diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 39e0acf..87329a6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -67,7 +67,7 @@ jobs:
       - name: Install package with dev extras
         run: |
           python -m pip install --upgrade pip
-          python -m pip install -e .[dev]
+          python -m pip install -e .[dev,atlassian]
 
       - name: Run tests
         run: python -m pytest -q
diff --git a/.rac/config.yaml b/.rac/config.yaml
index 998cc13..d2554c3 100644
--- a/.rac/config.yaml
+++ b/.rac/config.yaml
@@ -1 +1,8 @@
 repository_key: LCON
+
+# External ticketing provider (ADR-087, ADR-093). Roadmap intent lives in the
+# corpus; execution is tracked in GitHub issues, linked from a live artifact's
+# `## Related Tickets` section. `rac validate` format-lints those references as
+# `owner/repo#123` or a URL — offline; the engine never fetches issue state.
+ticketing:
+  provider: github
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e767439..7d272df 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,32 @@ All notable changes to `rac-connectors` are recorded here. Versions are CalVer
 (`YYYY.M.N`, ADR-008); the version is derived from the git tag by setuptools-scm,
 and the published distribution is `rac-connectors`.
 
+## Unreleased
+
+The Atlassian suite connector — Jira + Confluence (rac-core ADR-090), the
+first export-direction integration. Release gate: the docs page's live
+smoke test against a real Cloud site (itsthelore/rac-connectors#10).
+
+### Added
+
+- The `atlassian` module and the nested CLI verbs: `rac-connect atlassian
+  verify` (read-only Jira `related_tickets` existence/state checks over
+  `rac export --graph`, exit 3 on findings — the CI gate; ADR-010) and
+  `rac-connect atlassian publish` (idempotent managed Confluence pages over
+  `rac export --documents`, keyed by the `lore.artifact_id` content
+  property with body-hash skip and conflict surfacing; ADR-011).
+- The `[atlassian]` extra — an internal `httpx` client (no Atlassian SDK)
+  with Basic auth from `ATLASSIAN_*` environment variables and capped,
+  jittered backoff honouring `Retry-After`.
+- The `TicketVerifier` / `PagePublisher` seams and `VerifySummary` beside
+  the existing `Connector` / `GraphConnector` shapes (ADR-010).
+
+### Changed
+
+- The graph reader now surfaces the export's `external` / `provider` edge
+  markers (rac-core ADR-087/096) — additive; existing connectors are
+  unaffected.
+
 ## 2026.6.1
 
 First published release of **rac-connectors** — the integrations companion for
diff --git a/README.md b/README.md
index 826d40f..7f6c36c 100644
--- a/README.md
+++ b/README.md
@@ -467,6 +467,146 @@ Design + decision: [`rac/designs/`](rac/designs) (graph-connector-shape) and
 
 </details>
 
+### Workspace & ticketing
+
+<details>
+<summary><strong>Atlassian</strong> — Jira related_tickets verification + Confluence managed-page publish over the export contracts</summary>
+
+The Atlassian suite connector (rac-core ADR-090): **verify** that every Jira
+reference in the corpus still points at a real, reachable issue, and
+**publish** the corpus into a Confluence space as managed pages. Both verbs
+are thin consumers of the export contracts; the engine never talks to
+Atlassian (rac-core ADR-087), and the connector only ever contacts the
+instance you configure (rac-core ADR-086). No Atlassian SDK — an internal
+`httpx` client, see [ADR-010](rac/decisions/adr-010-atlassian-verify-publish-seams.md).
+
+```bash
+pip install 'rac-connectors[atlassian]'
+export ATLASSIAN_BASE_URL=https://yourorg.atlassian.net
+export ATLASSIAN_EMAIL=you@example.com
+export ATLASSIAN_API_TOKEN=...                 # id.atlassian.com API token
+export ATLASSIAN_CONFLUENCE_SPACE=DOCS         # publish only; or pass --space
+
+rac export rac/ --graph     | rac-connect atlassian verify            # check Jira refs
+rac export rac/ --graph     | rac-connect atlassian verify --dry-run  # list, no calls
+rac export rac/ --documents | rac-connect atlassian publish           # mirror pages
+rac export rac/ --documents | rac-connect atlassian publish --dry-run # plan, no calls
+```
+
+## `verify` — read-only Jira reference checks
+
+Selects the `--graph` projection's ticket edges by contract markers
+(`external: true`, `provider: "jira"` — set from your repo's
+`ticketing.provider`, rac-core ADR-087), dedupes the issue keys (bare
+`PROJ-123` or full `/browse/` URLs), fetches them 100 at a time through
+Jira's bulk-fetch endpoint with `fields=["status"]`, and reports each as
+**exists** (with status and statusCategory), **missing**, or **forbidden**
+— attributed back to the referencing artifacts. `verified_by` edges
+(rac-core ADR-096) and other providers' tickets are counted as skipped,
+never guessed at. It writes nothing, anywhere.
+
+| Exit code | Meaning |
+|---|---|
+| 0 | Every checked reference exists. |
+| 1 | The input was not a valid `--graph` payload. |
+| 2 | Credentials missing from the environment. |
+| 3 | One or more references are missing or forbidden — the CI gate. |
+
+| Flag | Meaning |
+|---|---|
+| `--dry-run` | List the references and batches that would be checked; no client, no calls. |
+| `--input`, `-i` | Read the `--graph` JSON from a file (default: stdin; `-` also means stdin). |
+| `--verbose`, `-v` | Print per-reference results on a live verify too (findings always print). |
+
+## `publish` — managed Confluence pages
+
+Mirrors the `--documents` stream into one space, idempotent on the canonical
+artifact id ([ADR-011](rac/decisions/adr-011-confluence-page-identity-and-idempotency.md)):
+
+- **Page identity is a content property** (`lore.artifact_id`) plus a
+  `lore-managed` label — never the title, so artifact renames are ordinary
+  updates; and no page id is ever written back into the corpus (write-back
+  is propose-only via human PR, rac-core ADR-065).
+- **Unchanged pages are skipped without a write.** The property stores a
+  sha256 of the rendered body; a second publish over an unchanged corpus
+  performs zero writes.
+- **Conflicts are surfaced, never clobbered.** Updates send
+  `version + 1`; a 409 means a human edited the page — it is reported as a
+  skip and left alone.
+- **Rendering is deterministic and escape-first.** A small Markdown subset
+  (headings, paragraphs, emphasis, code, fenced blocks, flat lists, links)
+  becomes storage format; corpus content is untrusted input, so hostile
+  HTML/macro text stays inert and only `http`/`https`/`mailto` links become
+  anchors. Tables are not yet rendered (they degrade to escaped text).
+
+| Flag | Meaning |
+|---|---|
+| `--space` | Confluence space key (default: `ATLASSIAN_CONFLUENCE_SPACE`). |
+| `--dry-run` | Print the pages that would be upserted; no client, no calls. |
+| `--input`, `-i` | Read JSONL from a file (default: stdin; `-` also means stdin). |
+| `--strict` | Fail on a malformed line instead of skipping it. |
+| `--verbose`, `-v` | Print per-page actions on a live publish too. |
+
+Exit codes are the standard 0 (done) / 1 (malformed input) / 2 (missing
+credentials or space).
+
+## Auth
+
+API token + Basic auth against Atlassian Cloud — mint a token at
+id.atlassian.com and set the three `ATLASSIAN_*` variables; one credential
+serves Jira and Confluence. Tokens expire; rotate them like any secret.
+Data Center (Bearer PAT, v2 Jira endpoints), OAuth, inbound Confluence
+ingest, and Jira comment-mode are named deferrals on the
+[`atlassian-connector`](rac/roadmaps/atlassian-connector.md) roadmap.
+
+### Python API
+
+```python
+from rac_connectors import parse_documents, parse_graph
+from rac_connectors.atlassian import (
+    AtlassianPublisher,
+    AtlassianVerifier,
+    client_from_env,
+)
+
+client = client_from_env()
+report = AtlassianVerifier(client).verify(parse_graph(open("graph.json").read()))
+summary = AtlassianPublisher(client, space_key="DOCS").publish(
+    parse_documents(open("corpus.jsonl"))
+)
+```
+
+### Live smoke test
+
+The connector is wired and unit-tested against fakes and a mock transport,
+but the live path (a real Cloud site) is unproven until someone runs it —
+this page is `drafted (live run pending)`. To validate end to end:
+
+1. **Configure the environment** with a real site, account, and API token
+   (all four variables above; pick a scratch Confluence space).
+2. **Verify, dry-run first:**
+   `rac export rac/ --graph | rac-connect atlassian verify --dry-run`, then
+   live. With a corpus referencing one known-good and one deleted issue,
+   confirm the exists/missing split and exit code 3.
+3. **Publish twice into the scratch space:**
+   `rac export rac/ --documents | rac-connect atlassian publish`. First run
+   creates every page (property + `lore-managed` label set); the second run
+   must report all pages `unchanged` and perform **zero writes**.
+4. **Rename check:** change one artifact's title, re-publish, and confirm
+   the same page updates in place (no duplicate).
+5. **Conflict check:** hand-edit a managed page in Confluence, re-publish a
+   changed body for that artifact, and confirm the run reports a version
+   conflict and leaves the human edit alone.
+6. **429 behaviour** (optional): run against a busy site and confirm
+   retries honour `Retry-After` rather than hammering.
+
+Then flip this page's `status` to `shipped` — and only then consider a
+release tag (the gate recorded on itsthelore/rac-connectors#10).
+
+**Full page:** [`docs/connectors/atlassian.md`](docs/connectors/atlassian.md)
+
+</details>
+
 <!-- /GENERATED:CONNECTORS -->
 
 ## Run it in CI
diff --git a/docs/connectors/atlassian.md b/docs/connectors/atlassian.md
new file mode 100644
index 0000000..c5f2a82
--- /dev/null
+++ b/docs/connectors/atlassian.md
@@ -0,0 +1,140 @@
+<!-- rac-connector
+name: Atlassian
+tagline: Jira related_tickets verification + Confluence managed-page publish over the export contracts
+category: Workspace & ticketing
+extra: atlassian
+order: 70
+status: drafted (live run pending)
+-->
+# Atlassian (Jira + Confluence)
+
+The Atlassian suite connector (rac-core ADR-090): **verify** that every Jira
+reference in the corpus still points at a real, reachable issue, and
+**publish** the corpus into a Confluence space as managed pages. Both verbs
+are thin consumers of the export contracts; the engine never talks to
+Atlassian (rac-core ADR-087), and the connector only ever contacts the
+instance you configure (rac-core ADR-086). No Atlassian SDK — an internal
+`httpx` client, see [ADR-010](../../rac/decisions/adr-010-atlassian-verify-publish-seams.md).
+
+```bash
+pip install 'rac-connectors[atlassian]'
+export ATLASSIAN_BASE_URL=https://yourorg.atlassian.net
+export ATLASSIAN_EMAIL=you@example.com
+export ATLASSIAN_API_TOKEN=...                 # id.atlassian.com API token
+export ATLASSIAN_CONFLUENCE_SPACE=DOCS         # publish only; or pass --space
+
+rac export rac/ --graph     | rac-connect atlassian verify            # check Jira refs
+rac export rac/ --graph     | rac-connect atlassian verify --dry-run  # list, no calls
+rac export rac/ --documents | rac-connect atlassian publish           # mirror pages
+rac export rac/ --documents | rac-connect atlassian publish --dry-run # plan, no calls
+```
+
+## `verify` — read-only Jira reference checks
+
+Selects the `--graph` projection's ticket edges by contract markers
+(`external: true`, `provider: "jira"` — set from your repo's
+`ticketing.provider`, rac-core ADR-087), dedupes the issue keys (bare
+`PROJ-123` or full `/browse/` URLs), fetches them 100 at a time through
+Jira's bulk-fetch endpoint with `fields=["status"]`, and reports each as
+**exists** (with status and statusCategory), **missing**, or **forbidden**
+— attributed back to the referencing artifacts. `verified_by` edges
+(rac-core ADR-096) and other providers' tickets are counted as skipped,
+never guessed at. It writes nothing, anywhere.
+
+| Exit code | Meaning |
+|---|---|
+| 0 | Every checked reference exists. |
+| 1 | The input was not a valid `--graph` payload. |
+| 2 | Credentials missing from the environment. |
+| 3 | One or more references are missing or forbidden — the CI gate. |
+
+| Flag | Meaning |
+|---|---|
+| `--dry-run` | List the references and batches that would be checked; no client, no calls. |
+| `--input`, `-i` | Read the `--graph` JSON from a file (default: stdin; `-` also means stdin). |
+| `--verbose`, `-v` | Print per-reference results on a live verify too (findings always print). |
+
+## `publish` — managed Confluence pages
+
+Mirrors the `--documents` stream into one space, idempotent on the canonical
+artifact id ([ADR-011](../../rac/decisions/adr-011-confluence-page-identity-and-idempotency.md)):
+
+- **Page identity is a content property** (`lore.artifact_id`) plus a
+  `lore-managed` label — never the title, so artifact renames are ordinary
+  updates; and no page id is ever written back into the corpus (write-back
+  is propose-only via human PR, rac-core ADR-065).
+- **Unchanged pages are skipped without a write.** The property stores a
+  sha256 of the rendered body; a second publish over an unchanged corpus
+  performs zero writes.
+- **Conflicts are surfaced, never clobbered.** Updates send
+  `version + 1`; a 409 means a human edited the page — it is reported as a
+  skip and left alone.
+- **Rendering is deterministic and escape-first.** A small Markdown subset
+  (headings, paragraphs, emphasis, code, fenced blocks, flat lists, links)
+  becomes storage format; corpus content is untrusted input, so hostile
+  HTML/macro text stays inert and only `http`/`https`/`mailto` links become
+  anchors. Tables are not yet rendered (they degrade to escaped text).
+
+| Flag | Meaning |
+|---|---|
+| `--space` | Confluence space key (default: `ATLASSIAN_CONFLUENCE_SPACE`). |
+| `--dry-run` | Print the pages that would be upserted; no client, no calls. |
+| `--input`, `-i` | Read JSONL from a file (default: stdin; `-` also means stdin). |
+| `--strict` | Fail on a malformed line instead of skipping it. |
+| `--verbose`, `-v` | Print per-page actions on a live publish too. |
+
+Exit codes are the standard 0 (done) / 1 (malformed input) / 2 (missing
+credentials or space).
+
+## Auth
+
+API token + Basic auth against Atlassian Cloud — mint a token at
+id.atlassian.com and set the three `ATLASSIAN_*` variables; one credential
+serves Jira and Confluence. Tokens expire; rotate them like any secret.
+Data Center (Bearer PAT, v2 Jira endpoints), OAuth, inbound Confluence
+ingest, and Jira comment-mode are named deferrals on the
+[`atlassian-connector`](../../rac/roadmaps/atlassian-connector.md) roadmap.
+
+### Python API
+
+```python
+from rac_connectors import parse_documents, parse_graph
+from rac_connectors.atlassian import (
+    AtlassianPublisher,
+    AtlassianVerifier,
+    client_from_env,
+)
+
+client = client_from_env()
+report = AtlassianVerifier(client).verify(parse_graph(open("graph.json").read()))
+summary = AtlassianPublisher(client, space_key="DOCS").publish(
+    parse_documents(open("corpus.jsonl"))
+)
+```
+
+### Live smoke test
+
+The connector is wired and unit-tested against fakes and a mock transport,
+but the live path (a real Cloud site) is unproven until someone runs it —
+this page is `drafted (live run pending)`. To validate end to end:
+
+1. **Configure the environment** with a real site, account, and API token
+   (all four variables above; pick a scratch Confluence space).
+2. **Verify, dry-run first:**
+   `rac export rac/ --graph | rac-connect atlassian verify --dry-run`, then
+   live. With a corpus referencing one known-good and one deleted issue,
+   confirm the exists/missing split and exit code 3.
+3. **Publish twice into the scratch space:**
+   `rac export rac/ --documents | rac-connect atlassian publish`. First run
+   creates every page (property + `lore-managed` label set); the second run
+   must report all pages `unchanged` and perform **zero writes**.
+4. **Rename check:** change one artifact's title, re-publish, and confirm
+   the same page updates in place (no duplicate).
+5. **Conflict check:** hand-edit a managed page in Confluence, re-publish a
+   changed body for that artifact, and confirm the run reports a version
+   conflict and leaves the human edit alone.
+6. **429 behaviour** (optional): run against a busy site and confirm
+   retries honour `Retry-After` rather than hammering.
+
+Then flip this page's `status` to `shipped` — and only then consider a
+release tag (the gate recorded on itsthelore/rac-connectors#10).
diff --git a/pyproject.toml b/pyproject.toml
index 2685b82..f5f284a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -57,6 +57,11 @@ cognee = ["cognee>=1,<2"]
 # fake-driven test-suite stay dependency-free. Embeddings come from an external
 # endpoint over stdlib HTTP (no SDK), so only qdrant-client is required here.
 qdrant = ["qdrant-client>=1.7,<2"]
+# The live Atlassian verify/publish needs httpx (an internal client, no
+# Atlassian SDK — ADR-010); the core install and the fake-driven test-suite
+# stay dependency-free. CI installs this extra so the mock-transport wire
+# tests run; they importorskip httpx and pass silently without it.
+atlassian = ["httpx>=0.27,<1"]
 dev = ["pytest>=7.0", "ruff", "mypy"]
 
 [project.scripts]
@@ -96,5 +101,6 @@ module = [
     "letta_client.*",
     "cognee.*",
     "qdrant_client.*",
+    "httpx.*",
 ]
 ignore_missing_imports = true
diff --git a/rac/decisions/adr-010-atlassian-verify-publish-seams.md b/rac/decisions/adr-010-atlassian-verify-publish-seams.md
new file mode 100644
index 0000000..fa3b49b
--- /dev/null
+++ b/rac/decisions/adr-010-atlassian-verify-publish-seams.md
@@ -0,0 +1,156 @@
+---
+schema_version: 1
+id: LCON-KWGHWM0W2DMV
+type: decision
+---
+# ADR-010: Atlassian Verify and Publish Seams, No SDK
+
+## Context
+
+rac-core ADR-090 places the Atlassian suite in this repo — `atlassian/`, one
+subdir spanning both directions on shared Cloud auth — and rac-core ADR-087
+explicitly delegates ticket **existence and state checks** here: the engine
+format-lints `related_tickets` references offline and never contacts a
+ticketing system. The engine side is live: `rac export --graph` marks ticket
+edges `external: true` with the configured `provider` (rac-core ADR-074).
+
+Two of the suite's surfaces are scheduled (roadmap `atlassian-connector`):
+verifying Jira references, and publishing corpus artifacts to Confluence.
+Neither fits the existing seams. `Connector.push` (ADR-002) is an outbound
+memory upsert; `GraphConnector.push_graph` (ADR-003) loads a graph image.
+Verification is *read-shaped* — it fetches issue state and writes nothing —
+and Confluence publish, while outbound, has page-identity and versioning
+semantics no memory backend has. ADR-002's rule that a connector "pushes, and
+never pulls" guards against one specific shape: a recall/re-rank surface that
+would couple reading agents to a backend. An operator-facing state check is
+not that shape, but the distinction must be recorded, not assumed.
+
+## Decision
+
+- **Two sibling seams, not overloads.** Following ADR-003's precedent:
+
+  ```python
+  class TicketVerifier(Protocol):
+      name: str
+      def verify(self, graph: Graph, *, dry_run: bool = False) -> VerifySummary: ...
+
+  class PagePublisher(Protocol):
+      name: str
+      def publish(self, records: Iterable[Record], *, dry_run: bool = False) -> PushSummary: ...
+  ```
+
+  `Connector`, `GraphConnector`, their readers, and the existing CLI
+  subcommands are untouched (additive — rac-core ADR-007, ADR-063).
+- **`verify` does not reopen ADR-002.** It is an operator-facing state check
+  delegated by rac-core ADR-087, run against the operator's own instance
+  (rac-core ADR-086); it exposes no recall, search, or re-rank surface to a
+  reading agent, and it never writes — not to Atlassian, not to the corpus.
+- **Verify selects edges by contract markers.** Only edges with
+  `external: true` and `provider == "jira"` are checked. `verified_by` edges
+  (rac-core ADR-096) carry `provider: null` and are excluded by construction;
+  other providers are skipped and counted, never guessed at.
+- **No Atlassian SDK.** The connector needs roughly six endpoints; a thin
+  internal client on `httpx` (the `[atlassian]` extra) keeps the supply chain
+  one dependency wide and makes contract tests trivial via a mock transport.
+  This deviates from ADR-002's "backend SDK behind a thin client Protocol"
+  pattern deliberately: there is no official Atlassian Python SDK worth
+  pinning, and the wrapper libraries chase API churn we would then chase
+  second-hand. The client Protocols still exist; only the adapter behind
+  them is ours.
+- **Cloud first, API-token Basic auth.** Credentials come from the
+  environment (`ATLASSIAN_BASE_URL`, `ATLASSIAN_EMAIL`,
+  `ATLASSIAN_API_TOKEN`), never hard-coded. The Data Center profile (Bearer
+  PAT, v2 Jira endpoints) is a named deferral; the auth seam leaves the slot.
+- **Jira reads use bulk fetch.** Verification batches issue keys through
+  `POST /rest/api/3/issue/bulkfetch` (100 keys, narrow fields). The classic
+  `/search` endpoint no longer exists in Jira Cloud; if search is ever
+  needed, it is `POST /search/jql` with cursor pagination.
+- **CLI verbs nest under one backend.** `rac-connect atlassian verify` and
+  `rac-connect atlassian publish` — the suite will grow verbs (comment-mode,
+  ingest), and a flat `atlassian-verify` would fork the backend namespace.
+- **Verify exits 3 on findings.** 0 = all references verified, 1 = malformed
+  input, 2 = missing credentials (the existing vocabulary), and 3 = one or
+  more references missing or forbidden — distinct so CI can gate on state
+  without conflating it with operator error.
+
+## Consequences
+
+### Positive
+
+- ADR-087's delegated obligation is discharged on the published contract
+  alone; the engine stays offline and pure.
+- The seam split keeps the rejected recall/re-rank shape structurally
+  impossible: `verify` returns a report, not records.
+- Contract tests drive the real request/response wire shape through a mock
+  transport instead of faking an SDK's object model.
+
+### Negative / trade-offs
+
+- Four seams now live in `base.py` (`push`, `push_graph`, `verify`,
+  `publish`). Accepted: the inputs and outputs are genuinely different
+  shapes, and each seam is a handful of lines.
+- Owning the HTTP client means owning retry/backoff behaviour. Accepted:
+  that behaviour is the part worth testing anyway, and 429/`Retry-After`
+  handling is recorded in the design and covered offline.
+
+### Risks
+
+- Atlassian Cloud API churn lands on us directly rather than via a wrapper
+  release. Mitigation: a pinned, deliberately small endpoint set; the docs
+  page carries a live smoke-test checklist that gates any release tag.
+- The verify report tempts growth toward a state-sync. Mitigation: the seam
+  returns a summary only; mirroring ticket state into the corpus is
+  explicitly out (rac-core ADR-017).
+
+## Status
+
+Accepted
+
+## Category
+
+Architecture
+
+## Alternatives Considered
+
+### Route verification through `GraphConnector.push_graph`
+
+Rejected: verification writes nothing; pretending a read is a push would
+falsify the seam's contract and its `PushSummary` shape.
+
+### Use `atlassian-python-api` or `jira` (pycontribs)
+
+Rejected: kitchen-sink wrappers with heavy transitive dependencies, uneven
+Cloud/Data-Center behaviour, and their own lag behind Atlassian's endpoint
+removals — for six endpoints, a wrapper is more surface than the client it
+wraps.
+
+### Flat CLI subcommands (`atlassian-verify`, `atlassian-publish`)
+
+Rejected: the suite is one backend with several verbs (ADR-090 names more to
+come); nesting keeps `rac-connect <backend>` one namespace.
+
+### Report findings via exit 0 and output parsing
+
+Rejected: the whole point of verify is a CI gate; a distinct exit code is the
+deterministic contract for that.
+
+## Related Decisions
+
+- adr-002
+- adr-003
+- adr-008
+- adr-011
+
+## Related Designs
+
+- atlassian-connector-shape
+
+## Related Roadmaps
+
+- atlassian-connector
+
+## Review Date
+
+Revisit when the Data Center profile or a second verb family (comment-mode,
+ingest) is scheduled, or if Atlassian ships an official Python SDK worth
+adopting.
diff --git a/rac/decisions/adr-011-confluence-page-identity-and-idempotency.md b/rac/decisions/adr-011-confluence-page-identity-and-idempotency.md
new file mode 100644
index 0000000..60c7c87
--- /dev/null
+++ b/rac/decisions/adr-011-confluence-page-identity-and-idempotency.md
@@ -0,0 +1,129 @@
+---
+schema_version: 1
+id: LCON-KWGHWM84VSVH
+type: decision
+---
+# ADR-011: Confluence Page Identity and Idempotent Publish
+
+## Context
+
+The `publish` seam (ADR-010) mirrors corpus artifacts into a Confluence
+space. Every existing connector is idempotent on the canonical artifact `id`
+(ADR-002), and publish must be too — but Confluence has no native
+upsert-by-external-id. The mature Markdown publishers show the failure
+modes: title-keyed lookup orphans pages on rename and creates duplicates;
+writing the page id back into the source binds cleanly but mutates the
+input. Our input is a read-only export stream, and corpus writes are
+propose-only via human PR review (rac-core ADR-065) — id write-back is not
+available to us even if we wanted it.
+
+Two further Confluence realities shape the decision: the API normalizes
+stored XHTML, so read-body-and-compare is not a reliable change detector;
+and updates are optimistic-concurrency versioned, so a stale version number
+means someone else edited the page.
+
+## Decision
+
+- **Page identity is a content property, never the title.** Each managed
+  page carries the content property `lore.artifact_id` holding the canonical
+  artifact id, plus a `lore-managed` label. Upsert resolves artifact →
+  page by that property within the configured space; the title is display
+  only and free to change with the artifact.
+- **No state outside Confluence.** The artifact-to-page mapping lives on
+  the pages themselves — no local state file, no id write-back into the
+  corpus (rac-core ADR-065).
+- **Change detection is a body hash.** The property also stores a sha256 of
+  the rendered storage-format body. Unchanged hash → the record is skipped
+  without a write, so a second publish over an unchanged corpus performs
+  zero writes.
+- **Updates are version-checked and never forced.** `PUT` sends
+  `version.number = current + 1`; a 409 conflict is recorded as a conflict
+  action in the summary and the stream continues. The connector never
+  overwrites an edit it did not make.
+- **Rendering is deterministic and escape-first.** Artifact Markdown renders
+  to storage format through a fixed, deliberately small subset (headings,
+  paragraphs, emphasis, code, fenced blocks, lists, links). All corpus
+  content is HTML-escaped before any markup is emitted — artifact content is
+  untrusted input (rac-core ADR-065), so no corpus text can smuggle a macro
+  or raw XHTML into the page.
+- **Jira backlinks ride the same idempotency.** When publish is asked to
+  link referenced issues back to their artifacts, it upserts a remote issue
+  link with `globalId = "lore:<ARTIFACT_ID>"` — Jira's native
+  same-`globalId` upsert makes re-runs update in place, never duplicate.
+
+## Consequences
+
+### Positive
+
+- Re-publish is safe by construction, mirroring every other connector's
+  idempotent-on-`id` contract; renames are ordinary updates.
+- Human edits to managed pages are surfaced as conflicts, not silently
+  clobbered — consistent with the trust boundary that humans, not tools,
+  have the last word.
+- The hash check makes the steady-state publish cheap: reads only.
+
+### Negative / trade-offs
+
+- A page manually stripped of its property/label becomes invisible to the
+  connector and a fresh publish creates a sibling. Accepted: the label makes
+  managed pages discoverable, and adopting orphans is a listable follow-up.
+- The rendering subset drops constructs (tables first among them) that
+  full-fat publishers support. Accepted: fidelity grows additively; golden
+  tests pin what is supported.
+
+### Risks
+
+- Confluence content-property APIs differ subtly between Cloud v2 and Data
+  Center. Mitigation: Cloud first (ADR-010); the property/label scheme
+  itself is portable.
+- Hash-skip hides drift if Confluence rewrites stored XHTML more
+  aggressively than expected. Mitigation: the hash is of *our* rendered
+  output, not the read-back body, so skips are decided entirely on our side.
+
+## Status
+
+Accepted
+
+## Category
+
+Architecture
+
+## Alternatives Considered
+
+### Title-keyed page lookup
+
+Rejected: renames orphan pages and duplicate on next publish — the exact
+failure mode the property scheme exists to prevent.
+
+### Page-id write-back into the corpus
+
+Rejected: the export stream is a read-only contract surface, and corpus
+writes are propose-only via human PR (rac-core ADR-065).
+
+### Read the stored body and diff for change detection
+
+Rejected: Confluence normalizes stored XHTML, so byte comparison flaps;
+hashing our own rendered output is deterministic.
+
+### Force updates on version conflict
+
+Rejected: a conflict means a human edited the page; the connector defers to
+humans by contract.
+
+## Related Decisions
+
+- adr-010
+- adr-002
+
+## Related Designs
+
+- atlassian-connector-shape
+
+## Related Roadmaps
+
+- atlassian-connector
+
+## Review Date
+
+Revisit when orphan adoption, table rendering, or the Data Center profile is
+scheduled, or if Confluence ships a native external-id upsert.
diff --git a/rac/designs/atlassian-connector-shape.md b/rac/designs/atlassian-connector-shape.md
new file mode 100644
index 0000000..ca37fb9
--- /dev/null
+++ b/rac/designs/atlassian-connector-shape.md
@@ -0,0 +1,173 @@
+---
+schema_version: 1
+id: LCON-KWGHWMFFTHY7
+type: design
+---
+# Atlassian Connector Shape: Client, Verify, Publish
+
+## Context
+
+ADR-010 fixes the seams (`TicketVerifier.verify`, `PagePublisher.publish`,
+no SDK, Cloud first) and ADR-011 fixes the publish identity model. This
+design works the *how*: module layout, client shape, transport behaviour,
+the verify report, the rendering subset, and the CLI tree. It is the
+Atlassian sibling of `graph-connector-shape`.
+
+## User Need
+
+An operator with a corpus full of `related_tickets` Jira references wants a
+CI-runnable check that every reference still points at a real, reachable
+issue — and a way to mirror the corpus into the Confluence space where the
+rest of the organisation reads, without hand-copying or clobbering human
+edits. Both must run from the export contract alone, with `--dry-run`
+needing no credentials.
+
+## Design
+
+Module layout, mirroring the per-backend convention:
+
+```text
+src/rac_connectors/atlassian/
+  __init__.py     re-exports: AtlassianVerifier, AtlassianPublisher, BACKEND,
+                  MissingCredentialsError, client_from_env
+  client.py       env credentials, JiraClient / ConfluenceClient Protocols,
+                  HttpAtlassianClient (httpx, lazy import), backoff
+  jira.py         verify_graph(): edge selection, key extraction, bulk fetch,
+                  classification; remote-link upsert helper
+  render.py       render_storage(markdown) -> str, body_hash(storage) -> str
+  confluence.py   publish_records(): property lookup, create/update/skip
+  connector.py    AtlassianVerifier / AtlassianPublisher seam implementations
+```
+
+`VerifySummary` sits beside `PushSummary` in the shared `base.py`, where the
+`TicketVerifier` and `PagePublisher` Protocols also live (the ADR-003
+precedent: seams are shared shape, implementations are per-backend).
+
+**Client.** `HttpAtlassianClient` implements both Protocols over one `httpx`
+client (imported lazily so the core install stays dependency-free). Base
+URLs derive from `ATLASSIAN_BASE_URL`: Jira under `/rest/api/3/`, Confluence
+under `/wiki/api/v2/`. Auth is Basic `email:api_token`. Every request runs
+through one `_request()` helper: timeout ~30s, sequential (no concurrency),
+and a retry loop for 429/5xx honouring `Retry-After` with capped, jittered
+exponential backoff (at most 4 retries; the sleep function is injectable so
+tests run instantly). 409 on a page update raises `VersionConflictError`;
+401/403 raise a permission error the callers classify.
+
+**Verify.** `verify_graph(graph, client, *, dry_run)`:
+
+1. Select edges with `external and provider == "jira"` (ADR-010); count
+   everything else it skips (other providers, `verified_by`, in-corpus).
+2. Extract issue keys from edge targets — bare `PROJ-123` or a full browse
+   URL — and dedupe while remembering every source artifact per key.
+3. Batch keys 100 at a time through `POST /issue/bulkfetch` with
+   `fields=["status"]`.
+4. Classify each key: `exists` (with status name and statusCategory),
+   `missing`, or `forbidden`; attribute results back to source artifacts in
+   the action log (`RAC-XXXX -> PROJ-123: missing`).
+
+`VerifySummary` carries counts (`checked/exists/missing/forbidden/skipped`),
+the per-key action log, a `summary_line()`, and `exit_code` (0 clean, 3
+findings). Dry-run lists the keys and batches it would check — no client,
+no network.
+
+**Render.** A deterministic Markdown → storage-format subset: ATX headings,
+paragraphs, bold/italic/inline code, fenced code blocks (a `code`
+structured macro with CDATA-safe escaping), ordered/unordered lists, links.
+Everything is HTML-escaped before markup is emitted; unknown constructs
+degrade to escaped text. Same input, same bytes — `body_hash` is sha256
+over the rendered output.
+
+**Publish.** For each record: render, hash, look up the page by the
+`lore.artifact_id` content property in the configured space. Not found →
+create (title from the record, optional parent), then set the property
+(artifact id + body hash) and the `lore-managed` label. Found, hash equal →
+skip as `unchanged`. Found, hash differs → `PUT` with `version.number + 1`
+and refresh the property; a 409 becomes a `conflict` action and the stream
+continues. The summary is the shared `PushSummary`.
+
+**CLI.**
+
+```text
+rac-connect atlassian verify   --input graph.json  [--dry-run] [--verbose]
+rac-connect atlassian publish  --input docs.jsonl  [--dry-run] [--strict]
+                               [--space KEY] [--verbose]
+```
+
+Nested verbs under one `atlassian` subparser, each with its own
+`set_defaults(func=...)` — `main()` untouched. Exit codes: verify
+0/1/2/3 per ADR-010; publish the standard 0/1/2. Missing credentials name
+the exact environment variables. `--space` overrides
+`ATLASSIAN_CONFLUENCE_SPACE`.
+
+**Testing.** Connector behaviour and CLI tests drive in-memory fakes of the
+two Protocols (the repo's standard pattern). Client contract tests use
+`httpx.MockTransport` behind `pytest.importorskip("httpx")`: auth header
+shape, bulkfetch body, 429 retry with patched sleep, 409 mapping. Render
+has golden fixtures including hostile input (`<script>`, `]]>`, `ac:`
+strings). An idempotence test publishes twice and asserts zero writes on
+the second pass.
+
+## Constraints
+
+- Consume only the published export contract; never re-derive from Markdown
+  (rac-core ADR-063, ADR-073).
+- Offline CI: no network, no live Atlassian account, `httpx` optional.
+- Corpus content is untrusted input — escape-first rendering, no macro or
+  raw-XHTML pass-through (rac-core ADR-065).
+- Air-gap posture: the connector talks only to the operator's configured
+  instance (rac-core ADR-086).
+- Cloud endpoints only in this pass; the Data Center profile is a named
+  deferral (ADR-010).
+
+## Rationale
+
+The shape is the smallest one that discharges ADR-087's delegated checks
+and ADR-090's publish surface while reusing everything the repo already
+has: the graph and documents readers, `PushSummary`, the dry-run
+convention, the per-backend module pattern, and the offline test style. The
+internal client exists because six endpoints do not justify a wrapper
+dependency; the injectable transport and sleep make the risky parts —
+backoff, conflict handling — the best-tested parts.
+
+## Alternatives
+
+- **One combined `sync` verb** — rejected: verify is read-only and CI-gated,
+  publish writes; conflating them blurs both contracts (ADR-010).
+- **Async/concurrent requests** — rejected for now: corpus sizes make
+  sequential + bulkfetch fast enough, and determinism matters more than
+  throughput.
+- **Rendering via a full Markdown-to-XHTML library** — rejected: the corpus
+  subset is small, and a hand-rolled deterministic renderer keeps golden
+  tests byte-stable and the escape path auditable.
+
+## Accessibility
+
+Published pages carry the artifact's heading structure so Confluence's own
+navigation and screen-reader affordances work; the renderer never emits
+colour- or layout-only semantics. CLI output stays plain-text,
+line-oriented, and readable without colour.
+
+## Style Guidance
+
+Follow the repo's connector conventions: frozen dataclasses for summaries,
+`Missing*Error` naming, `client_from_env()`, `--dry-run` that needs no
+credentials, action-log lines in the `<verb> <id>: <detail>` shape used by
+`PushSummary`, and docs-page metadata driving the README grouping.
+
+## Open Questions
+
+- Orphan adoption: should a later verb list `lore-managed` pages whose
+  property no longer matches any exported artifact?
+- Page tree shape: flat under one parent first; mirror the corpus directory
+  structure later?
+- `--json` report output for verify: scheduled as a follow-up; the exit
+  code is the day-one machine contract.
+
+## Related Decisions
+
+- adr-010
+- adr-011
+
+## Related Roadmaps
+
+- atlassian-connector
diff --git a/rac/roadmaps/atlassian-connector.md b/rac/roadmaps/atlassian-connector.md
new file mode 100644
index 0000000..1798290
--- /dev/null
+++ b/rac/roadmaps/atlassian-connector.md
@@ -0,0 +1,100 @@
+---
+schema_version: 1
+id: LCON-KWGHWMPN043M
+type: roadmap
+---
+# Atlassian Connector: Verify and Publish
+
+## Status
+
+Planned
+
+## Context
+
+rac-core schedules the Atlassian suite (roadmap `atlassian`, ADR-090) and
+delegates Jira existence/state checks to this repo (rac-core ADR-087). This
+item is the delivery track for the first two surfaces: the `verify` verb
+over the `--graph` projection and the `publish` verb over `--documents`,
+under the seams fixed by ADR-010 and the identity model fixed by ADR-011.
+
+## Outcomes
+
+- `rac export <dir> --graph | rac-connect atlassian verify` checks every
+  Jira `related_tickets` reference against the operator's instance and
+  exits 3 on missing/forbidden references, 0 when clean.
+- `rac export <dir> --documents | rac-connect atlassian publish` mirrors
+  artifacts into a Confluence space as managed pages; a second run over an
+  unchanged corpus performs zero writes.
+- The connector ships as `rac_connectors.atlassian` with an `[atlassian]`
+  extra, offline tests, and a docs page — the repo's standard shape.
+
+## Initiatives
+
+- **Contract reader** — surface the graph edges' `external`/`provider`
+  markers already emitted by the export (additive to `graph.py`).
+- **Client** — env-configured `httpx` client with Basic auth, backoff, and
+  the Jira/Confluence Protocol pair (ADR-010).
+- **Verify verb** — edge selection, key extraction, bulk fetch,
+  classification, `VerifySummary`, CLI wiring, exit-code contract.
+- **Publish verb** — deterministic storage-format rendering, property-keyed
+  page upsert, hash skip, conflict surfacing (ADR-011), CLI wiring.
+- **Docs and packaging** — connector page (with the live smoke-test
+  checklist that gates any release tag), README sync, CHANGELOG, extra,
+  CI install.
+
+## Success Measures
+
+- The full battery passes offline on 3.11–3.13 with and without `httpx`
+  installed.
+- Verify: dry-run needs no credentials; missing creds exit 2 naming the
+  variables; findings exit 3; a graph with only github/`verified_by`
+  edges exits 0 with everything counted as skipped.
+- Publish: the idempotence test (second run = zero writes) and the 409
+  conflict test pass; hostile corpus content renders escaped in the golden
+  fixtures.
+
+## Assumptions
+
+- Export contract major 1; edges carry `external`/`provider` as shipped in
+  rac-core v0.25.0.
+- One Cloud site and one Confluence space per run is enough for the first
+  delivery.
+- `httpx` is an acceptable optional dependency for CI contract tests
+  (ADR-010).
+
+## Risks
+
+- Endpoint churn on Jira Cloud (the `/search` removal precedent).
+  Mitigation: bulkfetch-first design, thin client, smoke-test checklist
+  before any tag.
+- Rendering fidelity disappointments. Mitigation: small pinned subset,
+  golden tests, additive growth.
+- Scope pull toward inbound sync. Mitigation: inbound ingest and
+  comment-mode stay separate, gated roadmap items (rac-core ADR-017,
+  ADR-065).
+
+## Related Decisions
+
+- adr-010
+- adr-011
+- adr-002
+- adr-003
+- adr-008
+
+## Related Designs
+
+- atlassian-connector-shape
+
+## Related Roadmaps
+
+- graph-connector
+
+## Related Tickets
+
+- itsthelore/rac-connectors#4
+- itsthelore/rac-connectors#5
+- itsthelore/rac-connectors#6
+- itsthelore/rac-connectors#7
+- itsthelore/rac-connectors#8
+- itsthelore/rac-connectors#9
+- itsthelore/rac-connectors#10
diff --git a/src/rac_connectors/atlassian/__init__.py b/src/rac_connectors/atlassian/__init__.py
new file mode 100644
index 0000000..786ebab
--- /dev/null
+++ b/src/rac_connectors/atlassian/__init__.py
@@ -0,0 +1,44 @@
+"""Atlassian connector: Jira reference verification and Confluence publish.
+
+The suite lives here per rac-core ADR-090; the seams and client decisions are
+ADR-010, the publish identity model is ADR-011, and the module shape is the
+``atlassian-connector-shape`` design.
+"""
+
+from .client import (
+    BASE_URL_ENV,
+    EMAIL_ENV,
+    SPACE_ENV,
+    TOKEN_ENV,
+    AtlassianAuthError,
+    BulkFetchResult,
+    ConfluenceClient,
+    HttpAtlassianClient,
+    IssueState,
+    JiraClient,
+    ManagedPage,
+    MissingCredentialsError,
+    VersionConflictError,
+    client_from_env,
+)
+from .connector import BACKEND, AtlassianPublisher, AtlassianVerifier
+
+__all__ = [
+    "BACKEND",
+    "AtlassianPublisher",
+    "AtlassianVerifier",
+    "BASE_URL_ENV",
+    "EMAIL_ENV",
+    "SPACE_ENV",
+    "TOKEN_ENV",
+    "AtlassianAuthError",
+    "BulkFetchResult",
+    "ConfluenceClient",
+    "HttpAtlassianClient",
+    "IssueState",
+    "JiraClient",
+    "ManagedPage",
+    "MissingCredentialsError",
+    "VersionConflictError",
+    "client_from_env",
+]
diff --git a/src/rac_connectors/atlassian/client.py b/src/rac_connectors/atlassian/client.py
new file mode 100644
index 0000000..c53fa20
--- /dev/null
+++ b/src/rac_connectors/atlassian/client.py
@@ -0,0 +1,397 @@
+"""The thin client seam the Atlassian connector talks through.
+
+The verify and publish paths depend only on :class:`JiraClient` and
+:class:`ConfluenceClient` (Protocols), so the test-suite drives in-memory
+fakes and CI never touches a live site. :class:`HttpAtlassianClient` is the
+real adapter — an internal client over ``httpx`` rather than an Atlassian
+SDK (ADR-010) — imported lazily so the package installs and tests run
+without the ``atlassian`` extra.
+
+Air-gap posture (rac-core ADR-086): the only host this client ever contacts
+is the operator's own instance from ``ATLASSIAN_BASE_URL``.
+"""
+
+from __future__ import annotations
+
+import os
+import random
+import time
+from base64 import b64encode
+from collections.abc import Callable, Sequence
+from dataclasses import dataclass
+from typing import Any, Protocol, runtime_checkable
+
+BASE_URL_ENV = "ATLASSIAN_BASE_URL"
+EMAIL_ENV = "ATLASSIAN_EMAIL"
+TOKEN_ENV = "ATLASSIAN_API_TOKEN"
+SPACE_ENV = "ATLASSIAN_CONFLUENCE_SPACE"
+
+# The content property that binds a Confluence page to its artifact (ADR-011).
+PROPERTY_KEY = "lore"
+MANAGED_LABEL = "lore-managed"
+
+_MAX_RETRIES = 4
+_BACKOFF_BASE_SECONDS = 1.0
+_BACKOFF_CAP_SECONDS = 30.0
+_TIMEOUT_SECONDS = 30.0
+
+
+class MissingCredentialsError(RuntimeError):
+    """One or more Atlassian credentials are absent from the environment."""
+
+    def __init__(self, missing: Sequence[str]) -> None:
+        self.missing = list(missing)
+        names = ", ".join(self.missing)
+        super().__init__(
+            f"set {names} in the environment (never hard-code credentials)"
+        )
+
+
+class AtlassianAuthError(RuntimeError):
+    """The instance rejected the request as unauthenticated or forbidden."""
+
+
+class VersionConflictError(RuntimeError):
+    """A page update lost the optimistic-concurrency race (HTTP 409).
+
+    Someone edited the page since it was read; the connector surfaces the
+    conflict and never force-overwrites (ADR-011).
+    """
+
+    def __init__(self, page_id: str) -> None:
+        self.page_id = page_id
+        super().__init__(f"version conflict updating page {page_id}")
+
+
+@dataclass(frozen=True)
+class IssueState:
+    """One fetched Jira issue: its key and portable status signals."""
+
+    key: str
+    status: str
+    status_category: str
+
+
+@dataclass(frozen=True)
+class BulkFetchResult:
+    """The outcome of one bulk fetch: found issues plus per-key errors."""
+
+    issues: list[IssueState]
+    errors: dict[str, str]
+
+
+@dataclass(frozen=True)
+class ManagedPage:
+    """A Confluence page already bound to an artifact via the property."""
+
+    page_id: str
+    version: int
+    title: str
+    body_hash: str | None
+
+
+@runtime_checkable
+class JiraClient(Protocol):
+    """What the verify path (and remote-link backlinks) need from Jira."""
+
+    def bulk_fetch_issues(self, keys: Sequence[str]) -> BulkFetchResult: ...
+
+    def upsert_remote_link(
+        self, *, issue_key: str, global_id: str, url: str, title: str
+    ) -> None: ...
+
+
+@runtime_checkable
+class ConfluenceClient(Protocol):
+    """What the publish path needs from Confluence.
+
+    Property versioning is the adapter's problem; the seam works in artifact
+    ids and body hashes only, so fakes stay a dict.
+    """
+
+    def find_managed_page(
+        self, *, space_key: str, artifact_id: str
+    ) -> ManagedPage | None: ...
+
+    def create_page(self, *, space_key: str, title: str, storage_body: str) -> str: ...
+
+    def update_page(
+        self, *, page_id: str, version: int, title: str, storage_body: str
+    ) -> None: ...
+
+    def set_managed_property(
+        self, *, page_id: str, artifact_id: str, body_hash: str
+    ) -> None: ...
+
+    def add_label(self, *, page_id: str, label: str) -> None: ...
+
+
+class HttpAtlassianClient:
+    """Adapter over ``httpx`` implementing both Protocols against Cloud.
+
+    Basic auth (``email:api_token``), Jira under ``/rest/api/3/``, Confluence
+    under ``/wiki/api/v2/`` (plus the v1 CQL search and label endpoints v2
+    does not cover). Requests are sequential; 429 and 5xx responses retry
+    with capped, jittered exponential backoff honouring ``Retry-After``. The
+    sleep function is injectable so the retry battery runs instantly.
+    """
+
+    def __init__(
+        self,
+        *,
+        base_url: str | None = None,
+        email: str | None = None,
+        api_token: str | None = None,
+        transport: Any = None,
+        sleep: Callable[[float], None] = time.sleep,
+    ) -> None:
+        env = {
+            BASE_URL_ENV: base_url or os.environ.get(BASE_URL_ENV),
+            EMAIL_ENV: email or os.environ.get(EMAIL_ENV),
+            TOKEN_ENV: api_token or os.environ.get(TOKEN_ENV),
+        }
+        missing = [name for name, value in env.items() if not value]
+        if missing:
+            raise MissingCredentialsError(missing)
+        self._base_url = str(env[BASE_URL_ENV]).rstrip("/")
+        credentials = f"{env[EMAIL_ENV]}:{env[TOKEN_ENV]}".encode()
+        self._auth_header = "Basic " + b64encode(credentials).decode("ascii")
+        self._transport = transport
+        self._sleep = sleep
+        self._client: Any = None
+        self._space_ids: dict[str, str] = {}
+
+    # -- transport ---------------------------------------------------------
+
+    def _ensure_client(self) -> Any:
+        if self._client is None:
+            try:
+                import httpx
+            except ImportError as exc:  # pragma: no cover - exercised via message
+                raise RuntimeError(
+                    "the 'httpx' package is not installed; "
+                    "install the connector's 'atlassian' extra"
+                ) from exc
+            self._client = httpx.Client(
+                base_url=self._base_url,
+                headers={
+                    "Authorization": self._auth_header,
+                    "Accept": "application/json",
+                },
+                timeout=_TIMEOUT_SECONDS,
+                transport=self._transport,
+            )
+        return self._client
+
+    def _request(
+        self,
+        method: str,
+        path: str,
+        *,
+        json: Any = None,
+        params: dict[str, Any] | None = None,
+        ok_statuses: tuple[int, ...] = (200,),
+    ) -> Any:
+        """One request with retry; returns parsed JSON (or None on 204)."""
+        client = self._ensure_client()
+        attempt = 0
+        while True:
+            response = client.request(method, path, json=json, params=params)
+            if response.status_code in ok_statuses:
+                return None if response.status_code == 204 else response.json()
+            if response.status_code in (401, 403):
+                raise AtlassianAuthError(
+                    f"{method} {path}: HTTP {response.status_code} — check the "
+                    f"credentials' permissions on the instance"
+                )
+            retryable = response.status_code == 429 or response.status_code >= 500
+            if retryable and attempt < _MAX_RETRIES:
+                self._sleep(self._retry_delay(attempt, response))
+                attempt += 1
+                continue
+            raise RuntimeError(
+                f"{method} {path}: HTTP {response.status_code}: {response.text[:200]}"
+            )
+
+    @staticmethod
+    def _retry_delay(attempt: int, response: Any) -> float:
+        retry_after = response.headers.get("Retry-After")
+        if retry_after is not None:
+            try:
+                return min(float(retry_after), _BACKOFF_CAP_SECONDS)
+            except ValueError:
+                pass
+        delay = min(_BACKOFF_BASE_SECONDS * (2**attempt), _BACKOFF_CAP_SECONDS)
+        return delay + random.uniform(0, delay / 4)
+
+    # -- Jira --------------------------------------------------------------
+
+    def bulk_fetch_issues(self, keys: Sequence[str]) -> BulkFetchResult:
+        """Fetch up to 100 issues in one call, status field only."""
+        payload = self._request(
+            "POST",
+            "/rest/api/3/issue/bulkfetch",
+            json={"issueIdsOrKeys": list(keys), "fields": ["status"]},
+        )
+        issues = []
+        for issue in payload.get("issues", []):
+            status = (issue.get("fields") or {}).get("status") or {}
+            category = status.get("statusCategory") or {}
+            issues.append(
+                IssueState(
+                    key=str(issue.get("key", "")),
+                    status=str(status.get("name", "")),
+                    status_category=str(category.get("key", "")),
+                )
+            )
+        errors: dict[str, str] = {}
+        for entry in payload.get("issueErrors", []):
+            key = str(entry.get("id") or entry.get("key") or "")
+            messages = entry.get("errorMessages") or []
+            errors[key] = "; ".join(str(m) for m in messages) or "not found"
+        return BulkFetchResult(issues=issues, errors=errors)
+
+    def upsert_remote_link(
+        self, *, issue_key: str, global_id: str, url: str, title: str
+    ) -> None:
+        # Same-globalId POSTs update in place — Jira's native idempotent
+        # upsert (ADR-011).
+        self._request(
+            "POST",
+            f"/rest/api/3/issue/{issue_key}/remotelink",
+            json={"globalId": global_id, "object": {"url": url, "title": title}},
+            ok_statuses=(200, 201),
+        )
+
+    # -- Confluence --------------------------------------------------------
+
+    def _space_id(self, space_key: str) -> str:
+        if space_key not in self._space_ids:
+            payload = self._request(
+                "GET", "/wiki/api/v2/spaces", params={"keys": space_key}
+            )
+            results = payload.get("results", [])
+            if not results:
+                raise RuntimeError(f"Confluence space not found: {space_key!r}")
+            self._space_ids[space_key] = str(results[0]["id"])
+        return self._space_ids[space_key]
+
+    def find_managed_page(
+        self, *, space_key: str, artifact_id: str
+    ) -> ManagedPage | None:
+        # CQL property search is a v1-only surface; page detail and the
+        # property body come from v2.
+        cql = (
+            f'space = "{space_key}" and type = page and '
+            f'content.property[{PROPERTY_KEY}].artifact_id = "{artifact_id}"'
+        )
+        payload = self._request(
+            "GET",
+            "/wiki/rest/api/content/search",
+            params={"cql": cql, "limit": 2},
+        )
+        results = payload.get("results", [])
+        if not results:
+            return None
+        page_id = str(results[0]["id"])
+        page = self._request("GET", f"/wiki/api/v2/pages/{page_id}")
+        prop = self._find_property(page_id)
+        body_hash = None
+        if prop is not None:
+            value = prop.get("value") or {}
+            if isinstance(value, dict) and isinstance(value.get("body_hash"), str):
+                body_hash = value["body_hash"]
+        return ManagedPage(
+            page_id=page_id,
+            version=int((page.get("version") or {}).get("number", 1)),
+            title=str(page.get("title", "")),
+            body_hash=body_hash,
+        )
+
+    def _find_property(self, page_id: str) -> dict[str, Any] | None:
+        payload = self._request(
+            "GET",
+            f"/wiki/api/v2/pages/{page_id}/properties",
+            params={"key": PROPERTY_KEY},
+        )
+        results = payload.get("results", [])
+        return results[0] if results else None
+
+    def create_page(self, *, space_key: str, title: str, storage_body: str) -> str:
+        payload = self._request(
+            "POST",
+            "/wiki/api/v2/pages",
+            json={
+                "spaceId": self._space_id(space_key),
+                "status": "current",
+                "title": title,
+                "body": {"representation": "storage", "value": storage_body},
+            },
+            ok_statuses=(200, 201),
+        )
+        return str(payload["id"])
+
+    def update_page(
+        self, *, page_id: str, version: int, title: str, storage_body: str
+    ) -> None:
+        client = self._ensure_client()
+        response = client.request(
+            "PUT",
+            f"/wiki/api/v2/pages/{page_id}",
+            json={
+                "id": page_id,
+                "status": "current",
+                "title": title,
+                "body": {"representation": "storage", "value": storage_body},
+                "version": {"number": version + 1},
+            },
+        )
+        if response.status_code == 409:
+            raise VersionConflictError(page_id)
+        if response.status_code in (401, 403):
+            raise AtlassianAuthError(
+                f"PUT pages/{page_id}: HTTP {response.status_code}"
+            )
+        if response.status_code != 200:
+            raise RuntimeError(
+                f"PUT pages/{page_id}: HTTP {response.status_code}: "
+                f"{response.text[:200]}"
+            )
+
+    def set_managed_property(
+        self, *, page_id: str, artifact_id: str, body_hash: str
+    ) -> None:
+        value = {"artifact_id": artifact_id, "body_hash": body_hash}
+        existing = self._find_property(page_id)
+        if existing is None:
+            self._request(
+                "POST",
+                f"/wiki/api/v2/pages/{page_id}/properties",
+                json={"key": PROPERTY_KEY, "value": value},
+                ok_statuses=(200, 201),
+            )
+            return
+        current = int((existing.get("version") or {}).get("number", 1))
+        self._request(
+            "PUT",
+            f"/wiki/api/v2/pages/{page_id}/properties/{existing['id']}",
+            json={
+                "key": PROPERTY_KEY,
+                "value": value,
+                "version": {"number": current + 1},
+            },
+        )
+
+    def add_label(self, *, page_id: str, label: str) -> None:
+        # Label writes are a v1-only surface.
+        self._request(
+            "POST",
+            f"/wiki/rest/api/content/{page_id}/label",
+            json=[{"prefix": "global", "name": label}],
+            ok_statuses=(200, 201),
+        )
+
+
+def client_from_env() -> HttpAtlassianClient:
+    """Build the real client from the ``ATLASSIAN_*`` environment variables."""
+    return HttpAtlassianClient()
diff --git a/src/rac_connectors/atlassian/confluence.py b/src/rac_connectors/atlassian/confluence.py
new file mode 100644
index 0000000..ce2cbdb
--- /dev/null
+++ b/src/rac_connectors/atlassian/confluence.py
@@ -0,0 +1,89 @@
+"""Confluence page publish over the ``--documents`` projection (ADR-011).
+
+For each record: render, hash, resolve the managed page by the artifact-id
+content property, then create / update / skip. A version conflict is a
+human's edit — recorded and left alone, never overwritten. A second publish
+over an unchanged corpus performs zero writes (the hash skip).
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+
+from ..base import PushSummary
+from ..records import Record
+from .client import MANAGED_LABEL, ConfluenceClient, VersionConflictError
+from .render import body_hash, render_storage
+
+
+def publish_records(
+    records: Iterable[Record],
+    client: ConfluenceClient | None,
+    *,
+    space_key: str,
+    dry_run: bool = False,
+) -> PushSummary:
+    """Upsert ``records`` as managed pages in ``space_key``.
+
+    With ``dry_run=True`` no client is needed and no call is made — the
+    summary lists each page that would be upserted with its body hash.
+    """
+    summary = PushSummary(backend="atlassian", dry_run=dry_run)
+
+    if not dry_run and client is None:
+        raise RuntimeError(
+            "a live publish needs a Confluence client; pass client_from_env() "
+            "or use dry_run=True"
+        )
+
+    for record in records:
+        storage = render_storage(record.text)
+        digest = body_hash(storage)
+
+        if dry_run:
+            space = space_key or "<space unset>"
+            summary.record_push(
+                record.id,
+                f"would upsert page {record.title!r} in {space} (hash {digest[:12]})",
+            )
+            continue
+
+        assert client is not None  # narrowed by the guard above
+        page = client.find_managed_page(space_key=space_key, artifact_id=record.id)
+
+        if page is None:
+            page_id = client.create_page(
+                space_key=space_key, title=record.title, storage_body=storage
+            )
+            client.set_managed_property(
+                page_id=page_id, artifact_id=record.id, body_hash=digest
+            )
+            client.add_label(page_id=page_id, label=MANAGED_LABEL)
+            summary.record_push(record.id, f"created page {page_id} {record.title!r}")
+            continue
+
+        if page.body_hash == digest:
+            summary.record_skip_item(record.id, f"unchanged (page {page.page_id})")
+            continue
+
+        try:
+            client.update_page(
+                page_id=page.page_id,
+                version=page.version,
+                title=record.title,
+                storage_body=storage,
+            )
+        except VersionConflictError:
+            # A human edited the page since our last write; surface it and
+            # move on — the connector never wins that race (ADR-011).
+            summary.record_skip_item(
+                record.id,
+                f"version conflict on page {page.page_id}; not overwritten",
+            )
+            continue
+        client.set_managed_property(
+            page_id=page.page_id, artifact_id=record.id, body_hash=digest
+        )
+        summary.record_push(record.id, f"updated page {page.page_id}")
+
+    return summary
diff --git a/src/rac_connectors/atlassian/connector.py b/src/rac_connectors/atlassian/connector.py
new file mode 100644
index 0000000..ff0da3c
--- /dev/null
+++ b/src/rac_connectors/atlassian/connector.py
@@ -0,0 +1,50 @@
+"""The Atlassian seam implementations: verifier now, publisher beside it.
+
+Both follow the repo convention: construct without a client for a
+credential-free ``--dry-run``, and a live run without a client is a clear
+error rather than a silent no-op.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+
+from ..base import PushSummary, VerifySummary
+from ..graph import Graph
+from ..records import Record
+from .client import ConfluenceClient, JiraClient
+from .confluence import publish_records
+from .jira import verify_graph
+
+BACKEND = "atlassian"
+
+
+class AtlassianVerifier:
+    """Implements the ``TicketVerifier`` seam for Jira references (ADR-010)."""
+
+    name = BACKEND
+
+    def __init__(self, client: JiraClient | None = None) -> None:
+        self._client = client
+
+    def verify(self, graph: Graph, *, dry_run: bool = False) -> VerifySummary:
+        return verify_graph(graph, self._client, dry_run=dry_run)
+
+
+class AtlassianPublisher:
+    """Implements the ``PagePublisher`` seam for managed pages (ADR-011)."""
+
+    name = BACKEND
+
+    def __init__(
+        self, client: ConfluenceClient | None = None, *, space_key: str = ""
+    ) -> None:
+        self._client = client
+        self._space_key = space_key
+
+    def publish(
+        self, records: Iterable[Record], *, dry_run: bool = False
+    ) -> PushSummary:
+        return publish_records(
+            records, self._client, space_key=self._space_key, dry_run=dry_run
+        )
diff --git a/src/rac_connectors/atlassian/jira.py b/src/rac_connectors/atlassian/jira.py
new file mode 100644
index 0000000..333d63a
--- /dev/null
+++ b/src/rac_connectors/atlassian/jira.py
@@ -0,0 +1,133 @@
+"""Jira reference verification over the ``--graph`` projection (ADR-010).
+
+Selects the export's Jira ticket edges by contract markers (``external`` +
+``provider == "jira"``), checks them against the operator's instance in
+bulk, and reports per reference — read-only, nothing is written anywhere.
+"""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Sequence
+
+from ..base import VerifySummary
+from ..graph import Graph, GraphEdge
+from .client import AtlassianAuthError, JiraClient
+
+BULK_FETCH_BATCH = 100
+
+# A Jira issue key inside a bare reference or a /browse/ URL.
+_ISSUE_KEY = re.compile(r"\b([A-Z][A-Z0-9]*-\d+)\b")
+
+_PERMISSION_HINTS = ("permission", "forbidden", "401", "403")
+
+
+def extract_issue_key(target: str) -> str | None:
+    """Pull the issue key out of an edge target (bare key or browse URL)."""
+    match = _ISSUE_KEY.search(target)
+    return match.group(1) if match else None
+
+
+def _jira_edges(graph: Graph) -> tuple[list[GraphEdge], list[GraphEdge]]:
+    """Split external edges into Jira ticket edges and everything else.
+
+    Only ``external`` edges are in scope; in-corpus relationship edges are
+    not references to verify. ``verified_by`` edges carry ``provider: None``
+    (rac-core ADR-096) and land in the skipped bucket by construction.
+    """
+    jira: list[GraphEdge] = []
+    other: list[GraphEdge] = []
+    for edge in graph.edges:
+        if not edge.external:
+            continue
+        (jira if edge.provider == "jira" else other).append(edge)
+    return jira, other
+
+
+def _keys_with_sources(
+    edges: Sequence[GraphEdge], summary: VerifySummary
+) -> dict[str, list[str]]:
+    """Dedupe issue keys, remembering every source artifact per key."""
+    keys: dict[str, list[str]] = {}
+    for edge in edges:
+        key = extract_issue_key(edge.target)
+        if key is None:
+            summary.record_skip_item(edge.target, "no Jira issue key in target")
+            continue
+        sources = keys.setdefault(key, [])
+        if edge.source not in sources:
+            sources.append(edge.source)
+    return keys
+
+
+def _batches(keys: Sequence[str]) -> list[list[str]]:
+    return [
+        list(keys[start : start + BULK_FETCH_BATCH])
+        for start in range(0, len(keys), BULK_FETCH_BATCH)
+    ]
+
+
+def verify_graph(
+    graph: Graph, client: JiraClient | None, *, dry_run: bool = False
+) -> VerifySummary:
+    """Verify the graph's Jira ticket references, batching through bulk fetch.
+
+    With ``dry_run=True`` no client is needed and no call is made — the
+    summary lists the keys and batches that a live run would check.
+    """
+    summary = VerifySummary(backend="atlassian", dry_run=dry_run)
+
+    jira_edges, other_external = _jira_edges(graph)
+    for edge in other_external:
+        provider = edge.provider or "no provider"
+        summary.record_skip_item(edge.target, f"{provider} reference, not checked")
+
+    keys = _keys_with_sources(jira_edges, summary)
+    ordered = sorted(keys)
+
+    if dry_run:
+        for key in ordered:
+            summary.checked += 1
+            summary.actions.append(
+                f"check {key}: referenced by {', '.join(sorted(keys[key]))}"
+            )
+        batches = len(_batches(ordered))
+        if batches:
+            summary.actions.append(
+                f"plan: {len(ordered)} issue(s) in {batches} bulk-fetch batch(es)"
+            )
+        return summary
+
+    if client is None:
+        raise RuntimeError(
+            "a live verify needs a Jira client; pass client_from_env() or use "
+            "dry_run=True"
+        )
+
+    for batch in _batches(ordered):
+        try:
+            result = client.bulk_fetch_issues(batch)
+        except AtlassianAuthError as exc:
+            for key in batch:
+                summary.record_forbidden(key, _attributed(str(exc), keys[key]))
+            continue
+        found = {issue.key: issue for issue in result.issues}
+        for key in batch:
+            sources = keys[key]
+            if key in found:
+                issue = found[key]
+                detail = f"{issue.status} ({issue.status_category})"
+                summary.record_exists(key, _attributed(detail, sources))
+            elif key in result.errors:
+                reason = result.errors[key]
+                if any(hint in reason.lower() for hint in _PERMISSION_HINTS):
+                    summary.record_forbidden(key, _attributed(reason, sources))
+                else:
+                    summary.record_missing(key, _attributed(reason, sources))
+            else:
+                summary.record_missing(key, _attributed("not returned", sources))
+    return summary
+
+
+def _attributed(detail: str, sources: Sequence[str]) -> str:
+    return f"{detail} <- {', '.join(sorted(sources))}"
diff --git a/src/rac_connectors/atlassian/render.py b/src/rac_connectors/atlassian/render.py
new file mode 100644
index 0000000..73edc8d
--- /dev/null
+++ b/src/rac_connectors/atlassian/render.py
@@ -0,0 +1,132 @@
+"""Deterministic Markdown → Confluence storage-format rendering (ADR-011).
+
+A deliberately small subset — headings, paragraphs, emphasis, inline code,
+fenced code blocks, flat lists, links — rendered escape-first: every piece
+of corpus text is HTML-escaped before any markup is emitted, because
+artifact content is untrusted input (rac-core ADR-065). No macro names or
+raw XHTML can pass through from the corpus. Unknown constructs degrade to
+escaped paragraph text.
+
+Same input, same bytes: :func:`body_hash` over the rendered output is the
+publish idempotency signal, so nothing here may depend on time, locale, or
+dict order.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import html
+import re
+
+_HEADING = re.compile(r"^(#{1,6})\s+(.*)$")
+_ORDERED_ITEM = re.compile(r"^\d+[.)]\s+(.*)$")
+_UNORDERED_ITEM = re.compile(r"^[-*+]\s+(.*)$")
+_FENCE = re.compile(r"^```")
+
+_INLINE_CODE = re.compile(r"`([^`]+)`")
+_BOLD = re.compile(r"\*\*(.+?)\*\*")
+_ITALIC = re.compile(r"(?<!\*)\*([^*]+)\*(?!\*)")
+_LINK = re.compile(r"\[([^\]]+)\]\(([^)\s]+)\)")
+
+_SAFE_LINK_SCHEMES = ("http://", "https://", "mailto:")
+
+
+def body_hash(storage: str) -> str:
+    """The sha256 of a rendered body — the change-detection key (ADR-011)."""
+    return hashlib.sha256(storage.encode("utf-8")).hexdigest()
+
+
+def _render_inline(escaped: str) -> str:
+    """Inline markup over already-escaped text."""
+    escaped = _INLINE_CODE.sub(r"<code>\1</code>", escaped)
+    escaped = _BOLD.sub(r"<strong>\1</strong>", escaped)
+    escaped = _ITALIC.sub(r"<em>\1</em>", escaped)
+
+    def link(match: re.Match[str]) -> str:
+        text, url = match.group(1), match.group(2)
+        # The URL is corpus content too: only plainly-safe schemes become
+        # anchors; anything else stays inert escaped text.
+        if url.startswith(_SAFE_LINK_SCHEMES):
+            return f'<a href="{url}">{text}</a>'
+        return match.group(0)
+
+    return _LINK.sub(link, escaped)
+
+
+def _inline(text: str) -> str:
+    return _render_inline(html.escape(text, quote=True))
+
+
+def _code_macro(lines: list[str]) -> str:
+    body = "\n".join(lines)
+    # CDATA cannot contain its own terminator; split it across sections.
+    body = body.replace("]]>", "]]]]><![CDATA[>")
+    return (
+        '<ac:structured-macro ac:name="code">'
+        f"<ac:plain-text-body><![CDATA[{body}]]></ac:plain-text-body>"
+        "</ac:structured-macro>"
+    )
+
+
+def render_storage(markdown: str) -> str:
+    """Render artifact Markdown to storage-format XHTML, deterministically."""
+    blocks: list[str] = []
+    lines = markdown.splitlines()
+    index = 0
+    total = len(lines)
+
+    while index < total:
+        line = lines[index]
+        stripped = line.strip()
+
+        if not stripped:
+            index += 1
+            continue
+
+        if _FENCE.match(stripped):
+            code: list[str] = []
+            index += 1
+            while index < total and not _FENCE.match(lines[index].strip()):
+                code.append(lines[index])
+                index += 1
+            index += 1  # consume the closing fence (or run off the end)
+            blocks.append(_code_macro(code))
+            continue
+
+        heading = _HEADING.match(stripped)
+        if heading:
+            level = len(heading.group(1))
+            blocks.append(f"<h{level}>{_inline(heading.group(2))}</h{level}>")
+            index += 1
+            continue
+
+        if _UNORDERED_ITEM.match(stripped) or _ORDERED_ITEM.match(stripped):
+            ordered = bool(_ORDERED_ITEM.match(stripped))
+            pattern = _ORDERED_ITEM if ordered else _UNORDERED_ITEM
+            items: list[str] = []
+            while index < total:
+                item = pattern.match(lines[index].strip())
+                if item is None:
+                    break
+                items.append(f"<li>{_inline(item.group(1))}</li>")
+                index += 1
+            tag = "ol" if ordered else "ul"
+            blocks.append(f"<{tag}>{''.join(items)}</{tag}>")
+            continue
+
+        paragraph: list[str] = []
+        while index < total:
+            current = lines[index].strip()
+            if (
+                not current
+                or _FENCE.match(current)
+                or _HEADING.match(current)
+                or _UNORDERED_ITEM.match(current)
+                or _ORDERED_ITEM.match(current)
+            ):
+                break
+            paragraph.append(current)
+            index += 1
+        blocks.append(f"<p>{_inline(' '.join(paragraph))}</p>")
+
+    return "".join(blocks)
diff --git a/src/rac_connectors/base.py b/src/rac_connectors/base.py
index ccb90c1..cd83c3f 100644
--- a/src/rac_connectors/base.py
+++ b/src/rac_connectors/base.py
@@ -49,6 +49,64 @@ def summary_line(self) -> str:
         return f"{self.backend} {mode}: {self.pushed} pushed, {self.skipped} skipped"
 
 
+@dataclass
+class VerifySummary:
+    """The outcome of an external-reference verification (ADR-010).
+
+    The verify seam returns a report, never records — the shape itself keeps
+    the rejected recall/re-rank surface impossible. ``missing`` and
+    ``forbidden`` are findings; ``skipped`` counts external edges the
+    verifier deliberately did not check (other providers, provider-less
+    ``verified_by`` edges, unparseable targets).
+    """
+
+    backend: str
+    checked: int = 0
+    exists: int = 0
+    missing: int = 0
+    forbidden: int = 0
+    skipped: int = 0
+    dry_run: bool = False
+    actions: list[str] = field(default_factory=list)
+
+    def record_exists(self, key: str, detail: str) -> None:
+        self.checked += 1
+        self.exists += 1
+        self.actions.append(f"exists {key}: {detail}")
+
+    def record_missing(self, key: str, detail: str) -> None:
+        self.checked += 1
+        self.missing += 1
+        self.actions.append(f"missing {key}: {detail}")
+
+    def record_forbidden(self, key: str, detail: str) -> None:
+        self.checked += 1
+        self.forbidden += 1
+        self.actions.append(f"forbidden {key}: {detail}")
+
+    def record_skip_item(self, label: str, reason: str) -> None:
+        self.skipped += 1
+        self.actions.append(f"skip {label}: {reason}")
+
+    @property
+    def findings(self) -> int:
+        return self.missing + self.forbidden
+
+    @property
+    def exit_code(self) -> int:
+        # 3 is the CI-gateable "references failed verification" contract
+        # (ADR-010) — distinct from malformed input (1) and missing creds (2).
+        return 3 if self.findings else 0
+
+    def summary_line(self) -> str:
+        mode = "dry-run" if self.dry_run else "verify"
+        return (
+            f"{self.backend} {mode}: {self.checked} checked, "
+            f"{self.exists} exist, {self.missing} missing, "
+            f"{self.forbidden} forbidden, {self.skipped} skipped"
+        )
+
+
 @runtime_checkable
 class Connector(Protocol):
     """Outbound-only sink for export records.
@@ -91,3 +149,46 @@ def push_graph(self, graph: Graph, *, dry_run: bool = False) -> PushSummary:
         without connecting to the backend.
         """
         ...
+
+
+@runtime_checkable
+class TicketVerifier(Protocol):
+    """Read-only checker for external ticket references (ADR-010).
+
+    An operator-facing state check delegated by rac-core ADR-087 — not a
+    recall surface for reading agents, which ADR-002 rejects. ``verify``
+    writes nothing anywhere; it reports whether the ``external`` ticket edges
+    in a ``--graph`` export still point at real, reachable issues.
+    """
+
+    name: str
+
+    def verify(self, graph: Graph, *, dry_run: bool = False) -> VerifySummary:
+        """Check the graph's ticket references, returning a :class:`VerifySummary`.
+
+        With ``dry_run=True`` the verifier must list what it would check
+        without making any network call.
+        """
+        ...
+
+
+@runtime_checkable
+class PagePublisher(Protocol):
+    """Outbound page mirror for the ``--documents`` projection (ADR-010).
+
+    Like :class:`Connector` it only writes outward and must be idempotent on
+    each record's canonical ``id`` — for pages, via the artifact-id content
+    property and body-hash skip recorded in ADR-011.
+    """
+
+    name: str
+
+    def publish(
+        self, records: Iterable[Record], *, dry_run: bool = False
+    ) -> PushSummary:
+        """Upsert ``records`` as managed pages, returning a :class:`PushSummary`.
+
+        With ``dry_run=True`` the publisher must describe what it would write
+        without making any network call.
+        """
+        ...
diff --git a/src/rac_connectors/cli.py b/src/rac_connectors/cli.py
index 3dadfd1..12e21f7 100644
--- a/src/rac_connectors/cli.py
+++ b/src/rac_connectors/cli.py
@@ -12,10 +12,17 @@
 from __future__ import annotations
 
 import argparse
+import os
 import sys
 from collections.abc import Iterable, Iterator
 from typing import TextIO
 
+from .atlassian import AtlassianPublisher, AtlassianVerifier
+from .atlassian.client import SPACE_ENV
+from .atlassian.client import (
+    MissingCredentialsError as AtlassianMissingCredentialsError,
+)
+from .atlassian.client import client_from_env as atlassian_client_from_env
 from .base import Connector, PushSummary
 from .cognee import CogneeConnector
 from .cognee.client import MissingCredentialsError as CogneeMissingCredentialsError
@@ -294,6 +301,81 @@ def _run_neo4j(args: argparse.Namespace) -> int:
     return 0
 
 
+def _run_atlassian_verify(args: argparse.Namespace) -> int:
+    stream, owned = _open_stream(args.input)
+    try:
+        payload = stream.read()
+    finally:
+        if owned:
+            stream.close()
+
+    try:
+        graph = parse_graph(payload)
+    except MalformedGraphError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 1
+
+    if args.dry_run:
+        verifier = AtlassianVerifier()
+    else:
+        try:
+            verifier = AtlassianVerifier(atlassian_client_from_env())
+        except AtlassianMissingCredentialsError as exc:
+            print(f"error: {exc}", file=sys.stderr)
+            return 2
+
+    summary = verifier.verify(graph, dry_run=args.dry_run)
+
+    if args.dry_run or args.verbose or summary.findings:
+        for action in summary.actions:
+            print(action)
+    print(summary.summary_line(), file=sys.stderr)
+    # 3 = references failed verification (ADR-010) — CI can gate on state
+    # without conflating it with malformed input (1) or missing creds (2).
+    return summary.exit_code
+
+
+def _run_atlassian_publish(args: argparse.Namespace) -> int:
+    space = args.space or os.environ.get(SPACE_ENV, "")
+    if not args.dry_run and not space:
+        print(
+            f"error: no Confluence space configured; pass --space or set {SPACE_ENV}",
+            file=sys.stderr,
+        )
+        return 2
+
+    publisher = AtlassianPublisher(space_key=space)
+    stream, owned = _open_stream(args.input)
+    try:
+        if not args.dry_run:
+            try:
+                publisher = AtlassianPublisher(
+                    atlassian_client_from_env(), space_key=space
+                )
+            except AtlassianMissingCredentialsError as exc:
+                print(f"error: {exc}", file=sys.stderr)
+                return 2
+        try:
+            summary = PushSummary(backend=publisher.name, dry_run=args.dry_run)
+            records = _records_with_skip_report(stream, summary, strict=args.strict)
+            published = publisher.publish(records, dry_run=args.dry_run)
+            summary.pushed = published.pushed
+            summary.skipped += published.skipped
+            summary.actions = published.actions + summary.actions
+        except MalformedRecordError as exc:
+            print(f"error: {exc}", file=sys.stderr)
+            return 1
+    finally:
+        if owned:
+            stream.close()
+
+    if args.dry_run or args.verbose:
+        for action in summary.actions:
+            print(action)
+    print(summary.summary_line(), file=sys.stderr)
+    return 0
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(
         prog="rac-connect",
@@ -495,6 +577,77 @@ def build_parser() -> argparse.ArgumentParser:
         help="Print per-node/edge actions on a live push too.",
     )
     neo.set_defaults(func=_run_neo4j)
+
+    # The Atlassian suite is one backend with several verbs (ADR-010): nested
+    # subcommands keep `rac-connect <backend>` a single namespace as
+    # comment-mode and ingest verbs join later.
+    atl = sub.add_parser(
+        "atlassian",
+        help="Verify Jira references and publish Confluence pages (ADR-010/011).",
+    )
+    atl_sub = atl.add_subparsers(dest="verb", required=True)
+
+    ver = atl_sub.add_parser(
+        "verify",
+        help=(
+            "Check the --graph projection's Jira related_tickets references "
+            "against the instance (read-only; exit 3 on findings)."
+        ),
+    )
+    ver.add_argument(
+        "--input",
+        "-i",
+        default=None,
+        help="--graph JSON file to read (default: stdin). '-' also means stdin.",
+    )
+    ver.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="List the references that would be checked without calling Jira.",
+    )
+    ver.add_argument(
+        "--verbose",
+        "-v",
+        action="store_true",
+        help="Print per-reference results on a live verify too.",
+    )
+    ver.set_defaults(func=_run_atlassian_verify)
+
+    pub = atl_sub.add_parser(
+        "publish",
+        help=(
+            "Mirror the --documents stream into a Confluence space as managed "
+            "pages (idempotent on the canonical id)."
+        ),
+    )
+    pub.add_argument(
+        "--input",
+        "-i",
+        default=None,
+        help="JSONL file to read (default: stdin). '-' also means stdin.",
+    )
+    pub.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="Print the pages that would be upserted without calling the API.",
+    )
+    pub.add_argument(
+        "--strict",
+        action="store_true",
+        help="Fail on a malformed line instead of skipping it.",
+    )
+    pub.add_argument(
+        "--space",
+        default=None,
+        help=f"Confluence space key (default: {SPACE_ENV} from the environment).",
+    )
+    pub.add_argument(
+        "--verbose",
+        "-v",
+        action="store_true",
+        help="Print per-page actions on a live publish too.",
+    )
+    pub.set_defaults(func=_run_atlassian_publish)
     return parser
 
 
diff --git a/src/rac_connectors/graph.py b/src/rac_connectors/graph.py
index ae7669e..719dffb 100644
--- a/src/rac_connectors/graph.py
+++ b/src/rac_connectors/graph.py
@@ -52,6 +52,10 @@ class GraphEdge:
     …) from rac's registry; ``directed`` carries its registry direction.
     ``resolved`` is False when the reference did not resolve uniquely, in which
     case ``target`` is the literal reference text rather than a canonical id.
+    ``external`` marks an external-target edge (``related_tickets``, rac-core
+    ADR-087; ``verified_by``, rac-core ADR-096) — unresolved by design, not a
+    dangling in-corpus link. ``provider`` carries the repository's configured
+    ticketing provider on ticket edges and is None everywhere else.
     """
 
     source: str
@@ -59,6 +63,8 @@ class GraphEdge:
     type: str
     directed: bool
     resolved: bool
+    external: bool = False
+    provider: str | None = None
 
     @classmethod
     def from_dict(cls, data: dict[str, Any]) -> GraphEdge:
@@ -67,6 +73,7 @@ def from_dict(cls, data: dict[str, Any]) -> GraphEdge:
                 raise MalformedGraphError(f"edge missing or non-string {key!r}")
         if not data["source"] or not data["target"]:
             raise MalformedGraphError("edge 'source'/'target' must be non-empty")
+        provider = data.get("provider")
         return cls(
             source=data["source"],
             target=data["target"],
@@ -74,6 +81,8 @@ def from_dict(cls, data: dict[str, Any]) -> GraphEdge:
             # Defaults keep the reader tolerant of additive contract growth.
             directed=bool(data.get("directed", True)),
             resolved=bool(data.get("resolved", True)),
+            external=bool(data.get("external", False)),
+            provider=provider if isinstance(provider, str) else None,
         )
 
 
diff --git a/tests/fixtures_graph_atlassian.json b/tests/fixtures_graph_atlassian.json
new file mode 100644
index 0000000..7adb967
--- /dev/null
+++ b/tests/fixtures_graph_atlassian.json
@@ -0,0 +1,55 @@
+{
+  "schema_version": "1",
+  "source": "rac",
+  "nodes": [
+    {"id": "RAC-1", "type": "roadmap", "status": "Planned", "title": "Roadmap"},
+    {"id": "RAC-2", "type": "requirement", "status": "Accepted", "title": "Req"}
+  ],
+  "edges": [
+    {
+      "source": "RAC-1",
+      "target": "PROJ-123",
+      "type": "related_tickets",
+      "directed": false,
+      "resolved": false,
+      "external": true,
+      "provider": "jira"
+    },
+    {
+      "source": "RAC-2",
+      "target": "https://example.atlassian.net/browse/PROJ-404",
+      "type": "related_tickets",
+      "directed": false,
+      "resolved": false,
+      "external": true,
+      "provider": "jira"
+    },
+    {
+      "source": "RAC-1",
+      "target": "itsthelore/rac-core#228",
+      "type": "related_tickets",
+      "directed": false,
+      "resolved": false,
+      "external": true,
+      "provider": "github"
+    },
+    {
+      "source": "RAC-2",
+      "target": "tests/test_req.py",
+      "type": "verified_by",
+      "directed": true,
+      "resolved": false,
+      "external": true,
+      "provider": null
+    },
+    {
+      "source": "RAC-1",
+      "target": "RAC-2",
+      "type": "related_requirements",
+      "directed": false,
+      "resolved": true,
+      "external": false,
+      "provider": null
+    }
+  ]
+}
diff --git a/tests/test_atlassian_client.py b/tests/test_atlassian_client.py
new file mode 100644
index 0000000..1ce3dbc
--- /dev/null
+++ b/tests/test_atlassian_client.py
@@ -0,0 +1,241 @@
+"""Wire-contract tests for the Atlassian HTTP client (mock transport, offline)."""
+
+from __future__ import annotations
+
+import json
+
+import pytest
+
+httpx = pytest.importorskip("httpx")
+
+from rac_connectors.atlassian.client import (  # noqa: E402
+    BASE_URL_ENV,
+    EMAIL_ENV,
+    TOKEN_ENV,
+    AtlassianAuthError,
+    HttpAtlassianClient,
+    MissingCredentialsError,
+    VersionConflictError,
+    client_from_env,
+)
+
+_CREDS = {
+    "base_url": "https://example.atlassian.net",
+    "email": "op@example.com",
+    "api_token": "token-123",
+}
+
+
+def _client(handler, sleeps=None):
+    recorded: list[float] = [] if sleeps is None else sleeps
+    return HttpAtlassianClient(
+        **_CREDS,
+        transport=httpx.MockTransport(handler),
+        sleep=recorded.append,
+    )
+
+
+def test_missing_credentials_name_every_absent_variable(monkeypatch) -> None:
+    for env in (BASE_URL_ENV, EMAIL_ENV, TOKEN_ENV):
+        monkeypatch.delenv(env, raising=False)
+    with pytest.raises(MissingCredentialsError) as excinfo:
+        client_from_env()
+    message = str(excinfo.value)
+    assert BASE_URL_ENV in message
+    assert EMAIL_ENV in message
+    assert TOKEN_ENV in message
+
+
+def test_bulk_fetch_sends_basic_auth_and_narrow_fields() -> None:
+    seen: dict[str, object] = {}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen["auth"] = request.headers.get("Authorization")
+        seen["url"] = str(request.url)
+        seen["body"] = json.loads(request.content)
+        return httpx.Response(
+            200,
+            json={
+                "issues": [
+                    {
+                        "key": "PROJ-1",
+                        "fields": {
+                            "status": {
+                                "name": "Done",
+                                "statusCategory": {"key": "done"},
+                            }
+                        },
+                    }
+                ],
+                "issueErrors": [
+                    {"id": "PROJ-404", "errorMessages": ["issue does not exist"]}
+                ],
+            },
+        )
+
+    result = _client(handler).bulk_fetch_issues(["PROJ-1", "PROJ-404"])
+    assert str(seen["auth"]).startswith("Basic ")
+    assert str(seen["url"]).endswith("/rest/api/3/issue/bulkfetch")
+    assert seen["body"] == {
+        "issueIdsOrKeys": ["PROJ-1", "PROJ-404"],
+        "fields": ["status"],
+    }
+    assert result.issues[0].key == "PROJ-1"
+    assert result.issues[0].status == "Done"
+    assert result.issues[0].status_category == "done"
+    assert result.errors == {"PROJ-404": "issue does not exist"}
+
+
+def test_429_retries_after_header_then_succeeds() -> None:
+    sleeps: list[float] = []
+    calls = {"n": 0}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        calls["n"] += 1
+        if calls["n"] < 3:
+            return httpx.Response(429, headers={"Retry-After": "2"})
+        return httpx.Response(200, json={"issues": [], "issueErrors": []})
+
+    result = _client(handler, sleeps).bulk_fetch_issues(["PROJ-1"])
+    assert calls["n"] == 3
+    assert sleeps == [2.0, 2.0]  # Retry-After honoured verbatim
+    assert result.issues == []
+
+
+def test_persistent_429_exhausts_capped_retries() -> None:
+    sleeps: list[float] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(429, headers={"Retry-After": "1"})
+
+    with pytest.raises(RuntimeError, match="HTTP 429"):
+        _client(handler, sleeps).bulk_fetch_issues(["PROJ-1"])
+    assert len(sleeps) == 4  # capped retry budget, then surfaced
+
+
+def test_auth_failure_raises_without_retry() -> None:
+    sleeps: list[float] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(403, json={"errorMessages": ["forbidden"]})
+
+    with pytest.raises(AtlassianAuthError):
+        _client(handler, sleeps).bulk_fetch_issues(["PROJ-1"])
+    assert sleeps == []
+
+
+def test_remote_link_upsert_carries_global_id() -> None:
+    seen: dict[str, object] = {}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen["url"] = str(request.url)
+        seen["body"] = json.loads(request.content)
+        return httpx.Response(201, json={"id": 1})
+
+    _client(handler).upsert_remote_link(
+        issue_key="PROJ-1",
+        global_id="lore:RAC-1",
+        url="https://example.com/RAC-1",
+        title="RAC-1",
+    )
+    assert str(seen["url"]).endswith("/rest/api/3/issue/PROJ-1/remotelink")
+    assert seen["body"] == {
+        "globalId": "lore:RAC-1",
+        "object": {"url": "https://example.com/RAC-1", "title": "RAC-1"},
+    }
+
+
+def _confluence_handler(state: dict) -> object:
+    """A tiny scripted Confluence covering the publish call sequence."""
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        path, method = request.url.path, request.method
+        if path == "/wiki/api/v2/spaces":
+            return httpx.Response(200, json={"results": [{"id": "111"}]})
+        if path == "/wiki/rest/api/content/search":
+            state["cql"] = dict(request.url.params)["cql"]
+            found = state.get("page")
+            results = [{"id": found["id"]}] if found else []
+            return httpx.Response(200, json={"results": results})
+        if method == "GET" and path == "/wiki/api/v2/pages/900":
+            return httpx.Response(
+                200,
+                json={"id": "900", "title": "Old", "version": {"number": 4}},
+            )
+        if method == "GET" and path == "/wiki/api/v2/pages/900/properties":
+            return httpx.Response(
+                200,
+                json={
+                    "results": [
+                        {
+                            "id": "77",
+                            "key": "lore",
+                            "value": {"artifact_id": "RAC-1", "body_hash": "abc"},
+                            "version": {"number": 2},
+                        }
+                    ]
+                },
+            )
+        if method == "POST" and path == "/wiki/api/v2/pages":
+            state["created"] = json.loads(request.content)
+            return httpx.Response(200, json={"id": "901"})
+        if method == "PUT" and path == "/wiki/api/v2/pages/900":
+            state["updated"] = json.loads(request.content)
+            return httpx.Response(state.get("update_status", 200), json={})
+        if path == "/wiki/api/v2/pages/901/properties" and method == "GET":
+            return httpx.Response(200, json={"results": []})
+        if path == "/wiki/api/v2/pages/901/properties" and method == "POST":
+            state["property"] = json.loads(request.content)
+            return httpx.Response(200, json={"id": "78"})
+        if path == "/wiki/rest/api/content/901/label":
+            state["label"] = json.loads(request.content)
+            return httpx.Response(200, json={})
+        raise AssertionError(f"unexpected call: {method} {path}")
+
+    return handler
+
+
+def test_find_managed_page_reads_version_and_hash() -> None:
+    state: dict = {"page": {"id": "900"}}
+    page = _client(_confluence_handler(state)).find_managed_page(
+        space_key="DOCS", artifact_id="RAC-1"
+    )
+    assert page is not None
+    assert (page.page_id, page.version, page.body_hash) == ("900", 4, "abc")
+    assert 'content.property[lore].artifact_id = "RAC-1"' in str(state["cql"])
+
+
+def test_find_managed_page_returns_none_when_absent() -> None:
+    state: dict = {}
+    page = _client(_confluence_handler(state)).find_managed_page(
+        space_key="DOCS", artifact_id="RAC-404"
+    )
+    assert page is None
+
+
+def test_create_page_then_property_and_label() -> None:
+    state: dict = {}
+    client = _client(_confluence_handler(state))
+    page_id = client.create_page(space_key="DOCS", title="T", storage_body="<p>b</p>")
+    client.set_managed_property(page_id=page_id, artifact_id="RAC-1", body_hash="h")
+    client.add_label(page_id=page_id, label="lore-managed")
+    assert page_id == "901"
+    created = state["created"]
+    assert created["spaceId"] == "111"
+    assert created["body"] == {"representation": "storage", "value": "<p>b</p>"}
+    assert state["property"]["value"] == {"artifact_id": "RAC-1", "body_hash": "h"}
+    assert state["label"] == [{"prefix": "global", "name": "lore-managed"}]
+
+
+def test_update_page_sends_incremented_version() -> None:
+    state: dict = {"page": {"id": "900"}}
+    client = _client(_confluence_handler(state))
+    client.update_page(page_id="900", version=4, title="New", storage_body="<p>x</p>")
+    assert state["updated"]["version"] == {"number": 5}
+
+
+def test_update_conflict_raises_version_conflict() -> None:
+    state: dict = {"page": {"id": "900"}, "update_status": 409}
+    client = _client(_confluence_handler(state))
+    with pytest.raises(VersionConflictError):
+        client.update_page(page_id="900", version=4, title="N", storage_body="b")
diff --git a/tests/test_atlassian_publish.py b/tests/test_atlassian_publish.py
new file mode 100644
index 0000000..53abb1e
--- /dev/null
+++ b/tests/test_atlassian_publish.py
@@ -0,0 +1,144 @@
+"""Publish-verb behaviour driven through a fake Confluence client (offline)."""
+
+from __future__ import annotations
+
+import itertools
+
+import pytest
+
+from rac_connectors.atlassian.client import ManagedPage, VersionConflictError
+from rac_connectors.atlassian.connector import AtlassianPublisher
+from rac_connectors.records import Record
+
+
+def _record(record_id: str, title: str, text: str) -> Record:
+    return Record(
+        id=record_id,
+        type="decision",
+        status="Accepted",
+        title=title,
+        text=text,
+        metadata={"source": "rac"},
+    )
+
+
+class FakeConfluenceClient:
+    """An in-memory space keyed by the artifact-id content property."""
+
+    def __init__(self, conflict_on_update: bool = False) -> None:
+        self.pages: dict[str, dict] = {}  # artifact_id -> page state
+        self.conflict_on_update = conflict_on_update
+        self.writes = 0
+        self._ids = itertools.count(900)
+
+    def find_managed_page(
+        self, *, space_key: str, artifact_id: str
+    ) -> ManagedPage | None:
+        page = self.pages.get(artifact_id)
+        if page is None:
+            return None
+        return ManagedPage(
+            page_id=page["page_id"],
+            version=page["version"],
+            title=page["title"],
+            body_hash=page.get("body_hash"),
+        )
+
+    def create_page(self, *, space_key: str, title: str, storage_body: str) -> str:
+        self.writes += 1
+        page_id = str(next(self._ids))
+        self._by_page_id = getattr(self, "_by_page_id", {})
+        self._by_page_id[page_id] = {"title": title, "body": storage_body}
+        return page_id
+
+    def update_page(
+        self, *, page_id: str, version: int, title: str, storage_body: str
+    ) -> None:
+        if self.conflict_on_update:
+            raise VersionConflictError(page_id)
+        self.writes += 1
+        for page in self.pages.values():
+            if page["page_id"] == page_id:
+                page["version"] = version + 1
+                page["title"] = title
+                page["body"] = storage_body
+
+    def set_managed_property(
+        self, *, page_id: str, artifact_id: str, body_hash: str
+    ) -> None:
+        self.writes += 1
+        page = self.pages.setdefault(
+            artifact_id,
+            {"page_id": page_id, "version": 1, "title": ""},
+        )
+        page["body_hash"] = body_hash
+
+    def add_label(self, *, page_id: str, label: str) -> None:
+        self.writes += 1
+
+
+def test_create_path_sets_property_and_label() -> None:
+    client = FakeConfluenceClient()
+    publisher = AtlassianPublisher(client, space_key="DOCS")
+    summary = publisher.publish([_record("RAC-1", "Title", "# Body")])
+    assert summary.pushed == 1
+    assert summary.skipped == 0
+    assert "RAC-1" in client.pages
+    assert client.pages["RAC-1"]["body_hash"]
+    assert any("created page" in action for action in summary.actions)
+
+
+def test_second_publish_over_unchanged_corpus_writes_nothing() -> None:
+    client = FakeConfluenceClient()
+    publisher = AtlassianPublisher(client, space_key="DOCS")
+    records = [
+        _record("RAC-1", "One", "# One"),
+        _record("RAC-2", "Two", "# Two"),
+    ]
+    publisher.publish(records)
+    writes_after_first = client.writes
+
+    summary = publisher.publish(records)
+    assert client.writes == writes_after_first  # zero writes — the ADR-011 test
+    assert summary.pushed == 0
+    assert summary.skipped == 2
+    assert all("unchanged" in action for action in summary.actions)
+
+
+def test_changed_body_updates_with_incremented_version() -> None:
+    client = FakeConfluenceClient()
+    publisher = AtlassianPublisher(client, space_key="DOCS")
+    publisher.publish([_record("RAC-1", "T", "# Old")])
+    summary = publisher.publish([_record("RAC-1", "T", "# New")])
+    assert summary.pushed == 1
+    assert any("updated page" in action for action in summary.actions)
+
+
+def test_version_conflict_is_surfaced_and_stream_continues() -> None:
+    client = FakeConfluenceClient()
+    publisher = AtlassianPublisher(client, space_key="DOCS")
+    publisher.publish([_record("RAC-1", "T", "# Old")])
+
+    client.conflict_on_update = True
+    summary = publisher.publish(
+        [_record("RAC-1", "T", "# New"), _record("RAC-2", "U", "# Fresh")]
+    )
+    assert summary.skipped == 1
+    assert summary.pushed == 1  # RAC-2 still landed
+    assert any("version conflict" in action for action in summary.actions)
+    # The stored hash must NOT advance past the human's edit.
+    assert client.pages["RAC-1"]["body_hash"] != "advanced"
+
+
+def test_dry_run_needs_no_client_and_plans_every_page() -> None:
+    publisher = AtlassianPublisher(space_key="DOCS")
+    summary = publisher.publish([_record("RAC-1", "One", "# One")], dry_run=True)
+    assert summary.dry_run is True
+    assert summary.pushed == 1
+    assert any("would upsert page 'One'" in action for action in summary.actions)
+
+
+def test_live_publish_without_client_is_a_clear_error() -> None:
+    publisher = AtlassianPublisher(space_key="DOCS")
+    with pytest.raises(RuntimeError, match="client_from_env"):
+        publisher.publish([_record("RAC-1", "T", "# B")])
diff --git a/tests/test_atlassian_render.py b/tests/test_atlassian_render.py
new file mode 100644
index 0000000..0261bcc
--- /dev/null
+++ b/tests/test_atlassian_render.py
@@ -0,0 +1,83 @@
+"""Golden and safety coverage for the storage-format renderer (ADR-011)."""
+
+from __future__ import annotations
+
+from rac_connectors.atlassian.render import body_hash, render_storage
+
+_DOCUMENT = """\
+# Title
+
+Intro paragraph with **bold**, *italic*, `code`, and a
+[link](https://example.com/page).
+
+## Section
+
+- first item
+- second item
+
+1. one
+2. two
+
+```python
+print("hi")
+```
+"""
+
+_GOLDEN = (
+    "<h1>Title</h1>"
+    "<p>Intro paragraph with <strong>bold</strong>, <em>italic</em>, "
+    '<code>code</code>, and a <a href="https://example.com/page">link</a>.</p>'
+    "<h2>Section</h2>"
+    "<ul><li>first item</li><li>second item</li></ul>"
+    "<ol><li>one</li><li>two</li></ol>"
+    '<ac:structured-macro ac:name="code">'
+    '<ac:plain-text-body><![CDATA[print("hi")]]></ac:plain-text-body>'
+    "</ac:structured-macro>"
+)
+
+
+def test_golden_document_renders_exactly() -> None:
+    assert render_storage(_DOCUMENT) == _GOLDEN
+
+
+def test_rendering_is_deterministic_and_hash_stable() -> None:
+    first, second = render_storage(_DOCUMENT), render_storage(_DOCUMENT)
+    assert first == second
+    assert body_hash(first) == body_hash(second)
+    assert body_hash(first) != body_hash(render_storage("# Other"))
+
+
+def test_hostile_html_is_escaped_not_emitted() -> None:
+    rendered = render_storage("<script>alert(1)</script>")
+    assert "<script>" not in rendered
+    assert "&lt;script&gt;" in rendered
+
+
+def test_hostile_macro_text_stays_inert() -> None:
+    rendered = render_storage('injected <ac:structured-macro ac:name="html">')
+    # The only macro in the output must be one the renderer itself emitted.
+    assert "<ac:structured-macro" not in rendered
+    assert "&lt;ac:structured-macro" in rendered
+
+
+def test_cdata_terminator_cannot_break_out_of_code_blocks() -> None:
+    rendered = render_storage("```\n]]><evil/>\n```")
+    assert "]]><evil/>" not in rendered
+    assert "]]]]><![CDATA[>" in rendered
+
+
+def test_unsafe_link_schemes_stay_text() -> None:
+    rendered = render_storage("[click](javascript:alert(1))")
+    assert "<a href" not in rendered
+    assert "javascript:alert(1)" in rendered
+
+
+def test_quotes_in_text_are_attribute_safe() -> None:
+    rendered = render_storage('say "hello" & goodbye')
+    assert "&quot;hello&quot;" in rendered
+    assert "&amp;" in rendered
+
+
+def test_unclosed_fence_still_renders_a_code_block() -> None:
+    rendered = render_storage("```\ndangling")
+    assert "<![CDATA[dangling]]>" in rendered
diff --git a/tests/test_atlassian_verify.py b/tests/test_atlassian_verify.py
new file mode 100644
index 0000000..bc35a55
--- /dev/null
+++ b/tests/test_atlassian_verify.py
@@ -0,0 +1,172 @@
+"""Verify-verb behaviour driven through a fake Jira client (offline)."""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Sequence
+from pathlib import Path
+
+import pytest
+
+from rac_connectors.atlassian.client import (
+    AtlassianAuthError,
+    BulkFetchResult,
+    IssueState,
+)
+from rac_connectors.atlassian.connector import AtlassianVerifier
+from rac_connectors.atlassian.jira import BULK_FETCH_BATCH, extract_issue_key
+from rac_connectors.graph import Graph, GraphEdge, GraphNode, parse_graph
+
+_FIXTURE = Path(__file__).parent / "fixtures_graph_atlassian.json"
+
+
+class FakeJiraClient:
+    """Scripted bulk-fetch results keyed by issue key."""
+
+    def __init__(
+        self,
+        existing: dict[str, tuple[str, str]] | None = None,
+        errors: dict[str, str] | None = None,
+        fail_auth: bool = False,
+    ) -> None:
+        self.existing = existing or {}
+        self.errors = errors or {}
+        self.fail_auth = fail_auth
+        self.batches: list[list[str]] = []
+        self.links: list[dict[str, str]] = []
+
+    def bulk_fetch_issues(self, keys: Sequence[str]) -> BulkFetchResult:
+        if self.fail_auth:
+            raise AtlassianAuthError("HTTP 403")
+        self.batches.append(list(keys))
+        issues = [
+            IssueState(key=key, status=name, status_category=category)
+            for key, (name, category) in self.existing.items()
+            if key in keys
+        ]
+        errors = {key: msg for key, msg in self.errors.items() if key in keys}
+        return BulkFetchResult(issues=issues, errors=errors)
+
+    def upsert_remote_link(
+        self, *, issue_key: str, global_id: str, url: str, title: str
+    ) -> None:
+        self.links.append({"issue_key": issue_key, "global_id": global_id})
+
+
+def _fixture_graph() -> Graph:
+    return parse_graph(_FIXTURE.read_text(encoding="utf-8"))
+
+
+def _jira_edge(source: str, target: str) -> GraphEdge:
+    return GraphEdge(
+        source=source,
+        target=target,
+        type="related_tickets",
+        directed=False,
+        resolved=False,
+        external=True,
+        provider="jira",
+    )
+
+
+def _graph(edges: list[GraphEdge]) -> Graph:
+    nodes = [GraphNode("RAC-1", "roadmap", "Planned", "R")]
+    return Graph(source="rac", nodes=nodes, edges=edges)
+
+
+def test_extract_issue_key_handles_bare_keys_and_urls() -> None:
+    assert extract_issue_key("PROJ-123") == "PROJ-123"
+    assert (
+        extract_issue_key("https://x.atlassian.net/browse/ABC-9?focused=1") == "ABC-9"
+    )
+    assert extract_issue_key("no key here") is None
+
+
+def test_selects_only_jira_edges_and_skips_the_rest() -> None:
+    client = FakeJiraClient(existing={"PROJ-123": ("Done", "done")})
+    summary = AtlassianVerifier(client).verify(_fixture_graph())
+    # PROJ-123 exists, PROJ-404 (browse URL) missing; github and verified_by
+    # edges are skipped; the in-corpus edge is not counted at all.
+    assert summary.checked == 2
+    assert summary.exists == 1
+    assert summary.missing == 1
+    assert summary.skipped == 2
+    assert summary.exit_code == 3
+
+
+def test_clean_graph_exits_zero() -> None:
+    client = FakeJiraClient(
+        existing={"PROJ-123": ("Done", "done"), "PROJ-404": ("Open", "new")}
+    )
+    summary = AtlassianVerifier(client).verify(_fixture_graph())
+    assert summary.findings == 0
+    assert summary.exit_code == 0
+    assert any("Done (done)" in action for action in summary.actions)
+
+
+def test_results_attribute_source_artifacts() -> None:
+    edges = [
+        _jira_edge("RAC-1", "PROJ-7"),
+        _jira_edge("RAC-2", "PROJ-7"),
+    ]
+    client = FakeJiraClient(errors={"PROJ-7": "issue does not exist"})
+    summary = AtlassianVerifier(client).verify(_graph(edges))
+    assert summary.missing == 1  # deduped: one key, two sources
+    assert any("RAC-1, RAC-2" in action for action in summary.actions)
+
+
+def test_batches_at_one_hundred_keys() -> None:
+    edges = [_jira_edge("RAC-1", f"PROJ-{n}") for n in range(1, 102)]
+    client = FakeJiraClient(
+        existing={f"PROJ-{n}": ("Open", "new") for n in range(1, 102)}
+    )
+    summary = AtlassianVerifier(client).verify(_graph(edges))
+    assert summary.checked == 101
+    assert [len(batch) for batch in client.batches] == [BULK_FETCH_BATCH, 1]
+
+
+def test_permission_hinted_error_classifies_as_forbidden() -> None:
+    client = FakeJiraClient(
+        errors={"PROJ-1": "you do not have permission to view this issue"}
+    )
+    summary = AtlassianVerifier(client).verify(_graph([_jira_edge("RAC-1", "PROJ-1")]))
+    assert summary.forbidden == 1
+    assert summary.missing == 0
+
+
+def test_auth_failure_marks_batch_forbidden() -> None:
+    client = FakeJiraClient(fail_auth=True)
+    summary = AtlassianVerifier(client).verify(_fixture_graph())
+    assert summary.forbidden == 2
+    assert summary.exit_code == 3
+
+
+def test_unparseable_target_is_skipped_not_checked() -> None:
+    client = FakeJiraClient()
+    summary = AtlassianVerifier(client).verify(
+        _graph([_jira_edge("RAC-1", "not a ticket")])
+    )
+    assert summary.checked == 0
+    assert summary.skipped == 1
+    assert summary.exit_code == 0
+
+
+def test_dry_run_needs_no_client_and_makes_no_calls() -> None:
+    summary = AtlassianVerifier().verify(_fixture_graph(), dry_run=True)
+    assert summary.dry_run is True
+    assert summary.checked == 2
+    assert summary.exit_code == 0  # a plan has no findings
+    assert any(action.startswith("check PROJ-123") for action in summary.actions)
+    assert any("bulk-fetch batch" in action for action in summary.actions)
+
+
+def test_live_verify_without_client_is_a_clear_error() -> None:
+    with pytest.raises(RuntimeError, match="client_from_env"):
+        AtlassianVerifier().verify(_fixture_graph())
+
+
+def test_empty_graph_verifies_clean() -> None:
+    graph = parse_graph(json.dumps({"source": "rac", "nodes": [], "edges": []}))
+    summary = AtlassianVerifier(FakeJiraClient()).verify(graph)
+    assert summary.checked == 0
+    assert summary.exit_code == 0
diff --git a/tests/test_cli_atlassian.py b/tests/test_cli_atlassian.py
new file mode 100644
index 0000000..4d4dc3d
--- /dev/null
+++ b/tests/test_cli_atlassian.py
@@ -0,0 +1,141 @@
+"""End-to-end CLI behaviour for the `rac-connect atlassian` verbs."""
+
+from __future__ import annotations
+
+import io
+import json
+from pathlib import Path
+
+import pytest
+
+from rac_connectors import cli
+
+_FIXTURE = Path(__file__).parent / "fixtures_graph_atlassian.json"
+
+_ATLASSIAN_ENV = (
+    "ATLASSIAN_BASE_URL",
+    "ATLASSIAN_EMAIL",
+    "ATLASSIAN_API_TOKEN",
+)
+
+
+def _clear_env(monkeypatch) -> None:
+    for var in _ATLASSIAN_ENV:
+        monkeypatch.delenv(var, raising=False)
+
+
+def test_verify_dry_run_needs_no_credentials(monkeypatch, capsys) -> None:
+    _clear_env(monkeypatch)
+    monkeypatch.setattr("sys.stdin", io.StringIO(_FIXTURE.read_text()))
+    rc = cli.main(["atlassian", "verify", "--dry-run"])
+    assert rc == 0
+    out = capsys.readouterr()
+    assert "check PROJ-123" in out.out
+    assert "2 checked" in out.err
+
+
+def test_verify_live_without_credentials_exits_two(monkeypatch, capsys) -> None:
+    _clear_env(monkeypatch)
+    monkeypatch.setattr("sys.stdin", io.StringIO(_FIXTURE.read_text()))
+    rc = cli.main(["atlassian", "verify"])
+    assert rc == 2
+    err = capsys.readouterr().err
+    assert "ATLASSIAN_API_TOKEN" in err
+
+
+def test_verify_malformed_graph_exits_one(monkeypatch, capsys) -> None:
+    monkeypatch.setattr("sys.stdin", io.StringIO("{not json"))
+    rc = cli.main(["atlassian", "verify", "--dry-run"])
+    assert rc == 1
+    assert "error:" in capsys.readouterr().err
+
+
+def test_verify_findings_exit_three(monkeypatch, capsys) -> None:
+    class FindingVerifier:
+        name = "atlassian"
+
+        def verify(self, graph, *, dry_run=False):
+            from rac_connectors.base import VerifySummary
+
+            summary = VerifySummary(backend="atlassian")
+            summary.record_missing("PROJ-404", "issue does not exist <- RAC-2")
+            return summary
+
+    monkeypatch.setattr(cli, "AtlassianVerifier", lambda client=None: FindingVerifier())
+    monkeypatch.setattr(cli, "atlassian_client_from_env", lambda: object())
+    monkeypatch.setattr("sys.stdin", io.StringIO(_FIXTURE.read_text()))
+    rc = cli.main(["atlassian", "verify"])
+    assert rc == 3
+    out = capsys.readouterr()
+    assert "missing PROJ-404" in out.out  # findings print without --verbose
+    assert "1 missing" in out.err
+
+
+def test_verify_reads_input_file(tmp_path, capsys) -> None:
+    path = tmp_path / "graph.json"
+    path.write_text(_FIXTURE.read_text(), encoding="utf-8")
+    rc = cli.main(["atlassian", "verify", "--dry-run", "--input", str(path)])
+    assert rc == 0
+    assert "check PROJ-123" in capsys.readouterr().out
+
+
+def test_verify_warns_on_contract_major_mismatch(monkeypatch, capsys) -> None:
+    payload = json.loads(_FIXTURE.read_text())
+    payload["schema_version"] = "2"
+    monkeypatch.setattr("sys.stdin", io.StringIO(json.dumps(payload)))
+    with pytest.warns(UserWarning, match="schema_version"):
+        rc = cli.main(["atlassian", "verify", "--dry-run"])
+    assert rc == 0
+
+
+def test_atlassian_requires_a_verb() -> None:
+    with pytest.raises(SystemExit):
+        cli.main(["atlassian"])
+
+
+_DOCS = Path(__file__).parent / "fixtures_documents.jsonl"
+
+
+def test_publish_dry_run_needs_no_credentials_or_space(monkeypatch, capsys) -> None:
+    _clear_env(monkeypatch)
+    monkeypatch.delenv("ATLASSIAN_CONFLUENCE_SPACE", raising=False)
+    monkeypatch.setattr("sys.stdin", io.StringIO(_DOCS.read_text()))
+    rc = cli.main(["atlassian", "publish", "--dry-run"])
+    assert rc == 0
+    out = capsys.readouterr()
+    assert "would upsert page" in out.out
+    assert "pushed" in out.err
+
+
+def test_publish_live_without_space_exits_two(monkeypatch, capsys) -> None:
+    _clear_env(monkeypatch)
+    monkeypatch.delenv("ATLASSIAN_CONFLUENCE_SPACE", raising=False)
+    monkeypatch.setattr("sys.stdin", io.StringIO(_DOCS.read_text()))
+    rc = cli.main(["atlassian", "publish"])
+    assert rc == 2
+    assert "ATLASSIAN_CONFLUENCE_SPACE" in capsys.readouterr().err
+
+
+def test_publish_live_without_credentials_exits_two(monkeypatch, capsys) -> None:
+    _clear_env(monkeypatch)
+    monkeypatch.setattr("sys.stdin", io.StringIO(_DOCS.read_text()))
+    rc = cli.main(["atlassian", "publish", "--space", "DOCS"])
+    assert rc == 2
+    assert "ATLASSIAN_API_TOKEN" in capsys.readouterr().err
+
+
+def test_publish_skips_malformed_line_and_reports(monkeypatch, capsys) -> None:
+    lines = _DOCS.read_text() + '{"id": ""}\n'
+    monkeypatch.setattr("sys.stdin", io.StringIO(lines))
+    rc = cli.main(["atlassian", "publish", "--dry-run"])
+    assert rc == 0
+    out = capsys.readouterr()
+    assert "skip line" in out.out
+
+
+def test_publish_strict_fails_on_malformed_line(monkeypatch, capsys) -> None:
+    lines = _DOCS.read_text() + '{"id": ""}\n'
+    monkeypatch.setattr("sys.stdin", io.StringIO(lines))
+    rc = cli.main(["atlassian", "publish", "--dry-run", "--strict"])
+    assert rc == 1
+    assert "error:" in capsys.readouterr().err
diff --git a/tests/test_graph.py b/tests/test_graph.py
index de32e13..fa5f4df 100644
--- a/tests/test_graph.py
+++ b/tests/test_graph.py
@@ -67,6 +67,58 @@ def test_edge_flags_default_when_absent() -> None:
     edge = parse_graph(json.dumps(payload)).edges[0]
     assert edge.directed is True  # additive-tolerant defaults
     assert edge.resolved is True
+    assert edge.external is False
+    assert edge.provider is None
+
+
+def test_external_edge_carries_provider() -> None:
+    payload = {
+        "source": "rac",
+        "nodes": [],
+        "edges": [
+            {
+                "source": "RAC-1",
+                "target": "PROJ-123",
+                "type": "related_tickets",
+                "directed": False,
+                "resolved": False,
+                "external": True,
+                "provider": "jira",
+            },
+            {
+                "source": "RAC-1",
+                "target": "tests/test_thing.py",
+                "type": "verified_by",
+                "directed": True,
+                "resolved": False,
+                "external": True,
+                "provider": None,
+            },
+        ],
+    }
+    ticket, verifier = parse_graph(json.dumps(payload)).edges
+    assert ticket.external is True
+    assert ticket.provider == "jira"
+    assert verifier.external is True
+    assert verifier.provider is None  # verified_by is never provider-tagged
+
+
+def test_non_string_provider_tolerated_as_none() -> None:
+    payload = {
+        "source": "rac",
+        "nodes": [],
+        "edges": [
+            {
+                "source": "A",
+                "target": "B",
+                "type": "related_tickets",
+                "external": True,
+                "provider": 7,
+            }
+        ],
+    }
+    edge = parse_graph(json.dumps(payload)).edges[0]
+    assert edge.provider is None
 
 
 def test_empty_payload_is_malformed() -> None: