id: 7085d2f3e279432895c9d49a65f24f40
parent_id: 0392390150144b75bc6271079e36028c
item_type: 1
item_id: bb3506f46ead40df8a7f965a73339928
item_updated_time: 1786698925772
title_diff: "[]"
body_diff: "[{\"diffs\":[[0,\"tirely |\"],[1,\"\\\n| — | `report_usage` not wired into KLMS flow | **Awaiting KLMS team alignment** (user coordinating) — method exists in klms_client.rs; needs agreement on status values/payload/serial semantics before wiring in |\"],[0,\"\\\n\\\n**Priv\"]],\"start1\":885,\"start2\":885,\"length1\":16,\"length2\":229},{\"diffs\":[[0,\"ring\"],[-1,\" (assessed 2026-08-14, not actionable as quick wins)\\\n\\\nThese need a dedicated session with comprehensive testing:\"],[0,\"\\\n\\\n| \"]],\"start1\":2439,\"start2\":2439,\"length1\":120,\"length2\":8},{\"diffs\":[[0,\"e | \"],[-1,\"Assessment\"],[1,\"Status\"],[0,\" |\\\n|\"]],\"start1\":2455,\"start2\":2455,\"length1\":18,\"length2\":14},{\"diffs\":[[0,\"---|--------\"],[-1,\"----\"],[0,\"|\\\n| H7 | SCP\"]],\"start1\":2477,\"start2\":2477,\"length1\":28,\"length2\":24},{\"diffs\":[[0,\" 5× \"],[-1,\"(scp03_setup, provision/lib, klms.rs, worker.rs, nfc_reader.rs) | **8 instances found.** Only 2\"],[1,\"| **RESOLVED 2026-08-14** — new `kf-provision::handshake` module with `establish_session()` (static-key handshake: INIT UPDATE + derive + card-cryptogram verify + EA) and `external_authenticate_with_keys()` (externally-derived-keys EA tail). All 5 call sites\"],[0,\" del\"]],\"start1\":2524,\"start2\":2524,\"length1\":103,\"length2\":266},{\"diffs\":[[0,\"gate\"],[1,\":\"],[0,\" \"],[-1,\"to `\"],[0,\"scp0\"]],\"start1\":2791,\"start2\":2791,\"length1\":13,\"length2\":10},{\"diffs\":[[0,\"03_setup\"],[1,\", worker\"],[0,\"::establ\"]],\"start1\":2800,\"start2\":2800,\"length1\":16,\"length2\":24},{\"diffs\":[[0,\"lish\"],[-1,\"()`. Worker can't delegate without API changes (needs \"],[1,\"_scp03, Provisioner::run_inner (FromStaticKeys), KlmsProvisioner (EA tail), nfc_reader KLMS auto-provision (EA tail). Added `Scp03Channel::\"],[0,\"session\"],[-1,\" \"],[1,\"_\"],[0,\"keys\"],[-1,\" exposed). KLMS paths inherently different (no local derivation). ISD SELECT has 3 variants (empty-data, explicit-AID, both) — cosmetic only\"],[1,\"()` accessor. Intentionally local: nfc_reader diagnostic INIT (non-fatal semantics) and KLMS INIT UPDATE (response feeds KLMS extra JSON). APDU sequences preserved exactly per flow (SELECTs stay in callers; audit tracing via callback)\"],[0,\". |\\\n\"]],\"start1\":2823,\"start2\":2823,\"length1\":214,\"length2\":393},{\"diffs\":[[0,\"r` (\"],[-1,\"231\"],[1,\"~215\"],[0,\" lin\"]],\"start1\":3268,\"start2\":3268,\"length1\":11,\"length2\":12},{\"diffs\":[[0,\"r` (\"],[-1,\"193\"],[1,\"~165\"],[0,\" lin\"]],\"start1\":3337,\"start2\":3337,\"length1\":11,\"length2\":12},{\"diffs\":[[0,\"inner` (\"],[-1,\"165\"],[1,\"~150\"],[0,\" lines),\"]],\"start1\":3376,\"start2\":3376,\"length1\":19,\"length2\":20},{\"diffs\":[[0,\") | \"],[-1,\"Decomposition risks breaking critical SCP03/provisioning flow\"],[1,\"Still open. H7 shrunk several of these\"],[0,\". `r\"]],\"start1\":3428,\"start2\":3428,\"length1\":69,\"length2\":46},{\"diffs\":[[0,\" safest \"],[1,\"next \"],[0,\"target (\"]],\"start1\":3495,\"start2\":3495,\"length1\":16,\"length2\":21},{\"diffs\":[[0,\"n). |\\\n| \"],[-1,\"H2\"],[1,\"~~H2~~\"],[0,\" | Audit\"]],\"start1\":3537,\"start2\":3537,\"length1\":18,\"length2\":22},{\"diffs\":[[0,\"atch\"],[-1,\" (doc claims redaction, code stores full APDU)\"],[0,\" | *\"]],\"start1\":3574,\"start2\":3574,\"length1\":54,\"length2\":8},{\"diffs\":[[0,\"— | \"],[-1,\"Audit trace doc (H2) | **RESOLVED 2026-08-14** — doc updated, no redaction needed |\\\n| — | `report_usage` not wired into KLMS flow | Open — method exists in klms_client.rs but nfc_reader auto-provision never calls it |\\\n| — | KLMS provisioning fails (6A 80 on DGI A003) | Open — workaround (decrypt CBC → extract scalar → DEK encrypt) runs but card still rejects. Files flow with same Provisioner/DEK works. May be KLMS key format issue (M5).\"],[1,\"Hardware test of H7 refactor | Open — run Production (Files) + KLMS flows on a real fob to confirm the handshake consolidation didn't break anything; also confirms the 6A 80 issue is gone\"],[0,\" |\\\n\\\n\"]],\"start1\":4046,\"start2\":4046,\"length1\":448,\"length2\":195},{\"diffs\":[[0,\"stency (\"],[-1,\"3\"],[1,\"empty-data vs explicit-AID\"],[0,\" variant\"]],\"start1\":4514,\"start2\":4514,\"length1\":17,\"length2\":42},{\"diffs\":[[0,\" on JCOP\"],[1,\"; SELECTs deliberately stay in callers after H7 consolidation\"]],\"start1\":4579,\"start2\":4579,\"length1\":8,\"length2\":69}]"
metadata_diff: {"new":{},"deleted":[]}
encryption_cipher_text: 
encryption_applied: 0
updated_time: 2026-08-14T09:20:00.460Z
created_time: 2026-08-14T09:20:00.460Z
is_locked: 0
type_: 13