feat(oauth): present pending device grants

[adrianwebb]

Outcome

Authenticated Admin users can inspect a pending CLI device grant before approving it. The API returns only client identity, user code, requested scopes, pending status, and expiry; it never returns the device credential.

Work authority

• Work item / Issue: Closes Expose authenticated device approval presentation #124
• Proposal / decision: User-approved Admin/Core/UI/Reviewer platform migration plan and docs/standards-dev.md
• Assignment / checkpoint: Device login defect reported during migration acceptance
• Actor: codex-root
• Human authority: @adrianwebb
• Agent / capacity provider: OpenAI Codex
• Exact base ref: staging at 807644a
• Exact head ref: codex/device-approval-presentation-rc at 774c416

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Consume the versioned SDK presentation contract, add a fail-closed store read and authenticated no-store protocol route, then verify the complete control-plane suite. Complete.

Changes and commits

• fe4a081 adds the device presentation provider/store/route and protocol coverage.
• 774c416 covers the actionable expired-code response.
• Updates @treeseed/sdk to 0.13.0-rc.45 and API to 0.8.0-rc.45.

Verification

• npm run build:dist — passed.

• npm run test:control-plane — 58 files and 181 tests passed.

• PR verify and authorization checks passed.

• I ran the narrowest relevant package verification and documented any checks that could not be run.

Risk and rollback

The new GET is authenticated, no-store, read-only, and rejects unknown, expired, or non-pending grants. Roll back commit fe4a081 and restore the prior SDK dependency to remove it; the existing POST and token protocol remain compatible.

Completion summary

The API half of the single-credential device-consent flow is implemented and verified. Admin PR #38 consumes it; the next action is exact RC composition verification.

AGPL committer authorization

The base-owned workflow checks the provider-authenticated pull-request author against .github/approved-committers.json. There is no per-PR grant checkbox. If the check reports that the GitHub username is unapproved, follow the linked one-time approval form and re-run the check after the reviewed allowlist change reaches this target branch.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.

[adrianwebb]

Refreshing the durable PR record validation after completing the required template.