feat(ceremony): implement browser identity ceremonies

[Wondertan]

Implements @libid/ceremony over a caller-supplied @libid/popup connection, with Google, X and GitHub v1 pipelines and a static CCDP distribution. Application owns popup lifetime and downstream submission. Prover keeps OAuth returns private, generates proofs and attestations, and returns a separate identity; Client structurally validates and assembles the result without browser cryptographic verification.

• Package guide
• Client API
• Architecture and platform extension
• Build and deployment
• Tests and manual walkthrough
• Qualification and remaining gates

The shared Browser tests job runs the popup, ceremony and dev-app suites; this PR contains no duplicate CI job. Normative browser contracts remain in #13, on popup spec #22, with #31's framing rules and #35's browser GitHub profile. This PR owns implementation documentation and preserves all 158 test requirement IDs.

A single operation feed drives readiness, UI and measurements. Callback forwards popup's authenticated Application origin privately to Prover; Prover admits exactly that origin. Prefetch and execution share declared resources and emitted dependencies. Backend/input preparation, notarization and proof work overlap while final delivery waits for all required outputs. X and GitHub perform both token and identity exchanges through browser notary sessions. Bridge supplies the public GitHub clientCredential; Client derives fixed /auth/callback from its Bridge origin. The shared dev app runs the updated Bridge/notary/CCDP services, supports concurrent manual ceremonies, and displays collapsible operation measurements and distinct interruption outcomes.

Release qualification remains incomplete. Automated coverage includes real fixture proofs and matched-notary concurrency. Manual runs confirm live Google, X and GitHub ceremony completion on desktop and mobile, and real-verifier acceptance for all three platforms. Physical-device edge cases, complete resource accounting and the optional WebRTC implementation remain qualification gaps; see the qualification guide.

[SupremaLex]

Ran this branch (0469056) end to end with a real GitHub OAuth app, a local
Notary and a local Bridge. Two problems in the browser package.

1. GitHub sends iss and the parser rejects the whole return

Created a fresh GitHub OAuth app for the test. The callback came back with an
iss parameter. The parser has no case for it, so auth failed straight away —
before any token exchange.

src/platforms/codeReturn.ts:20

if (key !== 'state' && key !== 'code' && key !== 'error') return null

What GitHub sent (keys only): code, iss, state

Any unknown key makes parseCodeOAuthReturn return null, and
platforms/github/1/prover.ts:37 then throws Invalid GitHub return. The
cancel path breaks the same way — error, iss, state is rejected too.

iss is the issuer identifier from RFC 9207. Rather than just adding it to the
allowlist, it may be worth checking its value against the expected issuer —
that is what it is for.

2. Errors are thrown away, so this was hard to find

fail takes no argument:

const fail = () => {          // src/ccdp/documents/prover.ts:36

so .catch(fail) at line 116 gets the error and drops it. There are six empty
catch blocks in the two CCDP documents — prover.ts:42,72,96,133 and
prefetch.ts:25,29. Each ends in a fixed message:

Unable to complete proof. Return to your application.
Unable to prepare. Return to your application.

The user sees that, the browser console is empty, and no server logs anything,
because it fails before any request goes out. A broken OAuth parser and a broken
service worker look identical from outside.

Smallest fix: catch (e) and log it. Better: pass a reason into fail and put
it in the abort-ceremony message, which already has a reason field that is
always a constant today.

With iss accepted locally, the ceremony gets through consent, the callback,
the Bridge token exchange and a real MPC-TLS session with github.com. It then
fails in the Notary's attestation step — reported on libid-org/notary#6.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	libid	08c3f3d	Sep 23 2026, 01:56 PM

[Wondertan]

@xgreenx, claim pkg is unrelated to this PR and thus the new commit on this branch... Force push it away