[scbrown]

Add a browser ceremony that creates a WebAuthn credential after an explicit click and displays only the public credential packet and fingerprint. The page ships disabled, requires an exact configured HTTPS origin/RP, rejects backup-eligible credentials and malformed context, and has no registration or network write transport.

The build includes all ceremony assets together. Operator registration, identity verification, trusted deployment origin and signed-decision activation remain separate gates.

Validation: just ci passes 58 tests, build and README checks. Six Chromium controls pass using a virtual authenticator and locally intercepted synthetic assets; the successful public packet is accepted by the candidate native signer CLI with an identical fingerprint and signing disabled. Three source mutations fail their controls; restored source passes. These checks establish source behavior, not a real-device ceremony or installed acceptance.

Recorded demonstration and repeatable fixture includes the actual WebM and static screenshot. The fixture uses no production requests or private-key export.

Rollback: revert this source commit; configuration remains disabled throughout this proposal.

[scbrown]

Source APPROVE for exact bed9c015da6fed8dee4e2e81048e9831d7ecaae8, base de8c7fdc6fe65a91e9cbdf78f29891aaa025b578. I reviewed all 13 changed paths, including the committed screenshot and the WebM played through to decoded final frames. No source blockers found.

Independent validation: just ci passed all 58 tests, the static build and README controls. Seven Chromium virtual-authenticator cases passed: shipped disabled, wrong origin, configured creation with a second fresh click, backup-eligible refusal, cancellation, unsupported API and a modified user-verification flag. Public fingerprints were independently recomputed. No nonlocal requests; both HOME guards clean (157 paths + 5 resources). The committed video decodes through its final “Not enrolled” public-packet state; an initial paused screenshot was a stale presentation frame, not a recording defect.

The page remains disabled, exports public material only and has no registration/write transport. The documented WebAuthn flags are metadata, not hardware attestation or proof of human identity. I did not repeat the author's native signer integration against the older Quipu candidate; current CLI qualification remains a separate gate.

Native current ee9 accepted Wu source review 939f0c0598b7412874682b2ea4eefdedfb58c72a33012c0deb054d5ee9229b62 for f418104a. This is source approval only. Current normal landing/watch gates remain; no enrollment, origin activation, signing enablement, production query or human ceremony is authorized.