identity: device authorization grant (RFC 8628, +10 tests)

device.sx — for input-constrained devices. authorize → {device_code,
user_code}; the human approves/denies out-of-band by user_code; the device
polls by device_code through the §3.5 status machine (authorization_pending
→ access_denied / {ok, Token}). Device code is single-use once a token
issues; approve-after-deny is rejected. Tokens grant-backed via token.sx.
Device-code expiry + slow_down deferred (no wall clock). New
tests/device.sx. 168/168.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/identity-on-sx.md

@@ -19,7 +19,7 @@ through the event log, all authorization questions delegated to `acl-on-sx`.
 
 ## Status (rolling)
 
-`bash lib/identity/conformance.sh` → **158/158** (4 phases + ext: scope, TTL, clients, client-creds)
+`bash lib/identity/conformance.sh` → **168/168** (4 phases + 6 ext incl device grant)
 
 ## Ground rules
 
@@ -82,12 +82,19 @@ lib/identity/api.sx ── (identity/login) (identity/grant?) (identity/revoke)
 - [x] access-token TTL / `expires_in` — logical-clock expiry, introspect honours it
 - [x] scope as a set + scope narrowing on refresh (RFC 6749 §6)
 - [x] client registry: public vs confidential clients, client authentication (RFC 6749 §2)
-- [~] client-credentials grant (RFC 6749 §4.4) DONE; device grant (RFC 8628) pending
+- [x] client-credentials grant (RFC 6749 §4.4) + device grant (RFC 8628)
 - [ ] acl-on-sx delegation: wire `verify`/membership projection → an acl decision, integration test
 - [ ] OAuth `state` (CSRF) + OIDC `nonce` threaded through authorize→exchange
 - [ ] unify `api.sx` over oauth + membership + audit (one facade, audited login/consent)
 
 ## Progress log
+- 2026-06-07 — `device.sx` (ext, RFC 8628): device authorization grant for
+  input-constrained devices. authorize → {device_code, user_code}; the human
+  approve/deny out-of-band by user_code; the device polls by device_code
+  through the §3.5 status machine (authorization_pending → access_denied /
+  {ok,Token}). Device code is single-use once a token issues; guarded
+  transitions (approve-after-deny rejected). Tokens grant-backed. Device-code
+  expiry + slow_down deferred (no wall clock). New tests/device.sx (10). 158→168.
 - 2026-06-07 — client-credentials grant (ext, RFC 6749 §4.4): `oauth.sx` now
   owns a client registry (loop/6); `register_client` + `client_credentials`.
   A confidential client authenticates and gets a token acting on its own