The mismatch
A browser mock worked while the native iPhone path failed. That difference made it important to identify which layers the browser test bypassed. Success in a simulated interface did not establish that the native transport, registration, or secure storage worked.
The investigation considered DNS, server behavior, key handling, native entitlements, cross-origin behavior, and the bridge between web and native code. These were alternative explanations to narrow, not interchangeable diagnoses.
Raw bytes matter
One identified issue was that a bridge path parsed JSON before the signature-verification boundary. Signed response validation depends on the exact representation being verified; parsing and reserializing can change that representation.
The AI-assisted patch used Swift URLSession and a base64 representation of the raw response body to preserve the relevant bytes. Registration and scene-controller integration also required changes. This is a systems example where an apparently small data-handling choice changes a security property.
A claim that had to be narrowed
Secure Enclave persistence encountered entitlement constraints, and a software fallback was used. The stronger hardware-backed claim was therefore withdrawn for that implementation.
Hardware-backed storage should not be inferred from an intended architecture or a successful software fallback. The actual entitlements, device behavior, and persistence tests are part of the evidence.
Contribution and outcome
I directed the product behavior and supplied observed activation and sign-in behavior in this AI-assisted investigation. The historical record includes owner-visible tests, but a later integrated binary’s status was not independently established in the review.
The transferable lesson is to test the real trust boundary. A browser mock, a native build, a successful launch, and a validated signed response each answer different questions.