From f30b1a519771ac49e2b03640e742fdb0a246bd81 Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Thu, 29 Oct 2026 22:22:27 +0100
Subject: v2.4.0: key stored credentials by certificate fingerprint

---
 AGENTS.md | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'AGENTS.md')

diff --git a/AGENTS.md b/AGENTS.md
index 3f96b7b..2a70ba2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -74,6 +74,12 @@
 ## TLS / TOFU
 - See `src/tofu.rs` for the trust model. The fingerprint is over the
   certificate's SPKI, not the whole certificate.
+- Credentials are keyed by the SPKI fingerprint, not by address: one login
+  covers every address that presents the same key. Never look credentials up
+  by host.
+- `forget_host` removes one address. Drop the credential only when no address
+  with that fingerprint remains, or two addresses for one server would stop
+  sharing a login.
 - `save_host` must not wipe the fingerprint column. Use `ON CONFLICT ...
   DO UPDATE SET last_used` — never `INSERT OR REPLACE`.
 
-- 
cgit v1.2.3