P3.4: Classifier — OIDC nonce missing / unverified

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P3
Depends on: P3.1, P2.1

Goal

Fire findings for missing OIDC nonce parameters in flow construction and missing nonce verification in ID-token verification.

Acceptance criteria

• oidc_nonce_missing fires when an OIDC flow (scope contains openid) is constructed without a visible nonce parameter in the authorize-URL builder.
• oidc_nonce_unverified_review fires when an ID-token verify call lacks a nonce option even though the matching flow construction set one.
• Evidence-bound — links the flow construction artifact and the verify-call options evidence (from P2.1).

New check IDs

• oidc_nonce_missing
• oidc_nonce_unverified_review

Files touched

• crates/sessionscope-classifier/src/oauth_flow.rs
• crates/sessionscope-classifier/src/jwt.rs (verify-side correlation)

Fixture expectations

• Negative: openid-scoped flow without nonce; openid-scoped flow with nonce but verify-call omits the option.
• Positive: openid-scoped flow with nonce on both sides.
• False-positive: pure OAuth flow without openid scope — no fire (the rule must scope to OIDC).

Audit-then-decide

• oidc_nonce_missing: missing_validation_evidence, severity medium.
• oidc_nonce_unverified_review: missing_validation_evidence, severity medium.
• Feed into the consolidated P4.8 audit.

Doc-update checklist

• docs/USAGE.md check catalog: two new IDs.
• docs/COVERAGE_MATRIX.md: two rows.
• CHANGELOG.md unreleased entry.

[bjcorder]

Implemented in $(git rev-parse --short HEAD).

Summary:

• Added oidc_nonce_missing for authorization-code flows with openid scope but no source-visible nonce evidence.
• Added oidc_nonce_unverified_review when nonce evidence exists but same-flow ID-token nonce verification evidence is absent.
• Scoped nonce checks to OIDC evidence so pure OAuth flows are not flagged.
• Added focused classifier tests for missing, unverified, OAuth-only, and verified OIDC nonce cases.

Validation:

• cargo test -q -p sessionscope-classifier oauth_flow — passed

Notes / follow-ups:

• User-facing catalog and coverage matrix rows are consolidated in P3.10: Docs — P3 check catalog, OAuth/OIDC flow narrative, matrix rows #86 after all P3 check IDs are stable.

[bjcorder]

Correction: implemented in 7a149cb.

Summary:

• Added oidc_nonce_missing for authorization-code flows with openid scope but no source-visible nonce evidence.
• Added oidc_nonce_unverified_review when nonce evidence exists but same-flow ID-token nonce verification evidence is absent.
• Scoped nonce checks to OIDC evidence so pure OAuth flows are not flagged.
• Added focused classifier tests for missing, unverified, OAuth-only, and verified OIDC nonce cases.

Validation:

• cargo test -q -p sessionscope-classifier oauth_flow — passed

Notes / follow-ups:

• User-facing catalog and coverage matrix rows are consolidated in P3.10: Docs — P3 check catalog, OAuth/OIDC flow narrative, matrix rows #86 after all P3 check IDs are stable.

[bjcorder]

Implemented in PR #98: #98

Implementation commits:

• 7a149cb — P3.4 OIDC nonce classifier

Validation:

• cargo fmt --all -- --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed

Closure status:

• This issue is ready to close when the PR is merged.

Remaining notes:

• None.