id: 0dd37331c47b46ae84471f37dcd5f2b0
parent_id: bd651e8c8ebb4dc9bb72f2cc951268b4
item_type: 1
item_id: a6768b6c7d2d4dbb855399468b9db6fa
item_updated_time: 1787059525110
title_diff: "[{\"diffs\":[[0,\"08-1\"],[-1,\"7\"],[1,\"8\"],[0,\")\"]],\"start1\":42,\"start2\":42,\"length1\":6,\"length2\":6}]"
body_diff: "[{\"diffs\":[[0,\"026-08-1\"],[-1,\"7\"],[1,\"8\"],[0,\")\\\n\\\n> Liv\"]],\"start1\":40,\"start2\":40,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\"t: `\"],[-1,\"065ee6b\"],[1,\"a1c923e\"],[0,\"` on\"]],\"start1\":215,\"start2\":215,\"length1\":15,\"length2\":15},{\"diffs\":[[0,\"rypt\"],[-1,\" (wrapper key)\"],[0,\", ta\"]],\"start1\":432,\"start2\":432,\"length1\":22,\"length2\":8},{\"diffs\":[[0,\"rify\"],[-1,\"\\\n- SCP03 via KLMS-delivered keys, auto-provision on tap, retry classification\\\n  (card-stage → re-install + retry; server-stage → single plain retry)\"],[1,\", local card-cg gate\"],[0,\"\\\n- *\"]],\"start1\":480,\"start2\":480,\"length1\":156,\"length2\":28},{\"diffs\":[[0,\"17**\"],[-1,\": KLMS delivers AES-128-CBC(IV=0)+M2;\\\n  station verifies structure and\"],[1,\" (CBC+IV0+M2\"],[0,\" forward\"],[-1,\"s\"],[1,\"ed\"],[0,\" unt\"]],\"start1\":552,\"start2\":552,\"length1\":87,\"length2\":30},{\"diffs\":[[0,\"hed;\"],[-1,\" verified on two fobs with\"],[0,\"\\\n  G\"]],\"start1\":585,\"start2\":585,\"length1\":34,\"length2\":8},{\"diffs\":[[0,\"pass\"],[-1,\"ing (24 APDUs each\"],[0,\")\\\n\\\n#\"]],\"start1\":612,\"start2\":612,\"length1\":26,\"length2\":8},{\"diffs\":[[0,\"ants\"],[-1,\" (full / test / minimal), zero clippy warnings across all\\\n- Tests green, rustfmt + rustdoc clean\\\n- Config-driven: `container_type_id` / `key_bundle_type` / `accept_invalid_certs`\"],[1,\", zero clippy warnings; size-optimized release profile\\\n- Config-driven typeID / keyBundleType / accept_invalid_certs\\\n\\\n## Deployment (2026-08-18)\\\n\\\n`scripts\\\\package-deployment.ps1` → `deploy\\\\keyfob-station\\\\` (+ zip, gitignored):\\\n- kfs-dev/test/prod.exe (~7.5–7.8 MB), run-*.bat launchers (mandatory — they set CWD)\\\n- app-local VC runtime; data subset + static certs (new-certs default, shared-certs alt)\\\n  + all 50 key containers (tars excluded); configure-windows.ps1; README-DEPLOY.txt\\\n- Runs WITHOUT client cert: everything works except KLMS Connect (fails cleanly with\\\n  `read client cert ...`). Cert expected 2026-08-19 → drop into data\\\\tls\\\\, edit\"],[0,\"\\\n  \"],[-1,\"(\"],[0,\"klms\"]],\"start1\":745,\"start2\":745,\"length1\":190,\"length2\":661},{\"diffs\":[[0,\"toml\"],[-1,\"), defaults secure\"],[1,\" paths, passphrase in GUI if encrypted.\\\n- Target machine: run configure-windows.ps1 as admin + reboot (kills the 23 s\\\n  per-GP-APDU driver search), then plug the ACR1281U-C1.\"],[0,\"\\\n\\\n##\"]],\"start1\":1414,\"start2\":1414,\"length1\":26,\"length2\":182},{\"diffs\":[[0,\"\\\n1. \"],[-1,\"External only (see audit note): C1 valid CA cert → flip `accept_invalid_certs=false`,\\\n   `cryptoDataContainerId`\"],[1,\"Test-machine deployment + feedback (incl. GUI responsiveness under opt-level=\\\"s\\\")\\\n2. Client cert issuance (tomorrow) → KLMS panel live on the test machine\\\n3. External items (audit note): C1 CA cert, CID\"],[0,\" hea\"]],\"start1\":1904,\"start2\":1904,\"length1\":120,\"length2\":210},{\"diffs\":[[0,\" key\"],[-1,\" confirmation\"],[0,\", ch\"]],\"start1\":2128,\"start2\":2128,\"length1\":21,\"length2\":8},{\"diffs\":[[0,\"pec,\\\n   \"],[-1,\"`\"],[0,\"report_u\"]],\"start1\":2144,\"start2\":2144,\"length1\":17,\"length2\":16},{\"diffs\":[[0,\"rt_usage\"],[-1,\"`\"],[0,\" semanti\"]],\"start1\":2156,\"start2\":2156,\"length1\":17,\"length2\":16},{\"diffs\":[[0,\"ics\\\n\"],[-1,\"2. Optional polish: shared AES block-size constant, config-default dedupe\"],[1,\"4. PlantUML re-render after Jan's edits (sources now committed in docs/diagrams/)\"],[0,\"\\\n\\\n##\"]],\"start1\":2171,\"start2\":2171,\"length1\":81,\"length2\":89},{\"diffs\":[[0,\"on`\\\n- **\"],[-1,\"R\"],[1,\"Dev r\"],[0,\"un**: `k\"]],\"start1\":2360,\"start2\":2360,\"length1\":17,\"length2\":21},{\"diffs\":[[0,\"at` \"],[-1,\"(full) / `kfs-prod.bat` (release, KLMS panel) — or\\\n \"],[1,\"/\"],[0,\" `RU\"]],\"start1\":2389,\"start2\":2389,\"length1\":60,\"length2\":9},{\"diffs\":[[0,\"ion`\"],[-1,\" for full request\\\n  and response-header evidence. Tracing writes to **stderr** (not visible when the GUI\\\n  is launched detached — run from a console)\"],[1,\"\\\n  (tracing → stderr; run from a console)\\\n- **Package**: `powershell -File scripts\\\\package-deployment.ps1` (~7 min, 3 release builds)\\\n- **Diagrams**: `docs\\\\diagrams\\\\{KDF,HSM_Backup}\\\\` (SVG for slides); re-render:\\\n  `python scripts\\\\\render-puml.py <folder>`\"],[0,\"\\\n- *\"]],\"start1\":2455,\"start2\":2455,\"length1\":157,\"length2\":263},{\"diffs\":[[0,\"*: `data\"],[-1,\"/\"],[1,\"\\\\\"],[0,\"klms-con\"]],\"start1\":2726,\"start2\":2726,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\"oml`\"],[1,\";\"],[0,\" \"],[-1,\"(endpoints, TLS paths, typeID, station id)\\\n- **\"],[0,\"TLS \"]],\"start1\":2748,\"start2\":2748,\"length1\":56,\"length2\":10},{\"diffs\":[[0,\"rial\"],[-1,\"**:\"],[1,\" in\"],[0,\" `data\"],[-1,\"/tls/` — client cert `jan.hunnius@breachlabz.com.cert.pem`,\\\n  key `jan.hunnius@breachlabz.com.key.pem` (ENCRYPTED PRIVATE KEY, PBKDF2-HMAC-SHA1;\\\n \"],[1,\"\\\\tls\\\\` (gitignored;\"],[0,\" pas\"]],\"start1\":2762,\"start2\":2762,\"length1\":163,\"length2\":36},{\"diffs\":[[0,\"ssphrase\"],[1,\"\\\n \"],[0,\" `IKWGc4\"]],\"start1\":2797,\"start2\":2797,\"length1\":16,\"length2\":18},{\"diffs\":[[0,\"Gnt`\"],[-1,\"), p12 bundle, `Clypeum_Root_CA.pem` (fails BadSignature →\\\n  `accept_invalid_certs = true` until C1\"],[1,\" for the current dev identity\"],[0,\")\\\n- \"]],\"start1\":2818,\"start2\":2818,\"length1\":107,\"length2\":37},{\"diffs\":[[0,\"eader**:\"],[-1,\" run\"],[0,\" `script\"]],\"start1\":2866,\"start2\":2866,\"length1\":20,\"length2\":16},{\"diffs\":[[0,\"ce (\"],[-1,\"SCardSvr driver-search\\\n  fix) — see th\"],[1,\"se\"],[0,\"e Wi\"]],\"start1\":2909,\"start2\":2909,\"length1\":46,\"length2\":10},{\"diffs\":[[0,\"uration note\"],[1,\")\"]],\"start1\":2931,\"start2\":2931,\"length1\":12,\"length2\":13}]"
metadata_diff: {"new":{},"deleted":[]}
encryption_cipher_text: 
encryption_applied: 0
updated_time: 2026-08-18T13:31:39.331Z
created_time: 2026-08-18T13:31:39.331Z
is_locked: 0
type_: 13