P4.4: Classifier — password-change without global revocation

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P4

Goal

Fire a finding when a password-change handler is detected but no evidence of global session invalidation, refresh-family revocation, or token-version bump is linked.

Acceptance criteria

• password_change_global_revocation_absent_review fires when:
  • a password-change handler is detected (existing reset/password lifecycle evidence)
  • no evidence of global revocation (revokeAllSessions, bumpTokenVersion, delete refresh_tokens where user_id, cycle_key cascade) is linked in the same scope
• Review-required.
• Existing django/password-change-refresh-revoke fixture should remain a positive case after this issue lands.

New check IDs

• password_change_global_revocation_absent_review

Files touched

• crates/sessionscope-classifier/src/lifecycle.rs

Fixture expectations

• Negative: password-change handler that only updates the password hash.
• Positive: password-change handler that calls a global-revocation helper.
• False-positive: standalone password-validation utility (not a handler) — no fire.

Audit-then-decide

• Category: lifecycle_gap, severity medium.
• Feed into the consolidated P4.8 audit.

Doc-update checklist

• docs/USAGE.md check catalog.
• docs/COVERAGE_MATRIX.md row.
• CHANGELOG.md unreleased entry.

[bjcorder]

Implemented in 4ecbc68.

Summary:

• Added password_change_global_revocation_absent_review lifecycle classification for password-change handlers without linked global session invalidation, refresh-family revocation, or token-version bump evidence.
• Added source-bound password-change handler and global-revocation evidence detection while keeping standalone password-validation utilities out of scope.
• Added missing-global-revoke, global-revoke-control, and standalone-validation fixtures plus focused fixture tests.
• Updated the check catalog, coverage matrix, and changelog entry for the new check.

Validation:

• cargo fmt --check — passed
• cargo test -q -p sessionscope-classifier password_change — passed
• cargo test -q -p sessionscope-detectors password_change — passed
• cargo test -q -p sessionscope-testing password_change — passed
• cargo test -q -p sessionscope-testing password_validation — passed
• cargo test -q -p sessionscope-testing — passed

Notes / follow-ups:

• None

[bjcorder]

Follow-up review fix committed in 9a2fabd.

Summary:

• Tightened P4.4 suppression so current-session-only controls (logout.session_destroy, cycle_key / session regeneration) no longer count as global password-change revocation.
• Kept suppression limited to explicit global/session-family controls such as password_change.global_revoke, refresh-family/user revocation, and token-version bump evidence.
• Added a Django regression fixture for password change + current-session rotation/logout still producing password_change_global_revocation_absent_review.

Validation:

• cargo fmt --check — passed
• cargo test -q -p sessionscope-classifier current_session_rotation_does_not_prevent_password_change_gap — passed
• cargo test -q -p sessionscope-detectors detects_django_password_change_refresh_revocation — passed
• cargo test -q -p sessionscope-testing password_change_current_session_only — passed
• cargo test -q -p sessionscope-testing fixture_cases_have_expected_metadata_and_sources — passed
• Full final validation also passed: cargo check --workspace, cargo test -q, cargo clippy --workspace --all-targets -- -D warnings, and cargo test --workspace --all-targets.