linimin

Shared completion workflow protocol for long-running coding tasks with canonical .agent state, one-slice execution, mandatory role dispatch, recovery, and final stop criteria. Use only after the user explicitly enters `/cook` and the main session becomes the completion workflow driver.

Ordinary-chat contract for treating `/cook` as an optional workflow mode while requiring `/cook` to synthesize a fresh primary-agent startup handoff and fail closed when that handoff is not startable.

Integrates HiTRUST VeriFido FIDO2/WebAuthn using VeriFido .NET 1.0.x NuGet packages (current 1.0.2): package selection, BFF embed vs RP host topology, IVeriFidoGateway adapters, FidoFlowService, rpId/ApiBaseUrl configuration, stateless rpTxId/txId echo, and testing. Use when working with VeriFido, FIDO2, WebAuthn, Passkey, FidoFlowService, rpId, VeriFido.Core, Rp.AspNetCore, or BFF FIDO integration.

Verifies HiTRUST VeriFido FIDO2 integration security and correctness: token issuance gates, OTP bind gate, identity mismatch, txId/rpTxId echo, ApiKey exposure, IAuthSessionIssuer policy, auth guards, ceremony replay. Use after implementing or reviewing FIDO bind/login flows, BFF adapters, or before marking VeriFido integration complete. Complements verifido-integration.

Implement HiTRUST VeriFido FIDO2/WebAuthn Passkey integration across a BFF (or RP service) and mobile/web client: VeriFido HTTP gateway, OTP-gated attestation, assertion login, token issuance, rpMessage/clientMessage, and txId echo. Use when integrating HiTRUST VeriFido, VeriFido API, hitrustpay FIDO, Passkey, WebAuthn, attestation, assertion, or VeriFido RP proxy routing.