Device-signed ledger approvals verified off the host #75

Server-verified ledger approvals (#73) stop callers that only have MCP access. They do not stop a full-access agent on the host:

• It runs as Chris, so it can write a forged answer or approval_json straight into statev2.sqlite.
• It can create a pairing session with t3 auth pairing create and answer as one of Chris's devices.
• The session label is chosen by the client.

Chris accepted this limit for now in the audit thread on 2026-11-12, and asked for this follow-up.

Proposal

When Chris answers a ledger-key dialog, his device signs the question text and his answer with a passkey (WebAuthn). The answer stores the signature. Jarvis verifies it off the host against Chris's registered public key, so nothing that runs on the host can mint an approval.

Open questions:

• How Jarvis registers and pins Chris's passkey.
• Which surfaces can sign: web, desktop and mobile.
• How Jarvis gets the signed payload: in approval, or by reading the answer.

Ledger key: r3/ledger-verified-approvals. Decision record: docs/jarvis/decisions/0015-server-verified-approvals.md.

🤖 Generated with Claude Code