Auth Code Flow

%% Authorization-code + PKCE issuance flow (the M0 walking-skeleton slice) sequenceDiagram participant RP as Relying party participant M as Modgud (admission) participant Core as Core participant V as Vör (edge) RP->>M: authorize (PKCE challenge) M->>M: login ceremony (auth method) M->>M: SSO session established (region-local, sid) M-->>RP: authorization code RP->>M: token request (PKCE verifier) M->>Core: issue — the irreducible core write Core-->>M: consistency token M-->>RP: signed OIDC JWT (minted) RP->>V: present token V-->>RP: verified — no core read