decisions: 107, Q104 deferred, no WebAuthn in the I1 brief (I1-3)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-09-26_lead-decisions.md

@@ -2374,3 +2374,17 @@ which stay with him. Each item names who decided it and what happened.
     - `execution.backend` stays `docker`, and no allowlist change is
       needed. How the endpoint gets into config is the brief's design
       item. A config schema change goes through review like any other.
+107. **Q104 deferred: no WebAuthn in the I1 brief, I1-3 (2026-10-12).**
+    Jason, relayed by Mos (sage-0077, recorded in jason-master-restart
+    DECISIONS.md): "Q104: defer". Q104 asked whether the Console should
+    require a passkey or security key before it accepts a decision or a
+    role change.
+    - The I1 brief carries no WebAuthn verifier, no new dependency and
+      no per-action key touch. The review's default for I1-3 stands.
+    - What stays open: under decision 105, reachability is the human
+      proof. A compromised Console therefore holds human authority. The
+      I1 brief limits that with the Console's route list and CSP, and
+      the docs say so.
+    - It reopens only as a new question to Jason, after the containers
+      run and the actions that need it are known. Nobody adds it to a
+      brief before then.