contracts.rules_passkeys

Passkeys / WebAuthn startup contract —passkeys=Truedependency posture.

What this rule deliberately does not re-check (to stay non-redundant and low-noise): the generic "a mutating route needs Session/CSRF" presence check is owned byrules_security_stack(a passkeys app's finish endpoints are mutating POSTs, so that rule already requiresSessionMiddleware); the static "rp_id is a registrable suffix of origin" invariant is owned by PasskeyConfig.__post_init__(fail-loud at construction); and the HTTPS-in-production posture is covered byrules_cookie_secure(a Secure session cookie implies HTTPS, which is WebAuthn's secure-context requirement).

Cookie-backed sessions are a first-class production path for passkeys. The single-use challenge (~86-char base64url) lives in the session between begin and finish on bothCookieSessionStore and RedisSessionStore; Redis is optional for horizontal scaling, not required for ceremonies (#871).

• passkeys ERROR (env-INDEPENDENT): passkeys=True but the webauthn package is not importable. Passkeys cannot work without it in any environment — every ceremony raisesConfigurationErrorat runtime — so this is a broken config, not a hardening gap, and is reported regardless ofenv (mirroring the env-independentsamesite='none'cookie-drop ERROR in rules_cookie_secure). webauthnavailability is read via chirp.security.passkeys._has_webauthn— the same find-spec probe the runtime uses to fail loud — not a middleware class name (mirrors how rules_password_extra reads _has_argon2).

Built-in (not a pluginContractCheck) because it reads config(the passkeys flag), which the pluginContractCheckSnapshotdoes not expose — the same reason the chirp-ui CSP rule is built-in (seecontracts/AGENTS.md).