WebAuthn registration ceremony per W3C L3 5.1 (Credential Creation). FLOW: (1) RP server generates PublicKeyCredentialCreationOptions including challenge + user + rp + pubKeyCredParams + authenticatorSelection + attestation + extensions + sends to client. (2) Client (browser) calls navigator.credentials.create({publicKey: options}) with user activation + secure context + origin matching rpId. (3) Browser presents UI for authenticator selection + user activation. (4) Authenticator authenticatorMakeCredential CTAP2 command: generates new key pair + stores credential (resident if requireResidentKey) + outputs attestation object (authenticatorData with RP ID hash + flags including UP + UV + BE + BS + AT + ED + counter + AAGUID + credentialId + credentialPublicKey + extensions + attestationStatement). (5) Browser returns PublicKeyCredential to RP including clientDataJSON (challenge + origin + type webauthn.create + crossOrigin + tokenBinding) + attestationObject + clientExtensionResults + transports. (6) RP server VERIFIES: clientDataJSON.type=webauthn.create + challenge match + origin match + RP ID hash in authenticatorData + flags UP+UV requirements + counter==0 for new credential + algorithm in pubKeyCredParams + attestation per attestation preference + extensions consistent. (7) RP STORES: credentialId + credentialPublicKey + signCount + AAGUID + transports + user/account binding + (optional) attestation result + backup eligibility + backup state.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.