KEY FOB STATION - TEST DEPLOYMENT
==================================

Delivery (three self-contained zips, one per variant — extract the one you
need; no combining required)
---------------------------------------------------------------------
keyfob-station-dev.zip   Development station (all panels): kfs-dev.exe,
                         run-dev.bat, VC runtime, configuration + trust
                         anchors, user guides, one-time setup script —
                         PLUS the provisioning content (50 fob containers
                         + factory certs) for Files mode.
keyfob-station-test.zip Test station (NFC Info + both production modes):
                         kfs-test.exe, run-test.bat, VC runtime, config,
                         docs, setup — PLUS the provisioning content.
keyfob-station-prod.zip Production station (KLMS panel only): kfs-prod.exe,
                         run-prod.bat, VC runtime, config, docs, setup.
                         NO provisioning content — the KLMS flow obtains
                         everything from the server; Files mode is not part
                         of the production variant.

All three share the keyfob-station\ root and are fully self-contained.

Contents (of a variant install)
-------------------------------
kfs-*.exe       The variant's executable (see run-*.bat)
run-*.bat       Launcher - ALWAYS start via this (it sets the working
                directory and log level). Do not double-click the exe
                directly from Explorer without the bat (config paths are
                resolved relative to the working directory).
docs\           User guides (Word): production and dev/test variants
data\           Configuration + key material (see below)
scripts\        One-time Windows configuration
*.dll           VC runtime (app-local)

One-time machine setup
----------------------
1. Install nothing else - VC runtime DLLs ship app-local; UCRT is part of
   Windows 10/11.
2. Run PowerShell AS ADMINISTRATOR:
       scripts\configure-windows.ps1
   This disables the Windows Update driver search (Plug & Play) that makes
   every GlobalPlatform APDU take ~23 seconds, disables smart-card
   background polling, and restarts SCardSvr. RESTART the machine afterwards.
   Expected result after the fix: INITIALIZE UPDATE returns in <60 ms.
3. Plug in the ACS ACR1281U-C1 reader.

Configuration (data\)
---------------------
klms-config.toml          KLMS endpoints, TLS paths, typeID, station id.
                          station_id is currently TPS-01 - change if the
                          test machine should report a different id.
dev_profiles.toml         B252 static keys (Files mode + applet re-install
                          retry + validation). Keys only - no certificates.
clypeum_signing_pubkey.pem  Container signing pubkey (verification pending).
tls\Clypeum_Root_CA.pem   Root CA.

Files mode inputs (DEV and TEST packages only)
-----------------------------------------------
data\containers\1KM0001E-0002R\
                          50 per-fob key containers (FESN.txt, irk_keyfob.key,
                          keyfob_private.der, keyfob_public.der each). Point
                          the GUI's container dir at a single fob folder.
data\static-certs\        Factory certs for DGI A004/A005 (new set, 2026-08-12
                          - matches the ICA/ROOT payloads the KLMS delivers).
                          Point the GUI's certs dir here. REQUIRED: without a
                          certs dir the Files/production flows fail fast (the
                          station no longer falls back to built-in certs).
Each container provisions exactly one fob - do not reuse a container after
a successful run.

KLMS client certificate - CURRENTLY ABSENT (deliberately)
---------------------------------------------------------
The app runs WITHOUT a client certificate: start it, use Files mode,
NFC info, applet reset, validation. Only the KLMS panel's Connect fails
with "read client cert ..." until the certificate exists.

When the certificate is issued:
  1. Copy <name>.cert.pem and <name>.key.pem into data\tls\
  2. Edit data\klms-config.toml:
         client_certificate_path = "data/tls/<name>.cert.pem"
         client_key_path        = "data/tls/<name>.key.pem"
  3. If the key is an ENCRYPTED PRIVATE KEY (recommended), enter its
     passphrase in the KLMS panel; an unencrypted key works with an
     empty passphrase.

Logging
-------
run-prod.bat sets RUST_LOG=warn (quiet), the others RUST_LOG=info.
For full KLMS request/response evidence set RUST_LOG=info,kf_dev_station=debug
before launching. Logs go to stderr - launch from a console to see them.

Security notes
--------------
- accept_invalid_certs = true in the shipped config (dev CA does not yet
  validate - open item C1). Flip to false once a valid CA chain is delivered.
- No personal client identities are included in this package.
