Certification readiness: FIDO Functional Certification and GovRAMP

[Bccorb]

Tracking issue for the work identified in
docs/public-sector/CERTIFICATION-READINESS.md,
which analyses what this API and the SDKs need in order to be credible for local
government work and to earn two credentials:

• FIDO Functional Certification (server). The applicable program for a server
  and relying party. Authenticator Certification levels (L1 to L3+) apply only to
  authenticator hardware and are not in scope here.
• GovRAMP. Membership plus a Single Security Snapshot first, Core Verification
  later. Note the program rebranded from StateRAMP in 2025.

Freeze status

Work in this repository is frozen except for four categories. Every child issue
states which one authorizes it:

1. Bugs found during a real migration
2. Gaps identified by the GovRAMP Security Snapshot
3. FIDO conformance self-validation fixes
4. The specific thing a signed customer requires to go live

Sessions 1 and 2 are mostly a fifth thing that already falls under 1 and 4: places
where the website and the migration runbook promise behaviour the code does not
implement. Session 7 is deliberately gated behind actually purchasing the Snapshot,
so remediation follows evidence rather than guesswork.

Sessions, in order

Each session is intended to be a self-contained working session.

Session 1: what the collateral promises but the code does not do

Highest priority. Each of these is a gap between what is being sold and what ships.

• Passkey registration is locked to platform authenticators, so security keys cannot be enrolled #156 Passkey registration is locked to platform authenticators, so security keys cannot be enrolled
• Session idle timeout can never fire, and neither lifetime is configurable #157 Session idle timeout can never fire, and neither lifetime is configurable
• Admin-assisted recovery records no identity proofing #158 Admin-assisted recovery records no identity proofing
• Authenticator attachment has no deployment-level default in system_config #182 Authenticator attachment has no deployment-level default in system_config
• React SDK cannot request a security key at enrollment #183 React SDK cannot request a security key at enrollment

#156 is the single highest value item in this plan. One hardcoded value blocks every
hardware security key scenario in Appendix B of the migration runbook. It shipped in
#180; #182 and #183 are the deployment-default and SDK halves split out of it, both
of which cross a repository boundary.

Session 2: audit trail correctness

• Admin recovery audit event names the target user, not the acting admin #159 Admin recovery audit event names the target user, not the acting admin
• webauthn_registration_success is logged when options are generated, before anything is registered #160 webauthn_registration_success is logged when options are generated, before anything is registered
• Auth events carry no session id, so events cannot be correlated to a session #161 Auth events carry no session id, so events cannot be correlated to a session
• One finding tracked privately as a security advisory

#159 and #161 both migrate the same table and are best done together.

Session 3: CI, supply chain and scanning

Independent of the application code, so it can run in parallel with anything else.

• Add dependency vulnerability scanning and static analysis to CI #162 Add dependency vulnerability scanning and static analysis to CI
• Published container images have no SBOM, vulnerability scan, or signature #163 Published container images have no SBOM, vulnerability scan, or signature

Session 4: WebAuthn correctness and FIDO prerequisites

• WebAuthn challenges share one user column, with no TTL and no concurrency #164 WebAuthn challenges share one user column, with no TTL and no concurrency
• Credentials do not store the AAGUID, blocking metadata lookup and authenticator policy #165 Credentials do not store the AAGUID, blocking metadata lookup and authenticator policy
• Registration does not advertise RS1, which FIDO Server Requirements v2.3 requires #166 Registration does not advertise RS1, which FIDO Server Requirements v2.3 requires
• userVerification is preferred at registration but required at login, so some credentials become unusable #167 userVerification is preferred at registration but required at login, so some credentials become unusable
• One finding tracked privately as a security advisory, to be fixed alongside WebAuthn challenges share one user column, with no TTL and no concurrency #164

#165 is a prerequisite for Session 5.

Session 5: FIDO attestation and metadata

• Wire the FIDO Metadata Service and validate attestation certificate chains #168 Wire the FIDO Metadata Service and validate attestation certificate chains
• Support direct attestation and persist the attestation format #169 Support direct attestation and persist the attestation format
• No authenticator policy: synced passkeys cannot be blocked and AAGUIDs cannot be restricted #170 No authenticator policy: synced passkeys cannot be blocked and AAGUIDs cannot be restricted

#170 resolves the synced passkey open decision the public sector README flags. It is
currently unimplemented, so the website text should be corrected until it ships.

Session 6: FIDO conformance

• Add the FIDO2 conformance test interface behind an environment flag #171 Add the FIDO2 conformance test interface behind an environment flag
• Run FIDO2 conformance self-validation and remediate findings #172 Run FIDO2 conformance self-validation and remediate findings

Do not start the 90 day interoperability clock until Sessions 4 and 5 have landed.
Register for tool access early so the tools can be run iteratively.

Session 7: GovRAMP remediation, gated on buying the Snapshot

Buy membership plus a Single Security Snapshot first, roughly $1,500, and assemble
the 40 control artifacts from docs/security-posture.md
and docs/production-operations.md before the intake
meeting. What the Snapshot actually finds supersedes this list.

• Audit events have no retention policy and no bulk export #173 Audit events have no retention policy and no bulk export
• Audit records are updatable and have no integrity protection #174 Audit records are updatable and have no integrity protection
• Production JWKS key rotation is not implemented #175 Production JWKS key rotation is not implemented
• No concurrent session limit per user #176 No concurrent session limit per user
• Refresh rotation resets the absolute session lifetime, so there is no absolute cap #185 Refresh rotation resets the absolute session lifetime, so there is no absolute cap
• No enforceable phishing-resistant-only login mode, and magic link is on by default #177 No enforceable phishing-resistant-only login mode, and magic link is on by default
• No authentication coverage report for assessment and insurance responses #178 No authentication coverage report for assessment and insurance responses

Not doing yet

• FIPS validated cryptography. Expensive, and only needed if CJIS is pursued
• SOC 2. Does not fit the budget alongside GovRAMP
• Ready or Authorized GovRAMP status. Both need a sponsoring government

Open decisions this work cannot resolve

Carried from Appendix C of the migration runbook and Part G of the analysis:

1. Attestation posture, and whether to require it by default
2. Audit failure posture: fail closed or fail open with alerting
3. CJIS position. The honest answer from the code today is not yet
4. Audit retention default, which needs a Maryland records retention schedule read
5. Data residency

Related

Two findings are tracked privately as security advisories rather than public issues,
per SECURITY.md. They are referenced above without detail.

[Bccorb]

FIDO Alliance conformance tool registration came through on 2026-08-31. #210 and #172 are no longer blocked on external access, and the blocked label is removed from both.

That reopens the second half of session 6. Nothing about the engineering changed while they were parked, so the notes on each still stand: #210 needs real certificate chains for the TPM, U2F and SafetyNet statements, and its metadata-absent postures only trigger on full attestation with an x5c chain, which is exactly what the tools provide.

Session 7 (GovRAMP: #173 to #178, #185) is still gated on the membership and Single Security Snapshot purchase, which is a separate decision.