WebAuthn authentication ceremony per W3C L3 5.2 (Credential Assertion). FLOW: (1) RP server generates PublicKeyCredentialRequestOptions: challenge + rpId + (optional) allowCredentials + userVerification + hints + extensions + sends to client. (2) Client calls navigator.credentials.get({publicKey: options}) with user activation + secure context. (3) Browser presents UI + selects authenticator + may use conditional UI for autofill. (4) Authenticator authenticatorGetAssertion CTAP2 command: locates matching credential + verifies user (presence + UV per requirements) + increments signCount + signs (authenticatorData + clientDataHash) with credential private key. (5) Browser returns AuthenticatorAssertionResponse: credentialId + clientDataJSON + authenticatorData + signature + userHandle + clientExtensionResults. (6) RP server VERIFIES: clientDataJSON.type=webauthn.get + challenge match + origin match (or authorized cross-origin) + RP ID hash + flags UP/UV/BE/BS per requirements + signature verifies with stored credentialPublicKey + signCount > stored signCount (clone/anti-replay detection) + extensions match. (7) RP UPDATES: signCount + lastUsed timestamp + (optionally) backup state for passkey-sync detection. (8) RP issues session token + completes authentication. NB: signCount=0 is acceptable for authenticators that do not maintain a counter; signCount lower than stored indicates CLONE - the credential MUST be revoked or trigger step-up.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.