v2.4.0: key stored credentials by certificate fingerprint

1 files changed, 6 insertions, 0 deletions

diff --git a/AGENTS.md b/AGENTS.md
index 3f96b7b..2a70ba2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -74,6 +74,12 @@
 ## TLS / TOFU
 - See `src/tofu.rs` for the trust model. The fingerprint is over the
   certificate's SPKI, not the whole certificate.
+- Credentials are keyed by the SPKI fingerprint, not by address: one login
+  covers every address that presents the same key. Never look credentials up
+  by host.
+- `forget_host` removes one address. Drop the credential only when no address
+  with that fingerprint remains, or two addresses for one server would stop
+  sharing a login.
 - `save_host` must not wipe the fingerprint column. Use `ON CONFLICT ...
   DO UPDATE SET last_used` — never `INSERT OR REPLACE`.