id: 61f2a696a6024beb8805879af4389563
parent_id: 3bab2c06d5ea4b16adff08276f34e603
item_type: 1
item_id: bb3506f46ead40df8a7f965a73339928
item_updated_time: 1786701996715
title_diff: "[]"
body_diff: "[{\"diffs\":[[0,\"ter \"],[-1,\"HW test sess\"],[1,\"M20 complet\"],[0,\"ion)\"]],\"start1\":70,\"start2\":70,\"length1\":20,\"length2\":19},{\"diffs\":[[0,\"\\\n\\\n##\"],[-1,\" Deferred — High-Risk\"],[0,\" Ref\"]],\"start1\":2104,\"start2\":2104,\"length1\":29,\"length2\":8},{\"diffs\":[[0,\"** —\"],[-1,\" new\"],[0,\" `kf\"]],\"start1\":2241,\"start2\":2241,\"length1\":12,\"length2\":8},{\"diffs\":[[0,\"dule\"],[-1,\" (`establish_session()` + `external_authenticate_with_keys()`). All 5 call sites delegate. Added `Scp03Channel::session_keys()` accessor. HW test: Files + KLMS + applet flows all pass. |\\\n| M20 | God functions: `run_production` (219 lines), `run_klms_auto_provision_inner` (~215 lines), `Provision\"],[1,\"; all 5 call sites delegate. |\\\n| M20 (run_production) | 219-line god function | **RESOLVED 2026-08-14** — `ProductionRequest` + `ProductionSetup::resolve()` + `reinstall_between_attempts()` + `provision_attempt()` + `validate_attempt()`; run_production is a thin retry loop. |\\\n| M20 (StationApp::update) | 149-line god function | **RESOLVED 2026-08-14** — split into `poll_workers`, `render_klms_only`, `render_log_console`, `render_sidebar`, `on_mode_changed`, `render_central_panel` + `nav_button` helper. |\\\n| M20 (Provisioner::run_inner) | ~193-line god function | **RESOLVED 2026-08-14** — payload tail (encode DGI → split → STORE DATA → lifecycle → post-perso) extracted into shared `help\"],[0,\"er\"],[1,\"s\"],[0,\"::\"],[-1,\"run_inner` (~165 lines), `KlmsProvisioner::run_inner` (~150 lines), `StationApp::update` (149 lines) | Still open. `run_production` is the safest next target (clean phase separation, mirrors Files reference flow). |\\\n| ~~H2~~ | Audit trace doc mismatch | **RESOLVED 2026-08-14** — doc updated; nothing secret in SCP03-wrapped comms. |\"],[1,\"deliver_payload()`; now ~100 lines (UID → fetch → channel → deliver → audit). |\\\n| M20 (KlmsProvisioner::run_inner) | ~165-line god function | **RESOLVED 2026-08-14** — uses same `deliver_payload()` (s_dek=None → KLMS must pre-encrypt); now ~90 lines. NOTE: lifecycle/post-perso now honors `config.skip_lifecycle_transition` (previously ignored in KLMS path; no caller sets it). |\\\n| M20 (run_klms_auto_provision_inner) | ~230-line god function | **RESOLVED 2026-08-14, awaiting HW test** — split into `connect_and_identify` + `init_update_for_klms` + `fetch_klms_payload` + `log_payload_fields` + `establish_klms_channel`; orchestrator now ~60 lines. INIT UPDATE parsing now uses shared `kf_provision::parse_init_update` (struct `InitUpdateResponse` incl. key_version); manual offset parsing removed. |\\\n| ~~H2~~ | Audit trace doc mismatch | **RESOLVED 2026-08-14** |\\\n\\\n**M20 fully resolved — no god functions remain >100 lines except panel renderers (GUI layout, low risk).**\"],[0,\"\\\n\\\n##\"]],\"start1\":2274,\"start2\":2274,\"length1\":641,\"length2\":1679},{\"diffs\":[[0,\"* — \"],[-1,\"retry gate widened (\"],[0,\"`sho\"]],\"start1\":4127,\"start2\":4127,\"length1\":28,\"length2\":8},{\"diffs\":[[0,\"install`\"],[-1,\"):\"],[1,\" retries\"],[0,\" any fai\"]],\"start1\":4152,\"start2\":4152,\"length1\":18,\"length2\":24},{\"diffs\":[[0,\"mpt \"],[-1,\"retried \"],[0,\"once\"]],\"start1\":4184,\"start2\":4184,\"length1\":16,\"length2\":8},{\"diffs\":[[0,\"tall\"],[-1,\", mirroring Files flow. Silent early failures (KF SELECT, INIT UPDATE, generate container) now log warnings\"],[0,\". |\\\n\"]],\"start1\":4212,\"start2\":4212,\"length1\":115,\"length2\":8},{\"diffs\":[[0,\"* — \"],[-1,\"S-ENC/S-MAC/S-RMAC/Host Cryptogram redacted; encrypted private key shown, plaintext scalar redacted. Verified in log\"],[1,\"redacted; field logging now in `log_payload_fields` with named constant\"],[0,\"s. |\"]],\"start1\":4385,\"start2\":4385,\"length1\":124,\"length2\":79},{\"diffs\":[[0,\"after H7\"],[1,\"\\\n- Minimal-variant dead-code warnings (panels exist unconditionally, calls are cfg-gated) — to be tackled in the next full audit\"]],\"start1\":4806,\"start2\":4806,\"length1\":8,\"length2\":136}]"
metadata_diff: {"new":{},"deleted":[]}
encryption_cipher_text: 
encryption_applied: 0
updated_time: 2026-08-14T10:10:00.524Z
created_time: 2026-08-14T10:10:00.524Z
is_locked: 0
type_: 13