identity: service facade api.sx — login/verify/revoke/logout (10 tests, Phase 1 complete)

identity:start() spawns one coordinator owning the token table + session
registry and exposes the whole-domain ops. The coordinator is the owner
sessions notify on idle timeout, so an expired session deregisters itself
— timeout-driven, never swept. verify/2 answers identity only ({active,
Subject, Client, Scope}); permission is delegated to acl. 39/39.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/identity-on-sx.md

@@ -19,7 +19,7 @@ through the event log, all authorization questions delegated to `acl-on-sx`.
 
 ## Status (rolling)
 
-`bash lib/identity/conformance.sh` → **29/29** (Phase 1: session, token, registry)
+`bash lib/identity/conformance.sh` → **39/39** (Phase 1 complete: session, token, registry, api)
 
 ## Ground rules
 
@@ -60,7 +60,7 @@ lib/identity/api.sx ── (identity/login) (identity/grant?) (identity/revoke)
 - [x] `session.sx` — session process, create/lookup/expire
 - [x] `token.sx` — issue/introspect/revoke (opaque, grant-backed)
 - [x] `registry.sx` — route by subject/client
-- [ ] `api.sx` + tests + scoreboard + conformance.sh
+- [x] `api.sx` + tests + scoreboard + conformance.sh
 
 ## Phase 2 — OAuth2 flows
 - [ ] authorization-code flow as a message protocol
@@ -78,6 +78,13 @@ lib/identity/api.sx ── (identity/login) (identity/grant?) (identity/revoke)
 - [ ] tests: audit completeness, cross-instance subject mapping
 
 ## Progress log
+- 2026-06-06 — `api.sx`: service facade. `identity:start()` spawns one
+  coordinator owning the token table + session registry; exposes
+  login/verify/revoke/logout/session_status. Coordinator is the sessions'
+  owner, so an expired session deregisters itself (timeout-driven, no
+  sweep). `verify` answers IDENTITY only ({active, Subject, Client, Scope});
+  permission is acl's job — explicit delegation boundary. **Phase 1 complete.**
+  +10 → 39/39.
 - 2026-06-06 — `registry.sx`: directory process routing sessions by id and
   by (subject, client). Answers the SSO probe `lookup(Subject, Client)` and
   the fan-out `sessions_for(Subject)` (one subject, many clients). Routes