P2.1: Detector — JWT verify-options key extraction

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P2

Goal

Extend the JWT detector to extract structured verify-call options as evidence so P2.2–P2.5 classifier rules can reason about them.

Acceptance criteria

• Verify-call option keys extracted from jsonwebtoken, jose, and PyJWT callsites: algorithms, algorithm, audience, issuer, subject, nonce, clockTolerance, clockTimestamp, complete, ignoreNotBefore, ignoreExpiration and their library-specific equivalents.
• Each option key emits its own evidence record with a stable detector ID like jwt.option.algorithms.
• Library expansion (python-jose, authlib) is explicitly out of scope and documented in a Future Work note in the issue's resolution comment.
• Existing JWT detector behaviour preserved — no regression in the 33 existing fixtures.

Files touched

• crates/sessionscope-detectors/src/jwt/mod.rs (extend; consider splitting into jwt/options.rs if helpful)

New detector IDs

• jwt.option.algorithms
• jwt.option.audience
• jwt.option.issuer
• jwt.option.subject
• jwt.option.nonce
• jwt.option.clock_tolerance
• jwt.option.clock_timestamp
• jwt.option.complete
• jwt.option.ignore_not_before
• jwt.option.ignore_expiration

Fixture expectations

• Fixtures exercising each option across all three libraries — included in P2.6 fixture work.

Audit-then-decide

No new finding category needed — this issue only adds evidence.

Doc-update checklist

• docs/USAGE.md lists the new evidence detector IDs under JWT.
• Coverage-matrix entries deferred until P2.2–P2.5 land findings.

[bjcorder]

Implemented in 89d4410.

Summary:

• Added artifact-bound JWT verify option evidence for jsonwebtoken, jose, and PyJWT.
• Emitted jwt.option.* evidence IDs for algorithms, issuer, audience, subject, nonce, clock tolerance/timestamp, complete, ignore-not-before, and ignore-expiration options.
• Added focused detector tests covering jsonwebtoken, jose, and PyJWT option extraction while preserving redaction boundaries.

Validation:

• cargo fmt --check — passed
• cargo test -q -p sessionscope-detectors jwt:: --no-fail-fast — passed
• cargo test -q -p sessionscope-testing jwt_fixtures_scan_with_builtin_jwt_detector — passed

Notes / follow-ups:

• python-jose and authlib JWT validation paths remain out of scope for this milestone, per issue scope.

[bjcorder]

Follow-up implemented in 96cd421.

Summary:

• Hardened JWT option/key-reference evidence so nonce/subject option literals and embedded key string literals are not persisted or rendered.\n- Added regression coverage for sensitive option/key-reference redaction.

Validation:

• cargo fmt --check — passed
• cargo test -q -p sessionscope-detectors jwt:: --no-fail-fast — passed
• cargo test -q -p sessionscope-classifier jwt:: --no-fail-fast — passed
• cargo test -q -p sessionscope-testing jwt_crypto_trust -- --nocapture — passed
• cargo test -q -p sessionscope-testing fixture_cases_have_expected_metadata_and_sources — passed

Notes / follow-ups:

• None.

[bjcorder]

Implemented in PR #97: #97

Implementation commits:

• 89d4410 — Fix P2.1: Detector — JWT verify-options key extraction #70: P2.1 Detector — JWT verify-options key extraction
• 29e366c — Fix P2.2: Classifier — JWT alg:none acceptance #71: P2.2 Classifier — JWT alg:none acceptance
• bd0e318 — Fix P2.3: Classifier — JWT algorithm-confusion signal (HMAC + asymmetric) #72: P2.3 Classifier — JWT algorithm-confusion signal
• ddc731f — Fix P2.4: Classifier — JWT header-trust risks (jku, x5u, embedded JWK) #73: P2.4 Classifier — JWT header-trust risks
• 1570716 — Fix P2.5: Classifier — nbf, clock-skew, kid validation gaps #74: P2.5 Classifier — nbf, clock-skew, kid validation gaps
• 68a1e05 — Fix P2.6: Fixtures — JWT crypto-trust scenarios #75: P2.6 Fixtures — JWT crypto-trust scenarios
• c82b4aa — Fix P2.7: Docs — P2 check catalog and coverage matrix rows #76: P2.7 Docs — P2 check catalog and coverage matrix rows
• 96cd421 — Fix P2.4: Classifier — JWT header-trust risks (jku, x5u, embedded JWK) #73: Address JWT crypto-trust review findings
• bf9b3da — Fix P2.4: Classifier — JWT header-trust risks (jku, x5u, embedded JWK) #73: Keep JWT verify helper clippy-clean

Validation:

• cargo fmt --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed
• cargo test --workspace --all-targets — passed

Closure status:

• This issue is ready to close when the PR is merged.

Remaining notes:

• P2.3/P2.4 category audit remains deferred to P4.8; no new category was introduced in this PR.