Initial snapshot: Aliro applet, harness, Nucleo NFC10A1 reader port

Three components, all bench-validated to varying depths:

- applet/: CSA Aliro v1.0 Java Card applet for J3R180. AUTH0 + AUTH1
  expedited-standard flow end-to-end green via PC/SC bench reader
  (aliro-bench-test). Userland AES-256-GCM and HMAC-SHA-256 layered
  on top of J3R180's primitives because the card lacks both natively.
  P-256 curve params seeded explicitly per J3R180's quirk.

- harness/: Python orchestrator (aliro-trustgen, aliro-personalize,
  aliro-bench-test) for trust-bundle generation, card personalization
  via PersonalizationApplet, and PC/SC AUTH0+AUTH1 transactions. 126
  pytest cases passing.

- reader/STM32CubeExpansion_ALIRO_V1_0_0/: ST X-CUBE-ALIRO V1.0.0
  with our NFC10A1 port (NUCLEO-U545RE-Q + X-NUCLEO-NFC10A1, ST25R200
  shared with NFC09A1). nfc10-only/ project, NFC10A1 BSP shim,
  ALIRO_TRUST_OVERRIDE include into vendor's provisioning.c, and an
  ALIRO_APDU_TRACE wrapper around demoTransceiveBlocking. Boots,
  detects the J3R180, completes SELECT + AUTH0; AUTH1 currently fails
  with RFAL ERR_PROTO (0xB) — under investigation, see
  docs/plans/2026-04-20-nucleo-nfc10a1-port.md and bench-notes/.

Excluded: x-cube-aliro.zip vendor archive, harness/.venv, build dirs,
generated aliro_trust.h (contains private reader scalar), all PEMs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

harness/tests/test_reader_transaction_offline.py

@@ -0,0 +1,101 @@
+"""Offline round-trip: reader transaction orchestrator vs. in-process fake card."""
+
+from cryptography.hazmat.primitives.asymmetric import ec
+
+from aliro_harness.reader.transaction import (
+    TransactionResult,
+    TrustBundle,
+    run_aliro_transaction,
+)
+from tests.fake_card import FakeAliroCard
+
+
+def _make_keys():
+    reader = ec.generate_private_key(ec.SECP256R1())
+    cred = ec.generate_private_key(ec.SECP256R1())
+    return reader, cred
+
+
+def test_transaction_against_in_process_fake_card_succeeds():
+    reader, cred = _make_keys()
+    bundle = TrustBundle.synthesize(
+        reader_priv=reader, credential_pub=cred.public_key()
+    )
+
+    fake = FakeAliroCard.provisioned(
+        reader_pub=reader.public_key(),
+        credential_priv=cred,
+        credential_pub=cred.public_key(),
+    )
+
+    result = run_aliro_transaction(transmit=fake.transmit, bundle=bundle)
+    assert result.ok, f"expected success, got error={result.error!r}"
+    assert result.signaling_bitmap == bytes([0x00, 0x00])  # no AD in fake
+    # cmd_params=0x01 path returns 0x5A credential_PubK
+    assert result.credential_pub is not None
+    assert len(result.credential_pub) == 65
+    assert result.credential_pub[0] == 0x04
+    assert result.ud_sig is not None
+    assert len(result.ud_sig) == 64
+
+
+def test_transaction_signals_ad_present_when_fake_card_has_access_document():
+    """Cross-check: bitmap tracks the has_access_document provisioning bit."""
+    reader, cred = _make_keys()
+    bundle = TrustBundle.synthesize(
+        reader_priv=reader, credential_pub=cred.public_key()
+    )
+    fake = FakeAliroCard.provisioned(
+        reader_pub=reader.public_key(),
+        credential_priv=cred,
+        credential_pub=cred.public_key(),
+        has_access_document=True,
+    )
+    result = run_aliro_transaction(transmit=fake.transmit, bundle=bundle)
+    assert result.ok
+    # Bit 0 (AD retrievable) + bit 2 (step-up-AID-required) set.
+    assert result.signaling_bitmap == bytes([0x00, 0x05])
+
+
+def test_transaction_fails_when_reader_priv_mismatches_card_reader_pub():
+    """Reader's long-term priv does not match what the card has provisioned
+    -> card's reader-sig verification fails -> AUTH1 returns 6A80."""
+    _, cred = _make_keys()
+    reader_in_bundle = ec.generate_private_key(ec.SECP256R1())
+    reader_provisioned = ec.generate_private_key(ec.SECP256R1())
+
+    bundle = TrustBundle.synthesize(
+        reader_priv=reader_in_bundle, credential_pub=cred.public_key()
+    )
+    fake = FakeAliroCard.provisioned(
+        reader_pub=reader_provisioned.public_key(),  # different key
+        credential_priv=cred,
+        credential_pub=cred.public_key(),
+    )
+
+    result = run_aliro_transaction(transmit=fake.transmit, bundle=bundle)
+    assert not result.ok
+    assert result.error is not None
+    assert "AUTH1 failed" in result.error
+    assert "6A80" in result.error
+
+
+def test_trust_bundle_synthesize_field_types():
+    """Round-trip: TrustBundle.synthesize produces the expected field shapes."""
+    reader = ec.generate_private_key(ec.SECP256R1())
+    cred = ec.generate_private_key(ec.SECP256R1())
+    bundle = TrustBundle.synthesize(
+        reader_priv=reader, credential_pub=cred.public_key()
+    )
+    assert isinstance(bundle.reader_priv, ec.EllipticCurvePrivateKey)
+    assert len(bundle.reader_long_term_pub_x) == 32
+    assert len(bundle.reader_group_id) == 16
+    assert len(bundle.reader_group_sub_id) == 16
+    assert len(bundle.credential_long_term_pub_uncompressed) == 65
+    assert bundle.credential_long_term_pub_uncompressed[0] == 0x04
+    assert len(bundle.credential_long_term_pub_x) == 32
+    # The x-coord inside the uncompressed encoding matches the separate x-coord field.
+    assert (
+        bundle.credential_long_term_pub_uncompressed[1:33]
+        == bundle.credential_long_term_pub_x
+    )