capauth 0.2.3__tar.gz → 0.2.14__tar.gz

{capauth-0.2.3/src/capauth.egg-info → capauth-0.2.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: capauth
-Version: 0.2.3
+Version: 0.2.14
 Summary: Capability-based Authentication — decentralized, PGP-based identity and authorization
 Author-email: smilinTux <admin@smilintux.org>
 License: GPL-3.0-or-later
@@ -18,6 +18,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Security :: Cryptography
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -35,10 +36,13 @@ Requires-Dist: python-gnupg>=0.5; extra == "gnupg"
 Provides-Extra: service
 Requires-Dist: fastapi>=0.110; extra == "service"
 Requires-Dist: uvicorn[standard]>=0.27; extra == "service"
+Requires-Dist: python-multipart>=0.0.6; extra == "service"
 Requires-Dist: PyJWT>=2.8; extra == "service"
 Requires-Dist: python-gnupg>=0.5; extra == "service"
 Requires-Dist: httpx>=0.25; extra == "service"
 Requires-Dist: segno>=1.6; extra == "service"
+Requires-Dist: pywebpush>=1.14; extra == "service"
+Requires-Dist: webauthn>=2.0; extra == "service"
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0; extra == "dev"
 Requires-Dist: pytest-cov>=4.0; extra == "dev"
@@ -49,12 +53,17 @@ Requires-Dist: python-gnupg>=0.5; extra == "dev"
 Requires-Dist: black>=24.0; extra == "dev"
 Requires-Dist: ruff>=0.3; extra == "dev"
 Requires-Dist: zeroconf>=0.38; extra == "dev"
+Requires-Dist: webauthn>=2.0; extra == "dev"
+Requires-Dist: soft-webauthn>=0.1; extra == "dev"
+Requires-Dist: pywebpush>=1.14; extra == "dev"
 Provides-Extra: all
 Requires-Dist: capauth[dev,gnupg,service]; extra == "all"
 Dynamic: license-file
 
 # capauth — Sovereign PGP Identity 🔐
 
+[![pytest](https://github.com/smilinTux/capauth/actions/workflows/pytest.yml/badge.svg)](https://github.com/smilinTux/capauth/actions/workflows/pytest.yml)
+
 > **OAuth is dead. Long live sovereignty.**
 > Your identity is a PGP keypair *you* generated, on hardware *you* own. No
 > "Login with Google", no authorization server in the middle, no revocation risk
@@ -73,6 +82,20 @@ bearer token issued by a third party, you sign a random challenge with a key onl
 you hold. The verifier checks the signature against your public key. Valid
 signature = authenticated. Done. No middleman ever sees the secret.
 
+> **Maturity tier: T0 (live).** The live sovereign root and the agent
+> signing / DID / challenge-response keys are **classical** Ed25519 / RSA-4096
+> (RFC 8032 / 4880) — Shor-breakable once a CRQC exists. capauth is a
+> **signature / identity** layer (not a KEM), so signatures are not retroactively
+> breakable and Harvest-Now-Decrypt-Later does not apply — migration is real but
+> **deferrable**. The **T3 hybrid-signature path is additive and proven**: the
+> Sequoia (`sq`) backend issues + verifies **ML-DSA-87 + Ed448** (FIPS 204) /
+> **ML-KEM-1024 + X448** (FIPS 203) composite v6 keys end-to-end, but the live root
+> stays classical until the gated root-rotation ceremony. **Honest claim:** this is
+> *not* "quantum-proof" / "quantum-safe." See [SOP.md](SOP.md),
+> [docs/CRYPTO_SPEC.md](docs/CRYPTO_SPEC.md), and the sk-standards
+> [CRYPTOGRAPHY_STANDARD](https://github.com/smilinTux/sk-standards). Migration:
+> epic `PQC-MIGRATION` (coord `e1d6ba2a`).
+
 ---
 
 ## The 60-second version
@@ -179,6 +202,31 @@ all Syncthing mesh nodes so every host shares one keypair.
 | **Integration generators** | One-shot config for third-party login, e.g. Forgejo OAuth2/OIDC (`capauth setup forgejo`) |
 | **skcapstone adapter** | Default-on-by-presence: routes auth events to `sk-alert`, registers a key-rotation check with `skscheduler` |
 
+### Challenge TTL and replay contract (`identity.verify_challenge`)
+
+`verify_challenge` enforces a **max challenge age of 5 minutes by default**
+(`DEFAULT_MAX_CHALLENGE_AGE_SECONDS = 300`); older challenges raise
+`ChallengeExpiredError`. Tune it with `max_age_seconds=...`, or pass
+`max_age_seconds=None` to opt out **only** when your layer enforces TTL
+itself (the service layer does, via its nonce store).
+
+**Within the TTL the bare primitive is replayable**: the same signed
+response verifies repeatedly unless you track seen challenge ids. For
+single-use semantics pass a `replay_guard`:
+
+```python
+from capauth.identity import InMemoryReplayGuard, verify_challenge
+
+guard = InMemoryReplayGuard()  # single-process reference implementation
+verify_challenge(challenge, response, pubkey, replay_guard=guard)
+verify_challenge(challenge, response, pubkey, replay_guard=guard)  # raises ChallengeReplayError
+```
+
+Any `(challenge_id, expires_at) -> bool` callable works as a guard. For
+durable / multi-node deployments use a real nonce store; the reference
+implementation is `capauth.authentik.nonce_store.NonceStore` (what the
+verification service uses).
+
 ## Key CLI commands
 
 ```bash
@@ -231,6 +279,8 @@ rides in the payload `event` field so routing stays severity-based.
 | **[Protocol](docs/PROTOCOL.md)** | the CapAuth wire protocol specification |
 | **[Claims](docs/CLAIMS.md)** | capability claims and token format |
 | **[Integration Blueprint](docs/INTEGRATION_BLUEPRINT.md)** | third-party integration guide |
+| **[Cold-Machine Bootstrap & DR](docs/COLD_MACHINE_BOOTSTRAP_AND_DR.md)** | standing capauth back up on a blank box + disaster recovery: the restore-not-regenerate rule, the ordered restore chain, and the operator checklist |
+| **[authentik-capauth](docs/authentik-capauth.md)** | the custom Authentik image with the CapAuth PGP stage baked in — build (`AK_VERSION`, version-agnostic venv install, frontend rebuild), SKStacks deploy + `lifecycle.migrate` override, and the four build/migrate gotchas |
 | **[AI Advocate](AI-ADVOCATE.md)** | how AI advocates manage a sovereign profile on your behalf |
 
 ## Why it matters
@@ -245,6 +295,24 @@ verification instantly instead of going undetected.
 
 > **"You are not a user. You are a sovereign."**
 
+## Related projects / See also
+
+capauth is the identity root of SKWorld — most of the stack links back here.
+
+- ⬇️ **Used by:** [skchat](https://github.com/smilinTux/skchat) — routes messages by
+  the identity capauth resolves (`resolve_agent_identity()`); per-agent signing key.
+- ⬇️ **Used by:** [skcomms](https://github.com/smilinTux/skcomms) — capauth-signed
+  envelopes + FQID (`<a>@<op>.<realm>`) sovereign addressing.
+- ↔️ **Sibling (PQC signing root):** [sk_pgp](https://github.com/smilinTux/sk_pgp) —
+  the sovereign OpenPGP-PQC library (Sequoia-backed) capauth's PQC root migrates onto.
+- ↔️ **Sibling (hybrid KEM):** [sk-pqc](https://github.com/smilinTux/sk-pqc-py) — the
+  `HKDF(X25519 ‖ ML-KEM-768)` KEM for confidentiality; capauth provides the
+  authentication that a KEM-only library deliberately does not (pair them).
+- ↔️ **Sibling (Security capability):** [sksecurity](https://github.com/smilinTux/sksecurity)
+  — produces the runtime crypto self-report that makes capauth's claims evidence-backed.
+- 📐 **Standards:** [sk-standards](https://github.com/smilinTux/sk-standards) — the
+  crypto, data-flow, version, and doc/SOP standards (incl. `CRYPTOGRAPHY_STANDARD`).
+
 ## License
 
 **GPL-3.0-or-later** — Free as in freedom. Identity is a right, not a product.

{capauth-0.2.3 → capauth-0.2.14}/README.md

@@ -1,5 +1,7 @@
 # capauth — Sovereign PGP Identity 🔐
 
+[![pytest](https://github.com/smilinTux/capauth/actions/workflows/pytest.yml/badge.svg)](https://github.com/smilinTux/capauth/actions/workflows/pytest.yml)
+
 > **OAuth is dead. Long live sovereignty.**
 > Your identity is a PGP keypair *you* generated, on hardware *you* own. No
 > "Login with Google", no authorization server in the middle, no revocation risk
@@ -18,6 +20,20 @@ bearer token issued by a third party, you sign a random challenge with a key onl
 you hold. The verifier checks the signature against your public key. Valid
 signature = authenticated. Done. No middleman ever sees the secret.
 
+> **Maturity tier: T0 (live).** The live sovereign root and the agent
+> signing / DID / challenge-response keys are **classical** Ed25519 / RSA-4096
+> (RFC 8032 / 4880) — Shor-breakable once a CRQC exists. capauth is a
+> **signature / identity** layer (not a KEM), so signatures are not retroactively
+> breakable and Harvest-Now-Decrypt-Later does not apply — migration is real but
+> **deferrable**. The **T3 hybrid-signature path is additive and proven**: the
+> Sequoia (`sq`) backend issues + verifies **ML-DSA-87 + Ed448** (FIPS 204) /
+> **ML-KEM-1024 + X448** (FIPS 203) composite v6 keys end-to-end, but the live root
+> stays classical until the gated root-rotation ceremony. **Honest claim:** this is
+> *not* "quantum-proof" / "quantum-safe." See [SOP.md](SOP.md),
+> [docs/CRYPTO_SPEC.md](docs/CRYPTO_SPEC.md), and the sk-standards
+> [CRYPTOGRAPHY_STANDARD](https://github.com/smilinTux/sk-standards). Migration:
+> epic `PQC-MIGRATION` (coord `e1d6ba2a`).
+
 ---
 
 ## The 60-second version
@@ -124,6 +140,31 @@ all Syncthing mesh nodes so every host shares one keypair.
 | **Integration generators** | One-shot config for third-party login, e.g. Forgejo OAuth2/OIDC (`capauth setup forgejo`) |
 | **skcapstone adapter** | Default-on-by-presence: routes auth events to `sk-alert`, registers a key-rotation check with `skscheduler` |
 
+### Challenge TTL and replay contract (`identity.verify_challenge`)
+
+`verify_challenge` enforces a **max challenge age of 5 minutes by default**
+(`DEFAULT_MAX_CHALLENGE_AGE_SECONDS = 300`); older challenges raise
+`ChallengeExpiredError`. Tune it with `max_age_seconds=...`, or pass
+`max_age_seconds=None` to opt out **only** when your layer enforces TTL
+itself (the service layer does, via its nonce store).
+
+**Within the TTL the bare primitive is replayable**: the same signed
+response verifies repeatedly unless you track seen challenge ids. For
+single-use semantics pass a `replay_guard`:
+
+```python
+from capauth.identity import InMemoryReplayGuard, verify_challenge
+
+guard = InMemoryReplayGuard()  # single-process reference implementation
+verify_challenge(challenge, response, pubkey, replay_guard=guard)
+verify_challenge(challenge, response, pubkey, replay_guard=guard)  # raises ChallengeReplayError
+```
+
+Any `(challenge_id, expires_at) -> bool` callable works as a guard. For
+durable / multi-node deployments use a real nonce store; the reference
+implementation is `capauth.authentik.nonce_store.NonceStore` (what the
+verification service uses).
+
 ## Key CLI commands
 
 ```bash
@@ -176,6 +217,8 @@ rides in the payload `event` field so routing stays severity-based.
 | **[Protocol](docs/PROTOCOL.md)** | the CapAuth wire protocol specification |
 | **[Claims](docs/CLAIMS.md)** | capability claims and token format |
 | **[Integration Blueprint](docs/INTEGRATION_BLUEPRINT.md)** | third-party integration guide |
+| **[Cold-Machine Bootstrap & DR](docs/COLD_MACHINE_BOOTSTRAP_AND_DR.md)** | standing capauth back up on a blank box + disaster recovery: the restore-not-regenerate rule, the ordered restore chain, and the operator checklist |
+| **[authentik-capauth](docs/authentik-capauth.md)** | the custom Authentik image with the CapAuth PGP stage baked in — build (`AK_VERSION`, version-agnostic venv install, frontend rebuild), SKStacks deploy + `lifecycle.migrate` override, and the four build/migrate gotchas |
 | **[AI Advocate](AI-ADVOCATE.md)** | how AI advocates manage a sovereign profile on your behalf |
 
 ## Why it matters
@@ -190,6 +233,24 @@ verification instantly instead of going undetected.
 
 > **"You are not a user. You are a sovereign."**
 
+## Related projects / See also
+
+capauth is the identity root of SKWorld — most of the stack links back here.
+
+- ⬇️ **Used by:** [skchat](https://github.com/smilinTux/skchat) — routes messages by
+  the identity capauth resolves (`resolve_agent_identity()`); per-agent signing key.
+- ⬇️ **Used by:** [skcomms](https://github.com/smilinTux/skcomms) — capauth-signed
+  envelopes + FQID (`<a>@<op>.<realm>`) sovereign addressing.
+- ↔️ **Sibling (PQC signing root):** [sk_pgp](https://github.com/smilinTux/sk_pgp) —
+  the sovereign OpenPGP-PQC library (Sequoia-backed) capauth's PQC root migrates onto.
+- ↔️ **Sibling (hybrid KEM):** [sk-pqc](https://github.com/smilinTux/sk-pqc-py) — the
+  `HKDF(X25519 ‖ ML-KEM-768)` KEM for confidentiality; capauth provides the
+  authentication that a KEM-only library deliberately does not (pair them).
+- ↔️ **Sibling (Security capability):** [sksecurity](https://github.com/smilinTux/sksecurity)
+  — produces the runtime crypto self-report that makes capauth's claims evidence-backed.
+- 📐 **Standards:** [sk-standards](https://github.com/smilinTux/sk-standards) — the
+  crypto, data-flow, version, and doc/SOP standards (incl. `CRYPTOGRAPHY_STANDARD`).
+
 ## License
 
 **GPL-3.0-or-later** — Free as in freedom. Identity is a right, not a product.

{capauth-0.2.3 → capauth-0.2.14}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "capauth"
-version = "0.2.3"
+version = "0.2.14"
 description = "Capability-based Authentication — decentralized, PGP-based identity and authorization"
 readme = "README.md"
 license = {text = "GPL-3.0-or-later"}
@@ -22,6 +22,7 @@ classifiers = [
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
     "Topic :: Security :: Cryptography",
 ]
 dependencies = [
@@ -43,10 +44,13 @@ gnupg = [
 service = [
     "fastapi>=0.110",
     "uvicorn[standard]>=0.27",
+    "python-multipart>=0.0.6",
     "PyJWT>=2.8",
     "python-gnupg>=0.5",
     "httpx>=0.25",
     "segno>=1.6",
+    "pywebpush>=1.14",
+    "webauthn>=2.0",
 ]
 dev = [
     "pytest>=7.0",
@@ -58,6 +62,9 @@ dev = [
     "black>=24.0",
     "ruff>=0.3",
     "zeroconf>=0.38",
+    "webauthn>=2.0",
+    "soft-webauthn>=0.1",
+    "pywebpush>=1.14",
 ]
 all = [
     "capauth[gnupg,service,dev]",

capauth-0.2.14/src/capauth/__init__.py

@@ -0,0 +1,177 @@
+"""CapAuth -- Capability-based Authentication.
+
+Decentralized, PGP-based identity and authorization.
+OAuth is dead. Long live sovereignty.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+from .agent_identity import AgentIdentity, resolve_agent_identity
+from .manifest import (
+    DEFAULT_SIG_SUFFIX,
+    ManifestSigningError,
+    canonical_manifest_bytes,
+    is_canonical,
+    operator_fingerprint,
+    sign_manifest,
+    verify_manifest,
+)
+from .authz import (
+    DEFAULT_RULES,
+    OBLIGATION_AUDIT,
+    CapabilityRule,
+    Decision,
+    Obligation,
+    decide,
+)
+from .pairing import (
+    DeviceRecord,
+    Enrollment,
+    EnrollmentMode,
+    PairingError,
+    PairingStore,
+    PairingWindow,
+    approve,
+    enroll_device,
+    list_devices,
+    mode_satisfies,
+    open_window,
+    revoke,
+)
+from .provisioning import SKCHAT_SCOPES, provision_subject
+from .tokens import (
+    AUDIENCE_SCOPES,
+    Capability,
+    SignedToken,
+    TokenPayload,
+    TokenType,
+    export_token,
+    has_scope,
+    import_token,
+    is_revoked,
+    issue_token,
+    list_tokens,
+    mint_agent_audience_token,
+    mint_audience_token,
+    revoke_token,
+    verify_audience_token,
+    verify_token,
+)
+from .trust import (
+    CALIBRATION_FILENAME,
+    DEFAULT_THRESHOLDS,
+    FORMATTERS,
+    TrustEdge,
+    TrustGraph,
+    TrustNode,
+    TrustThresholds,
+    apply_setting,
+    build_trust_graph,
+    format_dot,
+    format_json,
+    format_table,
+    load_calibration,
+    recommend_thresholds,
+    save_calibration,
+)
+
+__all__ = [
+    "AgentIdentity",
+    "resolve_agent_identity",
+    "resolve_capauth_home",
+    # manifest signing (umbrella-shell signed module registry, section 5.3)
+    "sign_manifest",
+    "verify_manifest",
+    "canonical_manifest_bytes",
+    "is_canonical",
+    "operator_fingerprint",
+    "ManifestSigningError",
+    "DEFAULT_SIG_SUFFIX",
+    # authz kernel (spine M3: deterministic decide() PDP)
+    "decide",
+    "Decision",
+    "Obligation",
+    "CapabilityRule",
+    "DEFAULT_RULES",
+    "OBLIGATION_AUDIT",
+    # pairing kernel (spine M2: enrollment modes + operator window)
+    "enroll_device",
+    "approve",
+    "revoke",
+    "list_devices",
+    "open_window",
+    "mode_satisfies",
+    "PairingError",
+    "EnrollmentMode",
+    "Enrollment",
+    "DeviceRecord",
+    "PairingWindow",
+    "PairingStore",
+    # tokens (kernel track M1: moved verbatim from skcapstone)
+    "Capability",
+    "SignedToken",
+    "TokenPayload",
+    "TokenType",
+    "export_token",
+    "import_token",
+    "is_revoked",
+    "issue_token",
+    "list_tokens",
+    "revoke_token",
+    "verify_token",
+    # audience-scoped token minting (audience-mint, M1+/R4.2)
+    "AUDIENCE_SCOPES",
+    "mint_audience_token",
+    "mint_agent_audience_token",
+    "verify_audience_token",
+    "has_scope",
+    # trust (kernel track M1: moved verbatim from skcapstone)
+    "FORMATTERS",
+    "CALIBRATION_FILENAME",
+    "DEFAULT_THRESHOLDS",
+    "TrustEdge",
+    "TrustGraph",
+    "TrustNode",
+    "TrustThresholds",
+    "apply_setting",
+    "build_trust_graph",
+    "format_dot",
+    "format_json",
+    "format_table",
+    "load_calibration",
+    "recommend_thresholds",
+    "save_calibration",
+]
+
+__version__ = "0.2.14"
+
+SKCAPSTONE_HOME = Path.home() / ".skcapstone"
+DEFAULT_CAPAUTH_DIR = SKCAPSTONE_HOME / "capauth"
+LEGACY_CAPAUTH_DIR = Path.home() / ".capauth"
+
+
+def resolve_capauth_home(base_dir: Path | None = None) -> Path:
+    """Resolve the CapAuth home directory.
+
+    Priority:
+    1. Explicit ``base_dir``
+    2. ``CAPAUTH_HOME`` environment override
+    3. New default under ``~/.skcapstone/capauth`` when present
+    4. Legacy ``~/.capauth`` when it already exists
+    5. New default under ``~/.skcapstone/capauth``
+    """
+    if base_dir is not None:
+        return Path(base_dir).expanduser()
+
+    env_home = os.environ.get("CAPAUTH_HOME")
+    if env_home:
+        return Path(env_home).expanduser()
+
+    if DEFAULT_CAPAUTH_DIR.exists():
+        return DEFAULT_CAPAUTH_DIR
+    if LEGACY_CAPAUTH_DIR.exists():
+        return LEGACY_CAPAUTH_DIR
+    return DEFAULT_CAPAUTH_DIR

{capauth-0.2.3 → capauth-0.2.14}/src/capauth/agent_identity.py

@@ -24,8 +24,9 @@ A resolved identity carries **two complementary URIs**:
     cluster.json is absent or malformed.
 
 ``fingerprint``
-    40-char PGP fingerprint from the agent's CapAuth profile.  ``None`` when
-    no real profile exists (placeholder identities are not surfaced here).
+    40 (v4) or 64 (v6) hex PGP fingerprint from the agent's CapAuth profile.
+    ``None`` when no real profile exists (placeholder identities are not
+    surfaced here).
 
 Public API
 ----------
@@ -85,8 +86,8 @@ class AgentIdentity:
         fqid:         Three-tier label — ``<agent>@<operator>.<realm>``
                       (e.g. ``"lumina@chef.skworld"``).  ``None`` when
                       cluster.json is not available.
-        fingerprint:  40-char PGP fingerprint from the agent's CapAuth
-                      profile.  ``None`` when no real profile exists.
+        fingerprint:  40 (v4) or 64 (v6) hex PGP fingerprint from the agent's
+                      CapAuth profile.  ``None`` when no real profile exists.
     """
 
     agent: str
@@ -110,6 +111,25 @@ class AgentIdentity:
             "fingerprint": self.fingerprint,
         }
 
+    def hybrid_prekey_available(self) -> bool:
+        """Whether this agent advertises a hybrid PQ confidentiality prekey.
+
+        Honest capability lookup for the PQC cut-over (see
+        :mod:`capauth.pqc_confidentiality`): ``True`` only when a real
+        X25519+ML-KEM-768 prekey exists for this agent; ``False`` (classical /
+        negotiated downgrade) otherwise. CapAuth does not generate these keys
+        (Phase 2) — it reports them.
+        """
+        from .pqc_confidentiality import hybrid_prekey_available
+
+        return hybrid_prekey_available(self.agent)
+
+    def confidentiality_suite(self) -> str:
+        """The confidentiality suite a peer negotiates TO this agent today."""
+        from .pqc_confidentiality import confidentiality_suite_for
+
+        return confidentiality_suite_for(self.agent)
+
 
 # ---------------------------------------------------------------------------
 # Internal helpers
@@ -173,7 +193,7 @@ def _load_fingerprint(agent: str) -> Optional[str]:
         agent: Short agent name.
 
     Returns:
-        40-char hex fingerprint string, or None.
+        40 (v4) or 64 (v6) hex fingerprint string, or None.
     """
     # 1. CapAuth profile.json (source of truth for real PGP profiles)
     capauth_dir = _agent_capauth_dir(agent)
@@ -182,7 +202,7 @@ def _load_fingerprint(agent: str) -> Optional[str]:
         try:
             data = json.loads(profile_path.read_text(encoding="utf-8"))
             fp = data.get("key_info", {}).get("fingerprint")
-            if isinstance(fp, str) and len(fp) == 40:
+            if isinstance(fp, str) and len(fp) in (40, 64):
                 return fp
         except (json.JSONDecodeError, OSError) as exc:
             logger.debug("profile.json parse failed for %s: %s", agent, exc)
@@ -193,7 +213,7 @@ def _load_fingerprint(agent: str) -> Optional[str]:
 
         profile = load_profile(base_dir=capauth_dir)
         fp = profile.key_info.fingerprint
-        if isinstance(fp, str) and len(fp) == 40:
+        if isinstance(fp, str) and len(fp) in (40, 64):
             return fp
     except ImportError:
         pass
@@ -207,7 +227,7 @@ def _load_fingerprint(agent: str) -> Optional[str]:
             data = json.loads(identity_path.read_text(encoding="utf-8"))
             fp = data.get("fingerprint")
             # Only return if it looks like a real fingerprint (not placeholder)
-            if isinstance(fp, str) and len(fp) == 40:
+            if isinstance(fp, str) and len(fp) in (40, 64):
                 # Reject placeholder fingerprints (all caps hex, but generated
                 # from SHA256 of "skcapstone:<name>")
                 if data.get("capauth_managed", False):

{capauth-0.2.3 → capauth-0.2.14}/src/capauth/authentik/claims_mapper.py

@@ -113,7 +113,7 @@ def preferred_username_fallback(fingerprint: str) -> str:
     """Generate a stable display handle from a fingerprint when no name is asserted.
 
     Args:
-        fingerprint: Full 40-char PGP fingerprint.
+        fingerprint: Full PGP fingerprint: 40 (v4) or 64 (v6) hex.
 
     Returns:
         str: Short handle like ``capauth-8A3FC2D1``.