P4.1: Classifier — JWT denylist absent on logout

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P4

Goal

Fire a finding when a logout handler is detected for an app that issues JWTs but no evidence of denylist/blocklist/revocation-store insertion is linked.

Acceptance criteria

• jwt_denylist_absent_on_logout_review fires when:
  • the lifecycle linker has connected a logout-stage evidence to a session/access-JWT artifact
  • no evidence of denylist insertion (e.g., redis.set, denyList.add, revokedTokens.insert, named helpers like revokeToken, addToBlocklist) is linked in the same scope or via classifier-linked helpers
• Evidence-bound: links the logout handler evidence and the JWT-issuance evidence.
• Review-required only — apps may rely on short-TTL JWTs intentionally.

New check IDs

• jwt_denylist_absent_on_logout_review

Files touched

• crates/sessionscope-classifier/src/lifecycle.rs

Fixture expectations

• Negative: logout handler with no denylist, JWT issued elsewhere.
• Positive: logout handler that calls a denylist helper.
• False-positive: app with short-TTL access tokens and refresh rotation only (review-required, with framework_default note).

Audit-then-decide

• Category: lifecycle_gap, severity medium.
• Feed into the consolidated P4.8 audit.

Doc-update checklist

• docs/USAGE.md check catalog.
• docs/COVERAGE_MATRIX.md row.
• CHANGELOG.md unreleased entry.

[bjcorder]

Implemented in a6a77a2.

Summary:

• Added jwt_denylist_absent_on_logout_review lifecycle classification for access-JWT logout flows without linked denylist/blocklist/revocation-store evidence.
• Added positive and clean-control generic TypeScript fixtures for logout without and with token revocation evidence.
• Updated fixture tests, check catalog, coverage matrix, and changelog entry for the new check.

Validation:

• cargo fmt --check — passed
• cargo test -q -p sessionscope-classifier jwt_logout — passed
• cargo test -q -p sessionscope-classifier linked_jwt_revoke — passed
• cargo test -q -p sessionscope-testing jwt_logout — passed
• cargo test -q -p sessionscope-testing — passed

Notes / follow-ups:

• None