Feature availability and versions
As checked on October 27, 2026 (America/New_York), current published releases are AuthCrunch v1.6.2, caddy-security v1.6.2 and go-authcrunch v1.5.0. Both Caddy executables use Caddy v2.11.7 and library v1.5.0. Installing a newer standalone library does not update an already built executable.
Choose the artifact
| Artifact | Contents and evidence |
|---|---|
| AuthCrunch v1.6.2 distribution | Ready-to-run authcrunch; the three embedded portal apps and all 17 backend companions. Pinned dependencies and compiled imports. |
| caddy-security v1.6.2 | Core authcrunch executable with the three apps and separate caddy-authenticator archives; backend companions require explicit imports/custom-build selection. Dependency declaration. |
| go-authcrunch v1.5.0 | Reusable runtime library with embedded app assets and mount-aware routing; its version alone does not prove a Caddy directive or plugin is compiled. |
All three have published release assets. The two server releases use the same archive filenames; verify the checksum from the same repository as the download. Follow installation and the companion inventory. Older provider examples retain their stated v1.3.0/v1.3.8 test baseline where no new provider-specific runtime check was made.
Feature support needs matching library, adapter, and executable evidence. A library release can contain behavior that an older Caddy adapter cannot configure. A source tag can exist without a downloadable binary. Inspect the executable actually run, its selected modules, and the feature’s parser/runtime boundary. Main-branch documentation alone does not prove a deployed release supports the feature.
Check the executable you run
authcrunch version
authcrunch security version
authcrunch list-modules --versions
These report Caddy, the linked AuthCrunch library, and compiled modules. Also
retain the integration version/build provenance. For custom caddy builds use
that executable's name. The caddy-security v1.6.2 macOS arm64 archive was
checksum-verified for the application setup, and
reported Caddy v2.11.7 and go-authcrunch v1.5.0. The older v1.5.0 distribution's
macOS arm64 archive was separately verified for the earlier companion review.
Portal apps in v1.6.2
The executable embeds User Profile,
Security Manager, and
File Vault. The portal supplies links according to
feature availability and role. Security Manager needs the Admin API and
authp/admin; File Vault needs an initialized Documents API and a portal
user/admin role. Profile shell access does not replace its API/session checks.
Use the complete setup for configuration and role tests.
App assets, fonts, translations and lazy-loaded routes follow root and nested portal mounts. Deep-link reloads retain the canonical app base. Missing asset files return 404 rather than SPA HTML; explicit escaped mounts are preserved. The UI's own version, such as v1.1.4 in the supplied File Vault demo, is separate from the integration and linked library versions.
Current feature map
| Capability | Availability and documentation |
|---|---|
| Local/LDAP/OAuth/SAML login, local MFA, direct OAuth, downstream OIDC | Core; existing guides retain their specified version/test boundaries |
| Typed policy-local ACL fields and corrected unconditional rules | Present in released v1.4.1 and v1.5.0; older v1.3.0 has the unconditional-rule limitation |
| Cross-device login | Released, HTTPS and explicit opt-in; approval flow |
| SQLite password accounts and email-confirmed signup | Selected companions; provisioning and signup |
| Trusted application tickets | SQLite/Consul companions; ticket protocol |
| Durable notification outbox and secret snapshots | Selected companions; messaging, secrets |
| Fresh standalone API-key backends | SQLite/Consul companions; API-key authentication |
| Required request-time ACL attributes and HTTP decisions | Selected companions; enrichment, external authorization |
| Selected PS256 signer and strict access-token profiles | Companion plus explicit consumer profiles; signing and rotation |
| Shared pending upstream OAuth transactions | SQLite/Consul companions plus provider namespace; login storage |
| Managed refresh storage and provider snapshot renewal | Named SQLite/Consul storage requires root state; OAuth renewal is explicit snapshot mode; refresh guide |
| Durable local attachments and user-confirmed account connection | Core plus explicit built-in-local-store target; connected accounts |
| Encrypted Documents API | Core, explicitly enabled, current local browser session; Documents |
| Built-in User Profile, Security Manager and File Vault apps | Bundled in v1.6.2 with go-authcrunch v1.5.0; setup and walkthroughs |
| Explicit mounts, independent tab destinations and portal/OIDC localization | Core; mounts, redirects, language |
| Standalone native login client | Separate caddy-security release asset; caddy-authenticator |
Earlier v1.5.0 upgrade baseline
The following notes retain the previous review's v1.5.0 baseline. For the app addition, also review v1.5.0 to v1.6.2 integration changes and v1.4.1 to v1.5.0 library changes. Select matching versions for any custom-build companions.
- Download the intended artifact and inspect its modules; custom builds select every needed companion at v1.5.0. Importing the root alone no longer suffices.
- Read the integration changes and library changes. V1.5.0 includes both library v1.4.0 and v1.4.1 changes.
- Back up coherent identities, keys and state. Persistent roots and overlapping local identity files require a drained stop/start, not an overlapping reload.
- Adapt the actual configuration with the replacement executable, then test login, required factors, allowed/denied requests, logout, renewal and restart. Use explicit mounts for new portal integrations. Unknown UI languages now fail.
- Check current credential changes: portal-backed Basic/API-key authentication rechecks the account on every request. Signed JWTs retain their own expiry. Authentication diagnostics add portal/realm attribution and redact raw provider identities; separately configure host-log credential redaction.
The release also fixes authorization reload hangs involving downstream streams
such as WebSockets, and SQLite ticket/refresh locking under contention. These
fixes do not make persistent overlapping reload supported. Upstream build
qualification uses Go 1.26.10 and golang.org/x/net v0.60.0; Caddy remains
v2.11.7. Source builds should retain those dependency/toolchain fixes rather
than inferring patch status from Caddy's version alone.
Remaining boundaries
AWS application SAML still has an incomplete assertion handler. Native Nextcloud login still lacks its profile integration. These are distinct from supported upstream SAML and generic OIDC login.
Consul distributes selected backend records, not all portal authority. Managed refresh still requires exclusive root state; independent roots cannot share refresh authority. Sandbox/MFA, cross-device, downstream OIDC and direct-policy session state retain their owners. See deployment boundaries.
Agentic Prompts
Copy a prompt into your LLM to explore this topic. Each prompt prioritizes upstream repository guidance and code over this page, and asks for version-aware reasoning.
Inventory the executable I actually run
Help me understand Feature availability and versions.
Primary authorities (take precedence over website documentation):
https://github.com/greenpau/caddy-security/blob/main/AGENTS.md
https://github.com/greenpau/caddy-security/tree/main/.codex/skills
https://github.com/greenpau/go-authcrunch/blob/main/AGENTS.md
https://github.com/greenpau/go-authcrunch/tree/main/.codex/skills
Read each repository's root AGENTS.md first, then any scoped AGENTS.md that
applies to inspected paths. Read the relevant SKILL.md files and follow their
implementation and test references.
Relevant skills to locate: release-and-versioning, configuration.
Secondary reference:
https://docs.authcrunch.com/docs/operations/versions
If a source is inaccessible, ask me to paste its relevant text. Identify the
versions your answer applies to; main may be newer than my release. Resolve
disagreements using code and tests, and flag unverified claims. Use synthetic
credentials and redacted examples; explain proposed checks before any changes.
Ask for the binary path, Caddy version, security version, compiled modules,
and integration build provenance. Explain what each proves and what it cannot
prove. Distinguish a downloadable bundle, a source tag, a library module
release, and the source currently checked out beside the docs.
Verify a feature’s release boundary
Help me understand Feature availability and versions.
Primary authorities (take precedence over website documentation):
https://github.com/greenpau/caddy-security/blob/main/AGENTS.md
https://github.com/greenpau/caddy-security/tree/main/.codex/skills
https://github.com/greenpau/go-authcrunch/blob/main/AGENTS.md
https://github.com/greenpau/go-authcrunch/tree/main/.codex/skills
Read each repository's root AGENTS.md first, then any scoped AGENTS.md that
applies to inspected paths. Read the relevant SKILL.md files and follow their
implementation and test references.
Relevant skills to locate: release-and-versioning, configuration.
Secondary reference:
https://docs.authcrunch.com/docs/operations/versions
If a source is inaccessible, ask me to paste its relevant text. Identify the
versions your answer applies to; main may be newer than my release. Resolve
disagreements using code and tests, and flag unverified claims. Use synthetic
credentials and redacted examples; explain proposed checks before any changes.
Choose a capability I want, then trace its adapter grammar, library consumer,
tests, release tags, and downloadable assets. Compare main with my exact
release. Mark source-only behavior explicitly and do not infer supported
syntax merely because the library exposes a related type.
Read release evidence critically
Help me understand Feature availability and versions.
Primary authorities (take precedence over website documentation):
https://github.com/greenpau/caddy-security/blob/main/AGENTS.md
https://github.com/greenpau/caddy-security/tree/main/.codex/skills
https://github.com/greenpau/go-authcrunch/blob/main/AGENTS.md
https://github.com/greenpau/go-authcrunch/tree/main/.codex/skills
Read each repository's root AGENTS.md first, then any scoped AGENTS.md that
applies to inspected paths. Read the relevant SKILL.md files and follow their
implementation and test references.
Relevant skills to locate: release-and-versioning, configuration.
Secondary reference:
https://docs.authcrunch.com/docs/operations/versions
If a source is inaccessible, ask me to paste its relevant text. Identify the
versions your answer applies to; main may be newer than my release. Resolve
disagreements using code and tests, and flag unverified claims. Use synthetic
credentials and redacted examples; explain proposed checks before any changes.
Compare a version file, go.mod selection, release notes, a Git tag, and an
attached executable/checksum. Explain why a tag without published assets is
not a downloadable upgrade and why updating a source dependency does not
update an existing binary. Verify current official release information before
recommending a version.
Plan a reproducible upgrade check
Help me understand Feature availability and versions.
Primary authorities (take precedence over website documentation):
https://github.com/greenpau/caddy-security/blob/main/AGENTS.md
https://github.com/greenpau/caddy-security/tree/main/.codex/skills
https://github.com/greenpau/go-authcrunch/blob/main/AGENTS.md
https://github.com/greenpau/go-authcrunch/tree/main/.codex/skills
Read each repository's root AGENTS.md first, then any scoped AGENTS.md that
applies to inspected paths. Read the relevant SKILL.md files and follow their
implementation and test references.
Relevant skills to locate: release-and-versioning, configuration.
Secondary reference:
https://docs.authcrunch.com/docs/operations/versions
If a source is inaccessible, ask me to paste its relevant text. Identify the
versions your answer applies to; main may be newer than my release. Resolve
disagreements using code and tests, and flag unverified claims. Use synthetic
credentials and redacted examples; explain proposed checks before any changes.
Create a plan to verify artifact provenance, required modules, redacted
configuration adaptation, trusted HTTPS, allowed and denied journeys, and
rollback constraints. Include local identity and persistent-state ownership
where applicable. Ask about topology and current versions before prescribing
commands or a deployment method.
Practice version diagnosis
Help me understand Feature availability and versions.
Primary authorities (take precedence over website documentation):
https://github.com/greenpau/caddy-security/blob/main/AGENTS.md
https://github.com/greenpau/caddy-security/tree/main/.codex/skills
https://github.com/greenpau/go-authcrunch/blob/main/AGENTS.md
https://github.com/greenpau/go-authcrunch/tree/main/.codex/skills
Read each repository's root AGENTS.md first, then any scoped AGENTS.md that
applies to inspected paths. Read the relevant SKILL.md files and follow their
implementation and test references.
Relevant skills to locate: release-and-versioning, configuration.
Secondary reference:
https://docs.authcrunch.com/docs/operations/versions
If a source is inaccessible, ask me to paste its relevant text. Identify the
versions your answer applies to; main may be newer than my release. Resolve
disagreements using code and tests, and flag unverified claims. Use synthetic
credentials and redacted examples; explain proposed checks before any changes.
Quiz me on five mismatches: new docs with an old bundle, new library with an
old adapter, a release tag without assets, an executable on a different PATH,
and a locally replaced module. Wait for my evidence and show how to resolve
each without claiming a version check exercises the feature.
Source Code References
Start with the code search, then follow the parser, runtime, and tests relevant
to this topic. These links target main; use GitHub's branch/tag selector to
compare them with your installed release.
- Search this topic in both repositories — searches topic-specific symbols and paths across both codebases.
- caddy-security: go.mod — records the integration's selected Caddy and AuthCrunch library dependencies.
- caddy-security: command_security.go — registers security commands, including the library-version report.
- caddy-security: command_security_version_e2e_test.go — checks the security version command through the executable boundary.
- go-authcrunch: VERSION — records the library version in the selected source revision.
- go-authcrunch: go.mod — records the library's module and dependency declarations.