Broker derives module access from the login session by scoped refresh

[kanushka]

Parent

Part of #17.

What to build

The definitive chain: after wso2 login, a reference module command receives a real, issuer-minted access token through the authentication broker, narrowed to exactly the scopes it requested and bound to its product's audience — proven by the issuer's introspection endpoint and by the bearer token the status service records receiving.

The broker resolves a token source per identity kind behind an internal seam (the development fixture source remains, restricted to the reference namespace). The oauth-browser source derives access by scoped refresh: the refresh grant carries exactly the module's requested scopes, the shell verifies the effective scopes equal the request and the token's audience covers the product's audience, and any shortfall — narrowing ignored, rejected, or wrong audience — is a typed narrowing-unavailable refusal, never a broader grant. Rotated refresh tokens are persisted under the session lock before the grant is returned.

New broker policy refusals: product not configured on the identity (or mismatched audience/scopes against the product entry), organization differing from the identity's home tenant (organization switch unsupported), stored session missing (login required) or minted by a different issuer (session issuer mismatch), and kind not implemented for device/PAT.

Detailed steps: implementation plan docs/superpowers/plans/2026-08-05-login-first-slice.md, Tasks 8–9 and 11.

Acceptance criteria

• Login then wso2 reference status yields a token the fake issuer's introspection confirms active, with exactly the requested scope and the product audience — asserted from the status service's recorded bearer token, never by printing it
• A second invocation succeeds after refresh-token rotation (rotated token persisted; old one invalid)
• Issuer "ignore" and "reject" narrowing modes, and a mismatched registered audience, each produce auth.narrowing_unavailable with no grant
• A module run without a prior login refuses auth.login_required naming wso2 login; a context targeting a non-home organization refuses auth.organization_switch_unsupported
• Existing development-credential broker behavior and its acceptance tests still pass
• A disclosure sweep finds no token material on any output surface of login or module runs
• go test ./... -race passes

Blocked by

• wso2 login: browser Authorization Code + PKCE end to end #20

[kanushka]

This was generated by AI during triage.

Implemented by PR #27, merged into feature/login (full stack landed; feature/login tip is the PR #29 merge). Auto-close did not fire because closing keywords only act on merges to the default branch — closed manually.