Epic: Enterprise auth

[rickylabs]

NetScript should cover enterprise authentication end to end—especially the
Microsoft identity layers—by fully leveraging WorkOS and Better Auth instead of
rebuilding their products or exposing only a fraction of their capabilities.

The target architecture keeps a vendor-neutral NetScript identity/session/policy
kernel while assigning clear responsibilities:

• KV OAuth provides direct OAuth/OIDC, including first-class Entra ID behavior.
• WorkOS provides enterprise SAML/OIDC SSO, administrator onboarding,
  organizations, Directory Sync/SCIM, audit delivery, and optional RBAC/FGA/Vault
  adapters.
• Better Auth provides application-facing authentication modalities and session/
  organization/admin capabilities through its upstream plugin ecosystem.
• NetScript provides truthful capability discovery, multi-backend routing,
  normalization, authorization policy ports, secret references, CLI/scaffold
  configuration, and conformance testing.
• Machine, agent, CLI, and MCP authentication is a first-class lane spanning
  Entra client credentials, WorkOS API Keys/M2M/device/Agent Auth, Better Auth
  machine-auth plugins, and the shipped @netscript/mcp protected-resource
  surface.
• NetScript-as-IdP is deliberately separate backlog scope, using WorkOS Connect
  or Better Auth OAuth Provider only behind an outbound issuer contract.

This epic deliberately separates config-first leverage from new adapter work.
Every capability must have one lifecycle owner per tenant, especially where
WorkOS and Better Auth overlap in organizations, SSO, or SCIM.

Epic acceptance

• gate: each advertised backend capability has a reachable conformance test
• gate: direct Entra ID OIDC and brokered Microsoft SAML/OIDC have documented ownership and security boundaries
• gate: organization, membership, directory, session, and authorization contracts are tenant-safe and fail closed
• gate: WorkOS and Better Auth capabilities are exposed through configuration/adapters without copying upstream implementations
• gate: secrets, audit events, and administrative operations meet redaction and lifecycle requirements
• gate: generated projects can select, configure, mock, and smoke-test supported auth profiles
• gate: service, machine, CLI, and delegated-agent identities have explicit organization, scope, actor, credential, revocation, audit, and MCP ownership
• gate: inbound enterprise SSO and outbound NetScript-as-IdP are separate security contracts and delivery slices
• gate: all implementation PRs satisfy CI and the required opposite-family evaluation before merge

Children

• [enterprise-auth S1] Make auth capability discovery backend-truthful #872 — [enterprise-auth S1] Make auth capability discovery backend-truthful
• [enterprise-auth S2] Add a first-class Microsoft Entra ID OAuth/OIDC profile #873 — [enterprise-auth S2] Add a first-class Microsoft Entra ID OAuth/OIDC profile
• [enterprise-auth S3] Compose multiple auth backends with tenant-aware routing #874 — [enterprise-auth S3] Compose multiple auth backends with tenant-aware routing
• [enterprise-auth S4] Complete the WorkOS AuthKit and enterprise SSO interactive adapter #875 — [enterprise-auth S4] Complete the WorkOS AuthKit and enterprise SSO interactive adapter
• [enterprise-auth S5] Normalize per-tenant enterprise connection setup #876 — [enterprise-auth S5] Normalize per-tenant enterprise connection setup
• [enterprise-auth S6] Integrate WorkOS Directory Sync and SCIM lifecycle #877 — [enterprise-auth S6] Integrate WorkOS Directory Sync and SCIM lifecycle
• [enterprise-auth S7] Define enterprise auth audit events and bridge WorkOS Audit Logs #878 — [enterprise-auth S7] Define enterprise auth audit events and bridge WorkOS Audit Logs
• [enterprise-auth S8] Add WorkOS RBAC/FGA authorization providers #879 — [enterprise-auth S8] Add WorkOS RBAC/FGA authorization providers
• [enterprise-auth S9] Introduce an enterprise auth secret-reference and rotation lifecycle #880 — [enterprise-auth S9] Introduce an enterprise auth secret-reference and rotation lifecycle
• [enterprise-auth S10] Generate Better Auth plugin schema and migrations #881 — [enterprise-auth S10] Generate Better Auth plugin schema and migrations
• [enterprise-auth S11] Mount Better Auth interactive handlers and client integration #882 — [enterprise-auth S11] Mount Better Auth interactive handlers and client integration
• [enterprise-auth S12] Ship curated Better Auth capability profiles #883 — [enterprise-auth S12] Ship curated Better Auth capability profiles
• [enterprise-auth S13] Define organization-aware identity and authorization policy contracts #884 — [enterprise-auth S13] Define organization-aware identity and authorization policy contracts
• [enterprise-auth S14] Build an auth conformance, mocking, and scaffold test kit #885 — [enterprise-auth S14] Build an auth conformance, mocking, and scaffold test kit
• [enterprise-auth S15] Authenticate machines, agents, CLIs, and MCP clients #886 — [enterprise-auth S15] Authenticate machines, agents, CLIs, and MCP clients
• [enterprise-auth S16] Define outbound NetScript-as-IdP support #887 — [enterprise-auth S16] Define outbound NetScript-as-IdP contract