Everything else in XNSB is covered by unit tests. This is the one layer only a human with a real authenticator can prove — and the whole of Tier 1 rests on it.
1. Press Run the checks and approve with your fingerprint, face, or PIN. You'll be asked twice — the second one is the determinism test.
2. Reload the page, then press Test after reload. Same npub means the identity is recomputed rather than retrieved, which is the entire product promise.
3. Open the other hostname linked above and press Test RP-ID scoping
there. localhost and 127.0.0.1 are different RP IDs even on the same port, so
this reproduces the cross-origin case locally. The browser must refuse. That refusal is why
custody has to live at a single signer origin — a per-site passkey would mean a per-site identity.
4. Export the JSON and attach it to the release record. An unrecorded platform is an untested platform.
If PRF is unsupported, that is a legitimate result, not a broken run. The correct product behaviour is to route the user to a NIP-07 extension or a NIP-46 signer — never to a weaker derivation. Record the platform and move on.