Repository navigation
Fixes a defect found in an external review of the published surface: the documented live-validation path could not succeed against any real deployment, including this project's own.
validate_domain() rejected correctly signed, unexpired documents. It passed check_timestamp=True unconditionally, which enforced the issuance window of draft Section 9.4 (default W = 600 s) against freshness.created. A statically published .well-known document is re-signed on its validity cycle, not per request, so the window could never be satisfied — validate_domain("litzki-systems.com") returned psi_core = 0. The window is now opt-in:
validate_domain("litzki-systems.com") # psi_core 1, reason "ok"
validate_domain("litzki-systems.com", check_timestamp=True) # psi_core 0, reason "issuance_window"freshness.expiresAt and host binding are still always enforced.
New reason field. validate_domain() now names the first failed check — ok, host_mismatch, signature, freshness_missing, freshness_invalid, created_in_future, expired, issuance_window, no_key — so an expired document is distinguishable from a forged one. Backed by the new verify_identity_detail(), which returns (verified, reason). verify_identity() keeps its boolean contract unchanged.
generate_identity_document() default validity. It defaulted freshness.expiresAt to created + 1 hour, while its own docstring and draft Section 10 both claimed the field was omitted unless supplied. The default is now created + DEFAULT_VALIDITY_DAYS (90 days), matching what the production deployments publish.
Documentation. The README's "Live validation example" pointed at examples/validate_live.py, which the PyPI distribution does not contain, and printed an expected output that was wrong in two fields. It is now a three-line example over the installed API with its real output. Two dead draft cross-references corrected: the issuance window is Section 9.4 (not 7.2, which does not exist in revision 04), the 300-second DNS TTL recommendation is Section 9.3 (not 6.1). requires-python = ">=3.9" is now declared.
No change to the wire format, the schema, the signed scope or the canonicalization. 80 tests pass.
Full detail in CHANGELOG.md.