Task: Bring ores.security to the clean standard

ores.security passes the Component Clean Standard for a component of kind All.

• Every checklist item that applies to a component of kind All passes, with its evidence recorded on the task.
• Every item that does not apply is recorded as not applicable, with the reason.
• Every generator defect found is fixed at its source, with a regression test.
• ores.security is listed in COMPONENTS_UNDER_TEST, and check_component_drift.py --all passes.

Work the Component Clean Standard in its section order, one entity at a time, and record each item's result in the table below.

1. Baseline and inventory (B01 to B05). Record the baseline before any edit.
2. Models (M01 to M10).
3. Protocol (P01 to P06).
4. Generation (G01 to G06).
5. Wiring and data (W01 to W04).
6. Shell (S01, S02).
7. Structure and hygiene (H01 to H03).
8. Verification (V01 to V06), ending with the registry entry.

Survey, 2026-09-25, at trunk `5de59e3fb8`, by an agent that did not write the component. Cryptographic code, so an untested path here carries more weight than an untested path elsewhere.

• Scale. 16 production C++ files in 11 headers and 5 sources, with 6 files under `tests/`. 55 test cases, 127 assertions, and 448 files outside the component include it. Consumers include `ores.iam`'s account and signup services and its auth handler.
• Suites pass. `ores.security.tests` runs green, 127 assertions in 55 test cases.
• Keep the component. It is the repo's only home for hashing, JWT and the OWASP validators.

The survey was checked against the tree before any edit. Eight of its findings held as written. Two did not: `encryption` turned out to have no reference anywhere, not even its own test being a consumer of anything but the test, and the `jwt_error::missing_claims` enumerator is not so much dead as unreachable, which is a different defect with a different fix.

Three files and 432 lines left the component, and the suite lost the eight cases that covered the deleted class.

`ores.security.hpp` is not in this table. The first cut of this pass deleted it as a consumer-less stub, and that was wrong: every component keeps a namespace documentation header, its content is an empty namespace plus the `@brief` doxygen renders, and the diagram conventions read that `@brief` when they label the component. The standard's G02 said dead headers go and did not exempt them; G08 now says so explicitly, and the header is restored with its claims corrected. The same mistake was made on the ores.utility pass, where eleven namespace headers were deleted, and is corrected there separately.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

ores.security meets the standard for the items that apply to a model-free component. All ten work items landed across five `[security]` commits: the deletions, the JWT fixes, the hasher fixes, the overview and diagram, and the restored namespace header.

The component lost three files and 432 lines: an AES-256-GCM and PBKDF2 surface nothing referenced, its test, and two declarations that were never defined. It gained the tests the survey asked for and the answers to two questions the survey could not settle: the error codes the enum declares now have producers, and the refresh path now checks the audience the way the strict path does.

Its suite went from 127 assertions in 55 test cases to 149 in 57. Ten cases arrived, the eight that covered the deleted class left, and the surviving cases are stronger for the cost floor, the stored format, the empty-input refusal, and the four JWT failure paths.

Three things stay as recorded. `nbf` cannot be tested because `create_token` never sets it. `crypto/encryption` is gone rather than kept as an unused capability, on the standing rule. And the registry gap stands: no catalogue row and no models, so V06 is the accepted exception.

One correction to the record's own count: the fifth commit restores the namespace header the first commit should not have deleted, so the pass ends with five `[security]` commits rather than four.

An independent verifier checked the branch and the review met it. The verifier's round posted PASS on `285042a2ed`, and it did something the record had called impossible: rather than accept that the pre-change baseline could not be measured, it checked the base versions of the changed files out of `230006c221`, rebuilt, and measured 127 assertions in 55 test cases exactly, against 149 in 57 at the head. It proved all four JWT fixes load-bearing by reverting each separately (two, one and one failures), the scrypt floor by removing it and watching the control fail, and the cache claim by restoring the function-local static.

The PR review raised one more item, a weak assertion in `jwt_authenticator_validate_invalid_hs256_signature` that accepted either `invalid_signature` or `invalid_token`. Both are in Review rows 6 and 7 and fixed in `b7d6fadb75`, which the verifier's round did not cover because it post-dated the verdict.

PR #2162 merged as `b2e6c069db` on 2026-09-26 with every CI check green.