core-identity-and-trust-architecture

# Identity and Trust Architecture Identity is the perimeter. Once a token is issued, a role is assigned, or a service-to-service call is trusted, every downstream component inherits that decision — silently, transitively, and usually without re-checking. Get it wrong and the audit trail becomes fiction: the logs show "user X did Y" when in fact "anyone holding a year-old refresh token did Y as user X." This skill codifies the rules that prevent that drift. Violations of the hard rules below are VETO-floor candidates: post-Wave-1c, the identity-trust- architect archetype's sign-off becomes mandatory on any L3+ change touching authentication, authorization, token issuance/validation, role hierarchy, S2S trust, or external-IdP integration. In v1.14.0 (pre-Wave-1c), the `identity-trust-architect` slug is NOT yet in `_lib/agent_frontmatter.VETO_FLOOR_ROLES` — the atomic add lands in the Wave 1c GPG sentinel ceremony alongside the corresponding agent file (per S90 P0-01 invariant). Until that ceremony ships, identity changes route through `security-engineer` (which IS VETO-floor) plus Owner gate. ## What This Skill Is (and isn't) This skill **EXTENDS** `core/security-and-auth` for the identity sub-domain. The parent skill covers the broader security posture (OWASP Top 10, CORS, WebSocket auth, CSRF, RLS, rate limiting). This skill focuses tightly on the **identity and trust** layer: - **In scope:** token lifecycle (issuance, validation, rotation, revocation), authorization mo...