Specify WebAuthn permit co-signatures (permit.co_signature.v1)

[sftimeless]

Defines the normative contract for a human co-signing a permit with their own passkey — a key Keel never holds — such that the co-signature can be verified offline, without contacting Keel.

Two roles: an approver (gating: the permit stays challenged until quorum is met) and a witness (non-gating: recorded after the fact, never changes the decision).

What's in it

• spec/permit-co-signature-v1.md — the normative contract, including the ordered verification procedure and the offline pack-binding requirements.
• Four closed schemas (additionalProperties: false): the claim, the WebAuthn assertion envelope, the co-signer key record, and the require_co_signature policy requirement.
• Golden corpus — 9 vectors (ES256 + EdDSA positives, 7 distinct negatives) plus a reference verifier. Downstream repos cross-check against this corpus in CI, so the runtime implementations cannot drift from the contract.
• claim_registry/v0.json — registers the new claim.
• spec/failure-codes.md — the reason codes each negative must produce.

Design notes worth reviewing

• A WebAuthn authenticator signs authenticatorData || SHA-256(clientDataJSON), not the permit bytes. The permit's canonical hash travels in the challenge, and equality is checked on decoded bytes — base64url_decode(challenge) == hex_decode(permit_canonical_hash) — never as strings.
• ES256 (-7) is first-class, alongside EdDSA (-8). Real passkeys are commonly ES256.
• aaguid, attestation, backup_eligible, backup_state, sign_count, cose_alg, rp_id and credential_id are recorded but not enforced. This is deliberate: it makes "hardware-bound only" (require attestation + an AAGUID allowlist + backup_eligible=false) a later policy flip rather than a rebuild.

Claim boundary (please hold the line on this)

This proves a co-signature by a key Keel does not hold, verifiable offline. It does not prove the key is hardware-bound, and it does not make the co-signature independent — offline verification still chains to Keel's signed key manifest. Independence requires an external identity root, which is deliberately out of scope here.

Sequencing

First of three. keel-verifier and keel-api both depend on this landing — their conformance tests read this corpus, and keel-api pins this repo by SHA.

🤖 Generated with Claude Code