Skip to content
QAuth

Status

This page is rendered from apps/docs-site/src/lib/status.ts, the single source for QAuth’s delivery status. To change what this page says, edit that file — not this one.

Current release: v0.1.0-rc.0 (pre-release, 2026-07-25).

Oldest lastVerified across the site: 2026-07-26 —Extend (30 pages checked).

Delivery tracks

Section titled “Delivery tracks”
TrackStateSummary
T0 — Trust floorshippedReal-DB (testcontainers) repository tests, logout endpoint test, CI typecheck + coverage gate.
T1 — MCP productizationshipped`@qauth-labs/mcp-guard` (RFC 9728 metadata + token validation + step-up scope challenges), Client ID Metadata Documents (CIMD) support, MCP quickstart + example, RFC 7009 revocation.
T2 — Agent-native authorizationshippedAgent client type, RFC 8693 on-behalf-of token exchange, scope modes (ReadOnly / Admin / Exec), step-up, per-agent audit.
T3 — OIDC conformance + hardeningshippedSecurity headers, CSRF, secure cookies, OIDC ID token/nonce/claims, structured logging + `/metrics`, failed-login lockout.
T5 — Environment-aware authorizationshipped`environment` (development / staging / production) as a fail-safe policy dimension; `resolveEnvironmentPolicy` drives token TTLs, PKCE, localhost redirects, rate-limit tier, agent step-up; environment-gated developer API keys.
T4 — Federation + PQC (long-term platform)partialIdentifier abstraction, the gate this track waited on, shipped and closed. Wallet federation completes a browser sign-in end to end behind a default-off flag, with HAIP profile wiring, key-storage assurance and the real-wallet interoperability pass still open; PQC hybrid signing shipped behind a default-off flag. See the feature rows below.

Feature status

Section titled “Feature status”

Flag-gated features are off by default; enabling one is an operator decision, not a statement that the feature is incomplete everywhere it applies.

FeatureStateFlagSummary
Identifier abstraction (ADR-002)shipped—Epic #224 closed. Migrations 0010–0012 shipped, including the destructive 0011 that dropped `users.email`, `users.email_normalized`, and `users.password_hash`. `users` is now a pure identity anchor; credentials live in `user_credentials`. Not a gate for anything else — done.
PQC / hybrid signingshippedHYBRID_SIGNING_ENABLED (default off)Epic #241 closed. Hybrid ML-DSA-65 + Ed25519 signing, mixed AKP+OKP JWKS, a native aws-lc-rs backend via napi-rs, and an attested reproducible build channel (byte-for-byte determinism verified on Linux only) all shipped.
Wallet federation / OID4VPpartialWALLET_FEDERATION_ENABLED (default off)Merged: `VerifierProfile` (#299), OID4VP 1.0 request generation and `direct_post` intake (#233), the per-realm issuer trust allowlist (#236), ES256 + JWE crypto (#298), SD-JWT VC presentation validation (#234), Token Status List revocation (#297), the wallet sign-in UI (#239) and the end-to-end mock-wallet suite (#240, `apps/auth-server/src/app/wallet-federation.integration.test.ts`). A browser completes a wallet sign-in — first-time enrolment, returning login, account linking and `acr` — once the flag is on and a `VerifierProfile` is named; with the flag on and no profile named the deployment refuses to start rather than falling back to a default posture. Validated so far only on the `oid4vp-1.0-base` profile against a mock wallet. Open: HAIP profile wiring (#377), key-storage assurance in the assurance policy (#379), and the real-wallet interoperability pass (#376).
Agent-native authorizationshipped—Agent client type, RFC 8693 on-behalf-of token exchange (`act` claim), scope modes (ReadOnly / Admin / Exec), step-up before dangerous operations, per-agent audit.
Environment-aware authorizationshipped—`environment` selects a fail-safe policy profile across token TTLs, PKCE, localhost redirects, rate-limit tier, and agent step-up.
API keysshipped—Environment-gated developer API keys (backend + portal UI), governed by the same environment-aware authorization policy rather than a standalone flag.