v0.3.6

本版本修复认证、凭据签发和 PostgreSQL 事务生命周期问题。

• 修复 Basic 认证的 Device 请求省略 client_id 时可能触发的 panic。
• 取消中的数据库事务由连接持有者负责清理；完成回滚后复用健康连接，修正凭据操作和用户禁用的锁顺序。
• 公开注册与管理员、CLI 创建账户统一执行 12–1024 字节密码限制，在消耗验证码前拒绝无效密码。
• 修复 IPv6 字面量在退出 URI、远程 JWKS、Request Object、CIBA 和退出通知中的处理，保留网络访问与 TLS 限制。
• 修正 Native SSO 刷新、依赖故障分类、DPoP、客户端证明、mTLS、HTTP 签名和 SCIM 协议行为。
• 凭据持有者绑定在即时与延迟签发链路中保留类型，拒绝损坏的存储数据，并减少重复转换与事务开销。

完整变更 · 修复 PR #261

v0.3.5

修复 OIDF 运行中确认的授权请求回归：

• PAR 不再提前强制要求 Token 的发送方绑定；已提供的绑定仍按客户端策略校验，Token 签发时继续强制执行绑定要求。
• 基础 confidential OIDC 动态注册使用已有的逐客户端 PKCE 兼容策略。Public、FAPI、发送方绑定及非 OIDC 客户端仍要求 PKCE；注册更新保留管理员策略。

CNB 已通过服务端应用层、核心层和 HTTP 注册边界回归及 Clippy 检查。发布后完整 OIDF 回归结果见下方公开记录。

建议与 NazoAuthCtl v0.3.7 配套使用。替代已撤回的 v0.3.4。

OIDF 公开回归记录 / Public regression — 2026-10-22

本轮使用 NazoAuth v0.3.5、NazoAuthCtl v0.3.7，在官方 https://www.certification.openid.net 上运行，Suite 报告版本为 5.3.3。首个计划开始于 2026-10-22 08:02（UTC+8）。

1169 项完整执行：1121 PASSED、40 REVIEW、8 SKIPPED，0 FAILED、0 未完成、0 WARNING。 FAPI、CIBA、OpenID4VCI 各组全部通过。44 个计划均以 everything 公开；全部 1169 个模块的结果与日志已逐项验证可匿名访问。

原报告字段为 matrix_expectations_satisfied=true、suite_pass=false、acceptance_pass=false。结果按 PASSED、REVIEW 和 SKIPPED 分别统计。

完整机器可读索引 / All 1169 module links and outcomes

Run ID: 01a16105-18c1-7728-b1bf-9aac3be2476c

Tested server image: sha256:8dc1ac4827a90d04c52677cdec346db36b51769503c5660d4d6259ba225e558e

公开索引由 NazoAuth 导出，记录输入摘要、原报告 SHA-256 和匿名验证范围。Suite 原始日志见下面的官方计划页面。

Matrix plan	Official Suite record	PASSED	REVIEW	SKIPPED
oidc-core-p001	i519dtaJDZVjJ	30	3	2
oidc-core-p002	VwkAPFK3QB0eQ	31	3	4
oidc-core-p003	GISDYcED6ECOg	30	3	2
oidc-core-p004	ZQlym7b80tQ4z	2	0	0
oidc-core-p005	mz9quOzd4D5U4	1	0	0
oidc-logout-p006	ANFdl7u0Ghd87	3	8	0
oidc-logout-p007	NqFGv1bxtddYF	2	0	0
oidc-logout-p008	lYv3abLBVsw93	2	0	0
oidc-session-p009	ejOCN24O5P3uI	2	0	0
fapi-ciba-p010	eW4OG3VM4c7oQ	34	0	0
fapi-ciba-p011	zFpcNBDqzOQDb	33	0	0
fapi-ciba-p012	fev706H0xMKxM	39	0	0
fapi-ciba-p013	CcuDFF9fqyadx	38	0	0
fapi-security-code-p014	ZeeLtG4A5tQgi	52	0	0
fapi-security-code-p015	2edmcWxx5S372	46	0	0
fapi-security-code-p016	IHzmB7O4HF139	43	0	0
fapi-security-code-p017	p2K4tYCFvtRtE	37	0	0
fapi-security-code-p018	Ko6vkFUhRmLxZ	46	0	0
fapi-security-code-p019	6ABkiads7HRpm	40	0	0
fapi-security-code-p020	vAThAVHIx6pcx	37	0	0
fapi-security-code-p021	Xc7uMhTG2TpV6	31	0	0
fapi-message-p022	VXv0lBxIlDgSD	66	0	0
fapi-message-p023	zbPfNUR4ZPS5x	66	0	0
fapi-security-credentials-p024	sFJLBMLwdw3bl	15	0	0
fapi-security-credentials-p025	4VeLl9f1EdCVs	11	0	0
fapi-security-credentials-p026	xbInsiJnFJ5JT	9	0	0
fapi-security-credentials-p027	Z0C7lTRMjeUsT	5	0	0
openid4vc-vci-p028	heohwPodT2WBN	14	0	0
openid4vc-vci-p029	1KBWXO2ixVnbJ	15	0	0
openid4vc-vci-p030	vi5Fo2hQf3C5f	15	0	0
openid4vc-vci-p031	GT7QXUHFoyKde	14	0	0
openid4vc-vci-p032	amuXseVYMtc28	14	0	0
openid4vc-vci-p033	h2uceOxAXo20I	15	0	0
openid4vc-vci-haip-p034	qP4XQ2mv4Vfed	63	0	0
openid4vc-vci-haip-p035	bAXX5A2naCEKq	63	0	0
openid4vc-vci-haip-p036	Q9Nq2kEyIEA4l	63	0	0
openid4vc-vci-haip-p037	rmYIZBr2nSVEr	63	0	0
openid4vc-vp-p038	4vA7N0e2tk27q	7	2	0
openid4vc-vp-p039	KnHGh63UVo8MI	7	4	0
openid4vc-vp-p040	zdGhIXL9W72pM	1	3	0
openid4vc-vp-p041	9yXzr8rRuS9T0	7	4	0
openid4vc-vp-p042	CeMx81X7FSEI7	1	3	0
openid4vc-vp-haip-p043	6asMYJrcrXfu9	7	4	0
openid4vc-vp-haip-p044	sAckKvgWuU80A	1	3	0

v0.3.3

迁移基线归并

将 v0.3.2 的 127 组历史迁移归并为一个基线，SQL 文件从 254 个减少为 2 个。历史 SQL 保留在 Git 历史中。

• 空数据库直接安装最终结构与初始数据。
• 已完成 v0.3.2 迁移的数据库只增加基线记账，保留业务数据、历史迁移记录、数据库对象和权限。
• 升级要求：旧于 v0.3.2 或尚未完成其迁移的数据库，必须先用 v0.3.2 完成升级，再升级到 v0.3.3。 回退数据库应恢复已验证的备份。

空库安装、带数据升级、结构和权限对照及 PostgreSQL 回归已验证。变更与验证范围见 PR #255。

v0.3.2

Changes

• Fix federated-login MFA enforcement, cross-client token introspection authorization and FAPI client-assertion policy consistency.
• Correct SD-JWT disclosure reconstruction and credential validity checks.
• Remove repeated database lookups, hashes, parsing and payload copies across token, credential, JWE, mdoc and HTTP paths. Borrow JWE header fields and share authenticated TLS certificate chains through the existing trust boundary.
• Preserve tenant isolation, atomic consumption, replay protection and certificate trust/revocation checks.

Upgrade note

Cross-client introspection requires administrator-granted security_policy.introspection_audiences. Upgrade every server instance before configuring a nonempty value. Operator protocol 3 and release-manifest schema 7 are unchanged.

Validation

All main-branch workflows passed for 385d23a330158ae78ff3fd55df2eac3a74cb2aec, including workspace quality, security and supply chain, CodeQL, coverage, operator fuzz and release policy. The tagged release pipeline includes eight native platform builds, dependency policy, OCI vulnerability scanning, signing and provenance. Tagged release pipeline: all 22 jobs passed; all 10 expected release assets are uploaded with SHA-256 digests. Ignored and conditionally skipped checks are not counted as passes.

Production deployment, official OIDF certification and complete network/kernel copy measurements are outside this release validation.

Full changelog: v0.3.1...v0.3.2

v0.3.1

修复 OAuth / OpenID Connect 发现文档中已支持 scope 的遗漏。

• OpenID4VCI 凭据 scope 自动取自现有凭据配置；随发行模块的启用、停用和排空状态更新声明。
• 新增可选 ADDITIONAL_SCOPES_SUPPORTED，用于显式公开业务 scope，例如 accounts；不会赋予客户端额外权限，也不会枚举私有客户端配置。
• OIDC 与 OAuth 发现端点保持一致，重复 scope 自动去重，并在启动时拒绝不符合 OAuth scope 语法的配置。

使用业务 scope 的部署可在服务端配置中设置 ADDITIONAL_SCOPES_SUPPORTED: "accounts"（按实际支持的名称填写）。凭据 scope 无需重复配置。

本次不修改授权、撤销、重放保护或数据库结构。

验证：原 12 个 WARNING 模块均已通过。对其所属的 12 个官方计划完成 446 项黑盒复测，全部通过，0 警告、0 失败。服务端仅实现协议行为，CTL 负责测试编排。

对应修复：PR #245。

---

Repository history was cleaned on 2026-10-12 to remove generated reports and test archives. Published assets are unchanged.

Original build source: fbf2d05619aed532f42a162fa4fe6bc9a33aa737. Corresponding source after cleanup: e0157e619d998b3a9e27f842af2047bdca401733. Artifact attestations retain the original build source.

v0.3.0

NazoAuth 0.3.0

This release combines the security-state/model work in #238 and the upgrade, OIDF and security repairs in #242.

• Reduce duplicated authorization and security state, compact acknowledged decision payloads, clear consumed credential payloads, and separate short-lived state from retained history. Preserve security TTLs, transaction confirmation, tenant binding and replay protection.
• Preserve released issuance and audit facts during upgrades from 0.2.16.
• Move audit acknowledgement authority to the independent receiver; exporter credentials can no longer acknowledge or delete undelivered evidence.
• Enforce FAPI policy floors, bound unauthenticated SCIM audit admission, verify downloaded UI provenance, reconcile tenant routing from PostgreSQL and correct external-key rotation.
• Reduce mdoc issuance-time fingerprinting through shared UTC-day certificate boundaries without extending credential validity.
• Publish eight platform binaries and the two attested protocol/crypto crates. Operator protocol 3 and release-manifest schema 7 remain unchanged.

Performance improvements and smaller storage

This release includes the measured performance and storage revisions from October 9–10.

Faster authorization and sustained capacity

• PostgreSQL hot reads now return their connections as soon as the database operation completes, without waiting for the request task to be scheduled again. This removes a verified cause of unnecessary pool contention while retaining transaction confirmation and security checks.
• In the recorded authorization-code comparison at 800 successful operations/s, 992 VUs and 180-second measurement windows, full-operation P95 fell from 24 to 20 ms and P99 from 56.01 to 38 ms. Both runs completed with zero drops and zero unexpected errors.
• The four previously failing capacity points—authorization code at 800 ops/s, revocation at 960 ops/s, single-CPU mixed at 400 ops/s and 16-CPU mixed at 1,600 ops/s—passed the original latency, success-rate and drop gates after the connection-ownership repair.
• The subsequent client-credentials retest sustained 4,000 successful operations/s for 10 minutes, with P95/P99 of 10/26 ms, zero drops and no unfinished operations.

Connection-ownership repair and original-gate results · Authorization comparison and client-credentials retest

Less storage per security record

Measured component	Before → after	Reduction
Authorization-code holder proof column, measured PKCE case	187 → 116 bytes	37.97%
Single-use receipt index, identical 300,000 keys	28,688,384 → 23,265,280 bytes	18.90%
Remembered-device table + indexes, 10,000 equivalent new records	4,300,800 → 3,751,936 bytes	12.76%
TOTP credential table + indexes, 10,000 equivalent new records	3,760,128 → 3,244,032 bytes	13.73%
Access-token revocation table + indexes, 10,000 equivalent new records	3,710,976 → 3,186,688 bytes	14.13%

These savings come from removing empty proof members, redundant index keys and unused model fields. Consumed backup-code verifiers are deleted in the same transaction as consumption and audit recording; consumed credential offers discard payloads that no longer have a reader. Acknowledged authorization decisions retain compact security facts instead of their full payloads.

Natural reclamation was also verified: the 30-minute authorization storage observation followed the final retention deadline and a complete maintenance cycle, after which the target decisions and all issuance receipts reached zero, while valid refresh families remained intact. Expired remembered devices and controller approvals now have an owned reclamation path.

The percentages above describe their named columns, indexes or equivalent-record fixtures. Original security retention, tenant binding, atomic consumption and replay protection are preserved.

Holder/index measurements and natural reclamation · MFA storage measurements · Revocation model measurements

Upgrade requirements

Read the 0.2.16 upgrade guide and audit role/cutover guide. The receiver, worker and restricted database roles need a coordinated cutover. Retain verified backups; do not assume the old binary can use a migrated database. Previously applied tenant-policy migrations are not automatically replayed.

Verification scope

Publication requires exact-main quality CI, native binary identity checks, dependency/image scanning, immutable asset checks and Sigstore attestations. See the security report and remaining boundaries, storage/performance evidence, and mdoc evidence. Historical load and conformance results retain their original revisions and limits; this release is not a new certification approval or a claim of unrestricted performance.

Legacy issuance cutover now blocks all live receipts, even those without ciphertext. This preserves the old replay/revocation window; upgrading may require waiting for the original refresh-token lifetime after stopping the old issuer. Already-applied cutovers do not replay this guard. Review and real PostgreSQL regression.

---

Repository history was cleaned on 2026-10-12 to remove generated reports and test archives. Published assets are unchanged.

Original build source: 5e63ff6e79805ced7b09814126ebac675bdd7d27. Corresponding source after cleanup: 7af8dfd801077e7b7390d26ed1af10eed9827882. Artifact attestations retain the original build source.

v0.2.16

What's Changed

• docs: record official release transport and OIDF acceptance by @bymoye in #191
• chore(deps): bump library/postgres from 06cad38 to 4ef4dbc by @dependabot[bot] in #181
• chore(deps): bump library/python from 05b2b8b to c6ead21 in /perf/keyset by @dependabot[bot] in #182
• chore(deps): bump library/python from 05b2b8b to c6ead21 in /perf/runner by @dependabot[bot] in #183
• chore(deps): bump psycopg from 3.3.4 to 3.3.5 in /.github by @dependabot[bot] in #184
• chore(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #185
• chore(deps): bump the cargo-minor-and-patch group across 1 directory with 9 updates by @dependabot[bot] in #186
• chore(deps): upgrade Argon2 to 0.6 and migrate password hashing by @dependabot[bot] in #187
• chore(deps): complete Rust 1.98 and dependency upgrade compatibility by @dependabot[bot] in #180
• feat: implement spec r2 authorization hardening by @bymoye in #192
• refactor: decouple default UI releases and refresh protocol sources by @bymoye in #193
• Fix audit transaction coupling, bounded revocation, and protocol validation by @bymoye in #194
• fix: close issuance races and remove historical format compatibility by @bymoye in #195
• docs: refresh security and operations contracts; remove one-time reports by @bymoye in #198
• chore(deps): bump the cargo-minor-and-patch group with 3 updates by @dependabot[bot] in #197
• chore(deps): bump taiki-e/install-action from 2.87.4 to 2.87.8 in the github-actions group by @dependabot[bot] in #196
• refactor: separate Application semantics from Native runtime ownership by @bymoye in #201
• chore(deps): bump rustls from 0.23.43 to 0.23.44 in the cargo-minor-and-patch group across 1 directory by @dependabot[bot] in #199
• chore(deps): bump the github-actions group across 1 directory with 3 updates by @dependabot[bot] in #200

Full Changelog: v0.2.15...v0.2.16

---

Repository history was cleaned on 2026-10-12 to remove generated reports and test archives. Published assets are unchanged.

Original build source: dc05cf3143986a4b101e7bff078b247518912be6. Corresponding source after cleanup: 8b6e12d42d064df5d7c06ba191b8db9965ccc9cc. Artifact attestations retain the original build source.

v0.2.15

What's Changed

• fix: finalize TLS, tenant audit and OIDF acceptance for v0.2.15 by @bymoye in #190

Full Changelog: v0.2.14...v0.2.15

---

Repository history was cleaned on 2026-10-12 to remove generated reports and test archives. Published assets are unchanged.

Original build source: 3bc257fc74bf1d21d03f4bb6083c088c09c9349a. Corresponding source after cleanup: 135f9fba0670518295461c4289e5d878d93c41a0. Artifact attestations retain the original build source.

v0.2.14

What's Changed

• fix: issue conformant mdoc certificates in v0.2.14 by @bymoye in #189

Full Changelog: v0.2.13...v0.2.14

---

Repository history was cleaned on 2026-10-12 to remove generated reports and test archives. Published assets are unchanged.

Original build source: c20d1f4502dd1de0b0443254ef97ac32fae30ff6. Corresponding source after cleanup: cf3ab27e37ff2717a4d920eeca4487a174778eaf. Artifact attestations retain the original build source.

v0.2.13

What's Changed

• fix: align tenant key revision contract for v0.2.13 by @bymoye in #188

Full Changelog: v0.2.12...v0.2.13

---

Repository history was cleaned on 2026-10-12 to remove generated reports and test archives. Published assets are unchanged.

Original build source: 5810e56ecc8de25ed1ee8b12510ea004f8e6e3e0. Corresponding source after cleanup: b4bf75c55808f3fdde5778c3a05f0a1a6ef60264. Artifact attestations retain the original build source.