[Enhancement]: Identity required enforcement in Spectrum / CLI run path

[rosspeili]

Area (optional)

core framework

Problem or use case

#55 adds identity_required config and IdentityRequiredError. Enterprise full-bind posture should wire this into Spectrum (#27) and aura run so regulated projects fail fast when no verified operator is present.

Proposed behavior

• Spectrum preset full-bind sets identity_required: true by default
• aura run documents required env vars (AURA_OIDC_TOKEN, etc.)
• Audit report finding when session ran without verified operator but policy expected one
• CLI --require-identity flag override for one-off runs

Alternatives considered (optional)

Always require identity globally — rejected; breaks OSS zero-config path.

[rosspeili]

Status update (Sep 2026): Spectrum enforcement is on main (#27 closed via #76). aura agent show includes effective_spectrum; spectrum.level drives egress bind.

Unblocked for:

• identity_required on full posture
• aura run fail-fast when verified operator required but missing
• Audit report finding when policy expected verified operator
• Optional CLI --require-identity

Blocked only on #55 (already shipped #69).