Phase 6c: Authentication #24

Implement AUTH-1–AUTH-38: the descriptor/resolver model, the four credential types with variant-specific
equality and redaction, the RFC 7235 challenge parser, the Basic and Digest handlers with the bounded per-nonce
counter store, the composing challenge handler, static key-credential stamping, and the AUTH pillar step — its
HTTPS guard, cross-origin suppression, 401 re-challenge replay, and bearer-token cache — on both the sync and
async runtimes.

Scope

• Descriptor/resolver model and the four credential types with variant-specific equality and redaction.
• RFC 7235 challenge parser — no regexp over the challenge grammar (the "no Regexp.timeout" house rule),
  scheme and parameter names folded with a bare downcase.
• Basic (["u:p"].pack("m0"), never Base64 — base64 is on the require denylist by name) and Digest
  (RFC 7616) handlers; AUTH-19's per-nonce counter store is per-handler with no configuration-chain deferral
  (R11); AUTH-21's ISO-8859-1 branch is a documented raise via a typed failure (R10).
• The composing challenge handler and static key-credential stamping.
• The AUTH pillar step at Stages::AUTH (order 800): HTTPS guard, cross-origin suppression read from
  Cursor#state(stage) — the reader half of the contract 6b writes (AUTH-29, design §10.15) — 401
  re-challenge replay, bearer-token cache; AUTH-27's "redirect wraps retry wraps auth" is PIPE-2's stage
  order, already fixed by 4c.
• AUTH-37's three-zone async policy against the core-owned pivot — Dexpace::Async::Future, Completer,
  Settlement (R12).

Spec refs

Product spec §11 — AUTH-1–AUTH-38 (38 IDs, no ⏳ row). sdk-design: §6.3, §10.15.

Dependencies

Phases 0–5. Independent of 6a and 6b — the AUTH step occupies Stages::AUTH whether or not a RETRY
step is installed; the single exception is the Cursor context-bundle widening, consumed if 6a has built it
and neither required nor built here.

Docs

• Segmentation: docs/work/mvp/phase6/2026-09-09-phase6-segmentation-design.md
• Design: docs/work/mvp/phase6/phase6c/2026-09-09-phase6c-authentication-design.md
• Plan: docs/work/mvp/phase6/phase6c/2026-09-09-phase6c-authentication.md (17 tasks)
• Checklist: docs/work/mvp/phase6/phase6c/<date>-phase6c-authentication-checklist.md — written at execution
  time, one row per ID in scope