewallRuleObject;
+use KTXF\Event\Event;
+
+abstract class FirewallRuleEvent extends Event implements SecurityEventInterface
+{
+    final protected function __construct(
+        private readonly string $ruleId,
+        private readonly string $ruleScope,
+        private readonly string $ruleType,
+        private readonly string $ruleAction,
+        private readonly string $ruleValue,
+        private readonly ?string $reason,
+        private readonly string $origin,
+        private readonly ?string $expiresAt,
+        private readonly array $details,
+        ?string $tenantId,
+        ?string $identityId,
+    ) {
+        if ($ruleId === '') {
+            throw new \InvalidArgumentException('Firewall rule events require a rule ID.');
+        }
+        foreach ([
+            'scope' => $ruleScope,
+            'type' => $ruleType,
+            'action' => $ruleAction,
+            'value' => $ruleValue,
+            'origin' => $origin,
+        ] as $field => $value) {
+            if ($value === '') {
+                throw new \InvalidArgumentException("Firewall rule events require a rule {$field}.");
+            }
+        }
+        foreach ([
+            'scope' => $ruleScope,
+            'type' => $ruleType,
+            'action' => $ruleAction,
+            'value' => $ruleValue,
+            'origin' => $origin,
+        ] as $field => $value) {
+            if ($value === '') {
+                throw new \InvalidArgumentException("Firewall rule events require a rule {$field}.");
+            }
+        }
+
+        parent::__construct(
+            static::class,
+            [
+                'ruleId' => $ruleId,
+                'ruleScope' => $ruleScope,
+                'ruleType' => $ruleType,
+                'ruleAction' => $ruleAction,
+                'ruleValue' => $ruleValue,
+                'reason' => $reason,
+                'origin' => $origin,
+                'expiresAt' => $expiresAt,
+                ...$details,
+            ],
+            $tenantId,
+            $identityId,
+        );
+    }
+
+    public static function fromRule(
+        FirewallRuleObject $rule,
+        ?string $actorId = null,
+        array $change = [],
+    ): static {
+        $metadata = $rule->getMetadata() ?? [];
+        $details = [...$metadata, ...$change];
+        foreach ([
+            'ruleId',
+            'ruleScope',
+            'ruleType',
+            'ruleAction',
+            'ruleValue',
+            'reason',
+            'origin',
+            'expiresAt',
+        ] as $reservedKey) {
+            unset($details[$reservedKey]);
+        }
+
+        return new static(
+            ruleId: (string) $rule->getId(),
+            ruleScope: (string) $rule->getScope(),
+            ruleType: (string) $rule->getType(),
+            ruleAction: (string) $rule->getAction(),
+            ruleValue: (string) $rule->getValue(),
+            reason: $rule->getReason(),
+            origin: (string) ($metadata['origin'] ?? 'manual'),
+            expiresAt: $rule->getExpiresAt()?->format(\DateTimeInterface::ATOM),
+            details: $details,
+            tenantId: $rule->getTenantId(),
+            identityId: $actorId ?? $rule->getCreatedBy(),
+        );
+    }
+
+    public function getRuleId(): string
+    {
+        return $this->ruleId;
+    }
+
+    public function getRuleScope(): string
+    {
+        return $this->ruleScope;
+    }
+
+    public function getRuleType(): string
+    {
+        return $this->ruleType;
+    }
+
+    public function getRuleAction(): string
+    {
+        return $this->ruleAction;
+    }
+
+    public function getRuleValue(): string
+    {
+        return $this->ruleValue;
+    }
+
+    public function getOrigin(): string
+    {
+        return $this->origin;
+    }
+
+    public function getExpiresAt(): ?string
+    {
+        return $this->expiresAt;
+    }
+
+    public function getDetails(): array
+    {
+        return $this->details;
+    }
+
+    public function getUserId(): ?string
+    {
+        return null;
+    }
+
+    public function getReason(): ?string
+    {
+        return $this->reason;
+    }
+
+    public function getSeverity(): SecurityEventSeverity
+    {
+        return SecurityEventSeverity::INFO;
+    }
+}

core/lib/Security/Event/FirewallRuleExtendedEvent.php

@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+final class FirewallRuleExtendedEvent extends FirewallRuleEvent
+{
+}

core/lib/Security/Event/FirewallRuleRemovedEvent.php

@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+final class FirewallRuleRemovedEvent extends FirewallRuleEvent
+{
+}

core/lib/Security/Event/FirewallSettingsUpdatedEvent.php

@@ -0,0 +1,76 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXF\Event\Event;
+
+final class FirewallSettingsUpdatedEvent extends Event implements SecurityEventInterface
+{
+    public function __construct(
+        private readonly string $changeReason,
+        private readonly array $previous,
+        private readonly array $current,
+        string $tenantId,
+        ?string $actorId = null,
+        private readonly string $changeOrigin = 'manual',
+    ) {
+        if ($changeReason === '') {
+            throw new \InvalidArgumentException('Firewall settings updates require a change reason.');
+        }
+        if ($tenantId === '') {
+            throw new \InvalidArgumentException('Firewall settings updates require a tenant ID.');
+        }
+        if ($changeOrigin === '') {
+            throw new \InvalidArgumentException('Firewall settings updates require a change origin.');
+        }
+
+        parent::__construct(
+            self::class,
+            [
+                'changeReason' => $changeReason,
+                'changeOrigin' => $changeOrigin,
+                'previous' => $previous,
+                'current' => $current,
+            ],
+            $tenantId,
+            $actorId,
+        );
+    }
+
+    public function getChangeReason(): string
+    {
+        return $this->changeReason;
+    }
+
+    public function getPrevious(): array
+    {
+        return $this->previous;
+    }
+
+    public function getCurrent(): array
+    {
+        return $this->current;
+    }
+
+    public function getChangeOrigin(): string
+    {
+        return $this->changeOrigin;
+    }
+
+    public function getUserId(): ?string
+    {
+        return null;
+    }
+
+    public function getReason(): string
+    {
+        return $this->changeReason;
+    }
+
+    public function getSeverity(): SecurityEventSeverity
+    {
+        return SecurityEventSeverity::INFO;
+    }
+}

core/lib/Security/Event/IpAllowedEvent.php

@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+final class IpAllowedEvent extends FirewallIpEvent
+{
+}

core/lib/Security/Event/IpBlockedEvent.php

@@ -0,0 +1,10 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+final class IpBlockedEvent extends FirewallIpEvent
+{
+    protected const SecurityEventSeverity SEVERITY = SecurityEventSeverity::CRITICAL;
+}

core/lib/Security/Event/RateLimitExceededEvent.php

@@ -0,0 +1,104 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXF\Event\Event;
+
+final class RateLimitExceededEvent extends Event implements SecurityRequestEventInterface
+{
+    private readonly string $reason;
+
+    public function __construct(
+        private readonly string $ipAddress,
+        private readonly int $requestCount,
+        private readonly int $windowSeconds,
+        private readonly ?string $endpoint = null,
+        ?string $tenantId = null,
+    ) {
+        if ($ipAddress === '') {
+            throw new \InvalidArgumentException('Rate-limit detection requires an IP address.');
+        }
+        if ($requestCount < 1) {
+            throw new \InvalidArgumentException('Rate-limit detection requires at least one request.');
+        }
+        if ($windowSeconds < 1) {
+            throw new \InvalidArgumentException('Rate-limit detection requires a positive window.');
+        }
+        if ($endpoint === '') {
+            throw new \InvalidArgumentException('A supplied rate-limit endpoint cannot be empty.');
+        }
+
+        $this->reason = sprintf(
+            '%d requests in %d seconds',
+            $requestCount,
+            $windowSeconds,
+        );
+
+        parent::__construct(
+            self::class,
+            [
+                'requestCount' => $requestCount,
+                'windowSeconds' => $windowSeconds,
+                'endpoint' => $endpoint,
+            ],
+            $tenantId,
+        );
+    }
+
+    public function getIpAddress(): string
+    {
+        return $this->ipAddress;
+    }
+
+    public function getRequestCount(): int
+    {
+        return $this->requestCount;
+    }
+
+    public function getWindowSeconds(): int
+    {
+        return $this->windowSeconds;
+    }
+
+    public function getEndpoint(): ?string
+    {
+        return $this->endpoint;
+    }
+
+    public function getDeviceFingerprint(): ?string
+    {
+        return null;
+    }
+
+    public function getUserAgent(): ?string
+    {
+        return null;
+    }
+
+    public function getRequestPath(): ?string
+    {
+        return $this->endpoint;
+    }
+
+    public function getRequestMethod(): ?string
+    {
+        return null;
+    }
+
+    public function getUserId(): ?string
+    {
+        return null;
+    }
+
+    public function getReason(): string
+    {
+        return $this->reason;
+    }
+
+    public function getSeverity(): SecurityEventSeverity
+    {
+        return SecurityEventSeverity::ERROR;
+    }
+}

core/lib/Security/Event/SecurityEventInterface.php

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+interface SecurityEventInterface
+{
+    public function getName(): string;
+
+    public function get(string $key, mixed $default = null): mixed;
+
+    public function getData(): array;
+
+    public function getEventId(): string;
+
+    public function getTenantId(): ?string;
+
+    public function getIdentityId(): ?string;
+
+    public function getUserId(): ?string;
+
+    public function getReason(): ?string;
+
+    public function getSeverity(): SecurityEventSeverity;
+}

core/lib/Security/Event/SecurityEventSeverity.php

@@ -0,0 +1,14 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+enum SecurityEventSeverity: int
+{
+    case DEBUG = 0;
+    case INFO = 1;
+    case WARNING = 2;
+    case ERROR = 3;
+    case CRITICAL = 4;
+}

core/lib/Security/Event/SecurityRequestEventInterface.php

@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+interface SecurityRequestEventInterface extends SecurityEventInterface
+{
+    public function getIpAddress(): ?string;
+
+    public function getDeviceFingerprint(): ?string;
+
+    public function getUserAgent(): ?string;
+
+    public function getRequestPath(): ?string;
+
+    public function getRequestMethod(): ?string;
+}

core/lib/Security/Event/SuspiciousActivityEvent.php

@@ -0,0 +1,100 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Security\Event;
+
+use KTXF\Event\Event;
+
+final class SuspiciousActivityEvent extends Event implements SecurityRequestEventInterface
+{
+    public function __construct(
+        private readonly string $ipAddress,
+        private readonly string $detector,
+        private readonly array $detectionData = [],
+        ?string $tenantId = null,
+        ?string $identityId = null,
+        private readonly ?string $deviceFingerprint = null,
+        private readonly ?string $userAgent = null,
+        private readonly ?string $requestPath = null,
+        private readonly ?string $requestMethod = null,
+        private readonly ?string $userId = null,
+        private readonly ?string $reason = null,
+    ) {
+        if ($ipAddress === '') {
+            throw new \InvalidArgumentException('Suspicious activity requires an IP address.');
+        }
+        if ($detector === '') {
+            throw new \InvalidArgumentException('Suspicious activity requires a detector.');
+        }
+        if (array_key_exists('detector', $detectionData)) {
+            throw new \InvalidArgumentException('Detection data cannot replace the detector.');
+        }
+        if (array_key_exists('detector', $detectionData)) {
+            throw new \InvalidArgumentException('Detection data cannot replace the detector.');
+        }
+        if ($requestPath === '') {
+            throw new \InvalidArgumentException('A supplied request path cannot be empty.');
+        }
+        if ($requestMethod === '') {
+            throw new \InvalidArgumentException('A supplied request method cannot be empty.');
+        }
+
+        parent::__construct(
+            self::class,
+            ['detector' => $detector] + $detectionData,
+            $tenantId,
+            $identityId,
+        );
+    }
+
+    public function getIpAddress(): string
+    {
+        return $this->ipAddress;
+    }
+
+    public function getDetector(): string
+    {
+        return $this->detector;
+    }
+
+    public function getDetectionData(): array
+    {
+        return $this->detectionData;
+    }
+
+    public function getDeviceFingerprint(): ?string
+    {
+        return $this->deviceFingerprint;
+    }
+
+    public function getUserAgent(): ?string
+    {
+        return $this->userAgent;
+    }
+
+    public function getRequestPath(): ?string
+    {
+        return $this->requestPath;
+    }
+
+    public function getRequestMethod(): ?string
+    {
+        return $this->requestMethod;
+    }
+
+    public function getUserId(): ?string
+    {
+        return $this->userId;
+    }
+
+    public function getReason(): ?string
+    {
+        return $this->reason;
+    }
+
+    public function getSeverity(): SecurityEventSeverity
+    {
+        return SecurityEventSeverity::ERROR;
+    }
+}

core/lib/Service/FirewallLogService.php

@@ -0,0 +1,126 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Service;
+
+use KTXC\Models\Firewall\FirewallLogObject;
+use KTXC\Models\Firewall\FirewallRuleObject;
+use KTXC\Stores\FirewallStore;
+
+final class FirewallLogService
+{
+    public const MAX_LIMIT = 100;
+
+    private const EVENT_TYPES = [
+        FirewallLogObject::EVENT_AUTH_FAILURE,
+        FirewallLogObject::EVENT_RATE_LIMIT,
+        FirewallLogObject::EVENT_BRUTE_FORCE,
+        FirewallLogObject::EVENT_SUSPICIOUS,
+        FirewallLogObject::EVENT_RULE_MATCH,
+        FirewallLogObject::EVENT_ACCESS_CHECK,
+        FirewallLogObject::EVENT_RULE_CREATED,
+        FirewallLogObject::EVENT_RULE_EXTENDED,
+        FirewallLogObject::EVENT_RULE_ENABLED,
+        FirewallLogObject::EVENT_RULE_DISABLED,
+        FirewallLogObject::EVENT_RULE_REMOVED,
+        FirewallLogObject::EVENT_SETTINGS_UPDATED,
+    ];
+
+    public function __construct(private readonly FirewallStore $store)
+    {
+    }
+
+    public function tenant(string $tenantId, array $filters, int $limit, int $offset): array
+    {
+        return $this->store->queryTenantLogs(
+            $tenantId,
+            $this->validate($filters, $limit, $offset),
+            $limit,
+            $offset
+        );
+    }
+
+    public function system(?string $tenantId, array $filters, int $limit, int $offset): array
+    {
+        if ($tenantId !== null && ($tenantId === '' || strlen($tenantId) > 128)) {
+            throw new \InvalidArgumentException('Invalid tenant filter.');
+        }
+        return $this->store->querySystemLogs(
+            $tenantId,
+            $this->validate($filters, $limit, $offset),
+            $limit,
+            $offset
+        );
+    }
+
+    private function validate(array $filters, int $limit, int $offset): array
+    {
+        if ($limit < 1 || $limit > self::MAX_LIMIT || $offset < 0) {
+            throw new \InvalidArgumentException('Pagination requires limit 1-100 and offset 0 or greater.');
+        }
+        $ipAddress = self::nullableString($filters, 'ipAddress');
+        if ($ipAddress !== null && filter_var($ipAddress, FILTER_VALIDATE_IP) === false) {
+            throw new \InvalidArgumentException('Invalid IP address filter.');
+        }
+        $eventType = self::nullableString($filters, 'eventType');
+        if ($eventType !== null && !in_array($eventType, self::EVENT_TYPES, true)) {
+            throw new \InvalidArgumentException('Invalid firewall event type filter.');
+        }
+        $result = self::nullableString($filters, 'result');
+        if ($result !== null && !in_array($result, [
+            FirewallLogObject::RESULT_ALLOWED,
+            FirewallLogObject::RESULT_BLOCKED,
+            FirewallLogObject::RESULT_RECORDED,
+        ], true)) {
+            throw new \InvalidArgumentException('Invalid firewall result filter.');
+        }
+        $ruleScope = self::nullableString($filters, 'ruleScope');
+        if ($ruleScope !== null && !in_array($ruleScope, [
+            FirewallRuleObject::SCOPE_TENANT,
+            FirewallRuleObject::SCOPE_SYSTEM,
+        ], true)) {
+            throw new \InvalidArgumentException('Invalid rule scope filter.');
+        }
+        $from = self::date($filters, 'from');
+        $to = self::date($filters, 'to');
+        if ($from !== null && $to !== null && $from > $to) {
+            throw new \InvalidArgumentException('The from date must not be later than the to date.');
+        }
+
+        return [
+            'ipAddress' => $ipAddress,
+            'eventType' => $eventType,
+            'result' => $result,
+            'ruleId' => self::nullableString($filters, 'ruleId'),
+            'ruleScope' => $ruleScope,
+            'from' => $from,
+            'to' => $to,
+        ];
+    }
+
+    private static function nullableString(array $filters, string $key): ?string
+    {
+        $value = $filters[$key] ?? null;
+        if ($value === null) {
+            return null;
+        }
+        if (!is_string($value) || $value === '' || strlen($value) > 255) {
+            throw new \InvalidArgumentException("Invalid {$key} filter.");
+        }
+        return $value;
+    }
+
+    private static function date(array $filters, string $key): ?\DateTimeImmutable
+    {
+        $value = self::nullableString($filters, $key);
+        if ($value === null) {
+            return null;
+        }
+        try {
+            return new \DateTimeImmutable($value);
+        } catch (\Exception) {
+            throw new \InvalidArgumentException("Invalid {$key} date filter.");
+        }
+    }
+}

core/lib/Service/FirewallRuleConflictException.php

@@ -0,0 +1,15 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Service;
+
+final class FirewallRuleConflictException extends \RuntimeException
+{
+    public function __construct(
+        public readonly string $conflictCode,
+        string $message
+    ) {
+        parent::__construct($message);
+    }
+}

core/lib/Service/FirewallRuleManager.php

@@ -5,12 +5,23 @@ declare(strict_types=1);
 namespace KTXC\Service;
 
 use KTXC\Models\Firewall\FirewallRuleObject;
+use KTXC\Security\Event\FirewallRuleCreatedEvent;
+use KTXC\Security\Event\FirewallRuleDisabledEvent;
+use KTXC\Security\Event\FirewallRuleEnabledEvent;
+use KTXC\Security\Event\FirewallRuleEvent;
+use KTXC\Security\Event\FirewallRuleExtendedEvent;
+use KTXC\Security\Event\FirewallRuleRemovedEvent;
+use KTXC\Security\Event\DeviceBlockedEvent;
+use KTXC\Security\Event\IpAllowedEvent;
+use KTXC\Security\Event\IpBlockedEvent;
 use KTXC\Stores\FirewallStore;
 use KTXF\Event\EventDispatcherInterface;
-use KTXF\Event\SecurityEvent;
+use KTXF\IpUtils;
 
 final class FirewallRuleManager
 {
+    public const QUERY_STATUSES = ['active', 'disabled', 'expired', 'all'];
+    public const MAX_QUERY_LIMIT = 100;
     public const ORIGIN_MANUAL = 'manual';
     public const ORIGIN_AUTOMATIC = 'automatic';
 
@@ -28,6 +39,120 @@ final class FirewallRuleManager
             : $this->store->listRules($scope->tenantId, $activeOnly);
     }
 
+    public function query(
+        FirewallRuleScope $scope,
+        string $status = 'active',
+        ?string $type = null,
+        ?string $action = null,
+        int $limit = 50,
+        int $offset = 0
+    ): array {
+        if (!in_array($status, self::QUERY_STATUSES, true)) {
+            throw new \InvalidArgumentException('Invalid rule status filter.');
+        }
+        if ($type !== null && !in_array($type, [
+            FirewallRuleObject::TYPE_IP,
+            FirewallRuleObject::TYPE_IP_RANGE,
+            FirewallRuleObject::TYPE_DEVICE,
+        ], true)) {
+            throw new \InvalidArgumentException('Invalid rule type filter.');
+        }
+        if ($action !== null && !in_array($action, [
+            FirewallRuleObject::ACTION_ALLOW,
+            FirewallRuleObject::ACTION_BLOCK,
+        ], true)) {
+            throw new \InvalidArgumentException('Invalid rule action filter.');
+        }
+        if ($limit < 1 || $limit > self::MAX_QUERY_LIMIT || $offset < 0) {
+            throw new \InvalidArgumentException('Pagination requires limit 1-100 and offset 0 or greater.');
+        }
+
+        return $this->store->queryRules(
+            $scope->scope,
+            $scope->tenantId,
+            $status,
+            $type,
+            $action,
+            $limit,
+            $offset
+        );
+    }
+
+    public function fetch(FirewallRuleScope $scope, string $ruleId): ?FirewallRuleObject
+    {
+        return $this->ownedRule($scope, $ruleId);
+    }
+
+    /** @return array{precedence: string[], system: FirewallRuleObject[], tenant: FirewallRuleObject[]} */
+    public function effectivePolicy(string $tenantId): array
+    {
+        return [
+            'precedence' => ['system_block', 'tenant_allow', 'tenant_block', 'system_allow', 'default_allow'],
+            'system' => $this->store->listSystemRules(),
+            'tenant' => $this->store->listRules($tenantId),
+        ];
+    }
+
+    public function createManualRule(
+        FirewallRuleScope $scope,
+        string $type,
+        string $action,
+        string $value,
+        string $reason,
+        ?string $createdBy,
+        ?int $durationSeconds = null,
+        ?string $currentIp = null,
+        bool $confirmCurrentIp = false
+    ): FirewallRuleObject {
+        $reason = trim($reason);
+        if ($reason === '' || strlen($reason) > 1000) {
+            throw new \InvalidArgumentException('A rule reason containing 1-1000 bytes is required.');
+        }
+        if ($currentIp !== null) {
+            $currentIp = FirewallRuleValidator::ipAddress($currentIp);
+        }
+        if (
+            !$confirmCurrentIp
+            && $currentIp !== null
+            && $action === FirewallRuleObject::ACTION_BLOCK
+            && $this->matchesIp($type, $value, $currentIp)
+        ) {
+            throw new FirewallRuleConflictException(
+                'current_ip_confirmation_required',
+                'This rule would block your current IP address. Explicit confirmation is required.'
+            );
+        }
+
+        return match ([$type, $action]) {
+            [FirewallRuleObject::TYPE_IP, FirewallRuleObject::ACTION_BLOCK] =>
+                $this->blockIp($scope, $value, $reason, $createdBy, $durationSeconds),
+            [FirewallRuleObject::TYPE_IP, FirewallRuleObject::ACTION_ALLOW] =>
+                $durationSeconds === null
+                    ? $this->allowIp($scope, $value, $reason, $createdBy)
+                    : throw new \InvalidArgumentException('Temporary allow rules are not supported.'),
+            [FirewallRuleObject::TYPE_IP_RANGE, FirewallRuleObject::ACTION_BLOCK] =>
+                $durationSeconds === null
+                    ? $this->blockIpRange($scope, $value, $reason, $createdBy)
+                    : throw new \InvalidArgumentException('Temporary CIDR rules are not supported.'),
+            [FirewallRuleObject::TYPE_DEVICE, FirewallRuleObject::ACTION_BLOCK] =>
+                $this->blockDevice($scope, $value, $reason, $createdBy, $durationSeconds),
+            default => throw new \InvalidArgumentException('Unsupported firewall rule type and action combination.'),
+        };
+    }
+
+    private function matchesIp(string $type, string $value, string $currentIp): bool
+    {
+        if ($type === FirewallRuleObject::TYPE_IP) {
+            $value = FirewallRuleValidator::ipAddress($value);
+            return inet_pton($value) === inet_pton($currentIp);
+        }
+        if ($type === FirewallRuleObject::TYPE_IP_RANGE) {
+            return IpUtils::checkIp($currentIp, FirewallRuleValidator::cidr($value));
+        }
+
+        return false;
+    }
+
     public function blockIp(
         FirewallRuleScope $scope,
         string $ipAddress,
@@ -69,7 +194,7 @@ final class FirewallRuleManager
             $origin,
             $metadata
         );
-        $this->publishIpEvent(SecurityEvent::IP_BLOCKED, $scope, $ipAddress, $reason);
+        $this->events->dispatch(new IpBlockedEvent($ipAddress, $reason, $scope->tenantId));
 
         return $rule;
     }
@@ -92,7 +217,7 @@ final class FirewallRuleManager
             null,
             $origin
         );
-        $this->publishIpEvent(SecurityEvent::IP_ALLOWED, $scope, $ipAddress, $reason);
+        $this->events->dispatch(new IpAllowedEvent($ipAddress, $reason, $scope->tenantId));
 
         return $rule;
     }
@@ -137,40 +262,155 @@ final class FirewallRuleManager
             $origin
         );
 
-        $event = new SecurityEvent(SecurityEvent::DEVICE_BLOCKED, ['device' => $fingerprint, 'reason' => $reason]);
-        $event->setDeviceFingerprint($fingerprint)->setReason($reason)->setTenantId($scope->tenantId);
+        $event = new DeviceBlockedEvent($fingerprint, $reason, $scope->tenantId);
         $this->events->dispatch($event);
 
         return $rule;
     }
 
-    public function disable(FirewallRuleScope $scope, string $ruleId, ?string $actorId = null): bool
-    {
+    public function disableManual(
+        FirewallRuleScope $scope,
+        string $ruleId,
+        string $reason,
+        ?string $actorId
+    ): ?FirewallRuleObject {
+        $reason = self::manualReason($reason);
         $rule = $this->ownedRule($scope, $ruleId);
         if (!$rule) {
-            return false;
+            return null;
+        }
+        if ($rule->isEnabled()) {
+            $rule->setEnabled(false);
+            $this->store->depositRule($rule);
+            $this->cache->invalidate();
+            $this->publishLifecycleEvent(
+                FirewallRuleDisabledEvent::class,
+                $rule,
+                $actorId,
+                ['changeReason' => $reason, 'changeOrigin' => self::ORIGIN_MANUAL]
+            );
         }
 
-        $rule->setEnabled(false);
-        $this->store->depositRule($rule);
-        $this->cache->invalidate();
-        $this->publishLifecycleEvent(SecurityEvent::FIREWALL_RULE_DISABLED, $rule, $actorId);
-
-        return true;
+        return $rule;
     }
 
-    public function remove(FirewallRuleScope $scope, string $ruleId, ?string $actorId = null): bool
-    {
+    public function enableManual(
+        FirewallRuleScope $scope,
+        string $ruleId,
+        string $reason,
+        ?string $actorId,
+        ?string $currentIp = null,
+        bool $confirmCurrentIp = false
+    ): ?FirewallRuleObject {
+        $reason = self::manualReason($reason);
         $rule = $this->ownedRule($scope, $ruleId);
         if (!$rule) {
-            return false;
+            return null;
+        }
+        if (
+            !$confirmCurrentIp
+            && $currentIp !== null
+            && $rule->getAction() === FirewallRuleObject::ACTION_BLOCK
+            && $this->matchesIp($rule->getType(), (string)$rule->getValue(), FirewallRuleValidator::ipAddress($currentIp))
+        ) {
+            throw new FirewallRuleConflictException(
+                'current_ip_confirmation_required',
+                'Enabling this rule would block your current IP address. Explicit confirmation is required.'
+            );
+        }
+        if (!$rule->isEnabled()) {
+            $rule->setEnabled(true);
+            $this->store->depositRule($rule);
+            $this->cache->invalidate();
+            $this->publishLifecycleEvent(
+                FirewallRuleEnabledEvent::class,
+                $rule,
+                $actorId,
+                ['changeReason' => $reason, 'changeOrigin' => self::ORIGIN_MANUAL]
+            );
         }
 
+        return $rule;
+    }
+
+    public function extendManual(
+        FirewallRuleScope $scope,
+        string $ruleId,
+        int $durationSeconds,
+        string $reason,
+        ?string $actorId
+    ): ?FirewallRuleObject {
+        $reason = self::manualReason($reason);
+        FirewallRuleValidator::duration($durationSeconds);
+        $rule = $this->ownedRule($scope, $ruleId);
+        if (!$rule) {
+            return null;
+        }
+        $previousExpiry = $rule->getExpiresAt();
+        if ($previousExpiry === null) {
+            throw new \InvalidArgumentException('Permanent firewall rules cannot be extended.');
+        }
+        $now = new \DateTimeImmutable();
+        $newExpiry = ($previousExpiry > $now ? $previousExpiry : $now)
+            ->modify("+{$durationSeconds} seconds");
+        $metadata = $rule->getMetadata() ?? [];
+        $extensions = is_array($metadata['extensions'] ?? null) ? $metadata['extensions'] : [];
+        $extensions[] = [
+            'extendedAt' => $now->format(\DateTimeInterface::ATOM),
+            'previousExpiresAt' => $previousExpiry->format(\DateTimeInterface::ATOM),
+            'expiresAt' => $newExpiry->format(\DateTimeInterface::ATOM),
+            'origin' => self::ORIGIN_MANUAL,
+            'actorId' => $actorId,
+            'reason' => $reason,
+        ];
+        $rule->setExpiresAt($newExpiry)->setMetadata([...$metadata, 'extensions' => $extensions]);
+        $this->store->depositRule($rule);
+        $this->cache->invalidate();
+        $this->publishLifecycleEvent(
+            FirewallRuleExtendedEvent::class,
+            $rule,
+            $actorId,
+            [
+                'changeReason' => $reason,
+                'changeOrigin' => self::ORIGIN_MANUAL,
+                'previousExpiresAt' => $previousExpiry->format(\DateTimeInterface::ATOM),
+            ]
+        );
+
+        return $rule;
+    }
+
+    public function removeManual(
+        FirewallRuleScope $scope,
+        string $ruleId,
+        string $reason,
+        ?string $actorId
+    ): ?FirewallRuleObject {
+        $reason = self::manualReason($reason);
+        $rule = $this->ownedRule($scope, $ruleId);
+        if (!$rule) {
+            return null;
+        }
         $this->store->destroyRule($rule);
         $this->cache->invalidate();
-        $this->publishLifecycleEvent(SecurityEvent::FIREWALL_RULE_REMOVED, $rule, $actorId);
+        $this->publishLifecycleEvent(
+            FirewallRuleRemovedEvent::class,
+            $rule,
+            $actorId,
+            ['changeReason' => $reason, 'changeOrigin' => self::ORIGIN_MANUAL]
+        );
 
-        return true;
+        return $rule;
+    }
+
+    private static function manualReason(string $reason): string
+    {
+        $reason = trim($reason);
+        if ($reason === '' || strlen($reason) > 1000) {
+            throw new \InvalidArgumentException('A change reason containing 1-1000 bytes is required.');
+        }
+
+        return $reason;
     }
 
     private function create(
@@ -209,9 +449,10 @@ final class FirewallRuleManager
         }
         $rule->setMetadata($metadata);
 
-        $this->store->depositRule($rule);
+        $rule = $this->store->depositRule($rule)
+            ?? throw new \RuntimeException('Failed to persist firewall rule.');
         $this->cache->invalidate();
-        $this->publishLifecycleEvent(SecurityEvent::FIREWALL_RULE_CREATED, $rule);
+        $this->publishLifecycleEvent(FirewallRuleCreatedEvent::class, $rule);
 
         return $rule;
     }
@@ -248,7 +489,7 @@ final class FirewallRuleManager
 
         $this->store->depositRule($rule);
         $this->cache->invalidate();
-        $this->publishLifecycleEvent(SecurityEvent::FIREWALL_RULE_EXTENDED, $rule);
+        $this->publishLifecycleEvent(FirewallRuleExtendedEvent::class, $rule);
 
         return $rule;
     }
@@ -260,36 +501,17 @@ final class FirewallRuleManager
         return $rule && $scope->owns($rule) ? $rule : null;
     }
 
-    private function publishIpEvent(
-        string $name,
-        FirewallRuleScope $scope,
-        string $ipAddress,
-        ?string $reason
-    ): void {
-        $event = new SecurityEvent($name, ['ip' => $ipAddress, 'reason' => $reason]);
-        $event->setIpAddress($ipAddress)->setReason($reason)->setTenantId($scope->tenantId);
-        $this->events->dispatch($event);
-    }
-
+    /**
+     * @param class-string<FirewallRuleEvent> $eventClass
+     */
     private function publishLifecycleEvent(
-        string $name,
+        string $eventClass,
         FirewallRuleObject $rule,
-        ?string $actorId = null
+        ?string $actorId = null,
+        array $change = []
     ): void
     {
-        $event = new SecurityEvent($name, [
-            'ruleId' => $rule->getId(),
-            'ruleScope' => $rule->getScope(),
-            'ruleType' => $rule->getType(),
-            'ruleAction' => $rule->getAction(),
-            'ruleValue' => $rule->getValue(),
-            'reason' => $rule->getReason(),
-            'origin' => $rule->getMetadata()['origin'] ?? self::ORIGIN_MANUAL,
-            'expiresAt' => $rule->getExpiresAt()?->format(\DateTimeInterface::ATOM),
-            ...($rule->getMetadata() ?? []),
-        ]);
-        $event->setTenantId($rule->getTenantId())
-            ->setIdentityId($actorId ?? $rule->getCreatedBy());
+        $event = $eventClass::fromRule($rule, $actorId, $change);
         $this->events->dispatch($event);
     }
 }

core/lib/Service/FirewallService.php

@@ -5,12 +5,26 @@ declare(strict_types=1);
 namespace KTXC\Service;
 
 use KTXC\Http\Request\Request;
+use KTXC\Http\Request\RequestContext;
 use KTXC\Models\Firewall\FirewallRuleObject;
 use KTXC\Models\Firewall\FirewallLogObject;
 use KTXC\Stores\FirewallStore;
 use KTXC\Context\TenantContextInterface;
+use KTXC\Security\Event\AccessDeniedEvent;
+use KTXC\Security\Event\AuthenticationFailedEvent;
+use KTXC\Security\Event\AuthenticationSucceededEvent;
+use KTXC\Security\Event\BruteForceDetectedEvent;
+use KTXC\Security\Event\FirewallRuleCreatedEvent;
+use KTXC\Security\Event\FirewallRuleDisabledEvent;
+use KTXC\Security\Event\FirewallRuleEnabledEvent;
+use KTXC\Security\Event\FirewallRuleExtendedEvent;
+use KTXC\Security\Event\FirewallRuleRemovedEvent;
+use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
+use KTXC\Security\Event\RateLimitExceededEvent;
+use KTXC\Security\Event\SuspiciousActivityEvent;
+use KTXC\Security\Event\SecurityEventInterface;
+use KTXC\Security\Event\SecurityRequestEventInterface;
 use KTXF\Event\EventDispatcherInterface;
-use KTXF\Event\SecurityEvent;
 use KTXF\IpUtils;
 
 /**
@@ -45,6 +59,7 @@ class FirewallService
         private readonly EventDispatcherInterface $events,
         private readonly FirewallRuleManager $rules,
         private readonly FirewallRuleCache $ruleCache,
+        private readonly RequestContext $requestContext,
     ) {
     }
 
@@ -130,17 +145,17 @@ class FirewallService
     /**
      * Handle authentication failure event
      */
-    public function handleAuthFailure(SecurityEvent $event): void
+    public function handleAuthFailure(AuthenticationFailedEvent $event): void
     {
-        $ipAddress = $event->getIpAddress();
+        $request = $this->requestContext->current();
+        $ipAddress = $request?->getClientIp();
         $tenantId = $event->getTenantId() ?? $this->tenantContext->identifier();
 
         if (!$ipAddress || !$tenantId) {
             return;
         }
 
-        $event->setTenantId($tenantId);
-        $log = $this->securityLog($event);
+        $log = $this->securityLog($event, $request);
         if ($log === null || !$this->store->createLogOnce($log)) {
             return;
         }
@@ -195,8 +210,12 @@ class FirewallService
         int $blockDuration
     ): void {
         // Publish brute force event
-        $event = SecurityEvent::bruteForceDetected($ipAddress, $failureCount, $windowSeconds);
-        $event->setTenantId($tenantId);
+        $event = new BruteForceDetectedEvent(
+            $ipAddress,
+            $failureCount,
+            $windowSeconds,
+            $tenantId,
+        );
         $this->events->dispatch($event);
 
         $this->rules->blockIp(
@@ -222,7 +241,7 @@ class FirewallService
     /**
      * Log security event to firewall logs
      */
-    public function logSecurityEvent(SecurityEvent $event): void
+    public function logSecurityEvent(SecurityEventInterface $event): void
     {
         $log = $this->securityLog($event);
         if ($log !== null) {
@@ -230,7 +249,18 @@ class FirewallService
         }
     }
 
-    private function securityLog(SecurityEvent $event): ?FirewallLogObject
+    public function logAuthenticationSuccess(AuthenticationSucceededEvent $event): void
+    {
+        $log = $this->securityLog($event, $this->requestContext->current());
+        if ($log !== null) {
+            $this->store->createLog($log);
+        }
+    }
+
+    private function securityLog(
+        SecurityEventInterface $event,
+        ?Request $request = null,
+    ): ?FirewallLogObject
     {
         $tenantId = $event->getTenantId() ?? $this->tenantContext->identifier();
         $ruleScope = $event->get('ruleScope');
@@ -238,14 +268,19 @@ class FirewallService
             return null;
         }
 
+        $requestEvent = $event instanceof SecurityRequestEventInterface ? $event : null;
+
         $log = new FirewallLogObject();
         return $log->setEventId($event->getEventId())
             ->setTenantId($tenantId)
-            ->setIpAddress($event->getIpAddress())
-            ->setDeviceFingerprint($event->getDeviceFingerprint())
-            ->setUserAgent($event->getUserAgent())
-            ->setRequestPath($event->getRequestPath())
-            ->setRequestMethod($event->getRequestMethod())
+            ->setIpAddress($request?->getClientIp() ?? $requestEvent?->getIpAddress())
+            ->setDeviceFingerprint(
+                $request?->headers->get('X-Device-Fingerprint')
+                    ?? $requestEvent?->getDeviceFingerprint()
+            )
+            ->setUserAgent($request?->headers->get('User-Agent') ?? $requestEvent?->getUserAgent())
+            ->setRequestPath($request?->getPathInfo() ?? $requestEvent?->getRequestPath())
+            ->setRequestMethod($request?->getMethod() ?? $requestEvent?->getRequestMethod())
             ->setEventType($this->mapEventToLogType($event->getName()))
             ->setResult($this->mapEventToResult($event))
             ->setRuleId($event->get('ruleId'))
@@ -261,16 +296,18 @@ class FirewallService
     private function mapEventToLogType(string $eventName): string
     {
         return match ($eventName) {
-            SecurityEvent::AUTH_FAILURE => FirewallLogObject::EVENT_AUTH_FAILURE,
-            SecurityEvent::AUTH_SUCCESS => FirewallLogObject::EVENT_ACCESS_CHECK,
-            SecurityEvent::BRUTE_FORCE_DETECTED => FirewallLogObject::EVENT_BRUTE_FORCE,
-            SecurityEvent::RATE_LIMIT_EXCEEDED => FirewallLogObject::EVENT_RATE_LIMIT,
-            SecurityEvent::ACCESS_DENIED => FirewallLogObject::EVENT_RULE_MATCH,
-            SecurityEvent::SUSPICIOUS_ACTIVITY => FirewallLogObject::EVENT_SUSPICIOUS,
-            SecurityEvent::FIREWALL_RULE_CREATED => FirewallLogObject::EVENT_RULE_CREATED,
-            SecurityEvent::FIREWALL_RULE_EXTENDED => FirewallLogObject::EVENT_RULE_EXTENDED,
-            SecurityEvent::FIREWALL_RULE_DISABLED => FirewallLogObject::EVENT_RULE_DISABLED,
-            SecurityEvent::FIREWALL_RULE_REMOVED => FirewallLogObject::EVENT_RULE_REMOVED,
+            AuthenticationFailedEvent::class => FirewallLogObject::EVENT_AUTH_FAILURE,
+            AuthenticationSucceededEvent::class => FirewallLogObject::EVENT_ACCESS_CHECK,
+            BruteForceDetectedEvent::class => FirewallLogObject::EVENT_BRUTE_FORCE,
+            RateLimitExceededEvent::class => FirewallLogObject::EVENT_RATE_LIMIT,
+            AccessDeniedEvent::class => FirewallLogObject::EVENT_RULE_MATCH,
+            SuspiciousActivityEvent::class => FirewallLogObject::EVENT_SUSPICIOUS,
+            FirewallRuleCreatedEvent::class => FirewallLogObject::EVENT_RULE_CREATED,
+            FirewallRuleExtendedEvent::class => FirewallLogObject::EVENT_RULE_EXTENDED,
+            FirewallRuleEnabledEvent::class => FirewallLogObject::EVENT_RULE_ENABLED,
+            FirewallRuleDisabledEvent::class => FirewallLogObject::EVENT_RULE_DISABLED,
+            FirewallRuleRemovedEvent::class => FirewallLogObject::EVENT_RULE_REMOVED,
+            FirewallSettingsUpdatedEvent::class => FirewallLogObject::EVENT_SETTINGS_UPDATED,
             default => FirewallLogObject::EVENT_ACCESS_CHECK,
         };
     }
@@ -278,15 +315,16 @@ class FirewallService
     /**
      * Map security event to result
      */
-    private function mapEventToResult(SecurityEvent $event): string
+    private function mapEventToResult(SecurityEventInterface $event): string
     {
         return match ($event->getName()) {
-            SecurityEvent::AUTH_SUCCESS,
-            SecurityEvent::ACCESS_GRANTED => FirewallLogObject::RESULT_ALLOWED,
-            SecurityEvent::FIREWALL_RULE_CREATED,
-            SecurityEvent::FIREWALL_RULE_EXTENDED,
-            SecurityEvent::FIREWALL_RULE_DISABLED,
-            SecurityEvent::FIREWALL_RULE_REMOVED => FirewallLogObject::RESULT_RECORDED,
+            AuthenticationSucceededEvent::class => FirewallLogObject::RESULT_ALLOWED,
+            FirewallRuleCreatedEvent::class,
+            FirewallRuleExtendedEvent::class,
+            FirewallRuleEnabledEvent::class,
+            FirewallRuleDisabledEvent::class,
+            FirewallRuleRemovedEvent::class,
+            FirewallSettingsUpdatedEvent::class => FirewallLogObject::RESULT_RECORDED,
             default => FirewallLogObject::RESULT_BLOCKED,
         };
     }
@@ -299,14 +337,14 @@ class FirewallService
         ?string $deviceFingerprint,
         FirewallRuleObject $rule
     ): void {
-        $event = SecurityEvent::accessDenied(
-            $ipAddress,
-            $deviceFingerprint,
-            $rule->getId(),
-            $rule->getScope(),
-            $rule->getReason()
+        $event = new AccessDeniedEvent(
+            ipAddress: $ipAddress,
+            ruleId: $rule->getId(),
+            ruleScope: $rule->getScope(),
+            deviceFingerprint: $deviceFingerprint,
+            reason: $rule->getReason(),
+            tenantId: $this->tenantContext->identifier(),
         );
-        $event->setTenantId($this->tenantContext->identifier());
         $this->events->dispatch($event);
     }
 

core/lib/Service/FirewallSettingsService.php

@@ -0,0 +1,76 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Service;
+
+use KTXC\Models\Tenant\TenantConfiguration;
+use KTXF\Event\EventDispatcherInterface;
+use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
+
+final class FirewallSettingsService
+{
+    public function __construct(
+        private readonly TenantService $tenants,
+        private readonly EventDispatcherInterface $events,
+    ) {
+    }
+
+    public function update(
+        string $tenantId,
+        bool $enabled,
+        int $maxAuthFailures,
+        int $authFailureWindow,
+        int $autoBlockDuration,
+        string $reason,
+        ?string $actorId
+    ): ?array {
+        $reason = trim($reason);
+        if ($reason === '' || strlen($reason) > 1000) {
+            throw new \InvalidArgumentException('A change reason containing 1-1000 bytes is required.');
+        }
+        self::bounded($maxAuthFailures, 1, 1000, 'Maximum authentication failures');
+        self::bounded($authFailureWindow, 1, 86400, 'Authentication failure window');
+        self::bounded($autoBlockDuration, 1, 31536000, 'Automatic block duration');
+
+        $tenant = $this->tenants->fetchById($tenantId);
+        if ($tenant === null) {
+            return null;
+        }
+
+        $previous = $tenant->getConfiguration()->firewall()->jsonSerialize();
+        $current = [
+            'enabled' => $enabled,
+            'maxAuthFailures' => $maxAuthFailures,
+            'authFailureWindow' => $authFailureWindow,
+            'autoBlockDuration' => $autoBlockDuration,
+        ];
+        $configuration = (new TenantConfiguration())->jsonDeserialize([
+            ...$tenant->getConfiguration()->jsonSerialize(),
+            'firewall' => $current,
+        ]);
+        $tenant->setConfiguration($configuration);
+        $this->tenants->deposit($tenant);
+
+        $event = new FirewallSettingsUpdatedEvent(
+            changeReason: $reason,
+            previous: $previous,
+            current: $current,
+            tenantId: $tenantId,
+            actorId: $actorId,
+            changeOrigin: FirewallRuleManager::ORIGIN_MANUAL,
+        );
+        $this->events->dispatch($event);
+
+        return $current;
+    }
+
+    private static function bounded(int $value, int $minimum, int $maximum, string $label): void
+    {
+        if ($value < $minimum || $value > $maximum) {
+            throw new \InvalidArgumentException(
+                "{$label} must be between {$minimum} and {$maximum}."
+            );
+        }
+    }
+}

core/lib/Service/FirewallStatusService.php

@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Service;
+
+use KTXC\Stores\FirewallStore;
+
+final class FirewallStatusService
+{
+    public function __construct(private readonly FirewallStore $store)
+    {
+    }
+
+    public function tenantMetrics(string $tenantId, ?string $since = null): array
+    {
+        $sinceDate = self::date($since);
+        return [
+            'tenantId' => $tenantId,
+            'blockedRequests' => $this->store->countBlockedRequests($tenantId, $sinceDate),
+            'since' => $sinceDate?->format(\DateTimeInterface::ATOM),
+        ];
+    }
+
+    public function systemMetrics(?string $tenantId = null, ?string $since = null): array
+    {
+        if ($tenantId !== null && ($tenantId === '' || strlen($tenantId) > 128)) {
+            throw new \InvalidArgumentException('Invalid tenant filter.');
+        }
+        $sinceDate = self::date($since);
+        return [
+            'tenantId' => $tenantId,
+            'blockedRequests' => $this->store->countSystemBlockedRequests($tenantId, $sinceDate),
+            'since' => $sinceDate?->format(\DateTimeInterface::ATOM),
+        ];
+    }
+
+    public function maintenanceStatus(): array
+    {
+        return $this->store->maintenanceStatus() ?? [
+            'status' => 'never_run',
+            'startedAt' => null,
+            'completedAt' => null,
+            'result' => null,
+            'error' => null,
+        ];
+    }
+
+    private static function date(?string $value): ?\DateTimeImmutable
+    {
+        if ($value === null) {
+            return null;
+        }
+        if ($value === '' || strlen($value) > 255) {
+            throw new \InvalidArgumentException('Invalid since date filter.');
+        }
+        try {
+            return new \DateTimeImmutable($value);
+        } catch (\Exception) {
+            throw new \InvalidArgumentException('Invalid since date filter.');
+        }
+    }
+}

core/lib/Service/SystemFirewallLogService.php

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Service;
+
+use KTXC\Context\IdentityContextInterface;
+
+final class SystemFirewallLogService
+{
+    public const PERMISSION_READ = 'firewall.system.logs.read';
+
+    public function __construct(
+        private readonly FirewallLogService $logs,
+        private readonly IdentityContextInterface $identity,
+    ) {
+    }
+
+    public function query(?string $tenantId, array $filters, int $limit = 50, int $offset = 0): array
+    {
+        if (!$this->identity->hasPermission(self::PERMISSION_READ)) {
+            throw new \RuntimeException('Missing required permission: '.self::PERMISSION_READ);
+        }
+        return $this->logs->system($tenantId, $filters, $limit, $offset);
+    }
+}

core/lib/Service/SystemFirewallRuleService.php

@@ -24,6 +24,46 @@ final class SystemFirewallRuleService
         return $this->rules->list(FirewallRuleScope::system(), $activeOnly);
     }
 
+    public function queryRules(
+        string $status = 'active',
+        ?string $type = null,
+        ?string $action = null,
+        int $limit = 50,
+        int $offset = 0
+    ): array {
+        $this->requirePermission(self::PERMISSION_READ);
+        return $this->rules->query(FirewallRuleScope::system(), $status, $type, $action, $limit, $offset);
+    }
+
+    public function fetchRule(string $ruleId): ?FirewallRuleObject
+    {
+        $this->requirePermission(self::PERMISSION_READ);
+        return $this->rules->fetch(FirewallRuleScope::system(), $ruleId);
+    }
+
+    public function createRule(
+        string $type,
+        string $action,
+        string $value,
+        string $reason,
+        ?int $durationSeconds = null,
+        ?string $currentIp = null,
+        bool $confirmCurrentIp = false
+    ): FirewallRuleObject {
+        $this->requirePermission(self::PERMISSION_MANAGE);
+        return $this->rules->createManualRule(
+            FirewallRuleScope::system(),
+            $type,
+            $action,
+            $value,
+            $reason,
+            $this->identity->identifier(),
+            $durationSeconds,
+            $currentIp,
+            $confirmCurrentIp
+        );
+    }
+
     public function blockIp(string $ip, ?string $reason = null, ?int $durationSeconds = null): FirewallRuleObject
     {
         $this->requirePermission(self::PERMISSION_MANAGE);
@@ -63,23 +103,44 @@ final class SystemFirewallRuleService
         );
     }
 
-    public function disableRule(string $ruleId): bool
+    public function disableRule(string $ruleId, string $reason): ?FirewallRuleObject
     {
         $this->requirePermission(self::PERMISSION_MANAGE);
-        return $this->rules->disable(
-            FirewallRuleScope::system(),
-            $ruleId,
-            $this->identity->identifier()
+        return $this->rules->disableManual(
+            FirewallRuleScope::system(), $ruleId, $reason, $this->identity->identifier()
         );
     }
 
-    public function removeRule(string $ruleId): bool
-    {
+    public function enableRule(
+        string $ruleId,
+        string $reason,
+        ?string $currentIp = null,
+        bool $confirmCurrentIp = false
+    ): ?FirewallRuleObject {
         $this->requirePermission(self::PERMISSION_MANAGE);
-        return $this->rules->remove(
+        return $this->rules->enableManual(
             FirewallRuleScope::system(),
             $ruleId,
-            $this->identity->identifier()
+            $reason,
+            $this->identity->identifier(),
+            $currentIp,
+            $confirmCurrentIp
+        );
+    }
+
+    public function extendRule(string $ruleId, int $durationSeconds, string $reason): ?FirewallRuleObject
+    {
+        $this->requirePermission(self::PERMISSION_MANAGE);
+        return $this->rules->extendManual(
+            FirewallRuleScope::system(), $ruleId, $durationSeconds, $reason, $this->identity->identifier()
+        );
+    }
+
+    public function removeRule(string $ruleId, string $reason): ?FirewallRuleObject
+    {
+        $this->requirePermission(self::PERMISSION_MANAGE);
+        return $this->rules->removeManual(
+            FirewallRuleScope::system(), $ruleId, $reason, $this->identity->identifier()
         );
     }
 

core/lib/Service/SystemFirewallStatusService.php

@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Service;
+
+use KTXC\Context\IdentityContextInterface;
+
+final class SystemFirewallStatusService
+{
+    public const PERMISSION_MAINTENANCE_READ = 'firewall.system.maintenance.read';
+    public const PERMISSION_SETTINGS_MANAGE = 'firewall.system.settings.manage';
+
+    public function __construct(
+        private readonly FirewallStatusService $status,
+        private readonly IdentityContextInterface $identity,
+        private readonly FirewallSettingsService $settings,
+    ) {
+    }
+
+    public function metrics(?string $tenantId = null, ?string $since = null): array
+    {
+        $this->requirePermission(SystemFirewallLogService::PERMISSION_READ);
+        return $this->status->systemMetrics($tenantId, $since);
+    }
+
+    public function maintenanceStatus(): array
+    {
+        $this->requirePermission(self::PERMISSION_MAINTENANCE_READ);
+        return $this->status->maintenanceStatus();
+    }
+
+    public function updateTenantConfiguration(
+        string $tenantId,
+        bool $enabled,
+        int $maxAuthFailures,
+        int $authFailureWindow,
+        int $autoBlockDuration,
+        string $reason
+    ): ?array {
+        $this->requirePermission(self::PERMISSION_SETTINGS_MANAGE);
+        return $this->settings->update(
+            $tenantId,
+            $enabled,
+            $maxAuthFailures,
+            $authFailureWindow,
+            $autoBlockDuration,
+            $reason,
+            $this->identity->identifier()
+        );
+    }
+
+    private function requirePermission(string $permission): void
+    {
+        if (!$this->identity->hasPermission($permission)) {
+            throw new \RuntimeException("Missing required permission: {$permission}");
+        }
+    }
+}

core/lib/Service/TenantFirewallLogService.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Service;
+
+use KTXC\Context\IdentityContextInterface;
+use KTXC\Context\TenantContextInterface;
+
+final class TenantFirewallLogService
+{
+    public const PERMISSION_READ = 'firewall.tenant.logs.read';
+
+    public function __construct(
+        private readonly FirewallLogService $logs,
+        private readonly TenantContextInterface $tenant,
+        private readonly IdentityContextInterface $identity,
+    ) {
+    }
+
+    public function query(array $filters, int $limit = 50, int $offset = 0): array
+    {
+        if (!$this->identity->hasPermission(self::PERMISSION_READ)) {
+            throw new \RuntimeException('Missing required permission: '.self::PERMISSION_READ);
+        }
+        return $this->logs->tenant($this->tenant->requireIdentifier(), $filters, $limit, $offset);
+    }
+
+}

core/lib/Service/TenantFirewallRuleService.php

@@ -26,6 +26,52 @@ final class TenantFirewallRuleService
         return $this->rules->list($this->scope(), $activeOnly);
     }
 
+    public function queryRules(
+        string $status = 'active',
+        ?string $type = null,
+        ?string $action = null,
+        int $limit = 50,
+        int $offset = 0
+    ): array {
+        $this->requirePermission(self::PERMISSION_READ);
+        return $this->rules->query($this->scope(), $status, $type, $action, $limit, $offset);
+    }
+
+    public function fetchRule(string $ruleId): ?FirewallRuleObject
+    {
+        $this->requirePermission(self::PERMISSION_READ);
+        return $this->rules->fetch($this->scope(), $ruleId);
+    }
+
+    public function createRule(
+        string $type,
+        string $action,
+        string $value,
+        string $reason,
+        ?int $durationSeconds = null,
+        ?string $currentIp = null,
+        bool $confirmCurrentIp = false
+    ): FirewallRuleObject {
+        $this->requirePermission(self::PERMISSION_MANAGE);
+        return $this->rules->createManualRule(
+            $this->scope(),
+            $type,
+            $action,
+            $value,
+            $reason,
+            $this->identity->identifier(),
+            $durationSeconds,
+            $currentIp,
+            $confirmCurrentIp
+        );
+    }
+
+    public function effectivePolicy(): array
+    {
+        $this->requirePermission(self::PERMISSION_READ);
+        return $this->rules->effectivePolicy($this->tenant->requireIdentifier());
+    }
+
     public function blockIp(string $ip, ?string $reason = null, ?int $durationSeconds = null): FirewallRuleObject
     {
         $this->requirePermission(self::PERMISSION_MANAGE);
@@ -57,16 +103,41 @@ final class TenantFirewallRuleService
         );
     }
 
-    public function disableRule(string $ruleId): bool
+    public function disableRule(string $ruleId, string $reason): ?FirewallRuleObject
     {
         $this->requirePermission(self::PERMISSION_MANAGE);
-        return $this->rules->disable($this->scope(), $ruleId, $this->identity->identifier());
+        return $this->rules->disableManual($this->scope(), $ruleId, $reason, $this->identity->identifier());
     }
 
-    public function removeRule(string $ruleId): bool
+    public function enableRule(
+        string $ruleId,
+        string $reason,
+        ?string $currentIp = null,
+        bool $confirmCurrentIp = false
+    ): ?FirewallRuleObject {
+        $this->requirePermission(self::PERMISSION_MANAGE);
+        return $this->rules->enableManual(
+            $this->scope(),
+            $ruleId,
+            $reason,
+            $this->identity->identifier(),
+            $currentIp,
+            $confirmCurrentIp
+        );
+    }
+
+    public function extendRule(string $ruleId, int $durationSeconds, string $reason): ?FirewallRuleObject
     {
         $this->requirePermission(self::PERMISSION_MANAGE);
-        return $this->rules->remove($this->scope(), $ruleId, $this->identity->identifier());
+        return $this->rules->extendManual(
+            $this->scope(), $ruleId, $durationSeconds, $reason, $this->identity->identifier()
+        );
+    }
+
+    public function removeRule(string $ruleId, string $reason): ?FirewallRuleObject
+    {
+        $this->requirePermission(self::PERMISSION_MANAGE);
+        return $this->rules->removeManual($this->scope(), $ruleId, $reason, $this->identity->identifier());
     }
 
     private function scope(): FirewallRuleScope

core/lib/Service/TenantFirewallStatusService.php

@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\Service;
+
+use KTXC\Context\IdentityContextInterface;
+use KTXC\Context\TenantContextInterface;
+
+final class TenantFirewallStatusService
+{
+    public const PERMISSION_SETTINGS_READ = 'firewall.tenant.settings.read';
+    public const PERMISSION_SETTINGS_MANAGE = 'firewall.tenant.settings.manage';
+
+    public function __construct(
+        private readonly FirewallStatusService $status,
+        private readonly TenantContextInterface $tenant,
+        private readonly IdentityContextInterface $identity,
+        private readonly FirewallSettingsService $settings,
+    ) {
+    }
+
+    public function metrics(?string $since = null): array
+    {
+        $this->requirePermission(TenantFirewallLogService::PERMISSION_READ);
+        return $this->status->tenantMetrics($this->tenant->requireIdentifier(), $since);
+    }
+
+    public function configuration(): array
+    {
+        $this->requirePermission(self::PERMISSION_SETTINGS_READ);
+        return $this->tenant->configuration()?->firewall()->jsonSerialize()
+            ?? [
+                'enabled' => true,
+                'maxAuthFailures' => 5,
+                'authFailureWindow' => 300,
+                'autoBlockDuration' => 3600,
+            ];
+    }
+
+    public function updateConfiguration(
+        bool $enabled,
+        int $maxAuthFailures,
+        int $authFailureWindow,
+        int $autoBlockDuration,
+        string $reason
+    ): ?array {
+        $this->requirePermission(self::PERMISSION_SETTINGS_MANAGE);
+        return $this->settings->update(
+            $this->tenant->requireIdentifier(),
+            $enabled,
+            $maxAuthFailures,
+            $authFailureWindow,
+            $autoBlockDuration,
+            $reason,
+            $this->identity->identifier()
+        );
+    }
+
+    private function requirePermission(string $permission): void
+    {
+        if (!$this->identity->hasPermission($permission)) {
+            throw new \RuntimeException("Missing required permission: {$permission}");
+        }
+    }
+}

core/lib/Service/UserAccountsService.php

@@ -6,14 +6,19 @@ use KTXC\Models\Identity\User;
 use KTXC\Context\IdentityContextInterface;
 use KTXC\Context\TenantContextInterface;
 use KTXC\Stores\UserAccountsStore;
+use KTXC\User\Event\UserCreatedEvent;
+use KTXC\User\Event\UserDeletingEvent;
+use KTXC\User\Event\UserUpdatedEvent;
+use KTXF\Event\EventDispatcherInterface;
 
 class UserAccountsService
 {
     
     public function __construct(
         private readonly TenantContextInterface $tenantContext,
-		private readonly IdentityContextInterface $identityContext,
-        private readonly UserAccountsStore $userStore
+        private readonly IdentityContextInterface $identityContext,
+        private readonly UserAccountsStore $userStore,
+        private readonly EventDispatcherInterface $events,
     ) {
     }
 
@@ -65,17 +70,53 @@ class UserAccountsService
 
     public function createUser(array $userData): array
     {
-        return $this->userStore->createUser($this->tenantContext->identifier(), $userData);
+        $tenantId = $this->tenantContext->requireIdentifier();
+        $user = $this->userStore->createUser($tenantId, $userData);
+        $this->events->dispatch(UserCreatedEvent::fromUser(
+            $user,
+            $tenantId,
+            $this->identityContext->identifier(),
+        ));
+
+        return $user;
     }
 
-    public function updateUser(string $uid, array $updates): bool
+    public function updateUser(string $userId, array $updates): bool
     {
-        return $this->userStore->updateUser($this->tenantContext->identifier(), $uid, $updates);
+        $tenantId = $this->tenantContext->requireIdentifier();
+        if (!$this->userStore->updateUser($tenantId, $userId, $updates)) {
+            return false;
+        }
+
+        $user = $this->userStore->fetchByIdentifier($tenantId, $userId);
+        if ($user === null) {
+            throw new \RuntimeException("Updated user '{$userId}' could not be retrieved.");
+        }
+
+        $this->events->dispatch(UserUpdatedEvent::fromUser(
+            $user,
+            $tenantId,
+            $this->identityContext->identifier(),
+        ));
+
+        return true;
     }
 
-    public function deleteUser(string $uid): bool
+    public function deleteUser(string $userId): bool
     {
-        return $this->userStore->deleteUser($this->tenantContext->identifier(), $uid);
+        $tenantId = $this->tenantContext->requireIdentifier();
+        $user = $this->userStore->fetchByIdentifier($tenantId, $userId);
+        if ($user === null) {
+            return false;
+        }
+
+        $this->events->dispatch(UserDeletingEvent::fromUser(
+            $user,
+            $tenantId,
+            $this->identityContext->identifier(),
+        ));
+
+        return $this->userStore->deleteUser($tenantId, $userId);
     }
 
     // =========================================================================
@@ -126,10 +167,6 @@ class UserAccountsService
         return $this->userStore->storeSettings($this->tenantContext->identifier(), $this->identityContext->identifier(), $settings);
     }
 
-    // =========================================================================
-    // Helper Methods
-    // =========================================================================
-
     /**
      * Check if a profile field is editable by the user
      * 

core/lib/Stores/FirewallStore.php

@@ -46,6 +46,10 @@ class FirewallStore
                 ['scope' => 1, 'tenantId' => 1, 'type' => 1, 'value' => 1, 'action' => 1, 'enabled' => 1, 'expiresAt' => 1],
                 ['name' => 'rules_exact_lookup']
             ),
+            $rules->createIndex(
+                ['scope' => 1, 'tenantId' => 1, 'createdAt' => -1],
+                ['name' => 'rules_browse']
+            ),
             $logs->createIndex(
                 ['tenantId' => 1, 'ipAddress' => 1, 'eventType' => 1, 'timestamp' => -1],
                 ['name' => 'logs_auth_failures']
@@ -62,6 +66,14 @@ class FirewallStore
                 ['tenantId' => 1, 'eventType' => 1, 'timestamp' => -1],
                 ['name' => 'logs_event_type']
             ),
+            $logs->createIndex(
+                ['tenantId' => 1, 'ruleId' => 1, 'timestamp' => -1],
+                ['name' => 'logs_rule']
+            ),
+            $logs->createIndex(
+                ['timestamp' => -1],
+                ['name' => 'logs_global_timeline']
+            ),
             $claims->createIndex(
                 ['expiresAt' => 1],
                 ['name' => 'claims_expiry', 'expireAfterSeconds' => 0]
@@ -73,6 +85,61 @@ class FirewallStore
     // Rule Operations
     // ========================================
 
+    /**
+     * Query rules within one ownership scope.
+     *
+     * @return array{items: FirewallRuleObject[], total: int, limit: int, offset: int}
+     */
+    public function queryRules(
+        string $scope,
+        ?string $tenantId,
+        string $status,
+        ?string $type,
+        ?string $action,
+        int $limit,
+        int $offset
+    ): array {
+        $filter = [
+            'scope' => $scope,
+            'tenantId' => $scope === FirewallRuleObject::SCOPE_SYSTEM ? null : $tenantId,
+        ];
+        $now = self::bsonDate(new \DateTimeImmutable());
+        if ($status === 'active') {
+            $filter['enabled'] = true;
+            $filter['$or'] = [
+                ['expiresAt' => null],
+                ['expiresAt' => ['$gt' => $now]],
+            ];
+        } elseif ($status === 'disabled') {
+            $filter['enabled'] = false;
+        } elseif ($status === 'expired') {
+            $filter['expiresAt'] = ['$ne' => null, '$lte' => $now];
+        }
+        if ($type !== null) {
+            $filter['type'] = $type;
+        }
+        if ($action !== null) {
+            $filter['action'] = $action;
+        }
+
+        $collection = $this->dataStore->selectCollection(self::RULES_COLLECTION);
+        $items = [];
+        foreach ($collection->find($filter, [
+            'sort' => ['createdAt' => -1, '_id' => -1],
+            'limit' => $limit,
+            'skip' => $offset,
+        ]) as $entry) {
+            $items[] = (new FirewallRuleObject())->jsonDeserialize((array)$entry);
+        }
+
+        return [
+            'items' => $items,
+            'total' => $collection->countDocuments($filter),
+            'limit' => $limit,
+            'offset' => $offset,
+        ];
+    }
+
     /**
      * List all rules for a tenant
      */
@@ -298,6 +365,62 @@ class FirewallStore
     // Log Operations
     // ========================================
 
+    public function queryTenantLogs(
+        string $tenantId,
+        array $filters,
+        int $limit,
+        int $offset
+    ): array {
+        return $this->queryLogs(['tenantId' => $tenantId], $filters, $limit, $offset);
+    }
+
+    public function querySystemLogs(
+        ?string $tenantId,
+        array $filters,
+        int $limit,
+        int $offset
+    ): array {
+        return $this->queryLogs($tenantId === null ? [] : ['tenantId' => $tenantId], $filters, $limit, $offset);
+    }
+
+    /** @return array{items: FirewallLogObject[], total: int, limit: int, offset: int} */
+    private function queryLogs(array $scopeFilter, array $filters, int $limit, int $offset): array
+    {
+        $filter = $scopeFilter;
+        foreach (['ipAddress', 'eventType', 'result', 'ruleId', 'ruleScope'] as $field) {
+            if (($filters[$field] ?? null) !== null) {
+                $filter[$field] = $filters[$field];
+            }
+        }
+        $timestamp = [];
+        if (($filters['from'] ?? null) instanceof \DateTimeInterface) {
+            $timestamp['$gte'] = self::bsonDate($filters['from']);
+        }
+        if (($filters['to'] ?? null) instanceof \DateTimeInterface) {
+            $timestamp['$lte'] = self::bsonDate($filters['to']);
+        }
+        if ($timestamp !== []) {
+            $filter['timestamp'] = $timestamp;
+        }
+
+        $collection = $this->dataStore->selectCollection(self::LOGS_COLLECTION);
+        $items = [];
+        foreach ($collection->find($filter, [
+            'sort' => ['timestamp' => -1, '_id' => -1],
+            'limit' => $limit,
+            'skip' => $offset,
+        ]) as $entry) {
+            $items[] = (new FirewallLogObject())->jsonDeserialize((array)$entry);
+        }
+
+        return [
+            'items' => $items,
+            'total' => $collection->countDocuments($filter),
+            'limit' => $limit,
+            'offset' => $offset,
+        ];
+    }
+
     /**
      * Log a firewall event
      */
@@ -453,6 +576,21 @@ class FirewallStore
         return $this->dataStore->selectCollection(self::LOGS_COLLECTION)->countDocuments($filter);
     }
 
+    public function countSystemBlockedRequests(
+        ?string $tenantId = null,
+        ?\DateTimeImmutable $since = null
+    ): int {
+        $filter = ['result' => FirewallLogObject::RESULT_BLOCKED];
+        if ($tenantId !== null) {
+            $filter['tenantId'] = $tenantId;
+        }
+        if ($since !== null) {
+            $filter['timestamp'] = ['$gte' => self::bsonDate($since)];
+        }
+
+        return $this->dataStore->selectCollection(self::LOGS_COLLECTION)->countDocuments($filter);
+    }
+
     /**
      * Clean up old logs
      */

core/lib/User/Event/UserCreatedEvent.php

@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\User\Event;
+
+final class UserCreatedEvent extends UserEvent
+{
+}

core/lib/User/Event/UserDeletingEvent.php

@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\User\Event;
+
+final class UserDeletingEvent extends UserEvent
+{
+}

core/lib/User/Event/UserEvent.php

@@ -0,0 +1,89 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\User\Event;
+
+use KTXF\Event\Event;
+
+abstract class UserEvent extends Event
+{
+    final public function __construct(
+        private readonly string $userIdentifier,
+        private readonly string $userIdentity,
+        private readonly string $userLabel,
+        private readonly bool $userEnabled,
+        private readonly array $userRoles,
+        private readonly string $tenantIdentifier,
+        private readonly ?string $actorIdentifier = null,
+    ) {
+        if ($userIdentifier === '') {
+            throw new \InvalidArgumentException('User lifecycle events require a user ID.');
+        }
+        if ($userIdentity === '') {
+            throw new \InvalidArgumentException('User lifecycle events require a user identity.');
+        }
+        if ($tenantIdentifier === '') {
+            throw new \InvalidArgumentException('User lifecycle events require a tenant ID.');
+        }
+        parent::__construct(
+            static::class,
+            [
+                'identifier' => $userIdentifier,
+                'identity' => $userIdentity,
+                'label' => $userLabel,
+                'roles' => $userRoles,
+                'enabled' => $userEnabled,
+            ],
+            $tenantIdentifier,
+            $actorIdentifier,
+        );
+    }
+
+    public static function fromUser(
+        array $user,
+        string $tenantIdentifier,
+        ?string $actorIdentifier = null,
+    ): static {
+        return new static(
+            (string) ($user['uid'] ?? ''),
+            (string) ($user['identity'] ?? ''),
+            (string) ($user['label'] ?? $user['identity'] ?? ''),
+            (bool) ($user['enabled'] ?? true),
+            array_values((array) ($user['roles'] ?? [])),
+            $tenantIdentifier,
+            $actorIdentifier,
+        );
+    }
+
+    public function userIdentifier(): string
+    {
+        return $this->userIdentifier;
+    }
+
+    public function userIdentity(): string
+    {
+        return $this->userIdentity;
+    }
+
+    public function userLabel(): string
+    {
+        return $this->userLabel;
+    }
+
+    public function userRoles(): array
+    {
+        return $this->userRoles;
+    }
+
+    public function userEnabled(): bool
+    {
+        return $this->userEnabled;
+    }
+
+    public function actorIdentifier(): ?string
+    {
+        return $this->actorIdentifier;
+    }
+
+}

core/lib/User/Event/UserUpdatedEvent.php

@@ -0,0 +1,9 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXC\User\Event;
+
+final class UserUpdatedEvent extends UserEvent
+{
+}

deploy/update-test-server.sh

@@ -33,6 +33,30 @@ require_command()
     fi
 }
 
+# Cron runs with a bare PATH, so nvm-installed npm (added to PATH only by
+# .bashrc sourcing nvm.sh in an interactive shell) is invisible here even
+# though it works fine when this script is run by hand. Resolve nvm's
+# current npm via bash (nvm.sh is not POSIX sh compatible) and prepend it,
+# so a later `nvm use`/`nvm install` doesn't require updating this script
+# or the crontab.
+ensure_npm_on_path()
+{
+    command -v npm >/dev/null 2>&1 && return 0
+
+    nvm_dir=${NVM_DIR:-${HOME:-/root}/.nvm}
+    [ -s "$nvm_dir/nvm.sh" ] || return 0
+    command -v bash >/dev/null 2>&1 || return 0
+
+    npm_path=$(bash -c ". \"\$1/nvm.sh\" >/dev/null 2>&1 && command -v npm" _ "$nvm_dir" 2>/dev/null) || return 0
+    [ -n "$npm_path" ] || return 0
+
+    PATH=$(dirname -- "$npm_path"):$PATH
+    export PATH
+    log "Resolved npm via nvm: $npm_path"
+}
+
+ensure_npm_on_path
+
 git_in()
 {
     repository=$1

package-lock.json

@@ -642,14 +642,14 @@
       }
     },
     "node_modules/@intlify/core-base": {
-      "version": "11.4.8",
-      "resolved": "https://registry.npmjs.org/@intlify/core-base/-/core-base-11.4.8.tgz",
-      "integrity": "sha512-A+Q7SKm5oEcy1E/cghqd7n/St4XjTqLhiiyDuieNcMrJcrHlkY5n0jp7Q9dD3txvVHzvsmBVV5M9wD5/s1zfzw==",
+      "version": "11.4.7",
+      "resolved": "https://registry.npmjs.org/@intlify/core-base/-/core-base-11.4.7.tgz",
+      "integrity": "sha512-MSB/sBKwEWJTILvQIhg2rnIcwPpLayo3wGwvVA+dJTNeUBD9GoqQgAaSOLdI9iOPDHCm9YoVnLqpfzza98MpkQ==",
       "license": "MIT",
       "dependencies": {
-        "@intlify/devtools-types": "11.4.8",
-        "@intlify/message-compiler": "11.4.8",
-        "@intlify/shared": "11.4.8"
+        "@intlify/devtools-types": "11.4.7",
+        "@intlify/message-compiler": "11.4.7",
+        "@intlify/shared": "11.4.7"
       },
       "engines": {
         "node": ">= 22"
@@ -659,13 +659,13 @@
       }
     },
     "node_modules/@intlify/devtools-types": {
-      "version": "11.4.8",
-      "resolved": "https://registry.npmjs.org/@intlify/devtools-types/-/devtools-types-11.4.8.tgz",
-      "integrity": "sha512-MGpID+rlfzGUbNcnC20bm5NMSBHPrvx0atLTfv9dftn3kjXw1hGKDcIcwrO99tSrZEc2i+hczRL7ks8qXsHPkQ==",
+      "version": "11.4.7",
+      "resolved": "https://registry.npmjs.org/@intlify/devtools-types/-/devtools-types-11.4.7.tgz",
+      "integrity": "sha512-GSz+J+hqH+AEpAHIYya6fSufS30OaMnG39HiZX7DmGKi3+aaLvassCfsXENEc4Wr4m68q2YP0QdMdB3D9UeAXg==",
       "license": "MIT",
       "dependencies": {
-        "@intlify/core-base": "11.4.8",
-        "@intlify/shared": "11.4.8"
+        "@intlify/core-base": "11.4.7",
+        "@intlify/shared": "11.4.7"
       },
       "engines": {
         "node": ">= 22"
@@ -675,12 +675,12 @@
       }
     },
     "node_modules/@intlify/message-compiler": {
-      "version": "11.4.8",
-      "resolved": "https://registry.npmjs.org/@intlify/message-compiler/-/message-compiler-11.4.8.tgz",
-      "integrity": "sha512-vbzk17dYwduYiv52EK61+FDCyhfVg1uPUtPmiD/d45W99uJIcXywrweOBcHv7n9/iEqmXiMGT52bgJbZDQqK3w==",
+      "version": "11.4.7",
+      "resolved": "https://registry.npmjs.org/@intlify/message-compiler/-/message-compiler-11.4.7.tgz",
+      "integrity": "sha512-bHxmh7n94N4N1evADeb7XTkc3jTw6Ki5biMFZVSX6Jmk+iehy8/maeH2XUsBI27rtKIK+Hzc6QnVAKggUwylKw==",
       "license": "MIT",
       "dependencies": {
-        "@intlify/shared": "11.4.8",
+        "@intlify/shared": "11.4.7",
         "source-map-js": "^1.0.2"
       },
       "engines": {
@@ -691,9 +691,9 @@
       }
     },
     "node_modules/@intlify/shared": {
-      "version": "11.4.8",
-      "resolved": "https://registry.npmjs.org/@intlify/shared/-/shared-11.4.8.tgz",
-      "integrity": "sha512-XbRgrv+XEuvDr7UCY55oibVrh+o4u+A0VB6nSL0F5Z8LcZxE/8j573LYG6bCrOigIcHdGpSNI7Rh5UpC5/B/eg==",
+      "version": "11.4.7",
+      "resolved": "https://registry.npmjs.org/@intlify/shared/-/shared-11.4.7.tgz",
+      "integrity": "sha512-OtjPZan3No2OZZFnMUiCVsXC6+j+XRwEywaFDk0AoayAbLuPesyDloXhJZLl9JUl5vHZeQUkYSbEA8VX+CWMjg==",
       "license": "MIT",
       "engines": {
         "node": ">= 22"
@@ -6537,14 +6537,14 @@
       }
     },
     "node_modules/vue-i18n": {
-      "version": "11.4.8",
-      "resolved": "https://registry.npmjs.org/vue-i18n/-/vue-i18n-11.4.8.tgz",
-      "integrity": "sha512-0ULeHP6Z9CGvAm67S77ZEp41cfGXIREGL8qfhos2BMgcQQewtQcDKuojt6jjasAD/S8GwfTp2ySPmDSpwvrCMQ==",
+      "version": "11.4.7",
+      "resolved": "https://registry.npmjs.org/vue-i18n/-/vue-i18n-11.4.7.tgz",
+      "integrity": "sha512-j6RyshdPPzqLiMAUpnpvZGFPM+rRoWi14Sl5yTsquvoW0/56DWyvhAj2o9TO2YXGvb6teg8T0xrYO9jR3urvdw==",
       "license": "MIT",
       "dependencies": {
-        "@intlify/core-base": "11.4.8",
-        "@intlify/devtools-types": "11.4.8",
-        "@intlify/shared": "11.4.8",
+        "@intlify/core-base": "11.4.7",
+        "@intlify/devtools-types": "11.4.7",
+        "@intlify/shared": "11.4.7",
         "@vue/devtools-api": "^6.5.0"
       },
       "engines": {

shared/lib/Event/Event.php

@@ -10,16 +10,18 @@ namespace KTXF\Event;
 class Event
 {
     private bool $propagationStopped = false;
-    private array $data = [];
-    private float $timestamp;
-    private string $eventId;
-    private ?string $tenantId = null;
-    private ?string $identityId = null;
+    private readonly array $data;
+    private readonly float $timestamp;
+    private readonly string $eventId;
 
     public function __construct(
         private readonly string $name,
-        array $data = []
+        array $data = [],
+        private readonly ?string $tenantId = null,
+        private readonly ?string $identityId = null,
     ) {
+        self::validateData($data);
+
         $this->data = $data;
         $this->timestamp = microtime(true);
         $this->eventId = bin2hex(random_bytes(16));
@@ -41,15 +43,6 @@ class Event
         return $this->data[$key] ?? $default;
     }
 
-    /**
-     * Set a data value
-     */
-    public function set(string $key, mixed $value): self
-    {
-        $this->data[$key] = $value;
-        return $this;
-    }
-
     /**
      * Check if a data key exists
      */
@@ -111,15 +104,6 @@ class Event
         return $this->tenantId;
     }
 
-    /**
-     * Set tenant ID for multi-tenant context
-     */
-    public function setTenantId(?string $tenantId): self
-    {
-        $this->tenantId = $tenantId;
-        return $this;
-    }
-
     /**
      * Get identity ID (user who triggered the event)
      */
@@ -128,26 +112,18 @@ class Event
         return $this->identityId;
     }
 
-    /**
-     * Set identity ID
-     */
-    public function setIdentityId(?string $identityId): self
+    private static function validateData(array $data): void
     {
-        $this->identityId = $identityId;
-        return $this;
-    }
-
-    /**
-     * Convert event to array for serialization/logging
-     */
-    public function toArray(): array
-    {
-        return [
-            'name' => $this->name,
-            'data' => $this->data,
-            'timestamp' => $this->timestamp,
-            'tenantId' => $this->tenantId,
-            'identityId' => $this->identityId,
-        ];
+        foreach ($data as $value) {
+            if (is_array($value)) {
+                self::validateData($value);
+                continue;
+            }
+            if ($value !== null && !is_scalar($value)) {
+                throw new \InvalidArgumentException(
+                    'Event data must contain only scalar, null, or array values.',
+                );
+            }
+        }
     }
 }

shared/lib/Event/EventListenerRegistrarInterface.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXF\Event;
+
+interface EventListenerRegistrarInterface
+{
+    /**
+     * @param class-string $service
+     */
+    public function listen(
+        string $module,
+        string $event,
+        string $service,
+        string $method,
+        DeliveryMode $delivery = DeliveryMode::Immediate,
+        int $priority = 0,
+        FailurePolicy $failurePolicy = FailurePolicy::Continue,
+    ): void;
+}

shared/lib/Event/SecurityEvent.php

@@ -1,309 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace KTXF\Event;
-
-/**
- * Security-specific event for authentication and access control events
- */
-class SecurityEvent extends Event
-{
-    // Event names
-    public const AUTH_SUCCESS = 'security.auth.success';
-    public const AUTH_FAILURE = 'security.auth.failure';
-    public const AUTH_LOGOUT = 'security.auth.logout';
-    public const TOKEN_REFRESH = 'security.token.refresh';
-    public const TOKEN_REVOKED = 'security.token.revoked';
-    
-    public const ACCESS_DENIED = 'security.access.denied';
-    public const ACCESS_GRANTED = 'security.access.granted';
-    
-    public const BRUTE_FORCE_DETECTED = 'security.brute_force.detected';
-    public const RATE_LIMIT_EXCEEDED = 'security.rate_limit.exceeded';
-    public const SUSPICIOUS_ACTIVITY = 'security.suspicious.activity';
-    
-    public const IP_BLOCKED = 'security.ip.blocked';
-    public const IP_ALLOWED = 'security.ip.allowed';
-    public const DEVICE_BLOCKED = 'security.device.blocked';
-    public const FIREWALL_RULE_CREATED = 'security.firewall.rule.created';
-    public const FIREWALL_RULE_EXTENDED = 'security.firewall.rule.extended';
-    public const FIREWALL_RULE_DISABLED = 'security.firewall.rule.disabled';
-    public const FIREWALL_RULE_REMOVED = 'security.firewall.rule.removed';
-
-    private ?string $ipAddress = null;
-    private ?string $deviceFingerprint = null;
-    private ?string $userAgent = null;
-    private ?string $requestPath = null;
-    private ?string $requestMethod = null;
-    private ?string $userId = null;
-    private ?string $reason = null;
-    private int $severity = self::SEVERITY_INFO;
-
-    // Severity levels
-    public const SEVERITY_DEBUG = 0;
-    public const SEVERITY_INFO = 1;
-    public const SEVERITY_WARNING = 2;
-    public const SEVERITY_ERROR = 3;
-    public const SEVERITY_CRITICAL = 4;
-
-    /**
-     * Create a security event with common parameters
-     */
-    public static function create(
-        string $name,
-        ?string $ipAddress = null,
-        ?string $deviceFingerprint = null,
-        array $data = []
-    ): self {
-        $event = new self($name, $data);
-        $event->ipAddress = $ipAddress;
-        $event->deviceFingerprint = $deviceFingerprint;
-        
-        // Set default severity based on event type
-        $event->severity = self::getSeverityForEvent($name);
-        
-        return $event;
-    }
-
-    /**
-     * Create an authentication failure event
-     */
-    public static function authFailure(
-        string $ipAddress,
-        ?string $deviceFingerprint = null,
-        ?string $userId = null,
-        ?string $reason = null
-    ): self {
-        $event = self::create(self::AUTH_FAILURE, $ipAddress, $deviceFingerprint, [
-            'userId' => $userId,
-            'reason' => $reason,
-        ]);
-        $event->userId = $userId;
-        $event->reason = $reason;
-        return $event;
-    }
-
-    /**
-     * Create an authentication success event
-     */
-    public static function authSuccess(
-        string $ipAddress,
-        ?string $deviceFingerprint = null,
-        string $userId = null
-    ): self {
-        $event = self::create(self::AUTH_SUCCESS, $ipAddress, $deviceFingerprint, [
-            'userId' => $userId,
-        ]);
-        $event->userId = $userId;
-        return $event;
-    }
-
-    /**
-     * Create a brute force detection event
-     */
-    public static function bruteForceDetected(
-        string $ipAddress,
-        int $failureCount,
-        int $windowSeconds
-    ): self {
-        $event = self::create(self::BRUTE_FORCE_DETECTED, $ipAddress, null, [
-            'failureCount' => $failureCount,
-            'windowSeconds' => $windowSeconds,
-        ]);
-        $event->reason = sprintf(
-            '%d failed attempts in %d seconds',
-            $failureCount,
-            $windowSeconds
-        );
-        return $event;
-    }
-
-    /**
-     * Create a rate limit exceeded event
-     */
-    public static function rateLimitExceeded(
-        string $ipAddress,
-        int $requestCount,
-        int $windowSeconds,
-        ?string $endpoint = null
-    ): self {
-        $event = self::create(self::RATE_LIMIT_EXCEEDED, $ipAddress, null, [
-            'requestCount' => $requestCount,
-            'windowSeconds' => $windowSeconds,
-            'endpoint' => $endpoint,
-        ]);
-        $event->requestPath = $endpoint;
-        $event->reason = sprintf(
-            '%d requests in %d seconds',
-            $requestCount,
-            $windowSeconds
-        );
-        return $event;
-    }
-
-    /**
-     * Create an access denied event
-     */
-    public static function accessDenied(
-        string $ipAddress,
-        ?string $deviceFingerprint = null,
-        ?string $ruleId = null,
-        ?string $ruleScope = null,
-        ?string $reason = null
-    ): self {
-        $event = self::create(self::ACCESS_DENIED, $ipAddress, $deviceFingerprint, [
-            'ruleId' => $ruleId,
-            'ruleScope' => $ruleScope,
-            'reason' => $reason,
-        ]);
-        $event->reason = $reason;
-        return $event;
-    }
-
-    /**
-     * Get default severity for event types
-     */
-    private static function getSeverityForEvent(string $eventName): int
-    {
-        return match ($eventName) {
-            self::AUTH_SUCCESS,
-            self::ACCESS_GRANTED,
-            self::TOKEN_REFRESH => self::SEVERITY_INFO,
-            
-            self::AUTH_FAILURE,
-            self::ACCESS_DENIED,
-            self::AUTH_LOGOUT,
-            self::TOKEN_REVOKED => self::SEVERITY_WARNING,
-            
-            self::RATE_LIMIT_EXCEEDED,
-            self::SUSPICIOUS_ACTIVITY => self::SEVERITY_ERROR,
-            
-            self::BRUTE_FORCE_DETECTED,
-            self::IP_BLOCKED,
-            self::DEVICE_BLOCKED => self::SEVERITY_CRITICAL,
-            
-            default => self::SEVERITY_INFO,
-        };
-    }
-
-    // Getters and setters
-
-    public function getIpAddress(): ?string
-    {
-        return $this->ipAddress;
-    }
-
-    public function setIpAddress(?string $ipAddress): self
-    {
-        $this->ipAddress = $ipAddress;
-        return $this;
-    }
-
-    public function getDeviceFingerprint(): ?string
-    {
-        return $this->deviceFingerprint;
-    }
-
-    public function setDeviceFingerprint(?string $deviceFingerprint): self
-    {
-        $this->deviceFingerprint = $deviceFingerprint;
-        return $this;
-    }
-
-    public function getUserAgent(): ?string
-    {
-        return $this->userAgent;
-    }
-
-    public function setUserAgent(?string $userAgent): self
-    {
-        $this->userAgent = $userAgent;
-        return $this;
-    }
-
-    public function getRequestPath(): ?string
-    {
-        return $this->requestPath;
-    }
-
-    public function setRequestPath(?string $requestPath): self
-    {
-        $this->requestPath = $requestPath;
-        return $this;
-    }
-
-    public function getRequestMethod(): ?string
-    {
-        return $this->requestMethod;
-    }
-
-    public function setRequestMethod(?string $requestMethod): self
-    {
-        $this->requestMethod = $requestMethod;
-        return $this;
-    }
-
-    public function getUserId(): ?string
-    {
-        return $this->userId;
-    }
-
-    public function setUserId(?string $userId): self
-    {
-        $this->userId = $userId;
-        return $this;
-    }
-
-    public function getReason(): ?string
-    {
-        return $this->reason;
-    }
-
-    public function setReason(?string $reason): self
-    {
-        $this->reason = $reason;
-        return $this;
-    }
-
-    public function getSeverity(): int
-    {
-        return $this->severity;
-    }
-
-    public function setSeverity(int $severity): self
-    {
-        $this->severity = $severity;
-        return $this;
-    }
-
-    public function getSeverityLabel(): string
-    {
-        return match ($this->severity) {
-            self::SEVERITY_DEBUG => 'DEBUG',
-            self::SEVERITY_INFO => 'INFO',
-            self::SEVERITY_WARNING => 'WARNING',
-            self::SEVERITY_ERROR => 'ERROR',
-            self::SEVERITY_CRITICAL => 'CRITICAL',
-            default => 'UNKNOWN',
-        };
-    }
-
-    /**
-     * Override toArray to include security-specific fields
-     */
-    public function toArray(): array
-    {
-        return array_merge(parent::toArray(), [
-            'ipAddress' => $this->ipAddress,
-            'deviceFingerprint' => $this->deviceFingerprint,
-            'userAgent' => $this->userAgent,
-            'requestPath' => $this->requestPath,
-            'requestMethod' => $this->requestMethod,
-            'userId' => $this->userId,
-            'reason' => $this->reason,
-            'severity' => $this->severity,
-            'severityLabel' => $this->getSeverityLabel(),
-        ]);
-    }
-}

shared/lib/IpUtils.php

@@ -95,6 +95,7 @@ class IpUtils
             if ($netmask < 0 || $netmask > 32) {
                 return self::setCacheResult($cacheKey, false);
             }
+            $netmask = (int)$netmask;
         } else {
             $address = $ip;
             $netmask = 32;
@@ -149,6 +150,7 @@ class IpUtils
             if ($netmask < 1 || $netmask > 128) {
                 return self::setCacheResult($cacheKey, false);
             }
+            $netmask = (int)$netmask;
         } else {
             if (!filter_var($ip, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV6)) {
                 return self::setCacheResult($cacheKey, false);

tests/php/Integration/Service/FirewallSettingsServiceTest.php

@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Integration\Service;
+
+use KTXC\Db\DataStore;
+use KTXC\Models\Tenant\DomainCollection;
+use KTXC\Models\Tenant\TenantConfiguration;
+use KTXC\Models\Tenant\TenantObject;
+use KTXC\Service\FirewallSettingsService;
+use KTXC\Service\TenantService;
+use KTXC\Stores\TenantStore;
+use KTXF\Event\EventDispatcherInterface;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class FirewallSettingsServiceTest extends TestCase
+{
+    private DataStore $dataStore;
+    private bool $databaseAvailable = false;
+
+    protected function setUp(): void
+    {
+        $system = require dirname(__DIR__, 4).'/config/system.php';
+        $database = $system['database'];
+        $database['database'] = sprintf('ktrix_firewall_settings_test_%d', getmypid());
+        $this->dataStore = new DataStore($database);
+
+        try {
+            $this->dataStore->getDatabase()->drop();
+            $this->databaseAvailable = true;
+        } catch (\MongoDB\Driver\Exception\Exception $error) {
+            self::markTestSkipped('MongoDB is unavailable: '.$error->getMessage());
+        }
+    }
+
+    protected function tearDown(): void
+    {
+        if ($this->databaseAvailable) {
+            $this->dataStore->getDatabase()->drop();
+        }
+    }
+
+    #[TestDox('Firewall settings updates persist without replacing unrelated tenant configuration')]
+    public function testPersistence(): void
+    {
+        $tenants = new TenantService(new TenantStore($this->dataStore));
+        $tenants->deposit((new TenantObject())
+            ->setIdentifier('tenant-a')
+            ->setEnabled(true)
+            ->setLabel('Tenant A')
+            ->setDomains(new DomainCollection(['tenant-a.example.test']))
+            ->setConfiguration((new TenantConfiguration())->jsonDeserialize([
+                'security' => ['code' => 'keep-me'],
+            ])));
+        $settings = new FirewallSettingsService(
+            $tenants,
+            $this->createStub(EventDispatcherInterface::class)
+        );
+
+        $settings->update(
+            'tenant-a', false, 8, 600, 7200, 'Tighten authentication controls', 'admin-a'
+        );
+        $stored = $tenants->fetchById('tenant-a')->getConfiguration();
+
+        self::assertFalse($stored->firewall()->enabled());
+        self::assertSame(8, $stored->firewall()->maxAuthFailures());
+        self::assertSame(600, $stored->firewall()->authFailureWindow());
+        self::assertSame(7200, $stored->firewall()->autoBlockDuration());
+        self::assertSame('keep-me', $stored->security()->code());
+    }
+}

tests/php/Integration/Stores/FirewallStoreTest.php

@@ -220,6 +220,48 @@ class FirewallStoreTest extends TestCase
         self::assertSame(FirewallRuleManager::ORIGIN_MANUAL, $logs[0]->getMetadata()['origin']);
     }
 
+    #[TestDox('Manual rule lifecycle changes persist through disable, enable, extension, and deletion')]
+    public function testManualRuleLifecyclePersistence(): void
+    {
+        $manager = new FirewallRuleManager(
+            $this->store,
+            new FirewallRuleCache($this->store),
+            $this->createStub(EventDispatcherInterface::class)
+        );
+        $rule = $manager->createManualRule(
+            FirewallRuleScope::tenant('tenant-a'),
+            FirewallRuleObject::TYPE_IP,
+            FirewallRuleObject::ACTION_BLOCK,
+            '203.0.113.10',
+            'Repeated abuse',
+            'admin-a',
+            300
+        );
+
+        $manager->disableManual(
+            FirewallRuleScope::tenant('tenant-a'), $rule->getId(), 'Investigating', 'admin-a'
+        );
+        self::assertFalse($this->store->fetchRule($rule->getId())->isEnabled());
+
+        $manager->enableManual(
+            FirewallRuleScope::tenant('tenant-a'), $rule->getId(), 'Threat confirmed', 'admin-a'
+        );
+        self::assertTrue($this->store->fetchRule($rule->getId())->isEnabled());
+
+        $previousExpiry = $rule->getExpiresAt();
+        $manager->extendManual(
+            FirewallRuleScope::tenant('tenant-a'), $rule->getId(), 300, 'Continue monitoring', 'admin-a'
+        );
+        $stored = $this->store->fetchRule($rule->getId());
+        self::assertGreaterThan($previousExpiry, $stored->getExpiresAt());
+        self::assertSame('Continue monitoring', $stored->getMetadata()['extensions'][0]['reason']);
+
+        $manager->removeManual(
+            FirewallRuleScope::tenant('tenant-a'), $rule->getId(), 'Case closed', 'admin-a'
+        );
+        self::assertNull($this->store->fetchRule($rule->getId()));
+    }
+
     #[TestDox('Event-backed firewall logs are inserted exactly once')]
     public function testIdempotentLogPersistence(): void
     {
@@ -452,6 +494,126 @@ class FirewallStoreTest extends TestCase
         self::assertContains('logs_auth_failures', self::indexNames($failurePlan));
     }
 
+    #[TestDox('Administrative rule queries filter, paginate, and preserve scope')]
+    public function testAdministrativeRuleQuery(): void
+    {
+        $this->store->depositRule($this->rule('tenant-active', FirewallRuleObject::SCOPE_TENANT, 'tenant-a'));
+        $this->store->depositRule(
+            $this->rule('tenant-disabled', FirewallRuleObject::SCOPE_TENANT, 'tenant-a')->setEnabled(false)
+        );
+        $this->store->depositRule($this->rule('other-tenant', FirewallRuleObject::SCOPE_TENANT, 'tenant-b'));
+        $this->store->depositRule($this->rule('system', FirewallRuleObject::SCOPE_SYSTEM));
+
+        $active = $this->store->queryRules(
+            FirewallRuleObject::SCOPE_TENANT,
+            'tenant-a',
+            'active',
+            FirewallRuleObject::TYPE_IP,
+            FirewallRuleObject::ACTION_BLOCK,
+            1,
+            0
+        );
+        $disabled = $this->store->queryRules(
+            FirewallRuleObject::SCOPE_TENANT,
+            'tenant-a',
+            'disabled',
+            null,
+            null,
+            50,
+            0
+        );
+
+        self::assertSame(1, $active['total']);
+        self::assertCount(1, $active['items']);
+        self::assertSame('tenant-active', $active['items'][0]->getReason());
+        self::assertSame(1, $disabled['total']);
+        self::assertSame('tenant-disabled', $disabled['items'][0]->getReason());
+    }
+
+    #[TestDox('Administrative creation persists tenant and system ownership')]
+    public function testAdministrativeRuleCreation(): void
+    {
+        $manager = new FirewallRuleManager(
+            $this->store,
+            new FirewallRuleCache($this->store),
+            $this->createStub(EventDispatcherInterface::class)
+        );
+        $tenantRule = $manager->createManualRule(
+            FirewallRuleScope::tenant('tenant-a'),
+            FirewallRuleObject::TYPE_DEVICE,
+            FirewallRuleObject::ACTION_BLOCK,
+            'device-123',
+            'Compromised device',
+            'admin-a',
+            3600
+        );
+        $systemRule = $manager->createManualRule(
+            FirewallRuleScope::system(),
+            FirewallRuleObject::TYPE_IP_RANGE,
+            FirewallRuleObject::ACTION_BLOCK,
+            '198.51.100.0/24',
+            'Malicious network',
+            'system-admin',
+            currentIp: '203.0.113.10'
+        );
+
+        $persistedTenant = $this->store->fetchRule($tenantRule->getId());
+        $persistedSystem = $this->store->fetchRule($systemRule->getId());
+        self::assertSame('tenant-a', $persistedTenant->getTenantId());
+        self::assertSame(FirewallRuleObject::SCOPE_SYSTEM, $persistedSystem->getScope());
+        self::assertNull($persistedSystem->getTenantId());
+        self::assertSame('system-admin', $persistedSystem->getCreatedBy());
+    }
+
+    #[TestDox('Administrative log queries enforce tenant scope and supported filters')]
+    public function testAdministrativeLogQuery(): void
+    {
+        $matching = (new FirewallLogObject())
+            ->setTenantId('tenant-a')
+            ->setIpAddress('203.0.113.10')
+            ->setEventType(FirewallLogObject::EVENT_RULE_MATCH)
+            ->setResult(FirewallLogObject::RESULT_BLOCKED)
+            ->setRuleId('rule-123')
+            ->setRuleScope(FirewallRuleObject::SCOPE_TENANT)
+            ->setTimestamp(new \DateTimeImmutable('-1 hour'));
+        $otherTenant = (new FirewallLogObject())
+            ->setTenantId('tenant-b')
+            ->setIpAddress('203.0.113.10')
+            ->setEventType(FirewallLogObject::EVENT_RULE_MATCH)
+            ->setResult(FirewallLogObject::RESULT_BLOCKED)
+            ->setRuleId('rule-123')
+            ->setRuleScope(FirewallRuleObject::SCOPE_TENANT)
+            ->setTimestamp(new \DateTimeImmutable('-1 hour'));
+        $tooOld = (new FirewallLogObject())
+            ->setTenantId('tenant-a')
+            ->setEventType(FirewallLogObject::EVENT_RULE_MATCH)
+            ->setResult(FirewallLogObject::RESULT_BLOCKED)
+            ->setRuleId('rule-123')
+            ->setTimestamp(new \DateTimeImmutable('-3 days'));
+        foreach ([$matching, $otherTenant, $tooOld] as $log) {
+            $this->store->createLog($log);
+        }
+
+        $tenant = $this->store->queryTenantLogs('tenant-a', [
+            'ipAddress' => '203.0.113.10',
+            'eventType' => FirewallLogObject::EVENT_RULE_MATCH,
+            'result' => FirewallLogObject::RESULT_BLOCKED,
+            'ruleId' => 'rule-123',
+            'ruleScope' => FirewallRuleObject::SCOPE_TENANT,
+            'from' => new \DateTimeImmutable('-1 day'),
+            'to' => new \DateTimeImmutable(),
+        ], 50, 0);
+        $system = $this->store->querySystemLogs(null, [], 2, 0);
+
+        self::assertSame(1, $tenant['total']);
+        self::assertSame('tenant-a', $tenant['items'][0]->getTenantId());
+        self::assertSame(3, $system['total']);
+        self::assertCount(2, $system['items']);
+        self::assertSame(2, $this->store->countSystemBlockedRequests('tenant-a'));
+        self::assertSame(3, $this->store->countSystemBlockedRequests());
+        self::assertSame(2, $this->store->countSystemBlockedRequests(null, new \DateTimeImmutable('-1 day')));
+    }
+
     private function rule(
         string $reason,
         string $scope,

tests/php/Unit/Application/KernelTest.php

@@ -17,9 +17,9 @@ use KTXC\Service\TenantService;
 use KTXF\Cache\BlobCacheInterface;
 use KTXF\Cache\EphemeralCacheInterface;
 use KTXF\Cache\PersistentCacheInterface;
-use KTXF\Event\DeferredEventProcessorInterface;
-use KTXF\Event\DeferredProcessingResult;
-use KTXF\Event\EventListenerRegistry;
+use KTXC\Event\DeferredEventProcessorInterface;
+use KTXC\Event\DeferredProcessingResult;
+use KTXC\Event\EventListenerRegistry;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
 use PHPUnit\Framework\MockObject\MockObject;

tests/php/Unit/Console/Tenant/TenantCreateCommandTest.php

@@ -5,8 +5,10 @@ declare(strict_types=1);
 namespace KTXT\Unit\Console\Tenant;
 
 use KTXC\Console\Tenant\TenantCreateCommand;
+use KTXC\Context\TenantContext;
 use KTXC\Models\Tenant\TenantObject;
 use KTXC\Service\TenantService;
+use KTXC\Service\UserAccountsService;
 use KTXC\Stores\UserAccountsStore;
 use KTXC\Stores\UserRolesStore;
 use PHPUnit\Framework\MockObject\MockObject;
@@ -22,6 +24,7 @@ class TenantCreateCommandTest extends TestCase
     private TenantService&MockObject $tenantService;
     private UserRolesStore $rolesStore;
     private UserAccountsStore $userStore;
+    private UserAccountsService $userService;
     private CommandTester $tester;
     private ?TenantObject $deposited = null;
 
@@ -31,12 +34,21 @@ class TenantCreateCommandTest extends TestCase
         $this->rolesStore = $this->createStub(UserRolesStore::class);
         $this->rolesStore->method('createRole')->willReturn(['rid' => 'admin']);
         $this->userStore = $this->createStub(UserAccountsStore::class);
-        $this->userStore->method('createUser')->willReturn(['uid' => 'admin']);
+        $this->userService = $this->createStub(UserAccountsService::class);
+        $this->userService->method('createUser')->willReturn(['uid' => 'admin']);
+        $contextTenantService = $this->createStub(TenantService::class);
+        $contextTenantService->method('fetchById')->willReturnCallback(
+            fn(string $identifier): ?TenantObject => $this->deposited?->getIdentifier() === $identifier
+                ? $this->deposited
+                : null,
+        );
         $this->tester = new CommandTester(
             new TenantCreateCommand(
                 $this->tenantService,
                 $this->rolesStore,
                 $this->userStore,
+                $this->userService,
+                new TenantContext($contextTenantService),
                 new NullLogger(),
             )
         );

tests/php/Unit/Controllers/FirewallControllerTest.php

@@ -0,0 +1,202 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Controllers;
+
+use KTXC\Context\IdentityContextInterface;
+use KTXC\Context\TenantContextInterface;
+use KTXC\Controllers\FirewallController;
+use KTXC\Http\Request\Request;
+use KTXC\Service\FirewallRuleCache;
+use KTXC\Service\FirewallRuleManager;
+use KTXC\Service\FirewallSettingsService;
+use KTXC\Service\FirewallStatusService;
+use KTXC\Service\FirewallLogService;
+use KTXC\Service\SystemFirewallLogService;
+use KTXC\Service\SystemFirewallRuleService;
+use KTXC\Service\SystemFirewallStatusService;
+use KTXC\Service\TenantFirewallLogService;
+use KTXC\Service\TenantFirewallRuleService;
+use KTXC\Service\TenantFirewallStatusService;
+use KTXC\Service\TenantService;
+use KTXC\Stores\FirewallStore;
+use KTXF\Event\EventDispatcherInterface;
+use KTXF\Routing\Attributes\AuthenticatedRoute;
+use PHPUnit\Framework\Attributes\AllowMockObjectsWithoutExpectations;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+#[AllowMockObjectsWithoutExpectations]
+final class FirewallControllerTest extends TestCase
+{
+    private FirewallStore $store;
+    private FirewallController $controller;
+
+    protected function setUp(): void
+    {
+        $this->store = $this->createMock(FirewallStore::class);
+        $tenant = $this->createMock(TenantContextInterface::class);
+        $tenant->method('requireIdentifier')->willReturn('tenant-a');
+        $identity = $this->createMock(IdentityContextInterface::class);
+        $identity->method('hasPermission')->willReturn(true);
+        $manager = new FirewallRuleManager(
+            $this->store,
+            new FirewallRuleCache($this->store),
+            $this->createStub(EventDispatcherInterface::class)
+        );
+        $settings = new FirewallSettingsService(
+            $this->createStub(TenantService::class),
+            $this->createStub(EventDispatcherInterface::class)
+        );
+        $this->controller = new FirewallController(
+            new TenantFirewallRuleService($manager, $tenant, $identity),
+            new SystemFirewallRuleService($manager, $identity),
+            new TenantFirewallLogService(new FirewallLogService($this->store), $tenant, $identity),
+            new SystemFirewallLogService(new FirewallLogService($this->store), $identity),
+            new TenantFirewallStatusService(new FirewallStatusService($this->store), $tenant, $identity, $settings),
+            new SystemFirewallStatusService(new FirewallStatusService($this->store), $identity, $settings)
+        );
+    }
+
+    #[TestDox('Tenant rule endpoint returns bounded paginated results')]
+    public function testTenantRules(): void
+    {
+        $this->store->expects(self::once())
+            ->method('queryRules')
+            ->with('tenant', 'tenant-a', 'active', null, null, 25, 10)
+            ->willReturn(['items' => [], 'total' => 0, 'limit' => 25, 'offset' => 10]);
+
+        $response = $this->controller->tenantRules(limit: '25', offset: '10');
+        $data = json_decode($response->getContent(), true, flags: JSON_THROW_ON_ERROR);
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame(25, $data['limit']);
+        self::assertSame(10, $data['offset']);
+    }
+
+    #[TestDox('Rule endpoints reject malformed and excessive pagination')]
+    public function testPaginationValidation(): void
+    {
+        $this->store->expects(self::never())->method('queryRules');
+
+        self::assertSame(400, $this->controller->tenantRules(limit: 'invalid')->getStatusCode());
+        self::assertSame(400, $this->controller->systemRules(limit: '101')->getStatusCode());
+    }
+
+    #[TestDox('Metric endpoints return scoped counts and stable validation errors')]
+    public function testMetrics(): void
+    {
+        $this->store->method('countBlockedRequests')->willReturn(4);
+
+        $response = $this->controller->tenantMetrics();
+        $data = json_decode($response->getContent(), true, flags: JSON_THROW_ON_ERROR);
+
+        self::assertSame(4, $data['blockedRequests']);
+        self::assertSame(400, $this->controller->systemMetrics(since: 'not-a-date')->getStatusCode());
+    }
+
+    #[TestDox('Current-IP blocks return a structured confirmation conflict')]
+    public function testCurrentIpConflict(): void
+    {
+        $this->store->expects(self::never())->method('depositRule');
+        $response = $this->controller->createTenantRule(
+            new Request(server: ['REMOTE_ADDR' => '203.0.113.10']),
+            'ip',
+            'block',
+            '203.0.113.10',
+            'Suspected abuse'
+        );
+        $data = json_decode($response->getContent(), true, flags: JSON_THROW_ON_ERROR);
+
+        self::assertSame(409, $response->getStatusCode());
+        self::assertSame('current_ip_confirmation_required', $data['error']['code']);
+    }
+
+    #[TestDox('Invalid manual rules return a stable validation response')]
+    public function testMutationValidation(): void
+    {
+        $response = $this->controller->createSystemRule(
+            new Request(server: ['REMOTE_ADDR' => '203.0.113.10']),
+            'device',
+            'allow',
+            'device-123',
+            'Trusted device'
+        );
+        $data = json_decode($response->getContent(), true, flags: JSON_THROW_ON_ERROR);
+
+        self::assertSame(400, $response->getStatusCode());
+        self::assertSame('invalid_firewall_rule', $data['error']['code']);
+    }
+
+    #[TestDox('Re-enabling a current-IP block requires explicit confirmation')]
+    public function testEnableSafeguard(): void
+    {
+        $rule = (new \KTXC\Models\Firewall\FirewallRuleObject())
+            ->setId('rule-123')
+            ->setScope('tenant')
+            ->setTenantId('tenant-a')
+            ->setType('ip')
+            ->setAction('block')
+            ->setValue('203.0.113.10')
+            ->setEnabled(false);
+        $this->store->method('fetchRule')->willReturn($rule);
+
+        $response = $this->controller->updateTenantRule(
+            new Request(server: ['REMOTE_ADDR' => '203.0.113.10']),
+            'rule-123',
+            'enable',
+            'Threat returned'
+        );
+        $data = json_decode($response->getContent(), true, flags: JSON_THROW_ON_ERROR);
+
+        self::assertSame(409, $response->getStatusCode());
+        self::assertSame('current_ip_confirmation_required', $data['error']['code']);
+    }
+
+    #[TestDox('Lifecycle endpoints return stable validation and not-found responses')]
+    public function testLifecycleResponses(): void
+    {
+        $request = new Request(server: ['REMOTE_ADDR' => '203.0.113.10']);
+
+        self::assertSame(400, $this->controller->updateSystemRule(
+            $request, 'rule-123', 'extend', 'More time required'
+        )->getStatusCode());
+        self::assertSame(404, $this->controller->deleteTenantRule(
+            'missing-rule', 'No longer required'
+        )->getStatusCode());
+    }
+
+    #[TestDox('Every rule endpoint declares its scope-specific read permission')]
+    public function testRoutePermissions(): void
+    {
+        $expected = [
+            'tenantRules' => TenantFirewallRuleService::PERMISSION_READ,
+            'tenantRule' => TenantFirewallRuleService::PERMISSION_READ,
+            'effectivePolicy' => TenantFirewallRuleService::PERMISSION_READ,
+            'systemRules' => SystemFirewallRuleService::PERMISSION_READ,
+            'systemRule' => SystemFirewallRuleService::PERMISSION_READ,
+            'tenantLogs' => TenantFirewallLogService::PERMISSION_READ,
+            'systemLogs' => SystemFirewallLogService::PERMISSION_READ,
+            'tenantMetrics' => TenantFirewallLogService::PERMISSION_READ,
+            'tenantConfiguration' => TenantFirewallStatusService::PERMISSION_SETTINGS_READ,
+            'systemMetrics' => SystemFirewallLogService::PERMISSION_READ,
+            'maintenanceStatus' => SystemFirewallStatusService::PERMISSION_MAINTENANCE_READ,
+            'updateTenantConfiguration' => TenantFirewallStatusService::PERMISSION_SETTINGS_MANAGE,
+            'updateSystemTenantConfiguration' => SystemFirewallStatusService::PERMISSION_SETTINGS_MANAGE,
+            'createTenantRule' => TenantFirewallRuleService::PERMISSION_MANAGE,
+            'createSystemRule' => SystemFirewallRuleService::PERMISSION_MANAGE,
+            'updateTenantRule' => TenantFirewallRuleService::PERMISSION_MANAGE,
+            'updateSystemRule' => SystemFirewallRuleService::PERMISSION_MANAGE,
+            'deleteTenantRule' => TenantFirewallRuleService::PERMISSION_MANAGE,
+            'deleteSystemRule' => SystemFirewallRuleService::PERMISSION_MANAGE,
+        ];
+
+        foreach ($expected as $method => $permission) {
+            $attributes = (new \ReflectionMethod(FirewallController::class, $method))
+                ->getAttributes(AuthenticatedRoute::class);
+            self::assertCount(1, $attributes);
+            self::assertSame([$permission], $attributes[0]->newInstance()->permissions);
+        }
+    }
+}

tests/php/Unit/Event/AccessDeniedEventTest.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Models\Firewall\FirewallRuleObject;
+use KTXC\Security\Event\AccessDeniedEvent;
+use KTXC\Security\Event\SecurityEventSeverity;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class AccessDeniedEventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Access-denial state is typed and complete at construction')]
+    public function constructsTypedState(): void
+    {
+        $event = new AccessDeniedEvent(
+            '203.0.113.10',
+            'rule-a',
+            FirewallRuleObject::SCOPE_TENANT,
+            'device-a',
+            'Blocked by policy',
+            'tenant-a',
+            'identity-a',
+        );
+
+        self::assertSame(AccessDeniedEvent::class, $event->getName());
+        self::assertSame('203.0.113.10', $event->getIpAddress());
+        self::assertSame('device-a', $event->getDeviceFingerprint());
+        self::assertSame('rule-a', $event->getRuleId());
+        self::assertSame(FirewallRuleObject::SCOPE_TENANT, $event->getRuleScope());
+        self::assertSame('Blocked by policy', $event->getReason());
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('identity-a', $event->getIdentityId());
+        self::assertSame(SecurityEventSeverity::WARNING, $event->getSeverity());
+    }
+
+    #[Test]
+    #[TestDox('Access denial rejects incomplete rule context')]
+    public function rejectsIncompleteRuleContext(): void
+    {
+        foreach ([
+            ['', 'rule-a', FirewallRuleObject::SCOPE_TENANT],
+            ['203.0.113.10', '', FirewallRuleObject::SCOPE_TENANT],
+            ['203.0.113.10', 'rule-a', 'unknown'],
+        ] as $arguments) {
+            try {
+                new AccessDeniedEvent(...$arguments);
+                self::fail('Incomplete access-denial context was accepted.');
+            } catch (\InvalidArgumentException) {
+                $this->addToAssertionCount(1);
+            }
+        }
+    }
+}

tests/php/Unit/Event/AuthenticationFailedEventTest.php

@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Security\Event\AuthenticationFailedEvent;
+use KTXC\Security\Event\SecurityEventSeverity;
+use KTXC\Security\Event\SecurityRequestEventInterface;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class AuthenticationFailedEventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Authentication failure state is typed and complete at construction')]
+    public function constructsTypedState(): void
+    {
+        $event = new AuthenticationFailedEvent(
+            'user-a',
+            'Invalid credentials',
+            'tenant-a',
+            'identity-a',
+        );
+
+        self::assertSame(AuthenticationFailedEvent::class, $event->getName());
+        self::assertSame('user-a', $event->getUserId());
+        self::assertSame('Invalid credentials', $event->getReason());
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('identity-a', $event->getIdentityId());
+        self::assertSame(SecurityEventSeverity::WARNING, $event->getSeverity());
+        self::assertNotInstanceOf(SecurityRequestEventInterface::class, $event);
+    }
+}

tests/php/Unit/Event/AuthenticationSucceededEventTest.php

@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Security\Event\AuthenticationSucceededEvent;
+use KTXC\Security\Event\SecurityEventSeverity;
+use KTXC\Security\Event\SecurityRequestEventInterface;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class AuthenticationSucceededEventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Successful-authentication state is typed and complete at construction')]
+    public function constructsTypedState(): void
+    {
+        $event = new AuthenticationSucceededEvent(
+            'user-a',
+            'tenant-a',
+        );
+
+        self::assertSame(AuthenticationSucceededEvent::class, $event->getName());
+        self::assertSame('user-a', $event->getUserId());
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame(['userId' => 'user-a'], $event->getData());
+        self::assertSame(SecurityEventSeverity::INFO, $event->getSeverity());
+        self::assertNotInstanceOf(SecurityRequestEventInterface::class, $event);
+    }
+
+    #[Test]
+    #[TestDox('Successful authentication requires a user ID')]
+    public function rejectsIncompleteAuthenticationContext(): void
+    {
+        $this->expectException(\InvalidArgumentException::class);
+
+        new AuthenticationSucceededEvent('');
+    }
+}

tests/php/Unit/Event/BruteForceDetectedEventTest.php

@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Security\Event\BruteForceDetectedEvent;
+use KTXC\Security\Event\SecurityEventSeverity;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class BruteForceDetectedEventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Brute-force detection state is typed and complete at construction')]
+    public function constructsTypedState(): void
+    {
+        $event = new BruteForceDetectedEvent(
+            '203.0.113.10',
+            5,
+            300,
+            'tenant-a',
+        );
+
+        self::assertSame(BruteForceDetectedEvent::class, $event->getName());
+        self::assertSame('203.0.113.10', $event->getIpAddress());
+        self::assertSame(5, $event->getFailureCount());
+        self::assertSame(300, $event->getWindowSeconds());
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('5 failed attempts in 300 seconds', $event->getReason());
+        self::assertSame(
+            ['failureCount' => 5, 'windowSeconds' => 300],
+            $event->getData(),
+        );
+        self::assertSame(SecurityEventSeverity::CRITICAL, $event->getSeverity());
+    }
+
+    #[Test]
+    #[TestDox('Brute-force detection rejects invalid measurements')]
+    public function rejectsInvalidMeasurements(): void
+    {
+        foreach ([
+            ['', 5, 300],
+            ['203.0.113.10', 0, 300],
+            ['203.0.113.10', 5, 0],
+        ] as $arguments) {
+            try {
+                new BruteForceDetectedEvent(...$arguments);
+                self::fail('Invalid brute-force measurements were accepted.');
+            } catch (\InvalidArgumentException) {
+                $this->addToAssertionCount(1);
+            }
+        }
+    }
+}

tests/php/Unit/Event/EventDispatcherTest.php

@@ -6,8 +6,8 @@ namespace KTXT\Unit\Event;
 
 use KTXF\Event\DeliveryMode;
 use KTXF\Event\Event;
-use KTXF\Event\EventDispatcher;
-use KTXF\Event\EventListenerRegistry;
+use KTXC\Event\EventDispatcher;
+use KTXC\Event\EventListenerRegistry;
 use KTXF\Event\FailurePolicy;
 use PHPUnit\Framework\TestCase;
 use PHPUnit\Framework\Attributes\Test;
@@ -167,6 +167,43 @@ final class EventDispatcherTest extends TestCase
         $dispatcher->dispatch(new Event('test.event'));
     }
 
+    #[Test]
+    #[TestDox('Propagated deferred failures close their execution scope')]
+    public function recoversFromDeferredFailure(): void
+    {
+        $registry = new EventListenerRegistry();
+        $registry->listen(
+            'test',
+            'test.event',
+            FailingListener::class,
+            'fail',
+            DeliveryMode::Deferred,
+            failurePolicy: FailurePolicy::Propagate,
+        );
+        $registry->freeze();
+
+        $dispatcher = new EventDispatcher(
+            $registry,
+            new RecordingContainer([FailingListener::class => new FailingListener()]),
+            new NullLogger(),
+        );
+        $dispatcher->beginExecution('failed');
+        $dispatcher->dispatch(new Event('test.event'));
+
+        try {
+            $dispatcher->processDeferred('failed');
+            self::fail('Expected deferred listener failure to propagate.');
+        } catch (\RuntimeException $error) {
+            self::assertSame('Listener failed.', $error->getMessage());
+        }
+
+        $dispatcher->beginExecution('next');
+        $result = $dispatcher->processDeferred('next');
+
+        self::assertSame(0, $result->processed);
+        self::assertSame(0, $result->remaining);
+    }
+
     #[Test]
     #[TestDox('Deferred processing stops at its configured count limit')]
     public function boundsDeferredWork(): void

tests/php/Unit/Event/EventTest.php

@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXF\Event\Event;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class EventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Event data and context are supplied during construction')]
+    public function constructsCompleteEventState(): void
+    {
+        $event = new Event(
+            'test.event',
+            ['nested' => ['value' => 'original']],
+            'tenant-a',
+            'identity-a',
+        );
+
+        $copy = $event->getData();
+        $copy['nested']['value'] = 'changed';
+
+        self::assertSame('original', $event->get('nested')['value']);
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('identity-a', $event->getIdentityId());
+    }
+
+    #[Test]
+    #[TestDox('Event data rejects mutable object references')]
+    public function rejectsMutablePayloadValues(): void
+    {
+        $this->expectException(\InvalidArgumentException::class);
+
+        new Event('test.event', ['mutable' => new \stdClass()]);
+    }
+}

tests/php/Unit/Event/FirewallPolicyEventTest.php

@@ -0,0 +1,79 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Security\Event\DeviceBlockedEvent;
+use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
+use KTXC\Security\Event\IpAllowedEvent;
+use KTXC\Security\Event\IpBlockedEvent;
+use KTXC\Security\Event\SecurityEventSeverity;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class FirewallPolicyEventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('IP and device policy events expose typed immutable state')]
+    public function constructsSubjectPolicyEvents(): void
+    {
+        $blocked = new IpBlockedEvent('203.0.113.10', 'Repeated abuse', 'tenant-a');
+        $allowed = new IpAllowedEvent('203.0.113.11', 'Trusted service', 'tenant-a');
+        $device = new DeviceBlockedEvent('device-a', 'Compromised device', 'tenant-a');
+
+        self::assertSame(IpBlockedEvent::class, $blocked->getName());
+        self::assertSame('203.0.113.10', $blocked->getIpAddress());
+        self::assertSame('Repeated abuse', $blocked->getReason());
+        self::assertSame(SecurityEventSeverity::CRITICAL, $blocked->getSeverity());
+        self::assertSame(IpAllowedEvent::class, $allowed->getName());
+        self::assertSame('203.0.113.11', $allowed->getIpAddress());
+        self::assertSame(SecurityEventSeverity::INFO, $allowed->getSeverity());
+        self::assertSame(DeviceBlockedEvent::class, $device->getName());
+        self::assertSame('device-a', $device->getDeviceFingerprint());
+        self::assertSame(SecurityEventSeverity::CRITICAL, $device->getSeverity());
+    }
+
+    #[Test]
+    #[TestDox('Firewall settings events capture the complete configuration transition')]
+    public function constructsSettingsEvent(): void
+    {
+        $event = new FirewallSettingsUpdatedEvent(
+            'Tighten controls',
+            ['maxAuthFailures' => 5],
+            ['maxAuthFailures' => 3],
+            'tenant-a',
+            'operator-a',
+        );
+
+        self::assertSame(FirewallSettingsUpdatedEvent::class, $event->getName());
+        self::assertSame('Tighten controls', $event->getChangeReason());
+        self::assertSame(['maxAuthFailures' => 5], $event->getPrevious());
+        self::assertSame(['maxAuthFailures' => 3], $event->getCurrent());
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('operator-a', $event->getIdentityId());
+        self::assertSame('manual', $event->getChangeOrigin());
+        self::assertSame(SecurityEventSeverity::INFO, $event->getSeverity());
+    }
+
+    #[Test]
+    #[TestDox('Firewall policy events reject missing subject and ownership context')]
+    public function rejectsIncompletePolicyContext(): void
+    {
+        foreach ([
+            static fn() => new IpBlockedEvent(''),
+            static fn() => new IpAllowedEvent(''),
+            static fn() => new DeviceBlockedEvent(''),
+            static fn() => new FirewallSettingsUpdatedEvent('', [], [], 'tenant-a'),
+            static fn() => new FirewallSettingsUpdatedEvent('Reason', [], [], ''),
+        ] as $construction) {
+            try {
+                $construction();
+                self::fail('Incomplete firewall policy context was accepted.');
+            } catch (\InvalidArgumentException) {
+                $this->addToAssertionCount(1);
+            }
+        }
+    }
+}

tests/php/Unit/Event/FirewallRuleEventTest.php

@@ -0,0 +1,81 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Models\Firewall\FirewallRuleObject;
+use KTXC\Security\Event\FirewallRuleCreatedEvent;
+use KTXC\Security\Event\FirewallRuleDisabledEvent;
+use KTXC\Security\Event\FirewallRuleEnabledEvent;
+use KTXC\Security\Event\FirewallRuleExtendedEvent;
+use KTXC\Security\Event\FirewallRuleRemovedEvent;
+use KTXC\Security\Event\SecurityEventSeverity;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class FirewallRuleEventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Firewall rule events capture immutable rule snapshots')]
+    public function capturesRuleSnapshot(): void
+    {
+        $expiresAt = new \DateTimeImmutable('+5 minutes');
+        $rule = (new FirewallRuleObject())
+            ->setId('rule-a')
+            ->setScope(FirewallRuleObject::SCOPE_TENANT)
+            ->setTenantId('tenant-a')
+            ->setType(FirewallRuleObject::TYPE_IP)
+            ->setAction(FirewallRuleObject::ACTION_BLOCK)
+            ->setValue('203.0.113.10')
+            ->setReason('Repeated abuse')
+            ->setCreatedBy('creator-a')
+            ->setExpiresAt($expiresAt)
+            ->setMetadata(['origin' => 'automatic', 'failureCount' => 5]);
+
+        $event = FirewallRuleExtendedEvent::fromRule(
+            $rule,
+            'operator-a',
+            ['changeReason' => 'Continue monitoring'],
+        );
+        $rule->setReason('Mutated after publication');
+
+        self::assertSame(FirewallRuleExtendedEvent::class, $event->getName());
+        self::assertSame('rule-a', $event->getRuleId());
+        self::assertSame(FirewallRuleObject::SCOPE_TENANT, $event->getRuleScope());
+        self::assertSame(FirewallRuleObject::TYPE_IP, $event->getRuleType());
+        self::assertSame(FirewallRuleObject::ACTION_BLOCK, $event->getRuleAction());
+        self::assertSame('203.0.113.10', $event->getRuleValue());
+        self::assertSame('Repeated abuse', $event->getReason());
+        self::assertSame('automatic', $event->getOrigin());
+        self::assertSame($expiresAt->format(\DateTimeInterface::ATOM), $event->getExpiresAt());
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('operator-a', $event->getIdentityId());
+        self::assertSame(5, $event->get('failureCount'));
+        self::assertSame('Continue monitoring', $event->get('changeReason'));
+        self::assertSame(SecurityEventSeverity::INFO, $event->getSeverity());
+    }
+
+    #[Test]
+    #[TestDox('Each firewall rule lifecycle operation has a dedicated event key')]
+    public function exposesDedicatedLifecycleKeys(): void
+    {
+        $rule = (new FirewallRuleObject())
+            ->setId('rule-a')
+            ->setScope(FirewallRuleObject::SCOPE_SYSTEM)
+            ->setType(FirewallRuleObject::TYPE_IP)
+            ->setAction(FirewallRuleObject::ACTION_BLOCK)
+            ->setValue('203.0.113.10');
+
+        foreach ([
+            FirewallRuleCreatedEvent::class,
+            FirewallRuleExtendedEvent::class,
+            FirewallRuleEnabledEvent::class,
+            FirewallRuleDisabledEvent::class,
+            FirewallRuleRemovedEvent::class,
+        ] as $eventClass) {
+            self::assertSame($eventClass, $eventClass::fromRule($rule)->getName());
+        }
+    }
+}

tests/php/Unit/Event/RateLimitExceededEventTest.php

@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Security\Event\RateLimitExceededEvent;
+use KTXC\Security\Event\SecurityEventSeverity;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class RateLimitExceededEventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Rate-limit state is typed and complete at construction')]
+    public function constructsTypedState(): void
+    {
+        $event = new RateLimitExceededEvent(
+            '203.0.113.10',
+            101,
+            60,
+            '/login',
+            'tenant-a',
+        );
+
+        self::assertSame(RateLimitExceededEvent::class, $event->getName());
+        self::assertSame('203.0.113.10', $event->getIpAddress());
+        self::assertSame(101, $event->getRequestCount());
+        self::assertSame(60, $event->getWindowSeconds());
+        self::assertSame('/login', $event->getEndpoint());
+        self::assertSame('/login', $event->getRequestPath());
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('101 requests in 60 seconds', $event->getReason());
+        self::assertSame(SecurityEventSeverity::ERROR, $event->getSeverity());
+    }
+
+    #[Test]
+    #[TestDox('Rate-limit detection rejects invalid measurements')]
+    public function rejectsInvalidMeasurements(): void
+    {
+        foreach ([
+            ['', 101, 60, '/login'],
+            ['203.0.113.10', 0, 60, '/login'],
+            ['203.0.113.10', 101, 0, '/login'],
+            ['203.0.113.10', 101, 60, ''],
+        ] as $arguments) {
+            try {
+                new RateLimitExceededEvent(...$arguments);
+                self::fail('Invalid rate-limit measurements were accepted.');
+            } catch (\InvalidArgumentException) {
+                $this->addToAssertionCount(1);
+            }
+        }
+    }
+}

tests/php/Unit/Event/SecurityEventSeverityTest.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Security\Event\SecurityEventSeverity;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class SecurityEventSeverityTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Security severity levels expose stable numeric values')]
+    public function exposesStableNumericValues(): void
+    {
+        self::assertSame(0, SecurityEventSeverity::DEBUG->value);
+        self::assertSame(1, SecurityEventSeverity::INFO->value);
+        self::assertSame(2, SecurityEventSeverity::WARNING->value);
+        self::assertSame(3, SecurityEventSeverity::ERROR->value);
+        self::assertSame(4, SecurityEventSeverity::CRITICAL->value);
+    }
+}

tests/php/Unit/Event/SuspiciousActivityEventTest.php

@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\Security\Event\SecurityEventSeverity;
+use KTXC\Security\Event\SuspiciousActivityEvent;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class SuspiciousActivityEventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Suspicious-activity state is typed and complete at construction')]
+    public function constructsTypedState(): void
+    {
+        $event = new SuspiciousActivityEvent(
+            ipAddress: '203.0.113.20',
+            detector: 'payload-signature',
+            detectionData: ['score' => 98],
+            tenantId: 'tenant-a',
+            identityId: 'identity-a',
+            deviceFingerprint: 'device-a',
+            userAgent: 'Test Agent',
+            requestPath: '/admin',
+            requestMethod: 'POST',
+            userId: 'user-a',
+            reason: 'Matched a blocked payload signature',
+        );
+
+        self::assertSame(SuspiciousActivityEvent::class, $event->getName());
+        self::assertSame('203.0.113.20', $event->getIpAddress());
+        self::assertSame('payload-signature', $event->getDetector());
+        self::assertSame(['score' => 98], $event->getDetectionData());
+        self::assertSame(['detector' => 'payload-signature', 'score' => 98], $event->getData());
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('identity-a', $event->getIdentityId());
+        self::assertSame('device-a', $event->getDeviceFingerprint());
+        self::assertSame('Test Agent', $event->getUserAgent());
+        self::assertSame('/admin', $event->getRequestPath());
+        self::assertSame('POST', $event->getRequestMethod());
+        self::assertSame('user-a', $event->getUserId());
+        self::assertSame('Matched a blocked payload signature', $event->getReason());
+        self::assertSame(SecurityEventSeverity::ERROR, $event->getSeverity());
+    }
+
+    #[Test]
+    #[TestDox('Suspicious activity rejects incomplete or conflicting detection context')]
+    public function rejectsInvalidDetectionContext(): void
+    {
+        foreach ([
+            ['', 'payload-signature', []],
+            ['203.0.113.20', '', []],
+            ['203.0.113.20', 'payload-signature', ['detector' => 'replacement']],
+        ] as $arguments) {
+            try {
+                new SuspiciousActivityEvent(...$arguments);
+                self::fail('Invalid suspicious-activity context was accepted.');
+            } catch (\InvalidArgumentException) {
+                $this->addToAssertionCount(1);
+            }
+        }
+    }
+}

tests/php/Unit/Event/UserEventTest.php

@@ -0,0 +1,62 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Event;
+
+use KTXC\User\Event\UserCreatedEvent;
+use KTXC\User\Event\UserDeletingEvent;
+use KTXC\User\Event\UserUpdatedEvent;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class UserEventTest extends TestCase
+{
+    #[Test]
+    #[TestDox('User lifecycle events contain an immutable user snapshot')]
+    public function containsUserSnapshot(): void
+    {
+        $event = UserCreatedEvent::fromUser(
+            [
+                'uid' => 'user-a',
+                'identity' => 'person@example.test',
+                'label' => 'Person',
+                'enabled' => true,
+                'roles' => ['member'],
+            ],
+            'tenant-a',
+            'actor-a',
+        );
+
+        self::assertSame(UserCreatedEvent::class, $event->getName());
+        self::assertSame('user-a', $event->userIdentifier());
+        self::assertSame('person@example.test', $event->userIdentity());
+        self::assertSame('Person', $event->userLabel());
+        self::assertTrue($event->userEnabled());
+        self::assertSame(['member'], $event->userRoles());
+        self::assertSame('tenant-a', $event->getTenantId());
+        self::assertSame('actor-a', $event->actorIdentifier());
+        self::assertSame('actor-a', $event->getIdentityId());
+    }
+
+    #[Test]
+    #[TestDox('Created, updated, and deleting users have distinct event names')]
+    public function distinguishesLifecycleStage(): void
+    {
+        $user = ['uid' => 'user-a', 'identity' => 'person@example.test'];
+
+        self::assertSame(UserCreatedEvent::class, UserCreatedEvent::fromUser($user, 'tenant-a')->getName());
+        self::assertSame(UserUpdatedEvent::class, UserUpdatedEvent::fromUser($user, 'tenant-a')->getName());
+        self::assertSame(UserDeletingEvent::class, UserDeletingEvent::fromUser($user, 'tenant-a')->getName());
+    }
+
+    #[Test]
+    #[TestDox('User lifecycle events reject incomplete snapshots')]
+    public function rejectsIncompleteSnapshot(): void
+    {
+        $this->expectException(\InvalidArgumentException::class);
+
+        UserCreatedEvent::fromUser(['identity' => 'person@example.test'], 'tenant-a');
+    }
+}

tests/php/Unit/Module/CoreModuleTest.php

@@ -10,10 +10,25 @@ use KTXC\Console\Event\EventsDebugCommand;
 use KTXC\Module\Module;
 use KTXC\Service\FirewallService;
 use KTXC\Service\SystemFirewallRuleService;
+use KTXC\Service\SystemFirewallLogService;
+use KTXC\Service\TenantFirewallLogService;
+use KTXC\Service\TenantFirewallStatusService;
+use KTXC\Service\SystemFirewallStatusService;
 use KTXC\Service\TenantFirewallRuleService;
+use KTXC\Event\EventListenerRegistry;
+use KTXC\Security\Event\AccessDeniedEvent;
+use KTXC\Security\Event\AuthenticationFailedEvent;
+use KTXC\Security\Event\AuthenticationSucceededEvent;
+use KTXC\Security\Event\BruteForceDetectedEvent;
+use KTXC\Security\Event\FirewallRuleCreatedEvent;
+use KTXC\Security\Event\FirewallRuleDisabledEvent;
+use KTXC\Security\Event\FirewallRuleEnabledEvent;
+use KTXC\Security\Event\FirewallRuleExtendedEvent;
+use KTXC\Security\Event\FirewallRuleRemovedEvent;
+use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
+use KTXC\Security\Event\RateLimitExceededEvent;
+use KTXC\Security\Event\SuspiciousActivityEvent;
 use KTXF\Event\DeliveryMode;
-use KTXF\Event\EventListenerRegistry;
-use KTXF\Event\SecurityEvent;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
 use PHPUnit\Framework\TestCase;
@@ -30,20 +45,31 @@ final class CoreModuleTest extends TestCase
         $module->boot();
         $definitions = $registry->definitions();
 
-        self::assertCount(10, $definitions);
+        self::assertCount(12, $definitions);
         self::assertSame(['core'], array_values(array_unique(array_column($definitions, 'module'))));
         self::assertSame(
             FirewallService::class,
-            $registry->listeners(SecurityEvent::AUTH_FAILURE, DeliveryMode::Immediate)[0]->service,
+            $registry->listeners(AuthenticationFailedEvent::class, DeliveryMode::Immediate)[0]->service,
         );
-        self::assertSame([], $registry->listeners(SecurityEvent::AUTH_FAILURE, DeliveryMode::Deferred));
+        self::assertSame([], $registry->listeners(AuthenticationFailedEvent::class, DeliveryMode::Deferred));
+        $successListeners = $registry->listeners(
+            AuthenticationSucceededEvent::class,
+            DeliveryMode::Deferred,
+        );
+        self::assertCount(1, $successListeners);
+        self::assertSame(FirewallService::class, $successListeners[0]->service);
+        self::assertSame('logAuthenticationSuccess', $successListeners[0]->method);
         foreach ([
-            SecurityEvent::RATE_LIMIT_EXCEEDED,
-            SecurityEvent::SUSPICIOUS_ACTIVITY,
-            SecurityEvent::FIREWALL_RULE_CREATED,
-            SecurityEvent::FIREWALL_RULE_EXTENDED,
-            SecurityEvent::FIREWALL_RULE_DISABLED,
-            SecurityEvent::FIREWALL_RULE_REMOVED,
+            AccessDeniedEvent::class,
+            BruteForceDetectedEvent::class,
+            RateLimitExceededEvent::class,
+            SuspiciousActivityEvent::class,
+            FirewallRuleCreatedEvent::class,
+            FirewallRuleExtendedEvent::class,
+            FirewallRuleDisabledEvent::class,
+            FirewallRuleEnabledEvent::class,
+            FirewallRuleRemovedEvent::class,
+            FirewallSettingsUpdatedEvent::class,
         ] as $event) {
             $listeners = $registry->listeners($event, DeliveryMode::Deferred);
             self::assertCount(1, $listeners);
@@ -74,5 +100,11 @@ final class CoreModuleTest extends TestCase
         self::assertArrayHasKey(SystemFirewallRuleService::PERMISSION_MANAGE, $permissions);
         self::assertArrayHasKey(TenantFirewallRuleService::PERMISSION_READ, $permissions);
         self::assertArrayHasKey(TenantFirewallRuleService::PERMISSION_MANAGE, $permissions);
+        self::assertArrayHasKey(TenantFirewallLogService::PERMISSION_READ, $permissions);
+        self::assertArrayHasKey(SystemFirewallLogService::PERMISSION_READ, $permissions);
+        self::assertArrayHasKey(TenantFirewallStatusService::PERMISSION_SETTINGS_READ, $permissions);
+        self::assertArrayHasKey(TenantFirewallStatusService::PERMISSION_SETTINGS_MANAGE, $permissions);
+        self::assertArrayHasKey(SystemFirewallStatusService::PERMISSION_MAINTENANCE_READ, $permissions);
+        self::assertArrayHasKey(SystemFirewallStatusService::PERMISSION_SETTINGS_MANAGE, $permissions);
     }
 }

tests/php/Unit/Runtime/HttpRuntimeTest.php

@@ -20,6 +20,7 @@ use KTXC\Http\Middleware\RequestHandlerInterface;
 use KTXC\Http\Middleware\RouterMiddleware;
 use KTXC\Http\Middleware\TenantMiddleware;
 use KTXC\Http\Request\Request;
+use KTXC\Http\Request\RequestContext;
 use KTXC\Http\Response\Response;
 use KTXC\Http\Response\StreamedResponse;
 use KTXC\KernelInterface;
@@ -78,6 +79,31 @@ final class HttpRuntimeTest extends TestCase
         self::assertTrue($kernel->outcome?->successful);
     }
 
+    #[Test]
+    #[TestDox('HTTP requests are available only for the active runtime execution')]
+    public function scopesRequestContext(): void
+    {
+        $requestContext = new RequestContext();
+        $observer = new RequestContextMiddleware($requestContext);
+        $kernel = new RuntimeKernel(
+            new RuntimeContainer([
+                RequestContext::class => $requestContext,
+                TenantMiddleware::class => new PassMiddleware(),
+                FirewallMiddleware::class => new PassMiddleware(),
+                AuthenticationMiddleware::class => new PassMiddleware(),
+                RouterMiddleware::class => $observer,
+            ]),
+            new TenantContext($this->createStub(TenantService::class)),
+            new IdentityContext(),
+        );
+        $request = Request::create('/auth/verify', 'POST');
+
+        (new HttpRuntime($kernel, false))->run($request, send: false);
+
+        self::assertSame($request, $observer->observed);
+        self::assertNull($requestContext->current());
+    }
+
     #[Test]
     #[TestDox('HTTP exceptions render a response and still terminate')]
     public function fails(): void
@@ -198,9 +224,12 @@ final class RuntimeKernel implements KernelInterface
 
 final class RuntimeContainer implements ContainerInterface
 {
+    private readonly array $services;
+
     public function __construct(
-        private readonly array $services,
+        array $services,
     ) {
+        $this->services = [RequestContext::class => new RequestContext(), ...$services];
     }
 
     public function get(string $id): mixed
@@ -250,6 +279,21 @@ final class ResponseMiddleware extends PassMiddleware
     }
 }
 
+final class RequestContextMiddleware extends PassMiddleware
+{
+    public ?Request $observed = null;
+
+    public function __construct(
+        private readonly RequestContext $requestContext,
+    ) {}
+
+    public function process(Request $request, RequestHandlerInterface $handler): Response
+    {
+        $this->observed = $this->requestContext->current();
+        return new Response('ok');
+    }
+}
+
 final class ThrowingMiddleware extends PassMiddleware
 {
     public function process(Request $request, RequestHandlerInterface $handler): Response

tests/php/Unit/Security/AuthenticationManagerTest.php

@@ -0,0 +1,283 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Security;
+
+use KTXC\Context\TenantContextInterface;
+use KTXC\Models\Tenant\TenantConfiguration;
+use KTXC\Resource\ProviderManager;
+use KTXC\Security\Authentication\AuthenticationRequest;
+use KTXC\Security\AuthenticationManager;
+use KTXC\Security\Event\AuthenticationFailedEvent;
+use KTXC\Security\Event\AuthenticationSucceededEvent;
+use KTXC\Service\TokenService;
+use KTXC\Service\UserAccountsService;
+use KTXF\Cache\CacheScope;
+use KTXF\Cache\EphemeralCacheInterface;
+use KTXF\Event\EventDispatcherInterface;
+use KTXF\Security\Authentication\AuthenticationProviderInterface;
+use KTXF\Security\Authentication\AuthenticationSession;
+use KTXF\Security\Authentication\ProviderContext;
+use KTXF\Security\Authentication\ProviderResult;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+
+final class AuthenticationManagerTest extends TestCase
+{
+    #[Test]
+    public function completedAuthenticationPublishesAuthenticationSucceededEvent(): void
+    {
+        $tenant = $this->createStub(TenantContextInterface::class);
+        $tenant->method('identifier')->willReturn('tenant-a');
+        $tenant->method('configuration')->willReturn(new TenantConfiguration());
+
+        $session = new AuthenticationSession(
+            id: 'auth-session',
+            state: AuthenticationSession::STATE_IDENTIFIED,
+            tenantIdentifier: 'tenant-a',
+            userIdentifier: 'user-a',
+            userIdentity: 'person@example.com',
+            methodsAvailable: ['password'],
+            createdAt: time(),
+            expiresAt: time() + 300,
+        );
+
+        $cache = $this->createMock(EphemeralCacheInterface::class);
+        $cache->expects($this->once())
+            ->method('get')
+            ->with('auth-session', CacheScope::Tenant, 'auth')
+            ->willReturn($session);
+        $cache->expects($this->once())->method('set')->willReturn(true);
+        $cache->expects($this->once())
+            ->method('delete')
+            ->with('auth-session', CacheScope::Tenant, 'auth')
+            ->willReturn(true);
+
+        $provider = new SuccessfulAuthenticationProvider();
+        $providers = $this->createStub(ProviderManager::class);
+        $providers->method('resolve')->willReturn($provider);
+
+        $users = $this->createMock(UserAccountsService::class);
+        $users->expects($this->once())
+            ->method('fetchByIdentifier')
+            ->with('user-a')
+            ->willReturn([
+                'uid' => 'user-a',
+                'identity' => 'person@example.com',
+                'label' => 'Person',
+                'permissions' => [],
+            ]);
+
+        $tokens = $this->createStub(TokenService::class);
+        $tokens->method('createToken')->willReturn('token');
+
+        $events = $this->createMock(EventDispatcherInterface::class);
+        $events->expects($this->once())
+            ->method('dispatch')
+            ->with(self::callback(static fn($event): bool =>
+                $event instanceof AuthenticationSucceededEvent
+                && $event->getUserId() === 'user-a'
+                && $event->getTenantId() === 'tenant-a'
+            ));
+
+        $manager = new AuthenticationManager(
+            $tenant,
+            $cache,
+            $providers,
+            $tokens,
+            $users,
+            $events,
+        );
+
+        $response = $manager->handle(AuthenticationRequest::verify(
+            'auth-session',
+            'password',
+            'correct',
+        ));
+
+        self::assertTrue($response->isSuccess());
+    }
+
+    #[Test]
+    public function rejectedCredentialPublishesAuthenticationFailedEvent(): void
+    {
+        $tenant = $this->createStub(TenantContextInterface::class);
+        $tenant->method('configuration')->willReturn(new TenantConfiguration());
+
+        $session = new AuthenticationSession(
+            id: 'auth-session',
+            state: AuthenticationSession::STATE_IDENTIFIED,
+            tenantIdentifier: 'tenant-a',
+            userIdentifier: 'user-a',
+            userIdentity: 'person@example.com',
+            methodsAvailable: ['password'],
+            createdAt: time(),
+            expiresAt: time() + 300,
+        );
+
+        $cache = $this->createMock(EphemeralCacheInterface::class);
+        $cache->expects($this->once())
+            ->method('get')
+            ->with('auth-session', CacheScope::Tenant, 'auth')
+            ->willReturn($session);
+        $cache->expects($this->once())
+            ->method('set')
+            ->willReturn(true);
+
+        $provider = new class implements AuthenticationProviderInterface {
+            public int $verificationCount = 0;
+
+            public function type(): string
+            {
+                return 'authentication';
+            }
+
+            public function identifier(): string
+            {
+                return 'password';
+            }
+
+            public function label(): string
+            {
+                return 'Password';
+            }
+
+            public function description(): string
+            {
+                return 'Test provider';
+            }
+
+            public function method(): string
+            {
+                return self::METHOD_CREDENTIAL;
+            }
+
+            public function icon(): string
+            {
+                return '';
+            }
+
+            public function verify(ProviderContext $context, string $secret): ProviderResult
+            {
+                $this->verificationCount++;
+                return ProviderResult::failed(ProviderResult::ERROR_INVALID_FACTOR);
+            }
+
+            public function beginChallenge(ProviderContext $context): ProviderResult
+            {
+                return ProviderResult::failed();
+            }
+
+            public function verifyChallenge(ProviderContext $context, string $code): ProviderResult
+            {
+                return ProviderResult::failed();
+            }
+
+            public function beginRedirect(
+                ProviderContext $context,
+                string $callbackUrl,
+                ?string $returnUrl = null,
+            ): ProviderResult {
+                return ProviderResult::failed();
+            }
+
+            public function completeRedirect(ProviderContext $context, array $params): ProviderResult
+            {
+                return ProviderResult::failed();
+            }
+        };
+
+        $providers = $this->createMock(ProviderManager::class);
+        $providers->method('resolve')->with('authentication', 'password')->willReturn($provider);
+
+        $events = $this->createMock(EventDispatcherInterface::class);
+        $events->expects($this->once())
+            ->method('dispatch')
+            ->with(self::callback(static function ($event): bool {
+                return $event instanceof AuthenticationFailedEvent
+                    && $event->getUserId() === 'user-a'
+                    && $event->getReason() === ProviderResult::ERROR_INVALID_FACTOR
+                    && $event->getTenantId() === 'tenant-a';
+            }));
+
+        $manager = new AuthenticationManager(
+            $tenant,
+            $cache,
+            $providers,
+            $this->createStub(TokenService::class),
+            $this->createStub(UserAccountsService::class),
+            $events,
+        );
+
+        $response = $manager->handle(AuthenticationRequest::verify(
+            'auth-session',
+            'password',
+            'incorrect',
+        ));
+
+        self::assertTrue($response->isFailed());
+        self::assertSame(1, $provider->verificationCount);
+    }
+}
+
+final class SuccessfulAuthenticationProvider implements AuthenticationProviderInterface
+{
+    public function type(): string
+    {
+        return 'authentication';
+    }
+
+    public function identifier(): string
+    {
+        return 'password';
+    }
+
+    public function label(): string
+    {
+        return 'Password';
+    }
+
+    public function description(): string
+    {
+        return 'Successful test provider';
+    }
+
+    public function method(): string
+    {
+        return self::METHOD_CREDENTIAL;
+    }
+
+    public function icon(): string
+    {
+        return '';
+    }
+
+    public function verify(ProviderContext $context, string $secret): ProviderResult
+    {
+        return ProviderResult::success();
+    }
+
+    public function beginChallenge(ProviderContext $context): ProviderResult
+    {
+        return ProviderResult::failed();
+    }
+
+    public function verifyChallenge(ProviderContext $context, string $code): ProviderResult
+    {
+        return ProviderResult::failed();
+    }
+
+    public function beginRedirect(
+        ProviderContext $context,
+        string $callbackUrl,
+        ?string $returnUrl = null,
+    ): ProviderResult {
+        return ProviderResult::failed();
+    }
+
+    public function completeRedirect(ProviderContext $context, array $params): ProviderResult
+    {
+        return ProviderResult::failed();
+    }
+}

tests/php/Unit/Service/FirewallLogServicesTest.php

@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Service;
+
+use KTXC\Context\IdentityContextInterface;
+use KTXC\Context\TenantContextInterface;
+use KTXC\Models\Firewall\FirewallLogObject;
+use KTXC\Service\FirewallLogService;
+use KTXC\Service\SystemFirewallLogService;
+use KTXC\Service\TenantFirewallLogService;
+use KTXC\Stores\FirewallStore;
+use PHPUnit\Framework\Attributes\AllowMockObjectsWithoutExpectations;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+#[AllowMockObjectsWithoutExpectations]
+final class FirewallLogServicesTest extends TestCase
+{
+    #[TestDox('Tenant log reads derive tenant ownership and validated filters')]
+    public function testTenantQuery(): void
+    {
+        $store = $this->createMock(FirewallStore::class);
+        $tenant = $this->createStub(TenantContextInterface::class);
+        $tenant->method('requireIdentifier')->willReturn('tenant-a');
+        $identity = $this->createStub(IdentityContextInterface::class);
+        $identity->method('hasPermission')->willReturn(true);
+        $store->expects(self::once())
+            ->method('queryTenantLogs')
+            ->with(
+                'tenant-a',
+                self::callback(static fn(array $filters): bool =>
+                    $filters['eventType'] === FirewallLogObject::EVENT_AUTH_FAILURE
+                    && $filters['from'] instanceof \DateTimeImmutable
+                ),
+                25,
+                10
+            )
+            ->willReturn(['items' => [], 'total' => 0, 'limit' => 25, 'offset' => 10]);
+        $service = new TenantFirewallLogService(new FirewallLogService($store), $tenant, $identity);
+
+        self::assertSame(0, $service->query([
+            'eventType' => FirewallLogObject::EVENT_AUTH_FAILURE,
+            'from' => '2026-08-01T00:00:00+00:00',
+        ], 25, 10)['total']);
+    }
+
+    #[TestDox('System log reads may filter one tenant without changing ownership')]
+    public function testSystemQuery(): void
+    {
+        $store = $this->createMock(FirewallStore::class);
+        $identity = $this->createStub(IdentityContextInterface::class);
+        $identity->method('hasPermission')->willReturn(true);
+        $store->expects(self::once())
+            ->method('querySystemLogs')
+            ->with('tenant-a', self::isArray(), 50, 0)
+            ->willReturn(['items' => [], 'total' => 0, 'limit' => 50, 'offset' => 0]);
+        $service = new SystemFirewallLogService(new FirewallLogService($store), $identity);
+
+        self::assertSame(0, $service->query('tenant-a', [], 50, 0)['total']);
+    }
+
+    #[TestDox('Log queries reject invalid filters before database access')]
+    public function testValidation(): void
+    {
+        $store = $this->createMock(FirewallStore::class);
+        $store->expects(self::never())->method('queryTenantLogs');
+        $query = new FirewallLogService($store);
+        $this->expectException(\InvalidArgumentException::class);
+
+        $query->tenant('tenant-a', ['ipAddress' => 'not-an-ip'], 50, 0);
+    }
+
+    #[TestDox('Log boundaries enforce dedicated read permissions')]
+    public function testPermissions(): void
+    {
+        $store = $this->createMock(FirewallStore::class);
+        $identity = $this->createStub(IdentityContextInterface::class);
+        $identity->method('hasPermission')->willReturn(false);
+        $tenant = $this->createStub(TenantContextInterface::class);
+        $store->expects(self::never())->method('queryTenantLogs');
+        $store->expects(self::never())->method('querySystemLogs');
+
+        try {
+            (new TenantFirewallLogService(new FirewallLogService($store), $tenant, $identity))->query([]);
+            self::fail('Tenant log read should be rejected.');
+        } catch (\RuntimeException $error) {
+            self::assertStringContainsString(TenantFirewallLogService::PERMISSION_READ, $error->getMessage());
+        }
+
+        $this->expectExceptionMessage(SystemFirewallLogService::PERMISSION_READ);
+        (new SystemFirewallLogService(new FirewallLogService($store), $identity))->query(null, []);
+    }
+}

tests/php/Unit/Service/FirewallRuleManagerTest.php

@@ -6,11 +6,19 @@ namespace KTXT\Unit\Service;
 
 use KTXC\Models\Firewall\FirewallRuleObject;
 use KTXC\Service\FirewallRuleCache;
+use KTXC\Service\FirewallRuleConflictException;
 use KTXC\Service\FirewallRuleManager;
 use KTXC\Service\FirewallRuleScope;
 use KTXC\Stores\FirewallStore;
 use KTXF\Event\EventDispatcherInterface;
-use KTXF\Event\SecurityEvent;
+use KTXC\Security\Event\FirewallRuleCreatedEvent;
+use KTXC\Security\Event\FirewallRuleDisabledEvent;
+use KTXC\Security\Event\FirewallRuleEnabledEvent;
+use KTXC\Security\Event\FirewallRuleExtendedEvent;
+use KTXC\Security\Event\FirewallRuleRemovedEvent;
+use KTXC\Security\Event\DeviceBlockedEvent;
+use KTXC\Security\Event\IpAllowedEvent;
+use KTXC\Security\Event\IpBlockedEvent;
 use PHPUnit\Framework\Attributes\AllowMockObjectsWithoutExpectations;
 use PHPUnit\Framework\Attributes\TestDox;
 use PHPUnit\Framework\MockObject\MockObject;
@@ -40,7 +48,10 @@ class FirewallRuleManagerTest extends TestCase
         $this->store->method('findExactIpRule')->willReturn(null);
         $this->store->expects($this->exactly(2))
             ->method('depositRule')
-            ->willReturnArgument(0);
+            ->willReturnCallback(static function (FirewallRuleObject $rule): FirewallRuleObject {
+                static $sequence = 0;
+                return $rule->setId('rule-' . ++$sequence);
+            });
 
         $tenant = $this->manager->blockIp(
             FirewallRuleScope::tenant('tenant-a'), '203.0.113.10', null, 'admin-a'
@@ -77,6 +88,100 @@ class FirewallRuleManagerTest extends TestCase
         );
     }
 
+    #[TestDox('Manual rule creation requires a reason before persistence')]
+    public function testManualReason(): void
+    {
+        $this->store->expects(self::never())->method('depositRule');
+        $this->expectException(\InvalidArgumentException::class);
+
+        $this->manager->createManualRule(
+            FirewallRuleScope::tenant('tenant-a'),
+            FirewallRuleObject::TYPE_IP,
+            FirewallRuleObject::ACTION_BLOCK,
+            '203.0.113.10',
+            '   ',
+            'admin-a'
+        );
+    }
+
+    #[TestDox('Blocking the current exact IP requires explicit confirmation')]
+    public function testCurrentIpSafeguard(): void
+    {
+        $this->store->expects(self::never())->method('depositRule');
+        try {
+            $this->manager->createManualRule(
+                FirewallRuleScope::tenant('tenant-a'),
+                FirewallRuleObject::TYPE_IP,
+                FirewallRuleObject::ACTION_BLOCK,
+                '2001:db8::1',
+                'Confirmed abuse',
+                'admin-a',
+                currentIp: '2001:0db8:0:0:0:0:0:1'
+            );
+            self::fail('Current IP block should require confirmation.');
+        } catch (FirewallRuleConflictException $error) {
+            self::assertSame('current_ip_confirmation_required', $error->conflictCode);
+        }
+    }
+
+    #[TestDox('CIDR rules covering the current IP require explicit confirmation')]
+    public function testCurrentIpCidrSafeguard(): void
+    {
+        $this->store->expects(self::never())->method('depositRule');
+        $this->expectException(FirewallRuleConflictException::class);
+
+        $this->manager->createManualRule(
+            FirewallRuleScope::system(),
+            FirewallRuleObject::TYPE_IP_RANGE,
+            FirewallRuleObject::ACTION_BLOCK,
+            '203.0.113.0/24',
+            'Network abuse',
+            'admin-a',
+            currentIp: '203.0.113.10'
+        );
+    }
+
+    #[TestDox('Confirmed current-IP blocks retain manual audit context')]
+    public function testConfirmedCurrentIpBlock(): void
+    {
+        $this->store->method('findExactIpRule')->willReturn(null);
+        $this->store->expects(self::once())
+            ->method('depositRule')
+            ->willReturnCallback(static fn(FirewallRuleObject $rule): FirewallRuleObject =>
+                $rule->setId('rule-confirmed')
+            );
+
+        $rule = $this->manager->createManualRule(
+            FirewallRuleScope::tenant('tenant-a'),
+            FirewallRuleObject::TYPE_IP,
+            FirewallRuleObject::ACTION_BLOCK,
+            '203.0.113.10',
+            'Emergency lockout',
+            'admin-a',
+            currentIp: '203.0.113.10',
+            confirmCurrentIp: true
+        );
+
+        self::assertSame('Emergency lockout', $rule->getReason());
+        self::assertSame(FirewallRuleManager::ORIGIN_MANUAL, $rule->getMetadata()['origin']);
+    }
+
+    #[TestDox('Manual creation rejects unsupported type and action combinations')]
+    public function testUnsupportedManualRule(): void
+    {
+        $this->store->expects(self::never())->method('depositRule');
+        $this->expectException(\InvalidArgumentException::class);
+
+        $this->manager->createManualRule(
+            FirewallRuleScope::tenant('tenant-a'),
+            FirewallRuleObject::TYPE_DEVICE,
+            FirewallRuleObject::ACTION_ALLOW,
+            'device-123',
+            'Trusted device',
+            'admin-a'
+        );
+    }
+
     #[TestDox('Rule lifecycle operations cannot cross scope ownership')]
     public function testOwnership(): void
     {
@@ -87,8 +192,65 @@ class FirewallRuleManagerTest extends TestCase
         $this->store->method('fetchRule')->willReturn($tenantRule);
         $this->store->expects($this->never())->method('destroyRule');
 
-        self::assertFalse($this->manager->remove(FirewallRuleScope::system(), 'tenant-rule'));
-        self::assertFalse($this->manager->remove(FirewallRuleScope::tenant('tenant-b'), 'tenant-rule'));
+        self::assertNull($this->manager->removeManual(
+            FirewallRuleScope::system(), 'tenant-rule', 'No longer required', 'operator'
+        ));
+        self::assertNull($this->manager->removeManual(
+            FirewallRuleScope::tenant('tenant-b'), 'tenant-rule', 'No longer required', 'operator'
+        ));
+    }
+
+    #[TestDox('Rule queries retain scope, filters, and bounded pagination')]
+    public function testRuleQuery(): void
+    {
+        $result = ['items' => [], 'total' => 0, 'limit' => 25, 'offset' => 50];
+        $this->store->expects(self::once())
+            ->method('queryRules')
+            ->with(
+                FirewallRuleObject::SCOPE_TENANT,
+                'tenant-a',
+                'disabled',
+                FirewallRuleObject::TYPE_IP,
+                FirewallRuleObject::ACTION_BLOCK,
+                25,
+                50
+            )
+            ->willReturn($result);
+
+        self::assertSame($result, $this->manager->query(
+            FirewallRuleScope::tenant('tenant-a'),
+            'disabled',
+            FirewallRuleObject::TYPE_IP,
+            FirewallRuleObject::ACTION_BLOCK,
+            25,
+            50
+        ));
+    }
+
+    #[TestDox('Rule queries reject invalid filters and excessive pages')]
+    public function testRuleQueryValidation(): void
+    {
+        $this->store->expects(self::never())->method('queryRules');
+        $this->expectException(\InvalidArgumentException::class);
+
+        $this->manager->query(FirewallRuleScope::system(), 'active', null, null, 101);
+    }
+
+    #[TestDox('Effective policy keeps system and tenant rule sets distinct')]
+    public function testEffectivePolicy(): void
+    {
+        $system = (new FirewallRuleObject())->setScope(FirewallRuleObject::SCOPE_SYSTEM);
+        $tenant = (new FirewallRuleObject())
+            ->setScope(FirewallRuleObject::SCOPE_TENANT)
+            ->setTenantId('tenant-a');
+        $this->store->method('listSystemRules')->willReturn([$system]);
+        $this->store->method('listRules')->with('tenant-a')->willReturn([$tenant]);
+
+        $policy = $this->manager->effectivePolicy('tenant-a');
+
+        self::assertSame([$system], $policy['system']);
+        self::assertSame([$tenant], $policy['tenant']);
+        self::assertSame('system_block', $policy['precedence'][0]);
     }
 
     #[TestDox('Rule mutations invalidate the shared enforcement cache')]
@@ -101,7 +263,9 @@ class FirewallRuleManagerTest extends TestCase
         $cache = new FirewallRuleCache($this->store);
         $manager = new FirewallRuleManager($this->store, $cache, $this->events);
         $this->store->method('findExactIpRule')->willReturn(null);
-        $this->store->method('depositRule')->willReturnArgument(0);
+        $this->store->method('depositRule')->willReturnCallback(
+            static fn(FirewallRuleObject $rule): FirewallRuleObject => $rule->setId('rule-cache')
+        );
 
         self::assertSame([], $cache->tenant('tenant-a'));
         $manager->blockIp(FirewallRuleScope::tenant('tenant-a'), '203.0.113.10', null, 'admin');
@@ -132,7 +296,7 @@ class FirewallRuleManagerTest extends TestCase
             300
         );
 
-        $audit = $events[SecurityEvent::FIREWALL_RULE_CREATED];
+        $audit = $events[FirewallRuleCreatedEvent::class];
         self::assertSame('rule-123', $audit->get('ruleId'));
         self::assertSame(FirewallRuleObject::SCOPE_TENANT, $audit->get('ruleScope'));
         self::assertSame(FirewallRuleObject::TYPE_IP, $audit->get('ruleType'));
@@ -140,32 +304,120 @@ class FirewallRuleManagerTest extends TestCase
         self::assertSame(FirewallRuleManager::ORIGIN_MANUAL, $audit->get('origin'));
         self::assertSame('admin-a', $audit->getIdentityId());
         self::assertNotNull($audit->get('expiresAt'));
+        self::assertInstanceOf(IpBlockedEvent::class, $events[IpBlockedEvent::class]);
+        self::assertSame('203.0.113.10', $events[IpBlockedEvent::class]->getIpAddress());
     }
 
-    #[TestDox('Disable and remove audits identify the acting administrator')]
-    public function testLifecycleActors(): void
+    #[TestDox('IP allowance and device blocking publish dedicated policy events')]
+    public function testSubjectPolicyEvents(): void
     {
+        $this->store->method('findExactIpRule')->willReturn(null);
+        $this->store->method('depositRule')->willReturnCallback(
+            static function (FirewallRuleObject $rule): FirewallRuleObject {
+                static $sequence = 0;
+                return $rule->setId('policy-rule-' . ++$sequence);
+            }
+        );
+        $events = [];
+        $this->events->expects($this->exactly(4))
+            ->method('dispatch')
+            ->willReturnCallback(static function (\KTXF\Event\Event $event) use (&$events): void {
+                $events[] = $event;
+            });
+
+        $this->manager->allowIp(
+            FirewallRuleScope::tenant('tenant-a'),
+            '203.0.113.11',
+            'Trusted service',
+            'admin-a',
+        );
+        $this->manager->blockDevice(
+            FirewallRuleScope::tenant('tenant-a'),
+            'device-a',
+            'Compromised device',
+            'admin-a',
+        );
+
+        self::assertCount(1, array_filter($events, static fn($event): bool => $event instanceof IpAllowedEvent));
+        self::assertCount(1, array_filter($events, static fn($event): bool => $event instanceof DeviceBlockedEvent));
+    }
+
+    #[TestDox('Manual lifecycle changes persist state, reasons, actors, and extension history')]
+    public function testManualLifecycle(): void
+    {
+        $originalExpiry = new \DateTimeImmutable('+5 minutes');
         $rule = (new FirewallRuleObject())
             ->setId('rule-123')
             ->setScope(FirewallRuleObject::SCOPE_SYSTEM)
-            ->setTenantId(null)
             ->setType(FirewallRuleObject::TYPE_IP)
             ->setAction(FirewallRuleObject::ACTION_BLOCK)
             ->setValue('203.0.113.10')
-            ->setCreatedBy('creator');
+            ->setEnabled(true)
+            ->setExpiresAt($originalExpiry)
+            ->setMetadata(['origin' => FirewallRuleManager::ORIGIN_MANUAL]);
         $this->store->method('fetchRule')->willReturn($rule);
-        $events = [];
-        $this->events->expects($this->exactly(2))
+        $this->store->expects(self::exactly(3))->method('depositRule')->willReturnArgument(0);
+        $this->store->expects(self::once())->method('destroyRule')->with($rule);
+        $audits = [];
+        $this->events->expects(self::exactly(4))
             ->method('dispatch')
-            ->willReturnCallback(static function (\KTXF\Event\Event $event) use (&$events): void {
-                $events[$event->getName()] = $event;
+            ->willReturnCallback(static function (\KTXF\Event\Event $event) use (&$audits): void {
+                $audits[] = $event;
             });
 
-        self::assertTrue($this->manager->disable(FirewallRuleScope::system(), 'rule-123', 'operator'));
-        self::assertTrue($this->manager->remove(FirewallRuleScope::system(), 'rule-123', 'operator'));
+        self::assertFalse($this->manager->disableManual(
+            FirewallRuleScope::system(), 'rule-123', 'Investigation', 'operator'
+        )->isEnabled());
+        self::assertTrue($this->manager->enableManual(
+            FirewallRuleScope::system(), 'rule-123', 'Threat confirmed', 'operator', '203.0.113.10', true
+        )->isEnabled());
+        $extended = $this->manager->extendManual(
+            FirewallRuleScope::system(), 'rule-123', 300, 'Continue monitoring', 'operator'
+        );
+        self::assertSame($rule, $this->manager->removeManual(
+            FirewallRuleScope::system(), 'rule-123', 'Case closed', 'operator'
+        ));
 
-        self::assertSame('operator', $events[SecurityEvent::FIREWALL_RULE_DISABLED]->getIdentityId());
-        self::assertSame('operator', $events[SecurityEvent::FIREWALL_RULE_REMOVED]->getIdentityId());
+        self::assertGreaterThan($originalExpiry, $extended->getExpiresAt());
+        self::assertCount(1, $extended->getMetadata()['extensions']);
+        self::assertSame([
+            FirewallRuleDisabledEvent::class,
+            FirewallRuleEnabledEvent::class,
+            FirewallRuleExtendedEvent::class,
+            FirewallRuleRemovedEvent::class,
+        ], array_map(static fn($event): string => $event->getName(), $audits));
+        self::assertSame(
+            ['Investigation', 'Threat confirmed', 'Continue monitoring', 'Case closed'],
+            array_map(static fn($event): string => $event->get('changeReason'), $audits)
+        );
+        self::assertSame(['operator'], array_values(array_unique(array_map(
+            static fn($event): ?string => $event->getIdentityId(),
+            $audits
+        ))));
+    }
+
+    #[TestDox('Manual lifecycle changes require reasons before reading or writing rules')]
+    public function testLifecycleReason(): void
+    {
+        $this->store->expects(self::never())->method('fetchRule');
+        $this->expectException(\InvalidArgumentException::class);
+
+        $this->manager->disableManual(FirewallRuleScope::system(), 'rule-123', ' ', 'operator');
+    }
+
+    #[TestDox('Permanent rules cannot be extended')]
+    public function testPermanentExtension(): void
+    {
+        $rule = (new FirewallRuleObject())
+            ->setId('rule-123')
+            ->setScope(FirewallRuleObject::SCOPE_SYSTEM);
+        $this->store->method('fetchRule')->willReturn($rule);
+        $this->store->expects(self::never())->method('depositRule');
+        $this->expectException(\InvalidArgumentException::class);
+
+        $this->manager->extendManual(
+            FirewallRuleScope::system(), 'rule-123', 300, 'Continue monitoring', 'operator'
+        );
     }
 
     #[TestDox('Continued attacks extend automatic blocks and retain their audit history')]
@@ -201,7 +453,7 @@ class FirewallRuleManagerTest extends TestCase
         $this->events->expects(self::once())
             ->method('dispatch')
             ->with(self::callback(static fn(\KTXF\Event\Event $event): bool =>
-                $event->getName() === SecurityEvent::FIREWALL_RULE_EXTENDED
+                $event instanceof FirewallRuleExtendedEvent
                 && $event->get('lastFailureCount') === 8
             ));
 

tests/php/Unit/Service/FirewallRuleServicesTest.php

@@ -57,6 +57,39 @@ class FirewallRuleServicesTest extends TestCase
         $this->systemService()->blockIp('203.0.113.10');
     }
 
+    #[TestDox('Read operations require their scope-specific permission')]
+    public function testReadPermissions(): void
+    {
+        $this->identity->method('hasPermission')->willReturn(false);
+        $this->store->expects(self::never())->method('queryRules');
+
+        try {
+            $this->tenantService()->queryRules();
+            self::fail('Tenant read should have been rejected.');
+        } catch (\RuntimeException $error) {
+            self::assertStringContainsString(TenantFirewallRuleService::PERMISSION_READ, $error->getMessage());
+        }
+
+        $this->expectExceptionMessage(SystemFirewallRuleService::PERMISSION_READ);
+        $this->systemService()->queryRules();
+    }
+
+    #[TestDox('Tenant reads derive ownership and effective policy from context')]
+    public function testTenantReads(): void
+    {
+        $this->allow(TenantFirewallRuleService::PERMISSION_READ);
+        $this->tenant->method('requireIdentifier')->willReturn('tenant-a');
+        $this->store->expects(self::once())
+            ->method('queryRules')
+            ->with(FirewallRuleObject::SCOPE_TENANT, 'tenant-a', 'active', null, null, 50, 0)
+            ->willReturn(['items' => [], 'total' => 0, 'limit' => 50, 'offset' => 0]);
+        $this->store->method('listSystemRules')->willReturn([]);
+        $this->store->method('listRules')->with('tenant-a')->willReturn([]);
+
+        self::assertSame(0, $this->tenantService()->queryRules()['total']);
+        self::assertSame([], $this->tenantService()->effectivePolicy()['system']);
+    }
+
     #[TestDox('Tenant management derives scope from tenant context')]
     public function testTenantScope(): void
     {
@@ -69,7 +102,9 @@ class FirewallRuleServicesTest extends TestCase
             ->with(self::callback(static fn(FirewallRuleObject $rule): bool =>
                 $rule->isTenantScoped() && $rule->getTenantId() === 'tenant-a'
             ))
-            ->willReturnArgument(0);
+            ->willReturnCallback(static fn(FirewallRuleObject $rule): FirewallRuleObject =>
+                $rule->setId('tenant-rule')
+            );
 
         $this->tenantService()->blockIp('203.0.113.10');
     }
@@ -84,11 +119,30 @@ class FirewallRuleServicesTest extends TestCase
             ->with(self::callback(static fn(FirewallRuleObject $rule): bool =>
                 $rule->isSystemScoped() && $rule->getTenantId() === null
             ))
-            ->willReturnArgument(0);
+            ->willReturnCallback(static fn(FirewallRuleObject $rule): FirewallRuleObject =>
+                $rule->setId('system-rule')
+            );
 
         $this->systemService()->blockIp('203.0.113.10');
     }
 
+    #[TestDox('Generic creation remains behind tenant and system management permissions')]
+    public function testGenericCreationPermissions(): void
+    {
+        $this->identity->method('hasPermission')->willReturn(false);
+        $this->store->expects(self::never())->method('depositRule');
+
+        try {
+            $this->tenantService()->createRule('ip', 'block', '203.0.113.10', 'Abuse');
+            self::fail('Tenant creation should have been rejected.');
+        } catch (\RuntimeException $error) {
+            self::assertStringContainsString(TenantFirewallRuleService::PERMISSION_MANAGE, $error->getMessage());
+        }
+
+        $this->expectExceptionMessage(SystemFirewallRuleService::PERMISSION_MANAGE);
+        $this->systemService()->createRule('ip', 'block', '203.0.113.10', 'Abuse');
+    }
+
     private function allow(string $permission): void
     {
         $this->identity->method('hasPermission')->with($permission)->willReturn(true);

tests/php/Unit/Service/FirewallServiceTest.php

@@ -5,9 +5,20 @@ declare(strict_types=1);
 namespace KTXT\Unit\Service;
 
 use KTXC\Context\TenantContextInterface;
+use KTXC\Http\Request\Request;
+use KTXC\Http\Request\RequestContext;
 use KTXC\Models\Firewall\FirewallRuleObject;
 use KTXC\Models\Firewall\FirewallLogObject;
 use KTXC\Models\Tenant\TenantConfiguration;
+use KTXC\Security\Event\AccessDeniedEvent;
+use KTXC\Security\Event\AuthenticationFailedEvent;
+use KTXC\Security\Event\AuthenticationSucceededEvent;
+use KTXC\Security\Event\BruteForceDetectedEvent;
+use KTXC\Security\Event\FirewallRuleCreatedEvent;
+use KTXC\Security\Event\FirewallRuleDisabledEvent;
+use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
+use KTXC\Security\Event\RateLimitExceededEvent;
+use KTXC\Security\Event\SuspiciousActivityEvent;
 use KTXC\Service\FirewallService;
 use KTXC\Service\FirewallRuleCache;
 use KTXC\Service\FirewallRuleManager;
@@ -24,6 +35,7 @@ class FirewallServiceTest extends TestCase
     private FirewallStore&MockObject $store;
     private TenantContextInterface&MockObject $tenantContext;
     private EventDispatcherInterface&MockObject $events;
+    private RequestContext $requestContext;
     private FirewallService $service;
     private ?string $currentTenant;
     private ?TenantConfiguration $currentConfiguration;
@@ -33,6 +45,16 @@ class FirewallServiceTest extends TestCase
         $this->store = $this->createMock(FirewallStore::class);
         $this->tenantContext = $this->createMock(TenantContextInterface::class);
         $this->events = $this->createMock(EventDispatcherInterface::class);
+        $this->requestContext = new RequestContext();
+        $this->requestContext->initialize(Request::create(
+            '/login',
+            'POST',
+            server: [
+                'REMOTE_ADDR' => '203.0.113.10',
+                'HTTP_USER_AGENT' => 'Test Agent',
+                'HTTP_X_DEVICE_FINGERPRINT' => 'device-a',
+            ],
+        ));
         $this->currentTenant = 'tenant-a';
         $this->currentConfiguration = null;
         $this->tenantContext->method('identifier')->willReturnCallback(
@@ -48,7 +70,8 @@ class FirewallServiceTest extends TestCase
             $this->tenantContext,
             $this->events,
             $manager,
-            $cache
+            $cache,
+            $this->requestContext,
         );
     }
 
@@ -70,7 +93,15 @@ class FirewallServiceTest extends TestCase
 
         $this->store->expects($this->once())->method('listSystemRules')->willReturn([$systemBlock]);
         $this->store->expects($this->once())->method('listRules')->with('tenant-a')->willReturn([$tenantAllow]);
-        $this->events->expects($this->once())->method('dispatch');
+        $this->events->expects($this->once())
+            ->method('dispatch')
+            ->with(self::callback(static function ($event): bool {
+                return $event instanceof AccessDeniedEvent
+                    && $event->getIpAddress() === '203.0.113.10'
+                    && $event->getRuleId() === 'system-block'
+                    && $event->getRuleScope() === FirewallRuleObject::SCOPE_SYSTEM
+                    && $event->getReason() === 'system-block';
+            }));
 
         $result = $this->service->analyze('203.0.113.10');
 
@@ -210,14 +241,13 @@ class FirewallServiceTest extends TestCase
                     && $log->getEventType() === FirewallLogObject::EVENT_RULE_MATCH;
             }))
             ->willReturnArgument(0);
-        $event = \KTXF\Event\SecurityEvent::accessDenied(
-            '203.0.113.10',
-            null,
-            'tenant-rule',
-            FirewallRuleObject::SCOPE_TENANT,
-            'Tenant block'
+        $event = new AccessDeniedEvent(
+            ipAddress: '203.0.113.10',
+            ruleId: 'tenant-rule',
+            ruleScope: FirewallRuleObject::SCOPE_TENANT,
+            reason: 'Tenant block',
+            tenantId: 'tenant-a',
         );
-        $event->setTenantId('tenant-a');
 
         $this->service->logSecurityEvent($event);
     }
@@ -234,12 +264,11 @@ class FirewallServiceTest extends TestCase
                     && $log->getRuleScope() === FirewallRuleObject::SCOPE_SYSTEM;
             }))
             ->willReturnArgument(0);
-        $event = \KTXF\Event\SecurityEvent::accessDenied(
-            '203.0.113.10',
-            null,
-            'system-rule',
-            FirewallRuleObject::SCOPE_SYSTEM,
-            'System block'
+        $event = new AccessDeniedEvent(
+            ipAddress: '203.0.113.10',
+            ruleId: 'system-rule',
+            ruleScope: FirewallRuleObject::SCOPE_SYSTEM,
+            reason: 'System block',
         );
 
         $this->service->logSecurityEvent($event);
@@ -252,7 +281,7 @@ class FirewallServiceTest extends TestCase
         $this->store->expects($this->never())->method('createLog');
 
         $this->service->logSecurityEvent(
-            \KTXF\Event\SecurityEvent::authFailure('203.0.113.10')
+            new AuthenticationFailedEvent()
         );
     }
 
@@ -271,17 +300,36 @@ class FirewallServiceTest extends TestCase
                     && $metadata['windowSeconds'] === 60;
             }))
             ->willReturnArgument(0);
-        $event = \KTXF\Event\SecurityEvent::rateLimitExceeded(
+        $event = new RateLimitExceededEvent(
             '203.0.113.10',
             101,
             60,
-            '/login'
+            '/login',
+            'tenant-a',
         );
-        $event->setTenantId('tenant-a');
 
         $this->service->logSecurityEvent($event);
     }
 
+    #[TestDox('Successful authentication maps to an allowed access log')]
+    public function testAuthenticationSuccessAudit(): void
+    {
+        $this->store->expects($this->once())
+            ->method('createLog')
+            ->with(self::callback(static function (FirewallLogObject $log): bool {
+                return $log->getEventType() === FirewallLogObject::EVENT_ACCESS_CHECK
+                    && $log->getResult() === FirewallLogObject::RESULT_ALLOWED
+                    && $log->getIpAddress() === '203.0.113.10'
+                    && $log->getIdentityId() === 'user-a';
+            }))
+            ->willReturnArgument(0);
+
+        $this->service->logAuthenticationSuccess(new AuthenticationSucceededEvent(
+            'user-a',
+            'tenant-a',
+        ));
+    }
+
     #[TestDox('Suspicious-activity events retain request and detection metadata')]
     public function testSuspiciousActivityAudit(): void
     {
@@ -296,15 +344,13 @@ class FirewallServiceTest extends TestCase
                     && $log->getMetadata()['detector'] === 'payload-signature';
             }))
             ->willReturnArgument(0);
-        $event = \KTXF\Event\SecurityEvent::create(
-            \KTXF\Event\SecurityEvent::SUSPICIOUS_ACTIVITY,
-            '203.0.113.20',
-            null,
-            ['detector' => 'payload-signature']
+        $event = new SuspiciousActivityEvent(
+            ipAddress: '203.0.113.20',
+            detector: 'payload-signature',
+            tenantId: 'tenant-a',
+            requestPath: '/admin',
+            requestMethod: 'POST',
         );
-        $event->setTenantId('tenant-a')
-            ->setRequestPath('/admin')
-            ->setRequestMethod('POST');
 
         $this->service->logSecurityEvent($event);
     }
@@ -323,15 +369,40 @@ class FirewallServiceTest extends TestCase
                     && $log->getIdentityId() === 'operator';
             }))
             ->willReturnArgument(0);
-        $event = new \KTXF\Event\SecurityEvent(
-            \KTXF\Event\SecurityEvent::FIREWALL_RULE_DISABLED,
-            [
-                'ruleId' => 'rule-123',
-                'ruleScope' => FirewallRuleObject::SCOPE_SYSTEM,
-                'origin' => FirewallRuleManager::ORIGIN_MANUAL,
-            ]
+        $event = FirewallRuleDisabledEvent::fromRule(
+            (new FirewallRuleObject())
+                ->setId('rule-123')
+                ->setScope(FirewallRuleObject::SCOPE_SYSTEM)
+                ->setType(FirewallRuleObject::TYPE_IP)
+                ->setAction(FirewallRuleObject::ACTION_BLOCK)
+                ->setValue('203.0.113.10')
+                ->setMetadata(['origin' => FirewallRuleManager::ORIGIN_MANUAL]),
+            'operator',
+        );
+
+        $this->service->logSecurityEvent($event);
+    }
+
+    #[TestDox('Settings changes map to recorded tenant audit entries')]
+    public function testSettingsAudit(): void
+    {
+        $this->store->expects(self::once())
+            ->method('createLog')
+            ->with(self::callback(static fn(FirewallLogObject $log): bool =>
+                $log->getEventType() === FirewallLogObject::EVENT_SETTINGS_UPDATED
+                && $log->getResult() === FirewallLogObject::RESULT_RECORDED
+                && $log->getTenantId() === 'tenant-a'
+                && $log->getIdentityId() === 'operator'
+                && $log->getMetadata()['changeReason'] === 'Tighten controls'
+            ))
+            ->willReturnArgument(0);
+        $event = new FirewallSettingsUpdatedEvent(
+            changeReason: 'Tighten controls',
+            previous: ['maxAuthFailures' => 5],
+            current: ['maxAuthFailures' => 3],
+            tenantId: 'tenant-a',
+            actorId: 'operator',
         );
-        $event->setIdentityId('operator');
 
         $this->service->logSecurityEvent($event);
     }
@@ -354,14 +425,53 @@ class FirewallServiceTest extends TestCase
             ->willReturn(4);
         $this->events->expects($this->never())->method('dispatch');
 
-        $event = \KTXF\Event\SecurityEvent::authFailure('203.0.113.10');
-        $event->setTenantId('tenant-a');
+        $event = new AuthenticationFailedEvent(tenantId: 'tenant-a');
         $this->service->handleAuthFailure($event);
 
         self::assertSame(8, $this->currentConfiguration->firewall()->maxAuthFailures());
         self::assertSame(7200, $this->currentConfiguration->firewall()->autoBlockDuration());
     }
 
+    #[TestDox('Authentication failures combine event facts with the current request')]
+    public function testAuthenticationFailureRequestContext(): void
+    {
+        $this->store->expects($this->once())
+            ->method('createLogOnce')
+            ->with(self::callback(static function (FirewallLogObject $log): bool {
+                return $log->getIpAddress() === '203.0.113.10'
+                    && $log->getDeviceFingerprint() === 'device-a'
+                    && $log->getUserAgent() === 'Test Agent'
+                    && $log->getRequestPath() === '/login'
+                    && $log->getRequestMethod() === 'POST'
+                    && $log->getIdentityId() === 'user-a'
+                    && $log->getMetadata()['reason'] === 'invalid_credentials';
+            }))
+            ->willReturn(true);
+        $this->store->expects($this->once())
+            ->method('countRecentFailures')
+            ->with('tenant-a', '203.0.113.10', 300)
+            ->willReturn(0);
+
+        $this->service->handleAuthFailure(new AuthenticationFailedEvent(
+            userId: 'user-a',
+            reason: 'invalid_credentials',
+            tenantId: 'tenant-a',
+        ));
+    }
+
+    #[TestDox('Authentication failures outside HTTP request context are ignored')]
+    public function testAuthenticationFailureWithoutRequestContext(): void
+    {
+        $this->requestContext->clear();
+        $this->store->expects($this->never())->method('createLogOnce');
+        $this->store->expects($this->never())->method('countRecentFailures');
+
+        $this->service->handleAuthFailure(new AuthenticationFailedEvent(
+            reason: 'invalid_credentials',
+            tenantId: 'tenant-a',
+        ));
+    }
+
     #[TestDox('Unsafe numeric firewall settings fall back to safe defaults')]
     public function testConfigurationBounds(): void
     {
@@ -378,8 +488,7 @@ class FirewallServiceTest extends TestCase
             ->with('tenant-a', '203.0.113.10', 300)
             ->willReturn(0);
 
-        $event = \KTXF\Event\SecurityEvent::authFailure('203.0.113.10');
-        $event->setTenantId('tenant-a');
+        $event = new AuthenticationFailedEvent(tenantId: 'tenant-a');
         $this->service->handleAuthFailure($event);
     }
 
@@ -416,27 +525,37 @@ class FirewallServiceTest extends TestCase
                     && $metadata['lastFailureCount'] === 5
                     && $metadata['blockDurationSeconds'] === 3600;
             }))
-            ->willReturnArgument(0);
+            ->willReturnCallback(static fn(FirewallRuleObject $rule): FirewallRuleObject =>
+                $rule->setId('automatic-rule')
+            );
 
         $publishedTenants = [];
         $lifecycleOrigin = null;
+        $bruteForceEvent = null;
         $this->events->expects($this->exactly(3))
             ->method('dispatch')
             ->willReturnCallback(static function (\KTXF\Event\Event $event) use (
                 &$publishedTenants,
-                &$lifecycleOrigin
+                &$lifecycleOrigin,
+                &$bruteForceEvent,
             ): void {
                 $publishedTenants[] = $event->getTenantId();
-                if ($event->getName() === \KTXF\Event\SecurityEvent::FIREWALL_RULE_CREATED) {
+                if ($event instanceof BruteForceDetectedEvent) {
+                    $bruteForceEvent = $event;
+                }
+                if ($event instanceof FirewallRuleCreatedEvent) {
                     $lifecycleOrigin = $event->get('origin');
                 }
             });
 
-        $event = \KTXF\Event\SecurityEvent::authFailure('203.0.113.10');
-        $event->setTenantId('tenant-event');
+        $event = new AuthenticationFailedEvent(tenantId: 'tenant-event');
         $this->service->handleAuthFailure($event);
 
         self::assertSame(['tenant-event', 'tenant-event', 'tenant-event'], $publishedTenants);
+        self::assertInstanceOf(BruteForceDetectedEvent::class, $bruteForceEvent);
+        self::assertSame('203.0.113.10', $bruteForceEvent->getIpAddress());
+        self::assertSame(5, $bruteForceEvent->getFailureCount());
+        self::assertSame(300, $bruteForceEvent->getWindowSeconds());
         self::assertSame(FirewallRuleManager::ORIGIN_AUTOMATIC, $lifecycleOrigin);
     }
 
@@ -456,7 +575,7 @@ class FirewallServiceTest extends TestCase
         $this->events->expects($this->never())->method('dispatch');
 
         $this->service->handleAuthFailure(
-            \KTXF\Event\SecurityEvent::authFailure('203.0.113.10')
+            new AuthenticationFailedEvent()
         );
     }
 
@@ -470,7 +589,7 @@ class FirewallServiceTest extends TestCase
             ->willReturn(0);
 
         $this->service->handleAuthFailure(
-            \KTXF\Event\SecurityEvent::authFailure('203.0.113.10')
+            new AuthenticationFailedEvent()
         );
     }
 
@@ -482,7 +601,7 @@ class FirewallServiceTest extends TestCase
         $this->store->expects($this->never())->method('depositRule');
 
         $this->service->handleAuthFailure(
-            \KTXF\Event\SecurityEvent::authFailure('203.0.113.10')
+            new AuthenticationFailedEvent()
         );
     }
 
@@ -496,7 +615,7 @@ class FirewallServiceTest extends TestCase
             ->method('countRecentFailures')
             ->with('tenant-a', '203.0.113.10', 300)
             ->willReturn(1);
-        $event = \KTXF\Event\SecurityEvent::authFailure('203.0.113.10');
+        $event = new AuthenticationFailedEvent();
         $eventId = $event->getEventId();
 
         $this->service->handleAuthFailure($event);

tests/php/Unit/Service/FirewallSettingsServiceTest.php

@@ -0,0 +1,86 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Service;
+
+use KTXC\Models\Tenant\TenantConfiguration;
+use KTXC\Models\Tenant\TenantObject;
+use KTXC\Service\FirewallSettingsService;
+use KTXC\Service\TenantService;
+use KTXF\Event\EventDispatcherInterface;
+use KTXC\Security\Event\FirewallSettingsUpdatedEvent;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class FirewallSettingsServiceTest extends TestCase
+{
+    #[TestDox('Settings updates preserve other tenant configuration and emit complete audit context')]
+    public function testUpdate(): void
+    {
+        $tenant = (new TenantObject())
+            ->setId('507f1f77bcf86cd799439011')
+            ->setIdentifier('tenant-a')
+            ->setConfiguration((new TenantConfiguration())->jsonDeserialize([
+                'firewall' => ['enabled' => true, 'maxAuthFailures' => 5],
+                'security' => ['code' => 'preserved'],
+            ]));
+        $tenants = $this->createMock(TenantService::class);
+        $tenants->method('fetchById')->with('tenant-a')->willReturn($tenant);
+        $tenants->expects(self::once())
+            ->method('deposit')
+            ->with(self::callback(static fn(TenantObject $updated): bool =>
+                $updated->getConfiguration()->firewall()->maxAuthFailures() === 8
+                && $updated->getConfiguration()->security()->jsonSerialize()['code'] === 'preserved'
+            ))
+            ->willReturnArgument(0);
+        $events = $this->createMock(EventDispatcherInterface::class);
+        $events->expects(self::once())
+            ->method('dispatch')
+            ->with(self::callback(static fn(FirewallSettingsUpdatedEvent $event): bool =>
+                $event->getName() === FirewallSettingsUpdatedEvent::class
+                && $event->getTenantId() === 'tenant-a'
+                && $event->getIdentityId() === 'admin-a'
+                && $event->get('changeReason') === 'Tighten authentication controls'
+                && $event->get('previous')['maxAuthFailures'] === 5
+                && $event->get('current')['maxAuthFailures'] === 8
+            ));
+
+        $result = (new FirewallSettingsService($tenants, $events))->update(
+            'tenant-a', false, 8, 600, 7200, 'Tighten authentication controls', 'admin-a'
+        );
+
+        self::assertSame([
+            'enabled' => false,
+            'maxAuthFailures' => 8,
+            'authFailureWindow' => 600,
+            'autoBlockDuration' => 7200,
+        ], $result);
+    }
+
+    #[TestDox('Invalid settings are rejected before tenant reads or persistence')]
+    public function testValidation(): void
+    {
+        $tenants = $this->createMock(TenantService::class);
+        $tenants->expects(self::never())->method('fetchById');
+        $tenants->expects(self::never())->method('deposit');
+        $this->expectException(\InvalidArgumentException::class);
+
+        (new FirewallSettingsService(
+            $tenants,
+            $this->createStub(EventDispatcherInterface::class)
+        ))->update('tenant-a', true, 0, 300, 3600, 'Invalid threshold', 'admin-a');
+    }
+
+    #[TestDox('Unknown tenants return no configuration without emitting audit events')]
+    public function testMissingTenant(): void
+    {
+        $tenants = $this->createStub(TenantService::class);
+        $events = $this->createMock(EventDispatcherInterface::class);
+        $events->expects(self::never())->method('dispatch');
+
+        self::assertNull((new FirewallSettingsService($tenants, $events))->update(
+            'missing', true, 5, 300, 3600, 'Apply defaults', 'admin-a'
+        ));
+    }
+}

tests/php/Unit/Service/FirewallStatusServicesTest.php

@@ -0,0 +1,121 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Service;
+
+use KTXC\Context\IdentityContextInterface;
+use KTXC\Context\TenantContextInterface;
+use KTXC\Models\Tenant\TenantConfiguration;
+use KTXC\Service\FirewallStatusService;
+use KTXC\Service\FirewallSettingsService;
+use KTXC\Service\SystemFirewallLogService;
+use KTXC\Service\SystemFirewallStatusService;
+use KTXC\Service\TenantFirewallLogService;
+use KTXC\Service\TenantFirewallStatusService;
+use KTXC\Service\TenantService;
+use KTXC\Stores\FirewallStore;
+use KTXF\Event\EventDispatcherInterface;
+use PHPUnit\Framework\Attributes\AllowMockObjectsWithoutExpectations;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+#[AllowMockObjectsWithoutExpectations]
+final class FirewallStatusServicesTest extends TestCase
+{
+    #[TestDox('Tenant metrics and configuration derive their tenant context')]
+    public function testTenantStatus(): void
+    {
+        $store = $this->createMock(FirewallStore::class);
+        $tenant = $this->createStub(TenantContextInterface::class);
+        $tenant->method('requireIdentifier')->willReturn('tenant-a');
+        $tenant->method('configuration')->willReturn(
+            (new TenantConfiguration())->jsonDeserialize([
+                'firewall' => ['enabled' => false, 'maxAuthFailures' => 8],
+            ])
+        );
+        $identity = $this->createStub(IdentityContextInterface::class);
+        $identity->method('hasPermission')->willReturn(true);
+        $store->expects(self::once())
+            ->method('countBlockedRequests')
+            ->with('tenant-a', self::isInstanceOf(\DateTimeImmutable::class))
+            ->willReturn(7);
+        $service = new TenantFirewallStatusService(
+            new FirewallStatusService($store), $tenant, $identity, $this->settings()
+        );
+
+        self::assertSame(7, $service->metrics('2026-08-01T00:00:00+00:00')['blockedRequests']);
+        self::assertFalse($service->configuration()['enabled']);
+        self::assertSame(8, $service->configuration()['maxAuthFailures']);
+    }
+
+    #[TestDox('System metrics and maintenance status expose operational state')]
+    public function testSystemStatus(): void
+    {
+        $store = $this->createMock(FirewallStore::class);
+        $identity = $this->createStub(IdentityContextInterface::class);
+        $identity->method('hasPermission')->willReturn(true);
+        $store->expects(self::once())
+            ->method('countSystemBlockedRequests')
+            ->with('tenant-a', null)
+            ->willReturn(12);
+        $store->method('maintenanceStatus')->willReturn(['status' => 'success']);
+        $service = new SystemFirewallStatusService(
+            new FirewallStatusService($store), $identity, $this->settings()
+        );
+
+        self::assertSame(12, $service->metrics('tenant-a')['blockedRequests']);
+        self::assertSame('success', $service->maintenanceStatus()['status']);
+    }
+
+    #[TestDox('Maintenance reports an explicit state before its first run')]
+    public function testNeverRunStatus(): void
+    {
+        $store = $this->createStub(FirewallStore::class);
+
+        self::assertSame('never_run', (new FirewallStatusService($store))->maintenanceStatus()['status']);
+    }
+
+    #[TestDox('Status reads require their dedicated permissions')]
+    public function testPermissions(): void
+    {
+        $store = $this->createMock(FirewallStore::class);
+        $identity = $this->createStub(IdentityContextInterface::class);
+        $identity->method('hasPermission')->willReturn(false);
+        $tenant = $this->createStub(TenantContextInterface::class);
+        $store->expects(self::never())->method('countBlockedRequests');
+        $store->expects(self::never())->method('maintenanceStatus');
+
+        try {
+            (new TenantFirewallStatusService(
+                new FirewallStatusService($store), $tenant, $identity, $this->settings()
+            ))->metrics();
+            self::fail('Tenant metrics should be rejected.');
+        } catch (\RuntimeException $error) {
+            self::assertStringContainsString(TenantFirewallLogService::PERMISSION_READ, $error->getMessage());
+        }
+
+        $this->expectExceptionMessage(SystemFirewallStatusService::PERMISSION_MAINTENANCE_READ);
+        (new SystemFirewallStatusService(
+            new FirewallStatusService($store), $identity, $this->settings()
+        ))->maintenanceStatus();
+    }
+
+    #[TestDox('Metrics reject invalid dates before querying storage')]
+    public function testMetricValidation(): void
+    {
+        $store = $this->createMock(FirewallStore::class);
+        $store->expects(self::never())->method('countSystemBlockedRequests');
+        $this->expectException(\InvalidArgumentException::class);
+
+        (new FirewallStatusService($store))->systemMetrics(null, 'not-a-date');
+    }
+
+    private function settings(): FirewallSettingsService
+    {
+        return new FirewallSettingsService(
+            $this->createStub(TenantService::class),
+            $this->createStub(EventDispatcherInterface::class)
+        );
+    }
+}

tests/php/Unit/Service/UserAccountsServiceTest.php

@@ -0,0 +1,191 @@
+<?php
+
+declare(strict_types=1);
+
+namespace KTXT\Unit\Service;
+
+use KTXC\Context\IdentityContextInterface;
+use KTXC\Context\TenantContextInterface;
+use KTXC\Service\UserAccountsService;
+use KTXC\Stores\UserAccountsStore;
+use KTXC\User\Event\UserCreatedEvent;
+use KTXC\User\Event\UserDeletingEvent;
+use KTXC\User\Event\UserUpdatedEvent;
+use KTXF\Event\EventDispatcherInterface;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+final class UserAccountsServiceTest extends TestCase
+{
+    #[Test]
+    #[TestDox('Successful user creation and deletion emit complete lifecycle events')]
+    public function emitsLifecycleEvents(): void
+    {
+        $user = [
+            'uid' => 'user-a',
+            'identity' => 'person@example.test',
+            'label' => 'Person',
+            'enabled' => true,
+            'roles' => ['member'],
+        ];
+
+        $tenant = $this->createStub(TenantContextInterface::class);
+        $tenant->method('requireIdentifier')->willReturn('tenant-a');
+        $identity = $this->createStub(IdentityContextInterface::class);
+        $identity->method('identifier')->willReturn('actor-a');
+        $store = $this->createMock(UserAccountsStore::class);
+        $store->expects($this->once())
+            ->method('createUser')
+            ->with('tenant-a', ['identity' => 'person@example.test'])
+            ->willReturn($user);
+        $store->expects($this->once())
+            ->method('fetchByIdentifier')
+            ->with('tenant-a', 'user-a')
+            ->willReturn($user);
+        $operations = [];
+        $store->expects($this->once())
+            ->method('deleteUser')
+            ->with('tenant-a', 'user-a')
+            ->willReturnCallback(static function () use (&$operations): bool {
+                $operations[] = 'delete';
+                return true;
+            });
+
+        $emitted = [];
+        $events = $this->createMock(EventDispatcherInterface::class);
+        $events->expects($this->exactly(2))
+            ->method('dispatch')
+            ->willReturnCallback(static function ($event) use (&$emitted, &$operations): void {
+                $emitted[] = $event;
+                if ($event instanceof UserDeletingEvent) {
+                    $operations[] = 'event';
+                }
+            });
+
+        $service = new UserAccountsService($tenant, $identity, $store, $events);
+
+        self::assertSame($user, $service->createUser(['identity' => 'person@example.test']));
+        self::assertTrue($service->deleteUser('user-a'));
+        self::assertInstanceOf(UserCreatedEvent::class, $emitted[0]);
+        self::assertInstanceOf(UserDeletingEvent::class, $emitted[1]);
+        self::assertSame('actor-a', $emitted[0]->actorIdentifier());
+        self::assertSame('tenant-a', $emitted[1]->getTenantId());
+        self::assertSame(['event', 'delete'], $operations);
+    }
+
+    #[Test]
+    #[TestDox('Deleting event precedes a failed persistence attempt')]
+    public function emitsBeforeFailedDeletion(): void
+    {
+        $store = $this->createStub(UserAccountsStore::class);
+        $store->method('fetchByIdentifier')->willReturn([
+            'uid' => 'user-a',
+            'identity' => 'person@example.test',
+        ]);
+        $store->method('deleteUser')->willReturn(false);
+        $events = $this->createMock(EventDispatcherInterface::class);
+        $events->expects($this->once())
+            ->method('dispatch')
+            ->with(self::isInstanceOf(UserDeletingEvent::class));
+
+        $tenant = $this->createStub(TenantContextInterface::class);
+        $tenant->method('requireIdentifier')->willReturn('tenant-a');
+        $service = new UserAccountsService(
+            $tenant,
+            $this->createStub(IdentityContextInterface::class),
+            $store,
+            $events,
+        );
+
+        self::assertFalse($service->deleteUser('user-a'));
+    }
+
+    #[Test]
+    #[TestDox('Successful updates emit the persisted user snapshot after storage')]
+    public function emitsAfterSuccessfulUpdate(): void
+    {
+        $updatedUser = [
+            'uid' => 'user-a',
+            'identity' => 'person@example.test',
+            'label' => 'Updated Person',
+            'enabled' => true,
+            'roles' => ['admin'],
+        ];
+        $operations = [];
+        $store = $this->createMock(UserAccountsStore::class);
+        $store->expects($this->once())
+            ->method('updateUser')
+            ->with('tenant-a', 'user-a', ['label' => 'Updated Person'])
+            ->willReturnCallback(static function () use (&$operations): bool {
+                $operations[] = 'update';
+                return true;
+            });
+        $store->expects($this->once())
+            ->method('fetchByIdentifier')
+            ->with('tenant-a', 'user-a')
+            ->willReturnCallback(static function () use (&$operations, $updatedUser): array {
+                $operations[] = 'fetch';
+                return $updatedUser;
+            });
+        $events = $this->createMock(EventDispatcherInterface::class);
+        $events->expects($this->once())
+            ->method('dispatch')
+            ->with(self::callback(static function ($event) use (&$operations): bool {
+                $operations[] = 'event';
+                return $event instanceof UserUpdatedEvent
+                    && $event->userLabel() === 'Updated Person'
+                    && $event->userRoles() === ['admin'];
+            }));
+        $tenant = $this->createStub(TenantContextInterface::class);
+        $tenant->method('requireIdentifier')->willReturn('tenant-a');
+        $identity = $this->createStub(IdentityContextInterface::class);
+        $identity->method('identifier')->willReturn('actor-a');
+        $service = new UserAccountsService($tenant, $identity, $store, $events);
+
+        self::assertTrue($service->updateUser('user-a', ['label' => 'Updated Person']));
+        self::assertSame(['update', 'fetch', 'event'], $operations);
+    }
+
+    #[Test]
+    #[TestDox('Unchanged users do not emit an updated event')]
+    public function ignoresUnchangedUser(): void
+    {
+        $store = $this->createMock(UserAccountsStore::class);
+        $store->expects($this->once())->method('updateUser')->willReturn(false);
+        $store->expects($this->never())->method('fetchByIdentifier');
+        $events = $this->createMock(EventDispatcherInterface::class);
+        $events->expects($this->never())->method('dispatch');
+        $tenant = $this->createStub(TenantContextInterface::class);
+        $tenant->method('requireIdentifier')->willReturn('tenant-a');
+        $service = new UserAccountsService(
+            $tenant,
+            $this->createStub(IdentityContextInterface::class),
+            $store,
+            $events,
+        );
+
+        self::assertFalse($service->updateUser('user-a', ['label' => 'Person']));
+    }
+
+    #[Test]
+    #[TestDox('Missing users do not emit a deleting event')]
+    public function ignoresMissingUser(): void
+    {
+        $store = $this->createStub(UserAccountsStore::class);
+        $store->method('fetchByIdentifier')->willReturn(null);
+        $events = $this->createMock(EventDispatcherInterface::class);
+        $events->expects($this->never())->method('dispatch');
+
+        $tenant = $this->createStub(TenantContextInterface::class);
+        $tenant->method('requireIdentifier')->willReturn('tenant-a');
+        $service = new UserAccountsService(
+            $tenant,
+            $this->createStub(IdentityContextInterface::class),
+            $store,
+            $events,
+        );
+
+        self::assertFalse($service->deleteUser('missing'));
+    }
+}