identity: silent SSO prompt=none fast-path — one session, many clients (10 tests)

oauth.sx now owns a session registry. establish creates a subject session;
silent_authorize (OIDC prompt=none §3.1.2.1) asks "does this subject have a
live session?" — if yes it mints a code skipping consent, bound to client +
redirect_uri + PKCE exactly like a consented code; if no it returns
login_required (a negative state, not a login redirect). One session serves
many clients; end_session closes the fast-path. New tests/sso.sx. 75/75.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/identity-on-sx.md

@@ -19,7 +19,7 @@ through the event log, all authorization questions delegated to `acl-on-sx`.
 
 ## Status (rolling)
 
-`bash lib/identity/conformance.sh` → **65/65** (Phases 1–2 complete)
+`bash lib/identity/conformance.sh` → **75/75** (Phases 1–2 + silent SSO)
 
 ## Ground rules
 
@@ -68,7 +68,7 @@ lib/identity/api.sx ── (identity/login) (identity/grant?) (identity/revoke)
 - [x] tests: full code exchange, refresh, revoke-then-use (must fail)
 
 ## Phase 3 — Silent SSO + membership
-- [ ] `prompt=none` cross-app login (one session, many clients)
+- [x] `prompt=none` cross-app login (one session, many clients)
 - [ ] membership state + per-app grant projection
 - [ ] grant verification delegated cache (mirror Redis-cache pattern)
 
@@ -78,6 +78,12 @@ lib/identity/api.sx ── (identity/login) (identity/grant?) (identity/revoke)
 - [ ] tests: audit completeness, cross-instance subject mapping
 
 ## Progress log
+- 2026-06-07 — silent SSO (`prompt=none`, OIDC §3.1.2.1): `oauth.sx` now owns
+  a session registry; `establish` creates a subject session, `silent_authorize`
+  asks "does this subject have a live session?" → mints a code (skipping
+  consent) bound to client+redirect+PKCE, else `login_required`. Same machine,
+  fast-path — one session, many clients; `end_session` closes the path.
+  New `tests/sso.sx` (10). +10 → 75/75.
 - 2026-06-07 — `oauth.sx` refresh wiring + e2e: exchange now issues an
   access+refresh pair (RFC 6749 §4.1.4/§5.1) via token.sx issue_grant; added
   the refresh grant (§6) delegating to token rotation. End-to-end tests: