Skip to content

CR-YK-001: Add hardware-backed human authorization receipts #110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
coreytshaffer merged 2 commits into from
Jul 24, 2026
Merged

CR-YK-001: Add hardware-backed human authorization receipts #110

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3c5490a
feat(authz): add CR-YK-001 FIDO2 authorization receipt foundation
coreytshaffer Jul 23, 2026
7a94535
fix(authz): complete Windows hardware verification
coreytshaffer Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,25 @@ Share feedback in [GitHub Discussions](https://github.com/coreytshaffer/TriageCo
- Supports local benchmark fixtures and benchmark reports without hiding the evidence trail.
- Enforces local-only privacy boundaries before any optional external-safe Qwen Cloud path is considered.

### Experimental WebAuthn Authorization

CR-YK-001 prototypes request-bound WebAuthn authorization receipts. Two
independently enrolled physical YubiKeys are the optimal production and
recovery posture. When a second hardware key is unavailable, TriageCore
supports a separately enrolled and labeled cross-device phone WebAuthn
passkey as a bounded secondary pathway. The phone passkey signs the same
request-bound WebAuthn challenge and can be verified offline, but it is not a
second hardware security key and must not be described as
assurance-equivalent. Google Authenticator/TOTP codes are not a substitute
for either WebAuthn pathway.

Primary YubiKey enrollment and assertion ceremonies verified on Windows. A phone passkey was also validated as a secondary cross-device pathway. Redundant backup-YubiKey enrollment remains unverified.

This feature remains experimental: execution integration and atomic
capability consumption are not complete. See
[CR-YK-001](docs/change/requests/CR-YK-001-hardware-authorization-receipts.md)
for evidence and limitations.

## Evidence-Bound Build Review

Build Review turns a development request and Git comparison into a local,
Expand Down
Loading
Loading