identity: grant audit ledger — issue/refresh/revoke events, queryable per subject (10 tests)

audit.sx is an append-only ledger process. token.sx gains start/1(Audit)
and emits an event on every grant transition (issue, refresh, revoke —
including reuse-triggered revoke); start/0 stays unaudited so existing use
is unchanged (token.sx has no compile-time dep on the audit module, it just
sends to a pid). The ledger answers (identity/audit subject) via
audit/actions/count/all, chronological. In-memory event stream; persist
backing is a later Erlang<->persist bridge, out of scope. 111/111.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/identity-on-sx.md

@@ -19,7 +19,7 @@ through the event log, all authorization questions delegated to `acl-on-sx`.
 
 ## Status (rolling)
 
-`bash lib/identity/conformance.sh` → **101/101** (Phases 1–3 complete)
+`bash lib/identity/conformance.sh` → **111/111** (Phases 1–3 + audit ledger)
 
 ## Ground rules
 
@@ -73,11 +73,19 @@ lib/identity/api.sx ── (identity/login) (identity/grant?) (identity/revoke)
 - [x] grant verification delegated cache (mirror Redis-cache pattern)
 
 ## Phase 4 — Audit + federation
-- [ ] every issue/refresh/revoke is a `persist` event; `(identity/audit subject)`
+- [x] every issue/refresh/revoke is a `persist` event; `(identity/audit subject)`
 - [ ] federated identity (peer-asserted subject) — advisory, trust-gated stub
 - [ ] tests: audit completeness, cross-instance subject mapping
 
 ## Progress log
+- 2026-06-07 — `audit.sx`: append-only grant audit ledger (an Erlang
+  process). `token.sx` gains `start/1(Audit)` and emits issue/refresh/revoke
+  events (incl. reuse-triggered revoke); `start/0` stays unaudited (no
+  regression — token.sx has no compile-time dep on the audit module, just
+  sends to a pid). Ledger queryable per subject — `audit`/`actions`/`count`/
+  `all`, chronological. In-memory event stream (persist-backing is a future
+  Erlang↔persist bridge, out of scope per loop allowance). New
+  tests/audit.sx (10). +10 → 111/111.
 - 2026-06-07 — `cache.sx`: delegated grant-verification cache (Redis-cache
   pattern) wrapping the token registry. introspect memoised; generation
   invalidation keeps revocation real — any revoke/refresh bumps a generation