id: 91c35e2ecf1f417ab366a7ded92174d0
parent_id: d0aa76f4f7c14171b1f3aa01463c361f
item_type: 1
item_id: bb3506f46ead40df8a7f965a73339928
item_updated_time: 1787059496074
title_diff: "[]"
body_diff: "[{\"diffs\":[[0,\"08-1\"],[-1,\"7 12\"],[1,\"8 15\"],[0,\":30 (\"],[-1,\"bridge removal\"],[1,\"diagrams + deployment packaging\"],[0,\" com\"]],\"start1\":61,\"start2\":61,\"length1\":31,\"length2\":48},{\"diffs\":[[0,\"ed: \"],[-1,\"065ee6b\"],[1,\"a1c923e\"],[0,\", pushed\"],[-1,\"; HW-verified on two fobs\"],[0,\")\\\n\\\n#\"]],\"start1\":113,\"start2\":113,\"length1\":48,\"length2\":23},{\"diffs\":[[0,\"17\\\n\\\n\"],[-1,\"The complete chain now works end-to-end, verified on hardware with **\"],[1,\"HW-verified end-to-end on \"],[0,\"two fobs\"],[-1,\"**\\\n\"],[1,\" \"],[0,\"(`04\"]],\"start1\":199,\"start2\":199,\"length1\":88,\"length2\":43},{\"diffs\":[[0,\"11d90`):\"],[-1,\"\\\n-\"],[0,\" KLMS de\"]],\"start1\":267,\"start2\":267,\"length1\":18,\"length2\":16},{\"diffs\":[[0,\"delivers\"],[-1,\" \"],[1,\"\\\n\"],[0,\"field[8]\"]],\"start1\":281,\"start2\":281,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\"eady as \"],[-1,\"**\"],[0,\"AES-128-\"]],\"start1\":316,\"start2\":316,\"length1\":18,\"length2\":16},{\"diffs\":[[0,\"1 M2\"],[-1,\"**\\\n  over the 32-byte scalar — the card-verified format.\\\n- Station (`worker.rs::prepare_card_ready_private_key`): verifies structure only\\\n  (48-byte length, S-DEK decrypt → M2-padded 32-byte scalar) and **forwards the blob\"],[1,\"; the station verifies\\\nstructure only and forwards untouched (065ee6b; ECB bridge removed). GA ECDSA signatures\\\npass on both fobs.\\\n\\\n## 2026-08-18 session\\\n\\\n- **Deployment packaging** (`scripts/package-deployment.ps1`, committed a1c923e):\\\n  3 release variants (kfs-dev/test/prod.exe, ~7.5–7.8 MB after the size-optimized\\\n  profile: fat LTO, 1 CGU, strip, opt-level=\\\"s\\\"), run-*.bat wrappers, app-local VC\"],[0,\"\\\n  \"],[1,\"r\"],[0,\"unt\"],[-1,\"ouched** — zero re-encryption.\\\n- Evidence (2026-08-17 10:20Z): `AES-CBC(IV=0)+M2 — forwarded as-is`, 9 STORE DATA\\\n  blocks, FACTORY transition, 2 post-perso commands, certs/FESN/SPID read back,\\\n  **GA ECDSA verify: true**, `Provisioning succeeded (24 APDUs)` — on both fobs.\\\n- The ECB→CBC compatibility bridge is **removed** (065ee6b); a regression test now\\\n  asserts ECB blobs are rejected. History: original spec said ECB (our error),\\\n  KLMS delivered ECB (6A80 rejections), bridge converted locally, KLMS switched to\\\n  CBC, bridge deleted.\\\n\\\nThe HW smoke run open since 2026-08-14 is thereby complete\"],[1,\"ime, data subset (config, B252 profiles, signing pubkey, root CA), static certs\\\n  (new 2026-08-12 set default + older shared set), all 50 key containers (tars excluded),\\\n  configure-windows.ps1 (PnP fix), README-DEPLOY. `deploy/` output gitignored — regenerate\\\n  via the script. App runs WITHOUT client cert (Files/NFC/validation fine; KLMS Connect\\\n  fails cleanly until the cert lands — expected tomorrow).\\\n- **Diagrams**: `docs/diagrams/KDF/` (12 sets) + `docs/diagrams/HSM_Backup/` (5 sets:\\\n  topology, universal ECIES ceremony, decrypt-key create+backup, NXP MK ceremony,\\\n  MK backup). Wrap algorithm decided: **ECIES — ECDH P-256 → HKDF-SHA256 → AES-256-GCM**\\\n  (NitroHSM is ECC-only → RSA impossible for its ceremonies). SVG+PNG+sources committed;\\\n  render script at scripts/render-puml.py. Jan plans to edit .puml files → re-render\\\n  pass + note refresh pending\"],[0,\".\\\n\\\n#\"]],\"start1\":352,\"start2\":352,\"length1\":838,\"length2\":1284},{\"diffs\":[[0,\"ion \"],[-1,\"side is \"],[0,\"conf\"]],\"start1\":1815,\"start2\":1815,\"length1\":16,\"length2\":8},{\"diffs\":[[0,\"cure\"],[-1,\", dev config opts in). Note: without the flag the server errors \\\"client error (Connect)\\\"; the p12 may contain the missing intermediate\"],[1,\")\"],[0,\" |\\\n|\"]],\"start1\":1843,\"start2\":1843,\"length1\":142,\"length2\":9},{\"diffs\":[[0,\"sion\"],[-1,\"; likely why admin serials are blank\"],[0,\") |\\\n\"]],\"start1\":2225,\"start2\":2225,\"length1\":44,\"length2\":8},{\"diffs\":[[0,\"y | \"],[-1,\"200 OK but zero entries — r\"],[1,\"R\"],[0,\"espo\"]],\"start1\":2282,\"start2\":2282,\"length1\":35,\"length2\":9},{\"diffs\":[[0,\"inor\"],[-1,\", ask when convenient) |\\\n\\\n## Session log\\\n\\\n**2026-08-17:** KLMS switched to CBC; bridge removed (065ee6b); two-fob HW verification\\\nwith GA signatures passing — private-key workstream closed.\\\n**2026-08-14:** KLMS REST 500 fixed their side; 6A80 root-caused to ECB-vs-CBC spec error\\\n(ours); bridge committed (ae5531f); pre-Monday hardening (config typeID/keyBundleType/TLS\\\nflag, retry classification, chip-UID serial, debug logging); full audit — clippy 0 ×3\\\nvariants, 105 tests, fmt/doc clean; ECB test-vector defect found and fixed; notes\\\nconsolidated into the single \\\"Key Fob Station\\\" notebook.\"],[1,\") |\"],[0,\"\\\n\\\n##\"]],\"start1\":2319,\"start2\":2319,\"length1\":602,\"length2\":11},{\"diffs\":[[0,\"copy\"],[-1,\" (dependency direction)\"],[0,\" · S\"]],\"start1\":2506,\"start2\":2506,\"length1\":31,\"length2\":8},{\"diffs\":[[0,\"BLE test\"],[-1,\"\\\n\"],[1,\" \"],[0,\"duplicat\"]],\"start1\":2526,\"start2\":2526,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\"on · ISD\"],[-1,\" \"],[1,\"\\\n\"],[0,\"SELECT v\"]],\"start1\":2544,\"start2\":2544,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\"py ·\"],[-1,\"\\\nProvisionResult/ProdResult/ValidateResul\"],[1,\" result-struc\"],[0,\"t mi\"]],\"start1\":2618,\"start2\":2618,\"length1\":49,\"length2\":21},{\"diffs\":[[0,\"\\\n\\\n- \"],[-1,\"None blocking. Optional polish from the round-5 audit backlog: shared AES block-size\\\n  constant, dedupe config-default placeholders in app.rs.\\\n\\\n## Workspace & Notes\\\n\\\n- Single canonical location:\"],[1,\"Await test-machine feedback (GUI responsiveness under opt-level=\\\"s\\\" — revert to 3 if sluggish)\\\n- PlantUML re-render after Jan's edits\\\n\\\n## Workspace & Notes\\\n\\\n-\"],[0,\" `D:\"]],\"start1\":2965,\"start2\":2965,\"length1\":202,\"length2\":166},{\"diffs\":[[0,\"station`\"],[-1,\"\\\n \"],[0,\" (origin\"]],\"start1\":3177,\"start2\":3177,\"length1\":18,\"length2\":16},{\"diffs\":[[0,\"168.1.2,\"],[1,\"\\\n \"],[0,\" pushed \"]],\"start1\":3204,\"start2\":3204,\"length1\":16,\"length2\":18},{\"diffs\":[[0,\"ugh \"],[-1,\"065ee6b)\\\n- All project notes in the **\"],[1,\"a1c923e)\\\n- \"],[0,\"Key \"]],\"start1\":3226,\"start2\":3226,\"length1\":46,\"length2\":19},{\"diffs\":[[0,\" Station\"],[-1,\"**\"],[0,\" noteboo\"]],\"start1\":3248,\"start2\":3248,\"length1\":18,\"length2\":16},{\"diffs\":[[0,\" state),\"],[-1,\"\\\n \"],[0,\" Project\"]],\"start1\":3288,\"start2\":3288,\"length1\":18,\"length2\":16},{\"diffs\":[[0,\"atus\"],[-1,\", KLMS\"],[1,\" (snapshot + ops),\\\n  specs (Flow 1/2/2b,\"],[0,\" RES\"]],\"start1\":3307,\"start2\":3307,\"length1\":14,\"length2\":48},{\"diffs\":[[0,\"REST API\"],[-1,\" Flow\"],[0,\", Contai\"]],\"start1\":3352,\"start2\":3352,\"length1\":21,\"length2\":16},{\"diffs\":[[0,\"ner \"],[-1,\"Binary \"],[0,\"Format, \"],[-1,\"Production (Files)\\\n  Reference Flow, PlantUML Diagram Sources, Locked-Fob I\"],[1,\"Files flow, Ford EoL overview rev 8,\\\n  Flow Reference), history (i\"],[0,\"ncid\"]],\"start1\":3368,\"start2\":3368,\"length1\":98,\"length2\":82},{\"diffs\":[[0,\"ows \"],[-1,\"C\"],[1,\"c\"],[0,\"onfig\"],[-1,\"uration,\\\n  I\"],[1,\", i\"],[0,\"mple\"]],\"start1\":3459,\"start2\":3459,\"length1\":26,\"length2\":17},{\"diffs\":[[0,\"ion \"],[-1,\"Plan (historical). \\\"KLMS Known Issues and Debug Notes\\\" was merged into\\\n  this note + Project Status on 2026-08-17 (500/cipher-mode content resolved; TLS detail\\\n  and ops data preserved) and deleted.\"],[1,\"plan, test-vector record)\"],[0,\"\\\n\\\n##\"]],\"start1\":3482,\"start2\":3482,\"length1\":206,\"length2\":33},{\"diffs\":[[0,\"(commit \"],[-1,\"065ee6b\"],[1,\"a1c923e\"],[0,\")\\\n\\\n- All\"]],\"start1\":3530,\"start2\":3530,\"length1\":23,\"length2\":23},{\"diffs\":[[0,\"sts \"],[-1,\"pass (12 in kf-dev-station)\\\n- Deploy via kfs-prod.bat; debug evidence via RUST_LOG=debug (tracing goes to stderr —\\\n  not visible when launched as a detached GUI process)\\\n- Fobs #2 and #3 provisioned + validated; #1 remains locked (GP counter — see incident note)\"],[1,\"green\\\n- Deployment package ready in `deploy\\\\` (regenerable); client cert pending → KLMS panel\\\n  limited until it arrives\"]],\"start1\":3610,\"start2\":3610,\"length1\":266,\"length2\":124}]"
metadata_diff: {"new":{},"deleted":[]}
encryption_cipher_text: 
encryption_applied: 0
updated_time: 2026-08-18T13:31:39.112Z
created_time: 2026-08-18T13:31:39.112Z
is_locked: 0
type_: 13