feat(auth): define explicit issuer trust policy

[seonghobae]

Objective

Advance issue #314 with a path-disjoint trust-profile value object stacked on #343. A provider-specific verifier must receive server-owned issuer, audience, and algorithm policy rather than deriving trust from an untrusted bearer credential.

Test-first state

This Draft starts intentionally RED at test-only head 2442db427b475f38d6c8a58239ae622cdcbb06cb. IssuerTrustPolicyTest requires an immutable policy with explicit HTTPS issuer, audience, and non-empty algorithm allowlist; it rejects missing/ambiguous issuer authority and implicit/unsafe algorithm policy. The production type does not exist at this head, so Maven test compilation is expected to fail at that exact boundary.

Stack and scope

Base is #343 exact head bc4418b4d1a88adcb73c07da61876414d49aac30 (feat/identity-verifier-contract-main-20260811), which remains directly based on protected main 55d7ae8647208e301f282350f076eeddaba61d11. This child adds only the server-owned issuer trust-policy model and focused tests. It does not parse JWTs, perform OIDC discovery/JWK retrieval, introspect opaque tokens, map roles, change controllers, or replace existing signed tenant-header auth.

Acceptance

Observe exact-head RED -> add the smallest production policy implementation -> exact-head Maven/coverage/Javadoc acceptance and directly emitted CI/security evidence. Keep Draft while #343 is open. After #343 integrates, reconcile this unique delta onto the new protected base and regenerate base-sensitive checks/reviews before final merge. Independent write-authorized approval remains a separate protected-merge gate.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3cf3776e-6f49-47b8-821f-c05dd143a319

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}