The format contract (ADR-004 decision 1) is SHA256: + unpadded standard base64 — not url-safe. The ssh-key re-export and ssh-keygen both emit the +/ alphabet (visible in the recorded fingerprints); the 'url-safe' wording in ADR-004/auth.md/plans/implementation.md and the POC-1 §1 finding was a misnomer. Wording corrected; the parity contract itself unchanged on both sides.