[aruintelligence]

Summary

• Generate a fresh, nonextractable P-256 private key for each browser session attestation. Keep key material local to each signing call so concurrent challenges cannot race over shared module state.
• Preserve the public JWK and fingerprint in each signed artifact for offline verification. Retain resetAMLSessionKey() to clear the last published global attestation.
• Verify sequential and concurrent calls produce distinct fingerprints with valid detached bundles, including Python verification of a second fresh-key bundle.

Local verification

• 900/900 Node tests passed.
• Python/JavaScript comparison: 70 signed quorum cases and 36 additional checks passed.
• Proof, API stability, upgrade contract, installed-package consumer compatibility, CLI contract, package artifact, links, proof surfaces, verifier surfaces, verifier claims, contract snapshot and drift, and diff checks passed.

Compatibility: applications that grouped successive attestations by a stable page-wide session_key_fingerprint will now see a different key per attestation. This removes that implicit correlation; other evidence fields may still correlate artifacts. Distinct session keys do not prove independent people, browsers, or organizations. GitHub CI is pending. These are project-controlled checks, not independent certification.