Production & Re-install Implementation Plan (IMPLEMENTED)

# ✅ IMPLEMENTED (2026-08-05) — historical plan, kept for reference

All tasks below were implemented and HW-verified (production flows, applet reset on
HW, validation, retry). Current architecture is documented in the crate docs and
the audit note; see "Project Status" for the current snapshot.

---

# Plan (original)

## Overview
Wire up 3 GUI workflows that already have most of their logic implemented in existing code:
1. **HW Re-install**: applet_reset (DELETE+INSTALL) + provision + lifecycle + validate
2. **HW Production**: provision + lifecycle + validate + KLMS report
3. **Mock Production**: same as HW but with mock transport

## Tasks

### 1. Enable factory transition in provisioner
- Change HW provisioner to use `skip_lifecycle_transition: false` (currently true)
- The provisioner already has lifecycle + post-perso code paths
- Need to ensure it works end-to-end

### 2. Add post-provisioning validation to provisioner
- After lifecycle transition: cert readback (GET DATA), FESN/SPID readback, ECDSA signature verification
- This logic exists in `factory_transition.rs` — needs to be ported into `kf-provision` (or exposed)
- Or: keep it in kf-dev-station and call it from the production workflow

### 3. Make applet_reset work on HW
- Currently mock-only (uses mock_transport/mock_keys)
- Need: connect to PICC reader, select ISD, SCP03 auth, DELETE instance, INSTALL instance
- Already has the core APDU logic, just needs real transport

### 4. Wire up GUI tabs
- **Re-install HW**: container dir + reader → applet reset → provision → validate
- **HW Production**: container dir + reader → provision → lifecycle → validate → report  
- **Mock Production**: container dir + UID → mock provision → mock validate

### 5. Fix existing issues
- 6A 80 on CMS cert fragment (first fob that works)
- 69 85 on second fob (different card OS)

## File Changes

### kf-provision changes:
- Make `ProvisionerConfig` expose lifecycle/validate flags
- Add `post_perso_commands` to `ProvisioningSource` trait (from `ProvisioningInput`)
- Or: add a `ProvisioningOutput` with validation data

### kf-dev-station changes:
- Make `applet_reset.rs::run()` work with real `SmartcardTransport` + real keys
- Wire production flow to use real provisioner with lifecycle enabled
- Add mock validation (mirrors factory_transition with mock transport)

id: 7d630d2e08274bb4880c341ea2bbc6e8
parent_id: beb251c3b3f9490285e6cb68942a5145
created_time: 2026-08-10T11:58:49.075Z
updated_time: 2026-08-14T16:59:38.897Z
is_conflict: 0
latitude: 0.00000000
longitude: 0.00000000
altitude: 0.0000
author: 
source_url: 
is_todo: 0
todo_due: 0
todo_completed: 0
source: joplin-desktop
source_application: net.cozic.joplin-desktop
application_data: 
order: 1786363129075
user_created_time: 2026-08-10T11:58:49.075Z
user_updated_time: 2026-08-14T16:59:38.897Z
encryption_cipher_text: 
encryption_applied: 0
markup_language: 1
is_shared: 0
share_id: 
conflict_original_id: 
master_key_id: 
user_data: 
deleted_time: 0
is_locked: 0
extracted_resource_ids: 
type_: 1