identity: OAuth2 authorization-code flow as message protocol + PKCE (14 tests)

oauth.sx — RFC 6749 §4.1 as a state machine on one authz-server process:
authorize → {consent_required} → consent(allow|deny) → {code} → exchange
→ {ok, Token}. Exchange enforces single-use codes (§10.5, replay →
invalid_grant), client_id + redirect_uri binding (§4.1.3), and PKCE
(RFC 7636 plain) verifier match. Issued tokens are grant-backed via
token.sx so revocation stays real. 53/53.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/identity-on-sx.md

@@ -19,7 +19,7 @@ through the event log, all authorization questions delegated to `acl-on-sx`.
 
 ## Status (rolling)
 
-`bash lib/identity/conformance.sh` → **39/39** (Phase 1 complete: session, token, registry, api)
+`bash lib/identity/conformance.sh` → **53/53** (Phase 1 + authz-code flow)
 
 ## Ground rules
 
@@ -63,7 +63,7 @@ lib/identity/api.sx ── (identity/login) (identity/grant?) (identity/revoke)
 - [x] `api.sx` + tests + scoreboard + conformance.sh
 
 ## Phase 2 — OAuth2 flows
-- [ ] authorization-code flow as a message protocol
+- [x] authorization-code flow as a message protocol
 - [ ] refresh + rotation; revocation cascades to issued tokens
 - [ ] tests: full code exchange, refresh, revoke-then-use (must fail)
 
@@ -78,6 +78,13 @@ lib/identity/api.sx ── (identity/login) (identity/grant?) (identity/revoke)
 - [ ] tests: audit completeness, cross-instance subject mapping
 
 ## Progress log
+- 2026-06-07 — `oauth.sx`: OAuth2 authorization-code flow as a message
+  protocol (RFC 6749 §4.1) + PKCE (RFC 7636, plain). State machine on one
+  authz-server process: authorize → {consent_required} → consent →
+  {code} → exchange → {ok, Token}. Exchange enforces single-use codes
+  (§10.5; removed on first attempt, replay → invalid_grant), client_id +
+  redirect_uri binding (§4.1.3), and PKCE verifier match. Issued tokens are
+  grant-backed so revocation stays real. +14 → 53/53.
 - 2026-06-06 — `api.sx`: service facade. `identity:start()` spawns one
   coordinator owning the token table + session registry; exposes
   login/verify/revoke/logout/session_status. Coordinator is the sessions'