[cariandrum22]

Summary

Preserve the stored token subject as sub and omit username from active JSON and signed introspection responses. RFC 7662 section 2.2 gives these optional fields distinct meanings; a stored subject does not establish a human-readable username source. Client-credentials tokens retain their machine subject, and inactive responses remain false-only.

The public TokenValidator::introspect_token helper now returns sub in place of its former username field. The implementation preserves exact opaque, readable and Unicode subject bytes without normalization, inference, user lookup or additional disclosure permission.

Validation

The consolidated source passes all 504 standard container tests: 137 Redis, 257 PostgreSQL, one dynamic-registration and 109 combined-service tests. Each expected test executes once, including the new subject regression in the combined PostgreSQL/Redis lane. Its name follows the established shared_redis convention. All owned test containers were removed.

All 55 selected recipient, introspection and stored-JWT tests pass on the same source. Routed controls cover JSON and independently verified signed responses, issued client-credentials machine subjects, exact Unicode/opaque subjects, denied owners and unknown/revoked/expired records. Local-helper tests verify the sub transition and continued client-credentials refusal. The inherited #129 parser-policy guard and #133 recipient-test formatting corrections are included.

Both Clippy packages, formatting, changed-file hooks, strict proof references and runtime drift pass. Commands include nix build .#database-tests .#lint-supplemental-clippy .#lint-server-clippy-inventory-dev, the source-bound executable with signed_recipient, introspection and stored_jwt filters, and scripts/tests/run_server_container_integration.sh all. Fresh public-head CI and Copilot review are required after consolidation.

Upgrade and scope

Depends on #133. This branch adds one signed subject-claim commit above the consolidated predecessor. Local-helper consumers reading subjects from username must migrate to sub; HTTP responses already expose sub. No migration or token rewrite is required. The helper remains a local stored-status API without online requester authorization and still refuses client-credentials records.

Aegaeon omits username because it has no dedicated username source. Broader JSON entitlement, authentication interpretation, privacy/scope and response protection remain separate obligations. Finite tests do not establish a complete feature/issuance matrix, deployment behavior or formal/product assurance.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation consistently updates both introspection paths with comprehensive coverage and aligned documentation.

Review effort: Balanced
Findings: None

What changed in this PR

Updates introspection responses to preserve token subjects in sub while omitting unsupported username claims.

Changes:

• Removes username from active HTTP and signed introspection responses.
• Migrates the public local helper from username to sub.
• Adds subject-preservation tests and compliance documentation.

File	Description
spec/​compliance-matrix.yaml	Records subject-claim behavior and evidence.
docs/​operations/​oauth-conformance.md	Documents semantics and compatibility impact.
crates/​server/​src/​web/​token_lifecycle/​tests/​subject.rs	Tests exact subject preservation.
crates/​server/​src/​web/​token_lifecycle/​tests/​schema.rs	Verifies username omission.
crates/​server/​src/​web/​token_lifecycle/​tests.rs	Registers the subject tests.
crates/​server/​src/​web/​token_lifecycle/​introspection.rs	Removes the HTTP username claim.
crates/​server/​src/​web/​token_client_credentials/​tests/​signed_introspection.rs	Covers machine subjects and signed responses.
crates/​server/​src/​authcode/​token/​validator.rs	Returns sub from local introspection.
crates/​server/​src/​authcode/​token/​tests/​local_introspection.rs	Tests local helper subject behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the introspection subject, stored-JWT verification, and signed-recipient changes.

No open issues 🎉

_{Review effort: Balanced}