giles 785faf2441 identity: delegated grant-verification cache with generation invalidation (Phase 3 complete, +9) ...

cache.sx — a process wrapping the token registry, memoising introspect.
Revocation stays real via generation invalidation: any revoke/refresh bumps
a generation counter, so every cached positive instantly becomes a miss and
re-validates against the live registry. A revoked token never reads valid
out of cache, not for a millisecond. stats() exposes hits/misses. New
tests/cache.sx. 101/101.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-07 01:03:57 +00:00

..

api.sx

identity: service facade api.sx — login/verify/revoke/logout (10 tests, Phase 1 complete)

2026-06-07 00:00:05 +00:00

cache.sx

identity: delegated grant-verification cache with generation invalidation (Phase 3 complete, +9)

2026-06-07 01:03:57 +00:00

membership.sx

identity: membership state machine + per-app grant projection (17 tests)

2026-06-07 00:54:51 +00:00

oauth.sx

identity: wire refresh into oauth + e2e flow tests (Phase 2 complete, +3 tests)

2026-06-07 00:35:10 +00:00

registry.sx

identity: session registry — route by id and (subject, client) + SSO fan-out (9 tests)

2026-06-06 23:55:34 +00:00

session.sx

identity: session-as-process — create/lookup/expire/revoke + idle timeout (11 tests)

2026-06-06 23:45:50 +00:00

sso.sx

identity: silent SSO prompt=none fast-path — one session, many clients (10 tests)

2026-06-07 00:45:15 +00:00

token.sx

identity: refresh-token rotation + cascading revocation (token.sx grant-centric, +9 tests)

2026-06-07 00:26:05 +00:00