mrhid6 217e2dc5a9 feat(auth): prefer rather than require passkey user verification ...

Requiring user verification made password managers such as NordPass ask
for their master password on every passkey use. Every ceremony now asks
for it as preferred and no longer rejects a result without it.

This is a deliberate trade-off: a passkey used without verification is
possession-only, so passwordless sign-in and step-up rest on the device or
vault being unlocked. The spec records the decision.

2026-09-16 15:20:31 +00:00

..

plans

docs: implementation plan for MFA on local sign-in

2026-09-16 08:15:46 +00:00

specs

feat(auth): prefer rather than require passkey user verification

2026-09-16 15:20:31 +00:00