feat(examples): wire offered/accepted COSE algorithm config through adapters + demos

Plumb the crypto-agility algorithm lists (ADR 0019) through all three adapter
config surfaces and set them explicitly in each example app, completing the
ADR's "wire through external host config" follow-up.

- Spring: pkauth.ceremony.offered-algorithms / accepted-algorithms bound on
  PkAuthProperties.Ceremony and forwarded via the 7-arg CeremonyConfig.from.
- Micronaut: same keys on PkAuthConfiguration.Ceremony (getter/setter pairs),
  forwarded in PkAuthFactory.
- Dropwizard: offeredAlgorithms / acceptedAlgorithms record components on
  PkAuthConfig.Ceremony (TTL-only and no-arg constructors kept for back-compat),
  forwarded in PkAuthModule.
- Demos: spring + micronaut application.yml set both lists; the Java-configured
  dropwizard DemoConfiguration sets them on PkAuthConfig.Ceremony. All set to the
  core defaults as living documentation; nulls still fall back to those defaults.
- Docs: operator-guide section on the two knobs; ADR 0019 follow-up marked done.

Verified: ./gradlew check passes, and all three demos boot with the new config
and pass their Playwright e2e suites (the enum-list binding is exercised by a
real registration ceremony in each).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: wolpert

docs/adr/0019-crypto-agility-post-quantum-readiness.md

@@ -85,9 +85,12 @@ verification and *are* Shor-vulnerable, with exposure bounded by the short token
 
 ## Open follow-ups
 
-- Wire `offeredAlgorithms` / `acceptedAlgorithms` through each adapter's external (YAML) host config.
-  Today they are overridable via `CeremonyConfig` / the `PasskeyAuthenticationServices` builder; full
-  per-adapter property plumbing is deferred until there is a concrete reason to narrow the lists from
-  configuration.
+- ~~Wire `offeredAlgorithms` / `acceptedAlgorithms` through each adapter's external host config.~~
+  Done: bound under `pkauth.ceremony.offered-algorithms` / `pkauth.ceremony.accepted-algorithms` in
+  the Spring starter (`PkAuthProperties.Ceremony`) and Micronaut adapter (`PkAuthConfiguration`),
+  and as the `PkAuthConfig.Ceremony(offeredAlgorithms, acceptedAlgorithms)` record components in the
+  Dropwizard adapter. Each adapter null-coalesces to the core defaults and passes the lists to the
+  seven-argument `CeremonyConfig.from(...)`. All three example apps set them explicitly (to the
+  defaults) as living documentation.
 - Revisit when a COSE-registered post-quantum signature algorithm lands in WebAuthn4J; adding it is
   the localized change this ADR was written to enable.

docs/operator-guide.md

@@ -46,6 +46,27 @@ authenticator (mere user-presence, no biometric/PIN). A passkey then degrades to
 UV-incapable roaming hardware security keys; if you do, scope it deliberately and
 understand the trade-off.
 
+### COSE signature algorithms (crypto-agility)
+
+Two ceremony knobs control which COSE signature algorithms are used (ADR 0019):
+
+- `pkauth.ceremony.offered-algorithms` — advertised to the authenticator in
+  registration create-options. Default: `[ES256, EdDSA, RS256]`.
+- `pkauth.ceremony.accepted-algorithms` — the verify allow-list; a credential
+  whose algorithm is absent is rejected on registration. Default (and the
+  enforced superset): `[ES256, EdDSA, RS256, ES384, RS384]`.
+
+`offered` must be a subset of `accepted`. The defaults are the historical union,
+so leaving them unset changes nothing. You may **narrow** either (e.g. drop RSA),
+but narrowing `accepted` can reject **already-registered** credentials that use a
+removed algorithm — drive a re-enrollment campaign first (see
+`AdminService.listCredentialsByAlgorithm`). In Spring and Micronaut these bind
+from `application.yml`; in Dropwizard they are the `PkAuthConfig.Ceremony`
+record's `offeredAlgorithms` / `acceptedAlgorithms` components. All three example
+apps set them explicitly (to the defaults) as living documentation. There is no
+post-quantum signature algorithm to select yet — see `docs/threat-model.md`
+(Post-quantum readiness).
+
 ## 3. Persistence migrations
 
 ### JDBI / Postgres

examples/dropwizard-demo/src/main/java/com/codeheadsystems/pkauth/demo/dropwizard/DemoConfiguration.java

@@ -1,9 +1,11 @@
 // SPDX-License-Identifier: MIT
 package com.codeheadsystems.pkauth.demo.dropwizard;
 
+import com.codeheadsystems.pkauth.config.CoseAlgorithm;
 import com.codeheadsystems.pkauth.dropwizard.HasPkAuthConfig;
 import com.codeheadsystems.pkauth.dropwizard.config.PkAuthConfig;
 import io.dropwizard.core.Configuration;
+import java.util.List;
 import java.util.Set;
 
 /**
@@ -18,7 +20,21 @@ public final class DemoConfiguration extends Configuration implements HasPkAuthC
           new PkAuthConfig.RelyingParty(
               "localhost", "pk-auth demo", Set.of("http://localhost:8080")),
           new PkAuthConfig.Jwt("https://issuer.local", "pkauth-demo", defaultDevSecret(), null),
-          new PkAuthConfig.Ceremony(),
+          // Crypto-agility (ADR 0019): the COSE algorithm lists are explicit here for illustration.
+          // These match the core defaults — `offered` is advertised to the authenticator,
+          // `accepted`
+          // is the (superset) verify allow-list. An operator can narrow either; the defaults are
+          // the
+          // historical union so no already-registered credential can fail verification.
+          new PkAuthConfig.Ceremony(
+              null,
+              List.of(CoseAlgorithm.ES256, CoseAlgorithm.EdDSA, CoseAlgorithm.RS256),
+              List.of(
+                  CoseAlgorithm.ES256,
+                  CoseAlgorithm.EdDSA,
+                  CoseAlgorithm.RS256,
+                  CoseAlgorithm.ES384,
+                  CoseAlgorithm.RS384)),
           new PkAuthConfig.Otp(defaultDevOtpPepper()),
           new PkAuthConfig.MagicLink("http://localhost:8080"),
           new PkAuthConfig.BackupCode());

examples/micronaut-demo/src/main/resources/application.yml

@@ -17,3 +17,10 @@ pkauth:
     issuer: pk-auth-micronaut-demo
     audience: pk-auth-micronaut-demo-clients
     secret: change-me-in-prod-use-a-32-byte-secret!!
+  ceremony:
+    # Crypto-agility (ADR 0019): COSE signature algorithms. `offered-algorithms` is advertised to
+    # the authenticator in create-options; `accepted-algorithms` is the verify allow-list and must
+    # be a superset. Listed here as the explicit core defaults; an operator can narrow either
+    # (narrowing `accepted` can reject already-registered credentials, so change deliberately).
+    offered-algorithms: [ES256, EdDSA, RS256]
+    accepted-algorithms: [ES256, EdDSA, RS256, ES384, RS384]

examples/spring-boot-demo/src/main/resources/application.yml

@@ -24,6 +24,12 @@ pkauth:
     token-ttl: PT1H
   ceremony:
     challenge-ttl: PT5M
+    # Crypto-agility (ADR 0019): COSE signature algorithms. `offered-algorithms` is advertised to
+    # the authenticator in create-options; `accepted-algorithms` is the verify allow-list and must
+    # be a superset. Listed here as the explicit core defaults; an operator can narrow either
+    # (narrowing `accepted` can reject already-registered credentials, so change deliberately).
+    offered-algorithms: [ES256, EdDSA, RS256]
+    accepted-algorithms: [ES256, EdDSA, RS256, ES384, RS384]
 logging:
   level:
     com.codeheadsystems.pkauth: INFO

pk-auth-dropwizard/src/main/java/com/codeheadsystems/pkauth/dropwizard/config/PkAuthConfig.java

@@ -1,10 +1,12 @@
 // SPDX-License-Identifier: MIT
 package com.codeheadsystems.pkauth.dropwizard.config;
 
+import com.codeheadsystems.pkauth.config.CoseAlgorithm;
 import com.codeheadsystems.pkauth.refresh.RefreshTokenConfig;
 import java.time.Duration;
 import java.util.LinkedHashMap;
 import java.util.LinkedHashSet;
+import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
@@ -148,10 +150,22 @@ public byte[] secret() {
    * com.codeheadsystems.pkauth.config.CeremonyConfig#defaults()}.
    *
    * @param challengeTtl Override for challenge TTL; null = use the brief's 5-minute default.
+   * @param offeredAlgorithms COSE algorithms advertised in create-options; null = core default
+   *     (ES256, EdDSA, RS256). Must be a subset of {@code acceptedAlgorithms}.
+   * @param acceptedAlgorithms COSE algorithms accepted on verify; null = core default union (ES256,
+   *     EdDSA, RS256, ES384, RS384). Narrowing can reject already-registered credentials.
    */
-  public record Ceremony(@Nullable Duration challengeTtl) {
+  public record Ceremony(
+      @Nullable Duration challengeTtl,
+      @Nullable List<CoseAlgorithm> offeredAlgorithms,
+      @Nullable List<CoseAlgorithm> acceptedAlgorithms) {
     public Ceremony() {
-      this(null);
+      this(null, null, null);
+    }
+
+    /** Back-compat convenience for the TTL-only construction used before crypto-agility config. */
+    public Ceremony(@Nullable Duration challengeTtl) {
+      this(challengeTtl, null, null);
     }
   }
 

pk-auth-dropwizard/src/main/java/com/codeheadsystems/pkauth/dropwizard/dagger/PkAuthModule.java

@@ -104,9 +104,11 @@ RelyingPartyConfig provideRelyingPartyConfig(PkAuthConfig cfg) {
   @Provides
   @Singleton
   CeremonyConfig provideCeremonyConfig(PkAuthConfig cfg) {
-    // Only challengeTtl is host-settable here; the remaining knobs take the conservative core
-    // defaults (UV=REQUIRED, counter=REJECT) via the null fallbacks.
-    return CeremonyConfig.from(cfg.ceremony().challengeTtl(), null, null, null, null);
+    // challengeTtl and the COSE algorithm lists are host-settable; the remaining knobs take the
+    // conservative core defaults (UV=REQUIRED, counter=REJECT) via the null fallbacks.
+    PkAuthConfig.Ceremony c = cfg.ceremony();
+    return CeremonyConfig.from(
+        c.challengeTtl(), null, null, null, null, c.offeredAlgorithms(), c.acceptedAlgorithms());
   }
 
   /**

pk-auth-micronaut/src/main/java/com/codeheadsystems/pkauth/micronaut/PkAuthConfiguration.java

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: MIT
 package com.codeheadsystems.pkauth.micronaut;
 
+import com.codeheadsystems.pkauth.config.CoseAlgorithm;
 import io.micronaut.context.annotation.ConfigurationProperties;
 import java.time.Duration;
 import java.util.List;
@@ -103,6 +104,8 @@ public void setDevMode(boolean devMode) {
   @ConfigurationProperties("ceremony")
   public static final class Ceremony {
     private Duration challengeTtl = Duration.ofMinutes(5);
+    @Nullable private List<CoseAlgorithm> offeredAlgorithms;
+    @Nullable private List<CoseAlgorithm> acceptedAlgorithms;
 
     public Duration getChallengeTtl() {
       return challengeTtl;
@@ -111,6 +114,26 @@ public Duration getChallengeTtl() {
     public void setChallengeTtl(Duration challengeTtl) {
       this.challengeTtl = challengeTtl;
     }
+
+    /** COSE algorithms advertised in create-options; null = core default (ES256, EdDSA, RS256). */
+    @Nullable
+    public List<CoseAlgorithm> getOfferedAlgorithms() {
+      return offeredAlgorithms;
+    }
+
+    public void setOfferedAlgorithms(@Nullable List<CoseAlgorithm> offeredAlgorithms) {
+      this.offeredAlgorithms = offeredAlgorithms;
+    }
+
+    /** COSE algorithms accepted on verify; null = core default union (adds ES384, RS384). */
+    @Nullable
+    public List<CoseAlgorithm> getAcceptedAlgorithms() {
+      return acceptedAlgorithms;
+    }
+
+    public void setAcceptedAlgorithms(@Nullable List<CoseAlgorithm> acceptedAlgorithms) {
+      this.acceptedAlgorithms = acceptedAlgorithms;
+    }
   }
 
   /**

pk-auth-micronaut/src/main/java/com/codeheadsystems/pkauth/micronaut/PkAuthFactory.java

@@ -65,9 +65,17 @@ RelyingPartyConfig relyingPartyConfig(PkAuthConfiguration config) {
 
   @Singleton
   CeremonyConfig ceremonyConfig(PkAuthConfiguration config) {
-    // Only challengeTtl is host-settable here; the remaining knobs take the conservative core
-    // defaults (UV=REQUIRED, counter=REJECT) via the null fallbacks.
-    return CeremonyConfig.from(config.getCeremony().getChallengeTtl(), null, null, null, null);
+    // challengeTtl and the COSE algorithm lists are host-settable; the remaining knobs take the
+    // conservative core defaults (UV=REQUIRED, counter=REJECT) via the null fallbacks.
+    PkAuthConfiguration.Ceremony c = config.getCeremony();
+    return CeremonyConfig.from(
+        c.getChallengeTtl(),
+        null,
+        null,
+        null,
+        null,
+        c.getOfferedAlgorithms(),
+        c.getAcceptedAlgorithms());
   }
 
   @Singleton

pk-auth-spring-boot-starter/src/main/java/com/codeheadsystems/pkauth/spring/autoconfigure/PkAuthAutoConfiguration.java

@@ -118,7 +118,9 @@ public CeremonyConfig pkAuthCeremonyConfig(PkAuthProperties props) {
         c.userVerification(),
         c.residentKey(),
         c.attestation(),
-        c.counterRegression());
+        c.counterRegression(),
+        c.offeredAlgorithms(),
+        c.acceptedAlgorithms());
   }
 
   /**