Unisynx PRF feasibility spike — negative-test association host

This host is deliberately misconfigured. It exists only to prove that WebAuthn operations fail closed when a declared associated domain does not authorize the requesting app. It is not a Unisynx product endpoint and serves no account service.

The Apple App Site Association file at /.well-known/apple-app-site-association is well-formed JSON served with application/json, but its webcredentials.apps entry names an App ID that does not exist and is not the spike's App ID. Association verification must therefore fail for the PRF feasibility spike.

This host intentionally provides:

• no WebAuthn relying-party page;
• no account backend, database, or credential storage;
• no reachable endpoint other than this page and the association file.

The authorized spike relying party is a separate host with a separate association file. Nothing here modifies, shadows, or supersedes it.