#114 fix(tokens): require the exact broker scope to mint History assertions

Summary

Tighten scope checks on the History assertion route. Workspace tokens and admin keys can no longer satisfy the assertion scope by implication.

• New lib/broker-scopes.ts: an assertion scope is satisfied only by its exact literal.
• The History assertion route authorizes with that exact matcher and accepts only a plain api-key credential.
• API key and workspace token issuance refuse to delegate an assertion scope unless the caller holds that exact literal.

Found in the 2026-10-30 security sweep.

Verification

• packages/server tests: all pass (691/691 at merge).
• Reverting the route changes (tests kept) fails the new tests.
• npx turbo build && npx turbo typecheck: clean.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Agent Relay sessions

• claude session aac00799 · opened via gh pr create · last active 2026-10-31
• claude session a685ac1e · contributor · ran gh pr commands · last active 2026-10-31