Founder Auth Gate — Audit-Ops v3

01 / PURPOSE

Prove one exact founder identity can sign in with Google, enroll TOTP, and step from aal1 to aal2. This harness never reads or writes the audit ledger.

02 / AUTH STATE

Configuration CHECKING

Session UNKNOWN

Founder email UNVERIFIED

Current assurance —

Registered passkeys UNKNOWN

Bootstrap eligibility BLOCKED

03 / IDENTITY

No signed-in user

UUID withheld until sign-in

04 / STEP-UP

TOTP challenge

Enrollment secrets remain in this browser session. Do not paste them into chat, Drive, SQL, or workflow JSON.

Passkeys are a sign-in method. The protected founder decision path still requires this separate TOTP challenge to prove aal2.

05 / REDACTED EVIDENCE

TOTP challenge

Session event log