T
i
g
h
t
w
a
d
Staging
Passkey spike (throwaway)
Staging only. Run the steps in order;
Copy results
at the bottom and paste them to Claude.
0 · What this browser can do
1 · Show my session (aal / amr) — as the browser sees it
2 · What OUR server sees (does it accept this session?)
Device name
3 · Register a passkey (be signed in the normal way first)
4 · List my passkeys
5 · Sign out of this browser
6 · Sign in with a passkey, then read the session
7 · What OUR server sees now
8 · Add a phone-unlock as a SECOND factor — asks the phone to UNLOCK (signed in with password + code first)
9 · Prove it with the second-factor — must ask for the unlock again (aal2?)
Copy results
[]