Client block: optional back-channel logout path for native Clients #460

What to build

Chapter 17's client block gains an optional backChannelLogoutPath for native Clients: a path on the Client's host that receives an OpenID Connect back-channel logout token. The rendered Client object carries it as backChannelLogoutUri, built as https:// + host + the path, the same way redirectUris is built from redirectPaths.

When a person signs out of any app, or an Admin signs them out, the Identity Provider posts a logout token to every native Client the ended session signed into that declares this URI (identity ADR 0007). Without the field in the authoring format, no Application can opt in.

Contract on the identity side

The Client CRD already accepts backChannelLogoutUri (JorisJonkers-dev/identity, sign-out everywhere). Its CEL rules require:

• only on signIn: native;
• https:// on the Client's own host.

So the renderer needs no checks of its own beyond refusing the field on gated and token Clients, with an error code next to the existing E_CLIENT_* ones.

Acceptance criteria

• backChannelLogoutPath is documented in the field table of spec/v1/17-sign-in.md, native only, optional.
• The render maps it to backChannelLogoutUri on the Client object.
• A gated or token Client that declares it is refused with a named error.

Blocked by

None (can start immediately).