Project Status: Key Fob Dev Station (2026-08-14)

# Project Status: Key Fob Dev Station (2026-08-14)

> Replaces the 2026-08-04 snapshot (commit `5ed9d05`, 91 tests). Live open-items
> tracking lives in **Keyfob Station — Code Audit Open Items**; this note is the
> periodic status snapshot.

## Commit: `2de34cf` (+ private-key bridge pending commit) on `master`, pushed to origin

## What Works (all HW-verified unless noted)

### KLMS REST integration (end-to-end 2026-08-14, one pending item below)
- mTLS + token auth against dev Clypeum CCS, seed lifecycle, container generation (201)
- Container decrypt (wrapper key), tag-keyed field extraction, session-key verify
- SCP03 via KLMS-delivered keys, auto-provision on tap, retry with re-install (card-stage)
  or plain retry (server-stage) depending on failure classification
- Card-ready private key (48-byte, S-DEK): CBC(IV=0)+M2 forwarded as-is; ECB+M2 bridged
  locally with WARN — **KLMS should switch to CBC** (open, next week)

### Files production flow
- Re-install + provision + FACTORY + validation, retry-on-failure — HW-verified

### Infrastructure
- 3 build variants (full / test / minimal), zero clippy warnings across all
- 105 tests, rustfmt + rustdoc clean
- Config-driven typeID / keyBundleType / accept_invalid_certs (klms-config.toml)
- Debug logging of full request forms + response headers (RUST_LOG=debug)

## Fob Status

| Fob | Chip UID | Status |
|-----|----------|--------|
| #1 | `04468c7ae11d90` | LOCKED (GP counter exhausted — see incident note) |
| #2 | `04478c7ae11d90` | Active test fob (KLMS flow) |
| #3 | `044b8c7ae11d90` | Fresh |

## Key Numbers

- 105 tests pass, 10 crates, workspace at `D:\Development\Workspaces\rust-workspace\keyfob-station`
- Deploy: `kfs-prod.bat` (release build verified); dev: `kfs-dev.bat`

## Next Week

1. KLMS switches field[8] to AES-128-CBC(IV=0)+M2 → drop the ECB bridge
2. Full HW smoke: card-ready path through provisioning + GA validation
3. Open external items (see audit note): C1 CA cert, CID header, signature key,
   checksum spec, report_usage semantics

id: a6768b6c7d2d4dbb855399468b9db6fa
parent_id: beb251c3b3f9490285e6cb68942a5145
created_time: 2026-08-04T07:56:04.489Z
updated_time: 2026-08-14T16:59:38.703Z
is_conflict: 0
latitude: 0.00000000
longitude: 0.00000000
altitude: 0.0000
author: 
source_url: 
is_todo: 0
todo_due: 0
todo_completed: 0
source: joplin-desktop
source_application: net.cozic.joplin-desktop
application_data: 
order: 1785830164489
user_created_time: 2026-08-04T07:56:04.489Z
user_updated_time: 2026-08-14T16:59:38.703Z
encryption_cipher_text: 
encryption_applied: 0
markup_language: 1
is_shared: 0
share_id: 
conflict_original_id: 
master_key_id: 
user_data: 
deleted_time: 0
is_locked: 0
extracted_resource_ids: 
type_: 1