[makeitfutureDev]

Administrators using a remote browser can be unable to create or use a device passkey. Add an off-by-default checkbox under Settings → Admin access allowing the shared dashboard password followed by a private Slack code for an existing Slack administrator. Linked initial setup can enable it before creating a passkey; existing passkeys remain available.

Codes are browser-bound, digest-only, single-use, expire after five minutes and allow five guesses. Role/version changes, password rotation and disable/re-enable revoke pending codes and alternate sessions. Sensitive actions support the same two-factor reauthentication. Disabling from an alternate session signs that browser out. Tests also fill existing linked-workspace authorization branch coverage without changing policy or lowering thresholds.

Validation:

• Full coverage suite with concurrency 4: 4,120 passed, 38 opt-in skipped, zero failed; line/branch/function coverage 93.91/86.55/90.27%.
• Chromium real-browser regressions: 15 passed, zero skipped across existing passkey, bootstrap and alternate-login fixtures; extended alternate disable/sign-out fixture separately passed.
• HTTP OTP security and deterministic password-rotation race regressions passed; independent implementation review completed.
• Security coverage, secret scan and production dependency audit at high threshold passed (three existing moderate advisories).
• Documentation build passed (152 pages, 27,242 internal links; 121 gateway controls). Fixed pre-existing missing control references and isolated an older web-security fixture that triggered the real-home guard in CI.
• DCO and static checks passed (955 JavaScript files). CI passes on both Node 22.13 and Node 24, including documentation, hygiene and DCO.

Not release-ready: live deployed Slack-code acceptance and private QA registry update remain pending. The requesting user's personal Airtable connection is unavailable. Tests use simulated private delivery and never contact deployed users. Main currently predates the passkey implementation; this change targets beta and is not a narrow standalone cherry-pick to main. Stable publication requires a separately reviewed exact release candidate under the repository release policy.