refactor(pipeline): Detype framework + consolidate single-owner authlib packages

[huang195]

Summary

Two coupled cleanups in one PR:

1. Decouple pipeline/ from plugin-specific types. pipeline.Context no longer imports authlib/validation or authlib/routing. Invocation no longer has 9 hardcoded jwt-validation + token-exchange diagnostic fields.
2. Move single-owner packages into their owning plugin. Four authlib/ packages had exactly one in-tree importer each. They now live under the plugin that owns them, so authlib/ top-level reflects what's actually shared.

Third-party plugins get typed slots they can use (Identity interface, Invocation.Details map) and a cleaner example of what to colocate inside their own directory vs what the framework actually shares.

What changed

Framework detyping (commits d68ab24, f0a877f, dcda457)

• pctx.Route deleted. Was written by nothing, read by a single listener helper that always returned empty. Dead code.
• pctx.Claims *validation.Claims → pctx.Identity Identity (interface). Identity exposes Subject() / ClientID() / Scopes(). jwt-validation wraps its *validation.Claims in an in-package adapter. Future auth plugins (SAML, mTLS, custom) plug in without the framework importing their types.
• Invocation's 9 plugin-specific fields → Details map[string]string. ExpectedIssuer, TokenSubject, TokenAudience, TokenScopes, RouteMatched, RouteHost, TargetAudience, RequestedScopes, CacheHit all collapse into a flat string→string map. Opaque to the framework; abctl renders as key=value rows in the detail pane. Suggested key + encoding conventions (snake_case keys, booleans as "true"/"false", scopes space-joined, audiences comma-joined) documented in plugin-reference.md.

Package moves (commit 3729a52)

History-preserving git mv:

From	To
authlib/validation/	authlib/plugins/jwtvalidation/validation/
authlib/exchange/	authlib/plugins/tokenexchange/exchange/
authlib/cache/	authlib/plugins/tokenexchange/cache/
authlib/spiffe/	authlib/plugins/tokenexchange/spiffe/

Each plugin converts from a flat file (plugins/<name>.go) to its own directory (plugins/<name>/plugin.go). main.go adds side-effect imports for the two moved plugins — same pattern an out-of-tree plugin would use.

Kept as shared building blocks: authlib/bypass, authlib/routing, authlib/auth. Rationale for each in the commit message for 3729a52.

Docs refresh (commit bbfba9d)

framework-architecture.md, plugin-reference.md, plugin-tutorial.md, authlib/README.md all updated for the new Identity / Details / package layout.

Review fixup (commit a11985f)

Expand plugin-reference.md Details-encoding guidance with a type→encoding table including the scope-vs-audience split and RFC rationale. Add TestJWTValidation_OnRequest_MultiAudience_CommaJoined locking in the comma-join encoding.

Wire schema change (breaking)

/v1/sessions invocations[*] entries: the 9 named diagnostic fields are gone; plugin-specific context now lives under details: {key: value, ...}. SessionEvent.targetAudience removed. abctl in this repo is updated in the same PR; any external consumer of /v1/sessions needs to migrate.

Migration notes for operators

• aud log attribute dropped from outbound records (authlib/session/store.go). The value was redundant with Invocation.Details["target_audience"]; queries grepping for aud=... against structured logs should switch to matching on the Invocation's details.target_audience field instead. The target audience is still recorded — just on a different path.
• Wire-field renames are also key renames. Dashboards, alerts, and saved abctl filters that referenced invocation.expectedIssuer, invocation.targetAudience, etc. need to move to invocation.details.expected_issuer, invocation.details.target_audience, and so on. Key names are snake_case by convention.

Test plan

• go build ./... and go test -race ./... pass in both modules (authbridge/authlib, authbridge/cmd/authbridge) under GOWORK=off
• Invariant: grep -rn 'authlib/(validation|exchange|cache|spiffe)' authbridge/authlib/pipeline/ returns empty
• Invariant: old authlib/{validation,exchange,cache,spiffe}/ directories removed
• abctl filter + detail pane render Details correctly
• Multi-audience encoding test locks in comma-join
• End-to-end smoke in kind: weather-agent + github-issue demos still produce session events with structured details

Out of scope

• Extensions named slots → protocol registry (separate PR, being explored next)
• authlib/routing generic refactor (defer until a second plugin needs it)
• CRD-driven operator UX (separate repo)

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[esnible]

Well-structured refactor split cleanly into 6 commits. Pipeline decoupling via Identity interface and Details map is the right direction, with history-preserving package moves for the four single-owner packages. All 17 CI checks pass; all commits signed-off with proper Assisted-By attribution and conventional commit prefixes.

Verified: no old import paths (authlib/validation|exchange|cache|spiffe) remain on kept lines, no dangling TargetAudience/Claims field references, the multi-audience comma-join encoding is locked in by TestJWTValidation_OnRequest_MultiAudience_CommaJoined, and the claimsIdentity adapter in plugins/jwtvalidation/identity.go correctly bridges the type change across all callers (listeners, snapshotIdentity).

One note for before merge: the E2E kind smoke item in the test plan is unchecked. Given the wire-format break on /v1/sessions (the 9 typed diagnostic fields collapsing into details: {...} and targetAudience removal), a run through the weather-agent and github-issue demos would catch any round-trip mismatch between the new Details map and abctl's decoder before external consumers hit it. Not blocking — leaving as a heads-up.

Areas reviewed: Go (core pipeline, plugins, tests), Docs
Commits: 6, all signed-off
CI status: passing (17/17)