{
  "required_positive_paths": [
    "registration ceremony verifies expected RP/origin/fresh challenge/UV",
    "authentication ceremony verifies registered credential and fresh challenge"
  ],
  "required_negative_paths": [
    "expired challenge rejected",
    "mismatched challenge rejected",
    "unexpected origin rejected",
    "unexpected RP ID rejected",
    "missing required user verification rejected",
    "materially weaker recovery shortcut rejected"
  ],
  "forbidden_conclusions": [
    "A passkey is just a password stored more securely.",
    "WebAuthn registration can trust a client-supplied challenge without server verification.",
    "All passkeys have identical synchronization, backup or attestation properties.",
    "Account recovery may safely use any weaker factor because it is only an exception path."
  ],
  "transfer_context": "A synthetic staff portal uses device-bound credentials for a higher-risk role. Re-evaluate user-verification and recovery evidence without assuming the same backup/sync properties as the original fixture."
}