id: b3135fb78a2c435c990a077fec947824
parent_id: c9486e169a634d1aa5a1322da698202d
item_type: 1
item_id: bb3506f46ead40df8a7f965a73339928
item_updated_time: 1786722425328
title_diff: "[]"
body_diff: "[{\"diffs\":[[0,\"14 1\"],[-1,\"5:55 (M5/M10 closed, commit 3bc2f97, pushed to origin)\"],[1,\"7:50 (pre-Monday hardening committed: 15d2b77 + 2de34cf, pushed)\\\n\\\n## TOP BLOCKER — KLMS generateContainer HTTP 500 (since their card-ready deployment)\\\n\\\n`POST /cryptoContainers` returns 500 \\\"Failed to generate the requested CryptoContainer or\\\ninsufficient rights\\\" on every attempt (both retries in a session). Our request is byte-identical\\\nto the HW-verified pre-deployment run. Evidence pack for the KLMS team:\\\n- Log 2026-08-14 15:23:17Z: `typeID=0x0900`, `productSerial=KF-04478c7ae11d90`, 7-byte uid in extra,\\\n  HTTP 500 twice (after pointless re-install — now fixed, see below)\\\n- Empty container UUID/CID in our log = headers absent from the 500 error response (not redaction);\\\n  `RUST_LOG=debug` now prints the full request form + every response header for proof\\\n- Questions for them: new typeID for card-ready containers? keyBundleType renamed? 7-vs-10-byte UID\\\n  expectation? (the failing fob returned a 7-byte card UID via the chip-UID fallback)\\\n- Blank serials in their admin: likely the serial column fills via the usage PUT (report_usage,\\\n  unwired by our choice) — or our productSerial form field is ignored server-side\"],[0,\"\\\n\\\n##\"]],\"start1\":64,\"start2\":64,\"length1\":62,\"length2\":1138},{\"diffs\":[[0,\"):**\"],[-1,\" The\"],[0,\" KLMS \"],[-1,\"now \"],[0,\"deli\"]],\"start1\":1288,\"start2\":1288,\"length1\":22,\"length2\":14},{\"diffs\":[[0,\"field[8]\"],[-1,\"\\\n\"],[1,\" \"],[0,\"(DGI A00\"]],\"start1\":1307,\"start2\":1307,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\"GI A003)\"],[-1,\" \"],[1,\"\\\n\"],[0,\"**card-r\"]],\"start1\":1318,\"start2\":1318,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\"e EC\"],[-1,\"\\\n\"],[1,\" \"],[0,\"scalar\"],[-1,\" — the preferred option from the meeting\"],[0,\". St\"]],\"start1\":1395,\"start2\":1395,\"length1\":55,\"length2\":15},{\"diffs\":[[0,\"tion\"],[-1,\" change \"],[1,\"\\\n\"],[0,\"(com\"]],\"start1\":1411,\"start2\":1411,\"length1\":16,\"length2\":9},{\"diffs\":[[0,\"bc2f97):\"],[-1,\"\\\n\"],[1,\" \"],[0,\"`worker.\"]],\"start1\":1425,\"start2\":1425,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\"(48 \"],[-1,\"bytes\"],[1,\"B\"],[0,\", `0\"]],\"start1\":1490,\"start2\":1490,\"length1\":13,\"length2\":9},{\"diffs\":[[0,\"*15`\"],[-1,\" M2 \"],[1,\"\\\n\"],[0,\"tail)\"],[-1,\"\\\n\"],[1,\" \"],[0,\"and \"]],\"start1\":1505,\"start2\":1505,\"length1\":18,\"length2\":15},{\"diffs\":[[0,\"rds \"],[-1,\"the blob as-is with\"],[1,\"as-is,\"],[0,\" `en\"]],\"start1\":1525,\"start2\":1525,\"length1\":27,\"length2\":14},{\"diffs\":[[0,\"alse` — \"],[-1,\"**\"],[0,\"zero loc\"]],\"start1\":1556,\"start2\":1556,\"length1\":18,\"length2\":16},{\"diffs\":[[0,\"ypto\"],[-1,\"**, the\\\n\"],[1,\"; \"],[0,\"CBC-\"]],\"start1\":1577,\"start2\":1577,\"length1\":16,\"length2\":10},{\"diffs\":[[0,\"rypt\"],[-1,\" / \"],[1,\"/\"],[0,\"`04 20`\"],[-1,\" scalar-scan / re-encrypt workaround and its heuristics are deleted.\\\nPrivate key field now logs length only (no ciphertext in logs). `extract_ec_scalar`\\\nre-privatized in kf-source (file-container parser only). Release binary builds clean\\\n(`cargo build -p kf-dev-station --no-default-features --release`); deploy via kfs-prod.bat.\\\n**First tap after deploy = live verification of the new format.**\"],[1,\"\\\nworkaround deleted. Awaiting first successful container to HW-verify end-to-end.\"],[0,\"\\\n\\\n**\"]],\"start1\":1590,\"start2\":1590,\"length1\":413,\"length2\":97},{\"diffs\":[[0,\"------|\\\n\"],[1,\"| — | generateContainer HTTP 500 | Server-side fix / expected typeID or fields (top blocker above) |\\\n\"],[0,\"| C1 | `\"]],\"start1\":1777,\"start2\":1777,\"length1\":16,\"length2\":117},{\"diffs\":[[0,\"erts\"],[-1,\"(true)\"],[0,\"` | \"]],\"start1\":1917,\"start2\":1917,\"length1\":14,\"length2\":8},{\"diffs\":[[0,\"rt chain\"],[1,\" — station side is now config-ready (see below)\"],[0,\" |\\\n| — |\"]],\"start1\":1950,\"start2\":1950,\"length1\":16,\"length2\":63},{\"diffs\":[[0,\"load\"],[-1,\"/productSerial semantics (client method ready) |\"],[1,\" semantics (method ready, unwired by decision) |\\\n\\\n## Pre-Monday hardening (15d2b77 + 2de34cf, 2026-08-14)\\\n\\\n1. **productSerial from the 7-byte PC/SC chip UID** (`KF-<chip uid hex>`), fallback to card-UID\\\n   prefix; `product serial: ...` log line; debug logging of generate/report request forms.\\\n2. **Config-driven `container_type_id` + `key_bundle_type`** (klms-config.toml `[klms]` section,\\\n   defaults 0x0900 / dev): if the KLMS expects a new typeID or bundle tag after their deployment,\\\n   Monday is a config edit + restart, no rebuild.\\\n3. **TLS C1 prep**: `accept_invalid_certs` config flag, default **false** (secure). Dev config\\\n   sets true (loud warning at connect) until a valid CA arrives; flipping to verification is a\\\n   config change.\\\n4. **Retry classification**: `FlowError` distinguishes card-stage (SELECT/INIT UPDATE/STORE DATA/\\\n   validation → re-install + retry, unchanged) from server-stage (HTTP/container/key-mismatch →\\\n   single plain retry, **no pointless applet re-install**). Fixes the observed 500 behavior of\\\n   re-installing the applet before retrying a dead server.\"],[0,\"\\\n\\\n##\"]],\"start1\":2403,\"start2\":2403,\"length1\":56,\"length2\":1102},{\"diffs\":[[0,\"te, \"],[-1,\"callers own SELECTs (\"],[0,\"via \"]],\"start1\":4042,\"start2\":4042,\"length1\":29,\"length2\":8},{\"diffs\":[[0,\"e/Some)`\"],[-1,\")\"],[0,\" |\\\n| — |\"]],\"start1\":4071,\"start2\":4071,\"length1\":17,\"length2\":16},{\"diffs\":[[0,\"ture\"],[-1,\", provenance documented\"],[0,\" |\\\n|\"]],\"start1\":4137,\"start2\":4137,\"length1\":31,\"length2\":8},{\"diffs\":[[0,\"TE\\\n\\\n\"],[-1,\"| # | Item | Status |\\\n|---|------|--------|\\\n| H7 | SCP03 handshake ×5 | **DONE, HW-verified** — `kf-provision::handshake` |\\\n| M20 | All god functions | **DONE, HW-verified** |\\\n| H2 | Audit trace doc | **DONE** |\\\n| M6/M7/M11/M17'/L12/L15 | All deferred polish | **DONE** (aabf7b6, 2026-08-14 audit round 5) |\\\n\\\n## Audit round 5 (aabf7b6) — summary\\\n\\\nError-enum unification (HandshakeError transparent source);\"],[1,\"H7 SCP03 handshake ×5, M20 god functions, H2 audit doc (all HW-verified) · M6/M7/M11/M17'/L12/L15\\\nclosed in audit round 5 (aabf7b6): error-enum unification,\"],[0,\" typed \"],[-1,\"`\"],[0,\"Step\"]],\"start1\":4268,\"start2\":4268,\"length1\":422,\"length2\":171},{\"diffs\":[[0,\"atus\"],[-1,\"` progress on\\\nall worker→UI channels; mock-applet `verify_trailing_c_mac`\"],[1,\", C-MAC\"],[0,\" helper\"],[-1,\"; `\"],[1,\",\\\n\"],[0,\"buil\"]],\"start1\":4441,\"start2\":4441,\"length1\":91,\"length2\":24},{\"diffs\":[[0,\"lect\"],[-1,\"` for\\\n12 inline sites;\"],[1,\",\"],[0,\" kf-\"]],\"start1\":4473,\"start2\":4473,\"length1\":30,\"length2\":9},{\"diffs\":[[0,\"ests\"],[-1,\" (0→3);\"],[1,\",\"],[0,\" fai\"]],\"start1\":4488,\"start2\":4488,\"length1\":15,\"length2\":9},{\"diffs\":[[0,\"aths\"],[-1,\" (run_hardware reconnect,\\\nKLMS validation error, prod-panel tracker); tag-keyed KLMS field extraction\\\n(`field_by_tag`);\"],[1,\", tag-keyed KLMS fields,\"],[0,\" pan\"]],\"start1\":4518,\"start2\":4518,\"length1\":127,\"length2\":32},{\"diffs\":[[0,\"safe\"],[-1,\" \"],[1,\"\\\n\"],[0,\"workers\"],[-1,\" + Disconnected handling; container_parser underflow\\\nguards; unused-dep cleanup (rustls/webpki-roots/pkcs12/pcsc/zeroize); `Key24` removed.\\\n\\\n## Remaining open (ours)\\\n\\\n- HW smoke run of the KLMS flow (tap one fob after deploying 3bc2f97) — validates the\\\n  card-ready private key path end-to-end; the GA signature check in validation is the\\\n  integrity proof that the KLMS encrypted with the\"],[1,\", dep cleanup.\\\n\\\n## Remaining open (ours)\\\n\\\n- HW smoke run of the card-ready private key path — blocked on the 500 fix; first successful tap\\\n  after their fix = verification (GA signature check proves\"],[0,\" cor\"]],\"start1\":4553,\"start2\":4553,\"length1\":405,\"length2\":214},{\"diffs\":[[0,\"ct S-DEK\"],[1,\" encryption)\"],[0,\"\\\n\\\n## Wor\"]],\"start1\":4769,\"start2\":4769,\"length1\":16,\"length2\":28},{\"diffs\":[[0,\"kspace\\\n\\\n\"],[-1,\"- \"],[0,\"Single c\"]],\"start1\":4797,\"start2\":4797,\"length1\":18,\"length2\":16},{\"diffs\":[[0,\"on`\\\n\"],[-1,\"  (git, \"],[1,\"(\"],[0,\"origin \"],[-1,\"at \"],[0,\"ssh:\"]],\"start1\":4886,\"start2\":4886,\"length1\":26,\"length2\":16},{\"diffs\":[[0,\"2). \"],[-1,\"The o\"],[1,\"O\"],[0,\"bsolete \"],[-1,\"pre-repo scratch copy\\\n  `D:\\\\Development\\\\Workspaces\\\\\"],[1,\"`\"],[0,\"rust\"]],\"start1\":4914,\"start2\":4914,\"length1\":72,\"length2\":18},{\"diffs\":[[0,\"ce` \"],[-1,\"was\"],[1,\"scratch copy\"],[0,\" del\"]],\"start1\":4940,\"start2\":4940,\"length1\":11,\"length2\":20},{\"diffs\":[[0,\"8-14\"],[-1,\" (contained one\\\n  outdated draft file, superseded in-repo; nothing unique lost)\"],[0,\".\\\n\\\n#\"]],\"start1\":4971,\"start2\":4971,\"length1\":87,\"length2\":8},{\"diffs\":[[0,\"(commit \"],[-1,\"3bc2f97\"],[1,\"2de34cf\"],[0,\")\\\n\\\n- All\"]],\"start1\":4995,\"start2\":4995,\"length1\":23,\"length2\":23},{\"diffs\":[[0,\"nts \"],[-1,\"compile with \"],[0,\"ZERO\"]],\"start1\":5032,\"start2\":5032,\"length1\":21,\"length2\":8},{\"diffs\":[[0,\"ippy\"],[-1,\" clean, rustfmt clean, \"],[1,\"/rustfmt/\"],[0,\"doc \"]],\"start1\":5053,\"start2\":5053,\"length1\":31,\"length2\":17},{\"diffs\":[[0,\"oc clean\"],[-1,\"\\\n-\"],[1,\";\"],[0,\" 104 tes\"]],\"start1\":5067,\"start2\":5067,\"length1\":18,\"length2\":17},{\"diffs\":[[0,\"pass\"],[-1,\" (5 new for the card-ready private key path)\\\n- KLMS flow: field extraction tag-based; private key card-ready forwarding — needs the\\\n  one HW smoke tap above before the next production batch\"],[1,\"\\\n- Deploy via kfs-prod.bat (release build verified); debug logging via RUST_LOG=debug\"]],\"start1\":5087,\"start2\":5087,\"length1\":193,\"length2\":89}]"
metadata_diff: {"new":{},"deleted":[]}
encryption_cipher_text: 
encryption_applied: 0
updated_time: 2026-08-14T15:50:01.287Z
created_time: 2026-08-14T15:50:01.287Z
is_locked: 0
type_: 13